Cryptography & PQC Audit.

A post-quantum cryptography audit from XSource Security reviews the implementation, not the maths: signature and KEM code, TLS stacks, serialization and key handling, and the error paths around them. This is the area behind most of the published CVEs on this site, and every finding is reproduced before it is written up.

What is in scope

• Post-quantum implementations: signatures, KEMs, stateful hash-based schemes, hybrids
• TLS stacks: handshake state, key handling, serialization
• Signature verification and secure-boot integration
• Error paths, length handling and parser edge cases

Who it is for

Teams integrating post-quantum cryptography, maintaining a TLS or crypto library, or embedding signature verification in a boot chain. The CROSS and Mbed TLS CVEs and the merged oqs-provider fixes listed below are the public record of the same method applied to reference implementations.

How the engagement runs

1. Scope and threat model. The component, its trust boundaries, the attacker positions that matter and the exact build under review are fixed in writing before any code is read.
2. Map the surface. Entry points, parsers, privilege transitions and the past security fixes in that code, because incomplete fixes are where the variants live.
3. Reproduce. Tooling produces candidates; a candidate becomes a finding only when it runs, from the attacker position the scope names.
4. Report, disclose, retest. Advisory-grade write-ups with evidence, CVSS rationale and remediation. One retest within 60 days is included.

One researcher runs each engagement end to end: scoping, review, reproducing every finding and writing the report. Scope, access, findings, questions and retest results are handled in writing.

What you receive

• Confirmed scope, threat model and methodology, agreed in writing before any code is read
• Prioritized findings, each reproduced live against the build in scope, with a working proof of concept
• CVSS with rationale and the attacker position each finding requires
• Written remediation naming the location and the change
• An executive summary written for a reader who will not open the technical section
• One asynchronous retest within 60 days
• Coordinated disclosure and the CVE request with the vendor or CNA, on request, where a finding belongs upstream

The report is written to be handed straight to whoever asked for it: customer security questionnaires, SOC 2 / ISO 27001 evidence requests, ISO/IEC 42001 and NIST AI RMF work for AI systems, procurement or investor review.