Glossary

The vocabulary the product, the API, and this guide all use.

PQC

Post-quantum cryptography — algorithms designed to resist attack by quantum computers, for example ML-KEM, ML-DSA, and SLH-DSA.

CRQC

Cryptographically relevant quantum computer — one powerful enough to break RSA and elliptic-curve cryptography. None exists today; all timelines are estimates.

HNDL

Harvest-now-decrypt-later — recording encrypted data today to decrypt it once a CRQC exists.

Mosca inequality

X + Y > Z: if data shelf-life plus migration time exceeds time-to-CRQC, you are already exposed.

Shor's algorithm

Factors integers and computes discrete logarithms in polynomial time — breaks RSA, DH, ECDSA, and ECDH on a CRQC.

Grover's algorithm

A quadratic speedup on unstructured search — effectively halves symmetric key strength. Mitigated by larger keys, not replacement.

ML-KEM (Kyber)

Module-Lattice Key-Encapsulation Mechanism, FIPS 203 — the standardized PQC key-establishment algorithm.

ML-DSA (Dilithium)

Module-Lattice Digital Signature Algorithm, FIPS 204 — the standardized PQC signature algorithm.

SLH-DSA (SPHINCS+)

Stateless hash-based signature scheme, FIPS 205 — a conservative PQC signature alternative.

Hybrid key exchange

Combining a classical and a PQC key exchange, for example X25519 + ML-KEM-768, so the session is safe unless both are broken. The recommended TLS transition step.

Crypto agility

How cheaply a system can swap cryptographic algorithms; measured by the 0–100 Crypto-Agility Scorecard.

CryptoFinding

The canonical finding schema — every scanner normalizes to this one shape before scoring.

Quantum safety

The per-finding classification: vulnerable, classically_broken, grover_weakened, hybrid, quantum_safe, or unknown. Separate from severity.

Baseline

A committed file recording every finding accepted at adoption time, matched by a content fingerprint resilient to line-number drift, so CI gates only on new debt.

Coverage sentinel

The informational CRYPTO_API_UNMAPPED finding emitted when a file imports a known crypto library but no rule recognizes any API in it — so blind spots surface as findings, never as silence.

Promoted hand-rolled finding

A high-severity HANDROLLED_<ALG>_PROMOTED finding raised when two or more distinct constant-fingerprint or heuristic signals agree on the same algorithm in one file.

RelixQ Score

The 0–100 quantum-readiness score, computed from weighted cross-surface signals and banded from Critical Exposure to Quantum-Ready.

Score band

One of five readable buckets of the score: Quantum-Ready 90–100, On Track 75–89, In Progress 50–74, At Risk 25–49, Critical Exposure 0–24.

Not yet assessed

The state of a scope that has never been scanned. Never rendered as 100 and never green — unknown is not the same as perfect.

QAST

Quantum Application Security Testing — the adversary-validation layer: HNDL classification, attack-path projection, consent-gated read-only probing, remediation, retest, and reporting.

Exposure window

(X + Y) − Z per data flow. A positive window means the harvest-now exposure already exists.

Harvestability

Whether a passive collector could capture the traffic at all. Not harvestable implies never HNDL-relevant.

Anchor rule

Internet-exposed plus a long or indefinite confidentiality horizon plus high sensitivity implies critical HNDL relevance — always, never averaged away.

Blast radius

The set of services, endpoints, and data flows transitively impacted if a given cryptographic asset is broken or migrated.

Readiness graph

The graph model joining code, dependency, TLS, cloud, and runtime evidence — the substrate for blast radius, attack-path projection, and migration simulation.

RoE

Rules of Engagement — the cryptographically signed authorization required before any active probe runs; independently re-verified by the probe worker at connect time.

Safe word

The kill-switch token defined in the RoE; presenting it halts an active run immediately.

Break proof

Reproducible evidence that a primitive is classically broken, demonstrated in a local sandbox on a golden or locally generated artifact. Never decryption of your data.

Identity key

The source-agnostic key a crypto asset dedupes on — a certificate fingerprint, a host:port, a package purl, a cloud resource id.

Evidence ledger

The append-only record of every observation accreted onto a crypto asset, with source scanner, confidence, timestamp, and raw source reference.

Honest-empty

An endpoint or widget that returns a well-formed, successful, empty response until a real data source populates it — never synthetic results.

CBOM

Cryptographic Bill of Materials — a complete inventory of the cryptographic assets in a system. Exported as CycloneDX by RelixQ Enterprise.

CycloneDX

An OWASP standard for BOM documents (SBOM and CBOM); the CBOM export format and one of the two SBOM formats ingested.

SBOM

Software Bill of Materials — the dependency inventory of a piece of software.

SARIF

Static Analysis Results Interchange Format 2.1.0 — the standard findings format RelixQ emits.

OCSF

Open Cybersecurity Schema Framework — the normalized security-event schema used when exporting findings to SIEMs.

PTES

Penetration Testing Execution Standard — the methodology whose reporting structure QAST reports follow.

NIST SP 800-115

The NIST technical guide to security testing and assessment — the second framework QAST reports align to.

OWASP WSTG

OWASP Web Security Testing Guide — referenced by QAST for cryptography-testing procedures.

purl

Package URL — the canonical package coordinate a dependency asset identity key is derived from.

RLS

Row-level security — the PostgreSQL feature enforcing per-tenant data isolation at the database layer.

SCIM

System for Cross-domain Identity Management — the provisioning protocol identity providers use to sync users into RelixQ.

OIDC

OpenID Connect — the SSO protocol supported for enterprise sign-in.

Device-code flow

The CLI login mechanism: relixq login prints a URL and short code, you approve in a browser, and tokens are stored in your OS keychain.

JTI blacklist

The revocation mechanism. A logged-out token or revoked API key is rejected immediately by its JWT id, even before its natural expiry.

Gate condition

One of the eight named checks the release gate evaluates. Each is pass, warn, fail, or not_evaluated — and not_evaluated always fails open.

Dedup key

The template that collapses repeated alert firings into one open incident, so a threshold breached across ten scans pages once.

Dead-letter

The explicit end state of a delivery whose bounded retry budget was exhausted — recorded and given up on, never retried silently forever.

.relixqignore

A gitignore-syntax file that skips whole paths from scanning — the practical substitute for scan.exclude, which the engine does not apply yet.