后量子密码迁移安全取证深度分析

openssl version
openssl list -kem-algorithms
openssl list -signature-algorithms
openssl s_client -connect target:443 -groups X25519Kyber768

openssl s_client -connect target:443 -curves X25519Kyber768
openssl s_client -connect target:443 -groups X25519Kyber768

curl -v --pqc 2>&1 | grep -i "kem\|kyber\|pqc"
curl --help all | grep pqc

pqcrypto-keygen --scheme kyber768
pqcrypto-keygen --scheme dilithium3

id-ML-DSA-44  OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) ... }

openssl s_client -connect target:443 -servername target 2>&1 | grep -E "Protocol|Cipher|Verify"
openssl s_client -connect target:443 -groups X25519Kyber768 2>&1 | grep -i "kem\|kyber\|group"

curl -s "https://crt.sh/?q=%.example.com&output=json" | jq '.[] | {issuer_ca_id, name_value, not_before, not_after, json}'

tcpdump -i any port 443 -w tls_pqc_capture.pcap
tshark -r tls_pqc_capture.pca -Y "tls.handshake.type == 2" -T fields -e tls.handshake.extensions.supported_group

openssl ciphers -v 'ALL:@SECLEVEL=0' | grep -E "RSA|ECDSA|ECDHE" | wc -l
openssl ciphers -v 'ALL:@SECLEVEL=0' | grep -v -E "Kyber|Dilithium|PQC" | wc -l

openssl s_client -connect target:443 -servername target 2>&1 | grep -E "Verify return|Cipher|Protocol"
openssl x509 -in certificate.pem -text -noout | grep -A2 "Signature Algorithm"

ct_log_search() {
    domain=$1
    curl -s "https://crt.sh/?q=%25${domain}%25&output=json" | \
    jq -r '.[] | "\(.not_before) \(.issuer_name) \(.name_value)"' | \
    sort | uniq -c | sort -rn
}
ct_log_search "target-domain.com"

grep -r "Cipher Suites:" /var/log/nginx/access.log | \
grep -v "TLS_AES_256_GCM_SHA384\|TLS_CHACHA20_POLY1305_SHA256" | \
head -20

title: TLS PQC Downgrade Attack Detection
id: 7a3b1c4d-5e6f-7a8b-9c0d-e1f2a3b4c5d6
status: experimental
description: Detects when a TLS connection downgrades from PQC to classic cryptography
author: Blue Team Forensics
date: 2026/07/13
references:
  - https://csrc.nist.gov/projects/post-quantum-cryptography
tags:
  - attack.defense_evasion
  - attack.t1557
logsource:
  category: tls_handshake
  product: web_server
detection:
  selection_server_hello:
    tls_handshake_type: ServerHello
    tls_cipher_suite:
      - 'TLS_RSA_WITH_AES_128_GCM_SHA256'
      - 'TLS_RSA_WITH_AES_256_GCM_SHA384'
      - 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'
      - 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384'
      - 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256'
      - 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384'
  selection_client_hello_pqc:
    tls_handshake_type: ClientHello
    tls_supported_groups_contains:
      - 'X25519Kyber768'
      - '4588'
  condition: selection_server_hello and selection_client_hello_pqc
  timeframe: 5s
falsepositives:
  - Clients that support but deliberately do not use PQC
  - Intermediary proxies that strip PQC extensions
level: high

title: Non-PQC Cipher Suite Persistent Usage
id: 8b4c2d5e-6f7a-8b9c-0d1e-f2a3b4c5d6e7
status: experimental
description: Detects persistent use of non-PQC cipher suites on PQC-capable endpoints
author: Blue Team Forensics
date: 2026/07/13
references:
  - https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.203.pdf
tags:
  - attack.defense_evasion
  - attack.t1553
logsource:
  category: tls_cipher_suite_audit
  product: server
detection:
  selection_audit:
    cipher_suite_name|contains:
      - 'RSA'
      - 'ECDHE_RSA'
      - 'ECDHE_ECDSA'
      - 'DHE_RSA'
    server_supports_pqc: true
  filter_legitimate:
    cipher_suite_name|startswith:
      - 'TLS_AES_256_GCM_SHA384'
      - 'TLS_CHACHA20_POLY1305_SHA256'
  condition: selection_audit and not filter_legitimate
  timeframe: 1h
  count(cipher_suite_name) > 50
falsepositives:
  - Legacy clients that cannot support PQC during migration period
level: medium

#!/bin/bash

TARGET_DOMAIN="${1:-example.com}"
TARGET_PORT="${2:-443}"
OUTPUT_DIR="/tmp/pqc_audit_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUTPUT_DIR"

echo "[*] PQC Certificate Readiness Scanner"
echo "[*] Target: ${TARGET_DOMAIN}:${TARGET_PORT}"
echo "[*] Output: ${OUTPUT_DIR}"

CERT_INFO=$(echo | openssl s_client -connect "${TARGET_DOMAIN}:${TARGET_PORT}" -servername "${TARGET_DOMAIN}" 2>/dev/null)
echo "$CERT_INFO" > "$OUTPUT_DIR/tls_handshake.txt"

CERT_PEM=$(echo "$CERT_INFO" | sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p')
echo "$CERT_PEM" > "$OUTPUT_DIR/server_cert.pem"

if [ -z "$CERT_PEM" ]; then
    echo "[-] Failed to retrieve certificate from ${TARGET_DOMAIN}"
    exit 1
fi

echo "[+] === Certificate Analysis ==="
echo ""

SIGNATURE_ALG=$(openssl x509 -in "$OUTPUT_DIR/server_cert.pem" -text -noout 2>/dev/null | grep "Signature Algorithm:")
echo "[*] Signature Algorithm: ${SIGNATURE_ALG}"

if echo "$SIGNATURE_ALG" | grep -qi "dilithium\|ml-dsa\|falcon\|slh-dsa\|sphincs"; then
    echo "[+] PQC Signature Algorithm detected"
    echo "PQC_SIGN=true" >> "$OUTPUT_DIR/audit_result.env"
else
    echo "[-] Classical signature algorithm in use (RSA/ECDSA)"
    echo "PQC_SIGN=false" >> "$OUTPUT_DIR/audit_result.env"
fi

echo ""
echo "[+] === TLS Handshake Analysis ==="

CERT_CHAIN=$(echo "$CERT_INFO" | grep -E "depth=|verify return")
echo "$CERT_CHAIN" > "$OUTPUT_DIR/cert_chain.txt"
cat "$OUTPUT_DIR/cert_chain.txt"

PROTOCOL=$(echo "$CERT_INFO" | grep "Protocol  :" | awk '{print $NF}')
CIPHER=$(echo "$CERT_INFO" | grep "Cipher    :" | awk '{print $NF}')
echo ""
echo "[*] TLS Protocol: ${PROTOCOL}"
echo "[*] Cipher Suite: ${CIPHER}"

echo ""
echo "[+] === PQC KEM Support Check ==="

KEM_RESULT=$(echo | openssl s_client -connect "${TARGET_DOMAIN}:${TARGET_PORT}" -servername "${TARGET_DOMAIN}" -groups X25519Kyber768 2>/dev/null | grep -i "kem\|kyber\|group\|error")
if echo "$KEM_RESULT" | grep -qi "kyber\|kem"; then
    echo "[+] Server supports PQC KEM (ML-KEM/Kyber)"
    echo "PQC_KEM=true" >> "$OUTPUT_DIR/audit_result.env"
else
    echo "[-] Server does not support PQC KEM or fallback occurred"
    echo "PQC_KEM=false" >> "$OUTPUT_DIR/audit_result.env"
fi

echo ""
echo "[+] === Certificate Chain PQC Audit ==="

CHAIN_DEPTH=$(echo "$CERT_INFO" | grep "depth=" | wc -l)
echo "[*] Certificate chain depth: ${CHAIN_DEPTH}"

for i in $(seq 0 $((CHAIN_DEPTH - 1))); do
    CA_CERT=$(echo "$CERT_INFO" | awk "/depth=${i}/,/-----END CERTIFICATE-----/" | sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p')
    if [ -n "$CA_CERT" ]; then
        CA_SIG=$(echo "$CA_CERT" | openssl x509 -text -noout 2>/dev/null | grep "Signature Algorithm:" | head -1)
        echo "[*] CA Level ${i}: ${CA_SIG}"
    fi
done

echo ""
echo "[+] === CT Log Check ==="

CT_LOGS=$(curl -s "https://crt.sh/?q=${TARGET_DOMAIN}&output=json" 2>/dev/null | \
    jq -r '.[] | "\(.not_before) | \(.issuer_name // "N/A") | \(.name_value)"' 2>/dev/null | \
    tail -5)
if [ -n "$CT_LOGS" ]; then
    echo "[*] Recent CT Log entries:"
    echo "$CT_LOGS"
else
    echo "[-] Unable to retrieve CT Log entries"
fi

echo ""
echo "[+] === Audit Summary ==="
echo "================================"

source "$OUTPUT_DIR/audit_result.env" 2>/dev/null

if [ "$PQC_SIGN" = "true" ] && [ "$PQC_KEM" = "true" ]; then
    echo "[STATUS] FULLY PQC-READY"
elif [ "$PQC_SIGN" = "true" ] || [ "$PQC_KEM" = "true" ]; then
    echo "[STATUS] PARTIALLY PQC-READY"
else
    echo "[STATUS] NOT PQC-READY - Migration required"
fi

echo "================================"
echo "[*] Full audit results saved to: ${OUTPUT_DIR}"

#!/usr/bin/env python3
import subprocess
import json
import re
import sys
from datetime import datetime

PQC_ALGORITHMS = {
    "signatures": ["dilithium", "ml-dsa", "falcon", "slh-dsa", "sphincs"],
    "kem": ["kyber", "ml-kem", "frodo", "ntru", "saber"],
    "hybrid": ["x25519kyber768", "x25519mlkem768"],
    "classical_rsa": ["rsa", "dhe-rsa", "ecdhe-rsa"],
    "classical_ecdsa": ["ecdsa", "ecdhe-ecdsa"],
}

PQC_OIDS = {
    "2.16.840.1.101.3.4.3.17": "ML-DSA-44",
    "2.16.840.1.101.3.4.3.18": "ML-DSA-65",
    "2.16.840.1.101.3.4.3.19": "ML-DSA-87",
    "2.16.840.1.101.3.4.3.20": "SLH-DSA-SHA2-128s",
    "2.16.840.1.101.3.4.3.21": "SLH-DSA-SHA2-128f",
}

CLASSICAL_OIDS = {
    "1.2.840.113549.1.1.11": "SHA256WithRSAEncryption",
    "1.2.840.113549.1.1.5": "SHA1WithRSAEncryption",
    "1.2.840.10045.4.3.2": "ECDSAWithSHA256",
}


def run_openssl_s_client(domain, port=443, extra_args=None):
    cmd = [
        "openssl", "s_client", "-connect", f"{domain}:{port}",
        "-servername", domain
    ]
    if extra_args:
        cmd.extend(extra_args)
    try:
        result = subprocess.run(
            cmd, input="", capture_output=True, text=True, timeout=10
        )
        return result.stdout + result.stderr
    except subprocess.TimeoutExpired:
        return ""


def parse_handshake_info(handshake_output):
    info = {"protocol": None, "cipher_suite": None, "peer_cert": None}
    for line in handshake_output.split("\n"):
        line = line.strip()
        if "Protocol  :" in line:
            info["protocol"] = line.split(":")[-1].strip()
        elif "Cipher    :" in line:
            info["cipher_suite"] = line.split(":")[-1].strip()
    cert_match = re.search(
        r"(-----BEGIN CERTIFICATE-----.+?-----END CERTIFICATE-----)",
        handshake_output, re.DOTALL
    )
    if cert_match:
        info["peer_cert"] = cert_match.group(1)
    return info


def analyze_certificate(cert_pem):
    result = {
        "signature_algorithm": None,
        "is_pqc": False,
        "key_type": None,
        "key_size": None,
        "subject": None,
        "issuer": None,
        "not_before": None,
        "not_after": None,
        "serial_number": None,
    }
    try:
        cmd = ["openssl", "x509", "-text", "-noout"]
        proc = subprocess.run(
            cmd, input=cert_pem, capture_output=True, text=True, timeout=10
        )
        text = proc.stdout
        sig_match = re.search(r"Signature Algorithm:\s*(\S+)", text)
        if sig_match:
            sig_alg = sig_match.group(1)
            result["signature_algorithm"] = sig_alg
            for pqc_alg in PQC_ALGORITHMS["signatures"]:
                if pqc_alg.lower() in sig_alg.lower():
                    result["is_pqc"] = True
                    break
        key_match = re.search(r"Public Key Algorithm:\s*(\S+)", text)
        if key_match:
            result["key_type"] = key_match.group(1)
        size_match = re.search(r"Public-Key:\s*\((\d+)\s*bit\)", text)
        if size_match:
            result["key_size"] = int(size_match.group(1))
        subject_match = re.search(r"Subject:.*?CN\s*=\s*(\S+)", text)
        if subject_match:
            result["subject"] = subject_match.group(1).rstrip(",")
        issuer_match = re.search(r"Issuer:.*?CN\s*=\s*(\S+)", text)
        if issuer_match:
            result["issuer"] = issuer_match.group(1).rstrip(",")
        nb_match = re.search(r"Not Before:\s*(.+)", text)
        if nb_match:
            result["not_before"] = nb_match.group(1).strip()
        na_match = re.search(r"Not After\s*:\s*(.+)", text)
        if na_match:
            result["not_after"] = na_match.group(1).strip()
        serial_match = re.search(r"Serial Number:\s*\n?\s*([0-9a-fA-F:]+)", text)
        if serial_match:
            result["serial_number"] = serial_match.group(1).strip()
    except Exception as e:
        result["error"] = str(e)
    return result


def check_pqc_kem(domain, port=443):
    output = run_openssl_s_client(domain, port, ["-groups", "X25519Kyber768"])
    result = {"supported": False, "details": None}
    if "error" in output.lower() and "no peer certificate" not in output.lower():
        result["details"] = "Connection error"
        return result
    for line in output.split("\n"):
        if "kem" in line.lower() or "kyber" in line.lower():
            result["supported"] = True
            result["details"] = line.strip()
            break
        if "group" in line.lower() and ("x25519" in line.lower() or "4588" in line):
            result["supported"] = True
            result["details"] = line.strip()
            break
    if not result["supported"]:
        result["details"] = "No PQC KEM detected in handshake"
    return result


def analyze_cipher_suite(cipher_suite):
    result = {
        "name": cipher_suite,
        "is_pqc": False,
        "category": "unknown",
    }
    cipher_lower = cipher_suite.lower() if cipher_suite else ""
    for algo in PQC_ALGORITHMS["hybrid"]:
        if algo in cipher_lower:
            result["is_pqc"] = True
            result["category"] = "hybrid_pqc"
            return result
    for algo in PQC_ALGORITHMS["kem"]:
        if algo in cipher_lower:
            result["is_pqc"] = True
            result["category"] = "pure_pqc"
            return result
    for algo in PQC_ALGORITHMS["classical_rsa"]:
        if algo in cipher_lower:
            result["category"] = "classical_rsa"
            return result
    for algo in PQC_ALGORITHMS["classical_ecdsa"]:
        if algo in cipher_lower:
            result["category"] = "classical_ecdsa"
            return result
    if "aes" in cipher_lower or "chacha" in cipher_lower:
        result["category"] = "classical_symmetric"
    return result


def full_audit(domain, port=4443):
    print(f"{'=' * 60}")
    print(f"  PQC Migration Security Audit Report")
    print(f"  Target: {domain}:{port}")
    print(f"  Date: {datetime.now().isoformat()}")
    print(f"{'=' * 60}")
    print()

    print("[1] TLS Handshake Analysis")
    print("-" * 40)
    handshake = run_openssl_s_client(domain, port)
    if not handshake:
        print(f"  [!] Failed to connect to {domain}:{port}")
        return
    info = parse_handshake_info(handshake)
    print(f"  Protocol: {info['protocol'] or 'N/A'}")
    print(f"  Cipher Suite: {info['cipher_suite'] or 'N/A'}")
    cipher_analysis = analyze_cipher_suite(info["cipher_suite"])
    print(f"  Cipher Category: {cipher_analysis['category']}")
    print(f"  PQC Cipher: {'YES' if cipher_analysis['is_pqc'] else 'NO'}")
    print()

    print("[2] Certificate Analysis")
    print("-" * 40)
    if info["peer_cert"]:
        cert_result = analyze_certificate(info["peer_cert"])
        print(f"  Subject: {cert_result['subject'] or 'N/A'}")
        print(f"  Issuer: {cert_result['issuer'] or 'N/A'}")
        print(f"  Signature Algorithm: {cert_result['signature_algorithm'] or 'N/A'}")
        print(f"  PQC Signature: {'YES' if cert_result['is_pqc'] else 'NO'}")
        print(f"  Key Type: {cert_result['key_type'] or 'N/A'}")
        print(f"  Key Size: {cert_result['key_size'] or 'N/A'} bits")
        print(f"  Valid From: {cert_result['not_before'] or 'N/A'}")
        print(f"  Valid Until: {cert_result['not_after'] or 'N/A'}")
    else:
        print("  [!] No certificate retrieved")
    print()

    print("[3] PQC KEM Support")
    print("-" * 40)
    kem_result = check_pqc_kem(domain, port)
    print(f"  PQC KEM Supported: {'YES' if kem_result['supported'] else 'NO'}")
    print(f"  Details: {kem_result['details']}")
    print()

    print("[4] Security Assessment")
    print("-" * 40)
    pqc_score = 0
    total_checks = 4
    if cipher_analysis["is_pqc"]:
        pqc_score += 1
        print("  [+] PQC cipher suite: PASS")
    else:
        print("  [-] PQC cipher suite: FAIL")
    if cert_result.get("is_pqc"):
        pqc_score += 1
        print("  [+] PQC certificate signature: PASS")
    else:
        print("  [-] PQC certificate signature: FAIL")
    if kem_result["supported"]:
        pqc_score += 1
        print("  [+] PQC KEM support: PASS")
    else:
        print("  [-] PQC KEM support: FAIL")
    if info["protocol"] == "TLSv1.3":
        pqc_score += 1
        print("  [+] TLS 1.3: PASS")
    else:
        print("  [-] TLS 1.3: FAIL (downgrade risk)")

    print()
    print(f"  PQC Readiness Score: {pqc_score}/{total_checks}")
    if pqc_score == total_checks:
        print("  Status: FULLY PQC-READY")
    elif pqc_score >= 2:
        print("  Status: PARTIALLY PQC-READY (migration in progress)")
    else:
        print("  Status: NOT PQC-READY (urgent migration required)")
    print()
    print(f"{'=' * 60}")


if __name__ == "__main__":
    target = sys.argv[1] if len(sys.argv) > 1 else "example.com"
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 443
    full_audit(target, port)