Assessment Dimensions¶
PostQ presents five dimensions of cryptographic review. Each answers a different question about the discovered source evidence. An operation can need attention in several dimensions at once; a favorable result in one does not settle the others.
Coverage in brief¶
| Dimension | What PostQ does | What it does not establish |
|---|---|---|
| Quantum exposure | Classifies supported cryptographic use for quantum exposure and effective-strength review. | A migration completion date, business impact, or proof of post-quantum conformance. |
| Crypto weaknesses | Identifies supported source weaknesses and explains their CWE mappings. | That every possible weakness was checked or that an application is secure. |
| FIPS source | Checks specific FIPS-related source uses and identifies missing evidence. | Module validation, approved runtime mode, or deployment compliance. |
| Crypto agility | Highlights source patterns relevant to replacing cryptography. | A complete replaceability assessment, agility score, or migration-effort estimate. |
| Risk signals | Explains context observations, anti-patterns, and supported parameter concerns. | That every observation is a vulnerability or an independent security issue. |
Anti-patterns belong to Risk signals. They also inform crypto-agility review; they are not a separate sixth dimension. Coverage depends on the detected library, source pattern, and available settings. See Languages and Libraries Supported.
What accompanies a result¶
A result can include its explanation, supporting source and parameter evidence, and three kinds of next action:
| Information | Purpose |
|---|---|
| Discovery follow-ups | Obtain or confirm facts needed to understand the operation, resolve conflicting settings, or qualify a conclusion. |
| Assessment review | Apply additional judgement or application and deployment context to the evidence. |
| Remediation | Consider a suggested change for the reported issue. This is guidance, not an automatic code change or confirmation that the issue is fixed. |
A follow-up does not always mean a value is missing. For example, Review quantum strength can accompany a known algorithm and resolved parameters.
Follow-up status meanings¶
| Status | Meaning |
|---|---|
REQUIRED |
Follow-up or review is needed. Read the accompanying question or instruction. |
NONE_IDENTIFIED |
No requirement was identified within this review's scope. This is not an application-wide all-clear. |
NOT_EVALUATED |
The requirement was not evaluated. Do not interpret it as completed. |
NOT_APPLICABLE |
This requirement does not apply to the assessed item. |
Keep missing information distinct from a reported weakness. Unknown or conflicting settings need investigation; they should not be assumed safe or unsafe. A displayed dash means no additional compact detail is shown, not that every check passed.
Use the dimensions together¶
A supported RSA operation can require quantum migration review while also having a conventional key-size weakness. A fixed algorithm choice can warrant agility review without being a weakness by itself. FIPS source assessment addresses a separate, limited compliance-review question.
Each dimension's page defines its result categories and boundaries. For how to open distributions, filter affected groups, and inspect reasoning in the product, use Assessment Overview and Interpret Results.