CipherGap Methodology

CipherGap measures observable post-quantum TLS readiness for internet-facing services.

Our scanner performs live network checks against the hostnames you provide and records the TLS behavior that is visible from the public internet. The goal is to help security teams understand whether their externally exposed services are ready for post-quantum key exchange, where classical TLS risks remain, and where additional remediation or vendor follow-up may be needed.

CipherGap does not assume that a single scan proves full post-quantum security. Instead, each scan captures evidence about the specific endpoint, protocol behavior, certificate chain, and negotiated cryptographic settings observed at scan time.

What CipherGap Tests

CipherGap currently focuses on HTTPS and TLS behavior for public hostnames.

For each scan, CipherGap attempts to determine:

Whether the hostname resolves successfully.
Which IP addresses are observed during the scan.
Whether the endpoint supports modern TLS.
Whether TLS 1.3 is available.
Whether the endpoint negotiates a post-quantum or hybrid post-quantum key exchange when offered by the scanner.
Which classical TLS settings are still present.
Whether the certificate chain appears valid and current.
Whether the observed certificate and TLS behavior changed since the previous scan.

Post-Quantum Key Exchange Check

CipherGap’s primary post-quantum signal is whether the endpoint can successfully negotiate a hybrid post-quantum TLS key exchange when the scanner offers one.

At this stage of the public web transition, post-quantum TLS readiness generally means support for hybrid key exchange, where a classical algorithm and a post-quantum algorithm are combined during TLS negotiation. This approach is intended to preserve classical security while adding protection against future quantum attacks against today’s key exchange methods.

When a host successfully negotiates a hybrid post-quantum key exchange, CipherGap records that as evidence of post-quantum key exchange support for the scanned endpoint.

When a host does not negotiate a hybrid post-quantum key exchange, CipherGap records that as a readiness gap. This does not necessarily mean the service is misconfigured. It may mean the CDN, load balancer, TLS stack, cloud service, proxy, or hosting platform does not currently support post-quantum TLS negotiation for that endpoint.

TLS Hygiene Check

CipherGap also evaluates classical TLS posture because post-quantum readiness does not replace normal TLS hygiene.

The scanner reviews observable TLS characteristics such as:

TLS protocol versions.
Cipher suite behavior.
Certificate validity.
Certificate expiration.
Certificate chain issues.
Hostname mismatch.
Legacy protocol exposure.
Other configuration details that may weaken the overall TLS posture.

These checks help separate post-quantum migration gaps from traditional TLS security issues.

Certificate and Authentication Context

Post-quantum key exchange and post-quantum authentication are separate concerns.

A service may support hybrid post-quantum key exchange while still using a classical certificate signature algorithm such as RSA or ECDSA. That is expected for many public HTTPS services today.

CipherGap reports certificate and authentication context separately so teams do not confuse “post-quantum key exchange support” with “fully post-quantum authentication.”

Scan Evidence

Each scan result is based on observable evidence collected during that scan.

CipherGap may record:

Scan timestamp.
Scanned hostname.
Resolved IP address or addresses.
TLS version negotiated.
Key exchange behavior.
Cipher suite.
Certificate subject.
Certificate issuer.
Certificate validity period.
Certificate chain observations.
HTTP reachability.
Redirect behavior.
Prior scan comparison, when available.

This evidence is intended to support technical validation, remediation planning, and reporting.

Scoring Model

CipherGap grades are intended to summarize risk and readiness. They should not be treated as a compliance certification or guarantee of security.

A strong score generally means:

The endpoint supports modern TLS.
TLS 1.3 is available.
Hybrid post-quantum key exchange is successfully negotiated.
The certificate appears valid.
No major classical TLS hygiene issues were observed.

A weak score generally means one or more of the following:

TLS 1.3 was not available.
Hybrid post-quantum key exchange was not negotiated.
Legacy TLS behavior was observed.
The certificate is expired, invalid, mismatched, or near expiration.
The endpoint could not be reached reliably.
The scan result changed in a way that may require investigation.

CipherGap separates observed evidence from interpretation wherever possible. The grade is a summary; the scan details are the authoritative result.

Monitoring

For monitored hosts, CipherGap periodically rescans the endpoint and compares the new result against prior observations.

Monitoring is designed to detect drift such as:

Loss of post-quantum key exchange support.
TLS version changes.
Certificate replacement.
Certificate expiration risk.
Certificate chain changes.
Host reachability changes.
Grade changes.
Unexpected cryptographic behavior changes.

When a monitored host changes, CipherGap can alert the account owner so the change can be reviewed.

Responsible Scanning

CipherGap performs lightweight external TLS checks against the hostnames submitted by users. The scanner does not attempt exploitation, authentication bypass, brute force, denial of service, or invasive testing.

Users should only scan domains and systems they own, administer, or are authorized to assess.

Intended Use

CipherGap is intended to help teams:

Identify externally visible post-quantum TLS readiness gaps.
Track migration progress over time.
Monitor for unexpected cryptographic drift.
Produce evidence for remediation discussions.
Support vendor and platform conversations about post-quantum TLS support.

CipherGap is not a replacement for a full cryptographic inventory, internal asset discovery program, penetration test, compliance audit, or formal risk assessment.