VeriCryptAn engine that inventories the cryptography in an estate, flags quantum-vulnerable assets, and produces signed reports anyone can verify offline.Status: v2 evidence engine built and tested; later versions in design

Finds and classifies cryptography. Reads certificates and keys from folders and probes TLS endpoints. RSA, EC and Ed25519 keys are classified as quantum-vulnerable or resistant, and findings fire on real properties such as weak keys, SHA-1 signatures and plaintext private keys.

Dated against standards. Applies NIST IR 8547 (draft) transition years and the CA/Browser Forum certificate-lifetime schedule to forecast what will need replacing.

Signed, tamper-evident reports. Reports are signed with SLH-DSA-SHAKE-128f (the FIPS 205 algorithm) and carry a Merkle root. Editing a report is detected, and a report with no signature fails verification.

Machine-readable inventory. Produces a CycloneDX 1.7 cryptographic bill of materials that validates against the official schema, plus an HTML report.

Built for gates. A diff command compares two scans, and a fail-on threshold returns an exit code your pipeline can act on.

Check it yourself: Run vericrypt verify on a report with the signer's public key pinned. Then edit the report and verify again: verification fails.