How It Works

One repository, start to finish.

A walkthrough of what actually happens when Quantera scans customer-vault, a Java service protecting customer financial records.

1

The application

customer-vault encrypts customer records with AES-256-GCM, protects that AES key with RSA-2048, and signs transactions with ECDSA. Nothing about this is unusual — it's a normal Java service written years before ML-KEM or ML-DSA existed.

2

Quantera scans

A .zip upload or a GitHub App connection, pinned to a commit. The Repository Scanner parses 284 files, resolves 1,041 symbols, and produces an inventory:

AlgorithmLocationPurposeStatus
AES-256-GCMVaultEncryptionService.java:42Data encryptionRetain
RSA-2048/OAEPRsaKeyProtectionService.java:47Key protectionMigration Ready
ECDSA P-256TransactionSigner.java:29Digital signatureReview Required

3. Quantera traces the RSA finding

The Cryptographic Context Engine resolves the call chain — not guessed, walked.

CustomerVaultService.store()→ VaultEncryptionService.seal()→ RsaKeyProtectionService.protectKey()→ Cipher.getInstance("RSA/OAEP")

4. Quantera determines what each finding needs

FindingDetermination
RSA-2048 (key protection)Key establishment → ML-KEM-768
AES-256-GCMAlready quantum-resistant → Retain
ECDSA P-256 (signature)Flagged separately → signature migration, reviewed on its own

5. Quantera generates the migration

RSA key protection → ML-KEM-768 (FIPS 203), approved by the policy engine's recipe for this exact pattern.

quantera/pqc-migration-4c1a90f2 · RsaKeyProtectionService.java
private static final String TRANSFORMATION =
- "RSA/ECB/OAEPWithSHA-256AndMGF1Padding";
+ "ML-KEM-768"; // FIPS 203
- Cipher cipher = Cipher.getInstance(TRANSFORMATION);
- return cipher.doFinal(dataKey.getEncoded());
+ KEM.Encapsulator enc = kem.newEncapsulator(keyPair.getPublic());
+ return wrap(enc.encapsulate(), dataKey);
+ 4 generated tests: round-trip, tamper, interop, KAT vectors

6. Quantera verifies

✓Baseline & migrated build
✓Existing tests
✓4 generated PQC tests
✓Behavioral workflow
✓Targeted rescan
✓Performance (advisory)
VERIFIED FOR REVIEW

7. The developer receives a review package

A draft pull request, not a merged change:

Draft PR #218 opened
  • Original algorithm & location
  • What it protected, and why it moved
  • Build, test, and rescan output
  • Performance delta
  • One-command rollback

Run this against your own repository

Request a Demo Explore the Product