Cryptographic Configuration Review as a Core Pentest Deliverable

Author: Sumit Chouhan
Date: March 5, 2026
Contact: insanemechanic@proton.me
Website: sumitchouhan.com

Overview

TLS scanners, cipher suite audits, and library version checks have always been available as optional pentest add-ons. The quantum threat makes them mandatory. This document is a ground-level technical guide to performing cryptographic configuration reviews as a mandatory penetration testing deliverable — with real tools, real commands, and no filler.

Topics Covered

• Store Now, Decrypt Later (SNDL) - why the threat model has fundamentally changed
• Five-layer review framework — protocol versions, key exchange groups, cipher suites, certificate signature algorithms, and library versions
• Tool walkthroughs with real commands:
  • testssl.sh
  • SSLyze
  • Nmap ssl-enum-ciphers
  • OpenSSL s_client
• PQC hybrid key exchange testing — X25519MLKEM768 negotiation tests
• Non-HTTP service coverage — LDAPS, SMTP, PostgreSQL, RDP, SSH
• Finding taxonomy with dual classical/quantum severity ratings
• Library and protocol PQC support matrix — OpenSSL, Go, Chrome, Firefox, Kubernetes, Nginx, strongSwan
• Report writing guidance — required components of a cryptographic finding
• Migration roadmap structure scoped to real engagements

Contents

File	Description
cryptographic_configuration_review_pentest_deliverable.pdf	Full technical document
CITATION.cff	Machine-readable citation metadata
LICENSE	Creative Commons Attribution 4.0 International

Key References

• arXiv 2505.15917 — Gidney (Google Quantum AI), How to factor 2048-bit RSA integers with less than a million noisy qubits, May 2025
• NIST FIPS 203 — ML-KEM (CRYSTALS-Kyber), finalized August 2024
• NIST FIPS 204 — ML-DSA (CRYSTALS-Dilithium), finalized August 2024
• NIST FIPS 205 — SLH-DSA (SPHINCS+), finalized August 2024
• RFC 8996 — Deprecating TLS 1.0 and TLS 1.1, March 2021
• RFC 8446 — TLS 1.3, August 2018

Citation

If you use or reference this work, please cite it using the DOI above or the metadata in CITATION.cff.

Chouhan, S. (2026). Cryptographic Configuration Review as a Core Pentest Deliverable.
Zenodo. https://doi.org/10.5281/zenodo.19859801

License

This work is licensed under the Creative Commons Attribution 4.0 International License.

You are free to share and adapt this material for any purpose, provided appropriate credit is given.