ソフトウェアエンジニアのための量子コンピューティング: 2026年に本当に知っておくべきこと

# Experimental: PQC JWT signing with liboqs
# Install: pip install pyoqs
import oqs
import json
import base64

def sign_payload_dilithium(payload: dict) -> tuple[str, bytes]:
    """Sign a JSON payload using CRYSTALS-Dilithium (ML-DSA)."""
    signer = oqs.Signature("Dilithium3")
    public_key = signer.generate_keypair()
    
    payload_bytes = json.dumps(payload).encode()
    signature = signer.sign(payload_bytes)
    
    return base64.b64encode(payload_bytes).decode(), signature

def verify_dilithium(payload_b64: str, signature: bytes, public_key: bytes) -> bool:
    """Verify a Dilithium signature."""
    verifier = oqs.Signature("Dilithium3")
    payload_bytes = base64.b64decode(payload_b64)
    return verifier.verify(payload_bytes, signature, public_key)

# Check what key exchange algorithms your SSH server supports
ssh -Q kex | grep -i ky
# sntrup761x25519-sha512@openssh.com  (post-quantum hybrid)

# Generate an SSH key using the PQC hybrid algorithm
ssh-keygen -t ed25519  # Still fine — signatures aren't broken yet
# For key exchange, configure in /etc/ssh/sshd_config:
# KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256

#!/usr/bin/env python3
"""Audit a codebase for quantum-vulnerable cryptographic usage."""
import subprocess
import sys
from pathlib import Path

VULNERABLE_PATTERNS = [
    # RSA
    ("rsa.generate_private_key", "RSA key generation"),
    ("RSA.generate", "RSA key generation (PyCryptodome)"),
    ("rsa.verify", "RSA signature verification"),
    # ECDSA / ECDH
    ("ec.generate_private_key", "ECDSA/ECDH key generation"),
    ("SECP256R1", "NIST P-256 curve (ECDH/ECDSA)"),
    ("SECP384R1", "NIST P-384 curve"),
    # JWT
    ('algorithm="RS256"', "RSA-signed JWT"),
    ('algorithm="ES256"', "ECDSA-signed JWT"),
    ('algorithms=["RS256"', "RSA JWT verification"),
    # TLS
    ('ssl.PROTOCOL_TLS', "TLS connection (verify key exchange)"),
    ("paramiko", "SSH library (review key exchange config)"),
]

def audit_directory(path: str) -> None:
    root = Path(path)
    findings = []
    
    for py_file in root.rglob("*.py"):
        content = py_file.read_text(errors="ignore")
        for pattern, description in VULNERABLE_PATTERNS:
            if pattern in content:
                # Find line numbers
                for i, line in enumerate(content.splitlines(), 1):
                    if pattern in line:
                        findings.append({
                            "file": str(py_file.relative_to(root)),
                            "line": i,
                            "pattern": pattern,
                            "description": description,
                            "code": line.strip(),
                        })
    
    if findings:
        print(f"Found {len(findings)} potentially quantum-vulnerable cryptography usages:\n")
        for f in findings:
            print(f"  {f['file']}:{f['line']}")
            print(f"    → {f['description']}")
            print(f"    → {f['code']}\n")
    else:
        print("No quantum-vulnerable patterns found.")

if __name__ == "__main__":
    audit_directory(sys.argv[1] if len(sys.argv) > 1 else ".")