BreachSAFE QuReddy

Contents

1. 1. Start here
2. 2. What QuReddy scans
3. 3. Install locally
4. 4. Docker and development
5. 5. Use cases and scan lanes
6. 6. Choose an output format
7. 7. Read the result correctly
8. 8. Exit codes
9. 9. Network and privacy
10. 10. Documentation
11. 11. Contributing
12. 12. Open-source stack
13. 13. License

QuReddy is an open-source field kit for finding out what cryptography is actually in use and assessing readiness for the age when quantum computers can attack today’s public-key cryptography. It helps you investigate the “harvest now, decrypt later” risk: data that can be collected today and decrypted when more capable quantum machines arrive.

Point QuReddy at a hostname, SSH server, VPN gateway, wallet address, artifact directory, or container image. It probes the target, records the evidence, and shows what it found.

Use Rich output while investigating, JSON or JSONL in automation, and CycloneDX CBOM when the result belongs in a cryptographic inventory. QuReddy connects observed algorithms, certificates, key establishment, legacy protocols, and post-quantum signals to the evidence collected during the run.

1. Start here

The container is the quickest way to try QuReddy. It includes the runtime tools needed for TLS, IKE, and artifact scans, including two isolated OpenSSL versions for broad TLS coverage:

OpenSSL 3.5.x  → modern TLS and post-quantum capability probes
OpenSSL 1.0.2u → legacy fallback probes for historical cipher suites

$ docker run --rm docker.io/breachsafe/qureddy:latest scan tls badssl.com:443
$ docker run --rm docker.io/breachsafe/qureddy:latest scan ssh github.com
$ docker run --rm docker.io/breachsafe/qureddy:latest \
    scan tls smtp.gmail.com:587 --starttls smtp

A scan can report a weak or incomplete posture and still exit successfully: read the result and the exit code together. Add --format json for a complete machine-readable scan document:

$ docker run --rm docker.io/breachsafe/qureddy:latest \
    scan tls badssl.com:443 --format json > scan.json

Run qureddy --help for the short command map, or open the CLI reference for every option and exit code.

2. What QuReddy scans

Target	Command	Evidence collected	Output
TLS endpoint	scan tls	Handshake, key exchange, certificate signatures, protocol offers, and cipher behavior	Rich, JSON, JSONL, CBOM
STARTTLS service	scan tls --starttls SERVICE	Cleartext upgrade followed by TLS evidence	Rich, JSON, JSONL, CBOM
SSH or SFTP endpoint	scan ssh	Server identification, KEXINIT algorithms, host keys, and authentication methods	Rich, JSON, JSONL, CBOM
IKE endpoint	scan ike	Responder discovery, transforms, modes, and explicit tool responses	Rich, JSON, JSONL, CBOM
Artifact directory	scan dir	Cryptographic artifacts discovered by CBOMkit Theia	CycloneDX CBOM
Container image	scan image	Cryptographic artifacts discovered from image layers by CBOMkit Theia	CycloneDX CBOM
Wallet account	scan wallet	Public account state, key publication, signatures, nonce reuse, and indexer evidence	Rich, JSON, JSONL, CBOM

The wallet lane supports Bitcoin, Litecoin, and Ethereum. STARTTLS supports SMTP, POP3, IMAP, FTP, XMPP, XMPP server, Telnet, IRC, MySQL, PostgreSQL, LMTP, NNTP, Sieve, and LDAP. See the STARTTLS profile reference for service-specific ports and upgrade behavior.

3. Install locally

QuReddy currently distributes the package through TestPyPI. Python 3.14 or newer is required:

pipx install --python 3.14 \
  --index-url https://test.pypi.org/simple/ \
  --pip-args '--extra-index-url https://pypi.org/simple/' \
  breachsafe-qureddy

Verify the installation:

$ qureddy --version
BreachSAFE QuReddy <version> -- https://github.com/breachsafe/qureddy

Local SSH scans work without an external scanner. TLS scans require a supported OpenSSL 3.5.x LTS build with the X25519MLKEM768 TLS group. IKE scans require stock ike-scan. Directory and image scans require cbomkit-theia; the container includes it.

See installation and troubleshooting for platform setup, executable discovery, and failure diagnostics.

4. Docker and development

GHCR is the canonical container registry, with Docker Hub as a mirror:

docker pull ghcr.io/breachsafe/qureddy:latest
docker pull docker.io/breachsafe/qureddy:latest

For reproducible deployments, replace :latest with a release tag or an immutable digest. To build locally from a fresh clone:

docker build --tag qureddy:local .
docker run --rm qureddy:local --version

For a guided TLS or SSH run, use examples/guided-scan.sh. It asks for the target and authorization before invoking the container.

5. Use cases and scan lanes

Quantum migration starts with a simple question: where is classical cryptography still doing important work? QuReddy gives engineering and security teams a fast path from that question to evidence. Scan the public edge, the protocols behind it, the wallets that publish keys, and the artifacts waiting to ship. Use the results to prioritize upgrades, prove hardening work, and give the next review a baseline it can compare with.

Risk area	Use QuReddy when you need to…	Copy and paste	How it helps you decide
Harvest now, decrypt later	Find public services whose key exchange or certificate chain protects long-lived data	docker run --rm docker.io/breachsafe/qureddy:latest scan tls badssl.com:443	Shows the negotiated exchange, certificate signatures, and post-quantum signals so teams can identify migration work at the public edge
Legacy TLS exposure	Find weak or deprecated protocol and cipher combinations that modern defaults can hide	docker run --rm docker.io/breachsafe/qureddy:latest scan tls rc4.badssl.com:443	Produces concrete weak-cipher findings, severity, and CWE identifiers when available, giving remediation tickets an actionable starting point
STARTTLS downgrade surface	Check whether mail, directory, or database services complete their cleartext-to-TLS upgrade	docker run --rm docker.io/breachsafe/qureddy:latest scan tls smtp.gmail.com:587 --starttls smtp	Connects the application upgrade to the resulting TLS evidence, so a “TLS enabled” claim can be checked at the service boundary
SSH fallback	Review the algorithms an SSH server offers before a policy or migration change	docker run --rm docker.io/breachsafe/qureddy:latest scan ssh github.com	Separates hybrid, classical, and weak options from the server’s direct algorithm offer, helping teams choose what to retire
VPN negotiation	Inspect an IKE responder before trusting its negotiated protection	docker run --rm docker.io/breachsafe/qureddy:latest scan ike netherlands.hide.me --nat-t	Preserves the responder’s transforms and explicit tool responses so network teams can distinguish observed support from assumptions
Public-key wallet exposure	Understand whether a public account has published key material or signing history	docker run --rm docker.io/breachsafe/qureddy:latest scan wallet 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa	Connects address type, key publication, signatures, nonce reuse, and balance to public indexer evidence for a defensible account review
Artifact inventory	Inventory cryptographic material already present in a directory before release	docker run --rm -v "$PWD:/scan:ro" docker.io/breachsafe/qureddy:latest scan dir /scan	Produces a CycloneDX CBOM from the artifact bytes so inventory can enter build, review, and governance workflows
Container-image inventory	Inspect an image’s layers before deployment	docker run --rm --group-add 0 -v /var/run/docker.sock:/var/run/docker.sock:ro docker.io/breachsafe/qureddy:latest scan image nginx:latest	Carries image-layer findings into a CycloneDX CBOM, making crypto dependencies visible before the image reaches production

Each lane keeps the observed evidence, the assessment, and the limits of the probe together. That makes the output useful for an engineering baseline, remediation ticket, or repeatable migration check.

TLS

qureddy scan tls badssl.com:443
qureddy scan tls tls-v1-2.badssl.com:1012 --format json
qureddy scan tls smtp.gmail.com:587 --starttls smtp
qureddy scan tls 1.1.1.1:443 --sni one.one.one.one

TLS scanning uses the selected OpenSSL 3.5.x LTS executable. Set QUREDDY_OPENSSL or pass --openssl PATH when automatic discovery is not the one you want. QuReddy also runs an isolated legacy OpenSSL 1.0.2u lane when QUREDDY_LEGACY_OPENSSL is available. That fallback exposes historical TLS protocol and cipher suites that the modern OpenSSL build no longer offers, so a configured run can include both current post-quantum capability and older weak-cipher evidence. The run details identify the legacy runtime separately; the modern TLS runtime remains the primary collector.

The compatibility lane is designed to widen suite coverage across the families that modern OpenSSL builds commonly remove or disable. The live badssl.com coverage exercises RC4, 3DES, NULL encryption, SEED, and CAMELLIA. The shared cipher catalog also recognizes AES, ChaCha20, RC4/Arcfour, single DES, 3DES, RC2, NULL, EXPORT, SEED, IDEA, Camellia, ARIA, Twofish, Serpent, CAST-128, Blowfish, Rijndael, and GOST spellings.

QuReddy records the exact suite a target accepts, the protocol version, the runtime that produced the evidence, and the associated finding severity and CWE when one is defined. Coverage depends on the target and runtime. The result names the suites accepted by the target.

SSH

qureddy scan ssh github.com
qureddy scan ssh sftp://sftp.vendor.example:2222 --format cbom

SSH reads the server identification and KEXINIT offer directly.

IKE

ike-scan --version
qureddy scan ike netherlands.hide.me --nat-t

The Python installation needs stock ike-scan; the container includes its pinned package. IKE results represent lower-trust responder discovery and tool-reported transforms. Run probes only against systems you are authorized to test.

Directories and images

Directory scans pass local artifact files to Theia:

qureddy scan dir /opt/application --timeout 120 --output application.cdx.json

Image scans read image layers through the Docker daemon. When using the container, mount the read-only Docker socket:

docker run --rm --group-add 0 \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  docker.io/breachsafe/qureddy:latest \
  scan image nginx:latest --timeout 120 > nginx.cdx.json

Both artifact commands emit Theia's CycloneDX CBOM to standard output and write diagnostics to standard error. They preserve the CBOM document produced by Theia, including its specVersion and component model.

Wallets

qureddy scan wallet 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa
qureddy scan wallet Ler4HNAEfwYhBmGXcFP2Po1NpRUEiK8km2 --type litecoin
qureddy scan wallet 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045

Wallet scans query the configured public indexer or RPC endpoint and inspect published account data.

6. Choose an output format

Network and wallet scans derive every projection from one canonical scan result:

### Human-readable terminal report
qureddy scan ssh github.com --format rich

### Complete QuReddy scan document
qureddy scan ssh github.com --format json > scan.json

### One finding record per line, followed by a summary record
qureddy scan ssh github.com --format jsonl > scan.jsonl

### CycloneDX 1.7 cryptographic inventory
qureddy scan ssh github.com --format cbom > scan.cdx.json

### Write all projections from one scan
qureddy scan ssh github.com --output-dir evidence/github-ssh

The bundle contains scan.json, scan.jsonl, scan.cdx.json, scan.rich.txt, scan.md, cbom.md, and manifest.json. Machine-readable data goes to standard output; diagnostics go to standard error. Use -v, -vv, or -vvv for progressively more process diagnostics. Use --deterministic when stable bytes are required for content addressing.

QuReddy's endpoint and wallet CBOMs use CycloneDX 1.7 crypto properties, evidence occurrences, annotations, and namespaced provenance. The artifact lane forwards Theia's own CycloneDX document. See the CBOM reference for the exact schemas and evidence model.

7. Read the result correctly

QuReddy reports observations, local scanner capabilities, findings, and interpretations as separate parts of a result. A finding can identify weak or classical cryptography even when the scan itself completed successfully. Unknown and unavailable states remain explicit so automation can distinguish missing evidence from a favorable result.

The scan describes the evidence collected from the selected target. TLS certificate trust and revocation, SSH authentication, and an authenticated IKE tunnel require evidence outside the corresponding discovery probe.

8. Exit codes

Code	Meaning
0	Scan completed; inspect the reported posture and findings
2	Target connection, handshake, timeout, or parse failure
3	Required local tool is missing or unusable
4	Invalid target, option, or configuration
70	Internal QuReddy error

Scripts should branch on the exit code and then inspect the structured result. See the exit-code reference for scanner-specific behavior.

9. Network and privacy

QuReddy connects to the target named on the command line. TLS, SSH, and IKE scans use bounded probes; wallet scans contact the configured indexer or RPC endpoint; image scans use the Docker daemon when requested. QuReddy sends no telemetry to BreachSAFE. Scan history and redirected result files remain on the operator's system unless the operator sends them elsewhere.

Scan only systems and accounts you are authorized to inspect.

10. Documentation

• Documentation index
• CLI reference
• Install and troubleshoot
• Docker and GHCR guide
• Scan an IKE endpoint
• Generate and validate a CBOM
• JSON output for CI
• Security policy
• Issue tracker

11. Contributing

Read CONTRIBUTING.md and the contributor documentation. Changes should preserve the single canonical result model, bounded subprocess behavior, output parity, and the evidence contracts documented in this repository.

12. Open-source stack

        

CLI: Click and Rich · Artifacts: CycloneDX CBOM · Tooling: uv

13. License

Apache License 2.0. See LICENSE, LICENSES/, and REUSE.toml.