OpenText 主页。
解决方案

面向量子计算的应用程序安全

在代码中直观了解易受量子攻击的密码学以及无噪声的 TLS

联系我们

47%
 的 HTTPS 流量现已采用后量子加密，较一年前的 17% 有所增长[1]

概述

一幅象征“数字密钥”概念的抽象或数字插画

量子风险带来了应用安全领域的一个新盲点。今天有效的加密技术，明天可能就不再安全。如果无法获知在何处使用了易受量子攻击的加密技术，迁移计划就会沦为盲目猜测。OpenText Application Security 结合了 SAST 与 DAST，可全面揭示代码及运行时的后量子风险，并通过各项控制措施确保检测结果既具有实用价值又便于管理。该解决方案专为规划和优先级排序而设计，而非替代全网加密。

量子就绪型应用程序安全的主要优势

在不放缓发布速度的同时降低应用程序风险。OpenText Application Security 为您的团队提供全面的覆盖范围、准确性和灵活性，以保障代码安全、满足合规要求，并确保业务持续运转。

  • product-connection-logo

    整合 SAST 与 DAST 的可见性

    无需将多个工具拼接在一起，即可在一个集成视图中查看源代码和 TLS 1.3 配置中的后量子加密风险。

  • 团队合作图标

    从容地确定优先级

    先从早期预警指标入手，待计划准备就绪后再收紧策略，这样各团队才能专注于当前的优先事项，而非未来的风险。

  • 跟踪图标

    跨开发团队跟踪加密使用情况

    检测 RSA 和 DSA 的使用情况（从 Java 开始），并将发现结果与代码所有者关联起来，以简化迁移计划并明确修复路径。

  • 搜索图标

    检测缺失的 PQC 握手过程

    识别不支持 TLS 1.3 中混合后量子密钥交换（例如 X25519MLKEM768）的服务器，并通过运行时扫描验证配置更新。

  • 速度图标

    根据您的需求分阶段启用检测功能

    利用 SAST 功能标志和信息性 DAST 发现项控制后量子检测的运行时间和方式，以平衡规划与交付速度。

  • 转发图标

    与不断发展的标准保持一致

    借助紧跟 NIST 标准、密钥长度最佳实践，以及更广泛语言支持范围而持续演进的前瞻性路线图，充满信心地开展规划。

商业影响

  • 跨代码与运行时的量子风险可见性

    当各团队之间的 SAST 发现结果和 TLS 设置彼此孤立时，加密风险便会潜伏其中。OpenText 将这两种视角结合起来，使团队能够在审计和规划过程中盘点风险敞口并重点进行修复。

  • 早期阶段检测，避免警报疲劳

    随着风险时间线的变化，后量子警报可能会给团队带来巨大压力，尤其是在发布冻结期临近时。考虑噪声影响的控制措施有助于团队在条件成熟时分阶段实施检测和扩展策略。

  • 基于真实代码构建的迁移积压

    团队往往不知道易受量子攻击的算法在旧代码或库中的具体位置。OpenText 实现了发现流程的自动化，建立了真实的积压列表，并将发现结果与负责人进行关联。

  • 基于证据而非猜测的 TLS 升级

    TLS 风险可能会隐匿在复杂的环境中，从而延缓系统就绪进程。OpenText Dynamic Application Security Testing (DAST) 会标记缺失的混合型后量子加密 (PQC) 握手过程，以便团队能够确定升级优先级并验证升级效果。

联系我们

探索解决方案的组成部分

相关产品

借助 OpenText 解决业务挑战

服务

在认证专家的指导下，加速实现数字化转型。

Resources

SAP-logo

Scaled AppSec across teams to find and fix risk earlier in the pipeline

Learn more
industry-logo

Improved security and compliance with integrated testing across the SDLC

Learn more
industry-logo

Secured high assurance apps in constrained environments with repeatable testing

Learn more
industry-logo

Reduced manual testing and improved coverage with automated AppSec scans

Learn more
See more success stories

  • Quantum Ready Application Security combines Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) to identify cryptographic algorithms that are secure against classical attacks but will be vulnerable to future quantum computers. SAST scans your code for vulnerable crypto patterns while DAST checks TLS 1.3 configurations for missing hybrid post quantum key exchanges like X25519MLKEM768.

  • OpenText SAST uses optional post quantum detection rules to flag algorithms that rely on hardness assumptions broken by quantum computers. When the PQC feature flag is enabled, SAST identifies instances of RSA or DSA usage in your code. Results show exactly where these algorithms appear so you can build a cryptographic inventory and plan migrations.

  • The first release of post quantum rules focuses on RSA and DSA. SAST flags code that generates or uses RSA or DSA keys—algorithms known to be vulnerable to Shor’s quantum factoring algorithm. OpenText’s roadmap extends coverage to other legacy algorithms and key exchange protocols as standards evolve.

  • Yes. Post quantum detection is disabled by default to reduce noise for organizations not yet planning migrations. To enable it, set the [com.fortify.sca.rules.enablePQCRules] feature flag. When disabled, SAST reports only traditional crypto vulnerabilities; when enabled, it adds RSA and DSA findings for inventory purposes.

  • OpenText DAST introduces a new category called “Insecure Transport: Missing PQC Resilient Key Exchange.” It checks whether a web server’s TLS 1.3 configuration supports hybrid post quantum key exchange options, such as X25519MLKEM768. If none are offered, DAST generates an informational finding, so teams know which endpoints need configuration updates.

  • To balance security and practicality, OpenText makes post quantum detection opt in and low severity. SAST’s quantum related rules are behind a feature flag so you decide when to start generating findings. DAST reports missing hybrid key exchanges as informational rather than high severity, ensuring teams can plan without blocking releases.

  • No. This solution helps you find and plan for cryptographic migrations; it does not implement new post quantum encryption. SAST and DAST surface where legacy algorithms are used and where TLS lacks hybrid PQC support, allowing you to prepare a migration strategy. It is about planning and prioritization, not an automatic replacement of encryption schemes.

  • OpenText plans to expand its post quantum capabilities beyond RSA and DSA. Future releases will detect additional quantum vulnerable algorithms and key exchange protocols, analyze key lengths (e.g., highlighting when AES 128 is inadequate in a post quantum context), and extend post quantum detection across more programming languages.

    OpenText SAST 25.4 introduces optional PQC checks that flag RSA and DSA with enablePQCRules

    View SAST post quantum checks

    Content update 25.4 adds DAST TLS 1.3 PQC check to inventory readiness and validate upgrades

    Read content update

    Preparing for post-quantum cryrogtaphy with OpenText

    Read the blog

    Content update 25.4 adds DAST TLS 1.3 PQC check to inventory readiness and validate upgrades

    Read content update

    Preparing for post-quantum cryrogtaphy with OpenText

    Read the blog

    我们能提供什么帮助？

    脚注

    脚注

    1. [1]OpenText，《借助 OpenText SAST 和 DAST 为后量子密码学做好准备》，2025 年 10 月