feat: Post-Quantum Cryptography readiness assessment plugin

[Taas-ai]

Summary

Proposing a pqc plugin for hiero-cli that provides post-quantum cryptography readiness assessment for managed Hiero accounts, topics, and tokens.

Motivation

Every key in the Hiero ecosystem today (ED25519, ECDSA-secp256k1) is vulnerable to Shor's algorithm on a cryptographically-relevant quantum computer. With NIST finalizing PQC standards (FIPS 203/204/205) and CNSA 2.0 mandating adoption by 2027, organizations need assessment tooling now to understand their exposure and plan migration.

No HIP or tooling currently addresses PQC readiness in the Hiero ecosystem. This plugin fills that gap at the application layer using existing SDK capabilities.

Proposed Commands

Command	Description
hcli pqc audit	Scan managed accounts for quantum-vulnerable key types
hcli pqc score --account 0.0.123456	Calculate Quantum Readiness Score with breakdown
hcli pqc report --format json|csv|human	Generate compliance reports

Features

• Vulnerability classification: 5-tier rubric (PQC_READY → CRITICAL) based on NIST SP 800-131A
• Quantum Readiness Score (QRS): Composite 0-100 score factoring key vulnerability, algorithm diversity, rotation readiness, and CNSA 2.0 alignment
• Compliance flags: CNSA 2.0 (2027), NIST FIPS 203 (ML-KEM), NIST FIPS 204 (ML-DSA)
• Multiple output formats: JSON (machine-readable), CSV (CRM/spreadsheet), human-readable

Implementation

Follows the standard hiero-cli plugin architecture:

• manifest.ts with 3 CommandSpec entries
• Zod input/output schemas
• Handlebars human-readable templates
• Unit tests for the scoring engine

A companion HIP (Hiero Improvement Proposal) is being drafted to formalize the PQC readiness framework.

Related

• Hiero TSC Issue Support local network for CLI tool - Closes #192 #220 — Migrate Hedera-Cryptography Repo
• hiero-sdk-js Issue #3054 — Noble Migration
• Consensus Node Issue #17294 — Future cryptography key needs
• NIST FIPS 203/204/205 (finalized August 2024)
• NSA CNSA 2.0 Suite (2027 deadline)

I have a working implementation ready and will open a PR shortly.