How Zeek Can Help With Post-Quantum Cryptography
Hi,
I’m a cryptography enthusiast, so I’m interested in the impact of PQC (Post-Quantum Cryptography). Naturally, I wondered what Zeek could contribute in this regard. Quite simply, it can help identify the protocols a company’s servers are using in order to target those that aren’t yet using protocols considered secure against this threat (more on this soonly). It would be surprising if someone hadn’t already had this idea, and precisely. A quick Google search led me to github, which does exactly that.
Here is the “pqc.log” file
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path pqc
#open 2026-09-22-11-01-05
#fields uid host is_client is_hybrid service pqc_algs
#types string addr bool bool string vector[string]
Cu2Bqp1FpldVSUwNHe 162.212.157.188 T T ssh mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com
CoKuZmm3tQvNN33s5 162.212.157.188 T T ssl X25519MLKEM768
CoKuZmm3tQvNN33s5 8.8.8.8 F T ssl X25519MLKEM768
CMFAcJ1AHkURD4hISh 162.212.157.188 T T ssl X25519MLKEM768
CMFAcJ1AHkURD4hISh 8.8.4.4 F T ssl X25519MLKEM768
aGYwInglsyPm2OWi 2.57.122.53 T T ssh mlkem768x25519-sha256
C0lVlltX7eMBCVpQk 162.212.157.188 F T ssh mlkem768x25519-sha256,sntrup761x25519-sha512@openssh.com
C0lVlltX7eMBCVpQk 93.123.109.192 T T ssh mlkem768x25519-sha256
It is then easy to sort out who uses what. A great example of the tool’s contribution.
Cheers.