pqblocks-cnsa-evidence¶

CNSA 2.0 evidence pack generator for quantum-safe compliance, CBOM generation, and migration scheduling.

At a glance


Area	Migration & readiness
Import	`import pqblocks_cnsa_evidence`
Command line	library only
Version	0.1.0 (Alpha)
Python	>=3.11
Native dependency	none
Repository	PQBlocks/cnsa-evidence-pack
Licence	Apache-2.0

What is pqblocks-cnsa-evidence?¶

CNSA 2.0 Procurement Evidence Pack Generator for federal contractors and enterprise systems transitioning to post-quantum cryptography.

pqblocks-cnsa-evidence parses cryptographic bill of materials (CBOM) scan results and multi-ecosystem build lockfiles to synthesize a formal, audit-ready evidence pack meeting US National Security Agency (NSA) Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) compliance requirements.

Install¶

pip (from GitHub)uv (from GitHub)

pip install git+https://github.com/PQBlocks/cnsa-evidence-pack

uv add git+https://github.com/PQBlocks/cnsa-evidence-pack

PyPI release staged

pqblocks-cnsa-evidence installs from its GitHub repository while the PyPI release is staged. The import name and API are identical either way.

Quickstart¶

Executed, not just written

This is the quickstart from the package README. It was run against the package source when this page was generated.

quickstart.py

import hashlib
import json
from pqblocks_cnsa_evidence import (
    scan_parser,
    lockfile_parser,
    sbom_emitter,
    crypto_inventory_emitter,
    compliance_matrix_emitter,
    narrative_emitter,
    migration_scheduler,
    executive_summary_emitter,
    attestation_emitter,
)

# 1. Ingest scan findings and lockfile
scan_data = {
    "algorithms": [
        {"name": "ML-KEM-1024", "type": "key-encapsulation", "mode": "PQC", "keySize": 1024, "cnsA20Grade": "A", "breakYear": 2040},
        {"name": "RSA-2048", "type": "signature", "mode": "classical", "keySize": 2048, "cnsA20Grade": "D", "breakYear": 2030},
        {"name": "AES-256", "type": "encryption", "mode": "classical", "keySize": 256, "cnsA20Grade": "A", "breakYear": 2050},
    ],
    "tls_endpoints": [{"host": "api.fed.gov", "cipher": "TLS_AES_256_GCM_SHA384"}],
    "dependencies": [{"name": "cryptography", "version": "42.0.5"}],
    "pqc_grades": {"ML-KEM-1024": "A", "RSA-2048": "D", "AES-256": "A"}
}
lockfile_content = "cryptography==42.0.5\nrequests>=2.31.0\n"

scan_res = scan_parser(scan_data)
lock_res = lockfile_parser("python", lockfile_content)

# 2. Synthesize evidence pack components
sbom = sbom_emitter(scan_res, lock_res)
inventory = crypto_inventory_emitter(scan_res, lock_res)
matrix = compliance_matrix_emitter(scan_res)
narrative = narrative_emitter(scan_res, lock_res)
schedule = migration_scheduler(lock_res, matrix)
exec_summary = executive_summary_emitter(matrix, narrative, schedule)

def sha256(val):
    b = val.encode("utf-8") if isinstance(val, str) else json.dumps(val, sort_keys=True).encode("utf-8")
    return hashlib.sha256(b).hexdigest()

# 3. Create cryptographic attestation
attestation = attestation_emitter(
    sbom_sha256=sha256(sbom),
    inventory_sha256=sha256(inventory),
    narrative_sha256=sha256(narrative),
    compliance_sha256=sha256(matrix),
    migration_plan_sha256=sha256(schedule),
    executive_summary_sha256=sha256(exec_summary),
    tool_version="0.1.0",
    tool_timestamp="2026-10-26T00:00:00Z",
    scan_json_sha256=sha256(scan_data),
    lockfile_hashes={"requirements.txt": sha256(lockfile_content)},
)

print(f"Evidence Pack Generated: {sbom['bomFormat']} {sbom['specVersion']}")
print(f"Compliance Status: {matrix.get('status', 'complete')}")

Examples¶

Runnable scripts in the repository:

Documentation and evidence¶

Every PQBlocks package ships the same evidence set, so each claim can be checked against tests, sources and measurements.

Overview

What it does, install, usage and API.
For AI agents

Correct imports, pitfalls and rules for coding assistants.
Security notes

What it protects, hostile input, constant-time and audit status.
Testing

Test suites, coverage, vectors and what is not covered.
Benchmarks

Measured performance, including where it loses.
Evidence

Primary sources and the method-to-code map.
Verification report

Self-verification results, defects found and limits.
Use cases

Worked scenarios and when to pick something else.
Changelog

Every release and what changed.

pqblocks-agility: Cryptographic Agility Readiness Scoring (CARS) and CI/CD regression firewall for CycloneDX 1.6 CBOM inventories.
pqblocks-cbom: CycloneDX 1.5 CBOM metadata enrichment engine injecting quantum-safe classifications and CNSA 2.0 compliance properties.
pqblocks-jwe-audit: High-throughput JSON Web Encryption (JWE) cryptographic policy auditor enforcing CNSA 2.0 and NIST FIPS 203 PQC…
pqblocks-lint: Static analysis for Python source that finds classical and post-quantum cryptographic primitives with a source-to-sink…
pqblocks-policy: Policy-as-code engine for post-quantum cryptography compliance and CBOM verification.
pqblocks-scan: Cryptography inventory scanner: finds classical and post-quantum algorithms in source code or a TLS endpoint and…