With the updated BSI Technical Guideline TR-02102-1 (Cryptographic Mechanisms: Recommendations and Key Lengths) and the NIS-2 Directive (§ 30 & § 38 BSIG) in Germany and the EU, DevSecOps engineers, CISOs, and Linux infrastructure teams face a hard regulatory deadline:
RSA-2048, Diffie-Hellman, and non-hybrid elliptic curve key exchanges (ECDH / X25519 alone) are being phased out by the end of ML-KEM-768 / ML-KEM-1024) ML-DSA)
To automate host-level verification without installing heavy agents, we built an open-source, zero-dependency Python CLI scanner (bsi_pqc_check.py) alongside an interactive browser calculator and audit workbooks.
bsi-tr02102-pqc-audit-cli)
GitHub Repository: 👉 github.com/KenanErorr404/bsi-tr02102-pqc-audit-cli
bsi_pqc_check.py uses 100% Python Standard Library (stdlib) and inspects:
sshd_config & Host Keys per BSI TR-02102-4):ssh-rsa, ecdsa-sha2-nistp256, and SHA-1 KEX while checking for hybrid PQC key exchange ( mlkem768x25519-sha256 in OpenSSH 9.9+ and sntrup761x25519-sha512@openssh.com). openssl.cnf per BSI TR-02102-2):MinProtocol = TLSv1.3, and hybrid Groups (X25519MLKEM768, SecP256r1MLKEM768)..pem / .crt): RSA < 3072-bit keys, legacy signature hashes (SHA-1, MD5), and exports a machine-readable --generate-cbom-csv)--json-out) for ISO 27001 / BSI IT-Grundschutz audits. pipx)
pipx run git+https://github.com/KenanErorr404/bsi-tr02102-pqc-audit-cli.git --generate-cbom-csv
curl -sSL https://raw.githubusercontent.com/KenanErorr404/bsi-tr02102-pqc-audit-cli/main/bsi_pqc_check.py | python3 -
KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
Need to quantify your 2031 Compliance-Gap-Score and NIS-2 fine exposure (§ 60 BSIG) in 60 seconds?
👉 Launch the Client-Side BSI PQC & NIS-2 Calculator (pqc-nis2-rechner.html)
(100% local in-browser calculation, zero tracking cookies, instant protocol-by-protocol remediation roadmap).
€0+ Starter Pack & Enterprise .xlsx Compliance Suite
For teams preparing for an external ISO 27001, BSI IT-Grundschutz, NIS-2 (§ 30 BSIG), or KRITIS audit:
BSI-Audit-Matrix-Leseprobe.csv (6 sample audit rows covering TLS 1.3, SSHv2, IPsec/IKEv2, and Secure SDLC) plus a BSI2026PRO) BSI-TR-02102-CBOM-und-Risiko-Matrix-2031.xlsx (3-tab Excel workbook with live KPI formulas, 45-row CBOM inventory across TLS/SSH/IPsec/PKI/KMS/DB, and NIS-2 § 38 BSIG Sign-Off Log)Krypto-Inventar-PQC-2031.csv`` PQC-Migrationsplan-2026-2031.md``Management-Vorlage-Haftungsfreistellung-BSIG38.html (Printable C-level resolution template for § 38 BSIG liability protection).yml)