Smart India Hackathon 2026 · PS 26164 · NTRO

ECDAT

We built ECDAT to find every piece of cryptography an organisation runs, show which of it a quantum computer will break and when that stops being theoretical, then plan the fix under a real budget.

What we built, and what we measured with it

CBOM Atlas

We pointed our prototype at 109 public codebases, including India's open digital public infrastructure. Every inventory we produced is a CycloneDX 1.7 CBOM signed with ML-DSA-65, published here with its report and VEX file.

109repositories
18 Sep 2026open →

India quantum-readiness snapshot

We probed 132 public sites across NCIIPC's seven critical sectors. 18.9% negotiate post-quantum key exchange, against 56.0% of the global reference sites we used as a control. We publish sector totals only — we name no site.

132sites
18 Sep 2026open →

The dashboard, on real scans

Our dashboard, running on the scans above. Move the quantum-year slider, filter by tier, open any asset and read the evidence our scanners produced for it.

2scans
liveopen →

Check our work

We sign every CBOM we publish with ML-DSA-65 (FIPS 204). Download one, download our public key and check it offline — we are not asking you to take our numbers on trust.

git clone https://github.com/SarthakShrivastav-a/ecdat && cd ecdat && pip install -e .
curl -O https://sarthakshrivastav-a.github.io/ecdat/ecdat-mldsa65.pub
ecdat verify cbom.json --pubkey ecdat-mldsa65.pub

Public key ecdat-mldsa65.pub, SHA-256 18d160354202ea76454f96b345b3772de15ba6f331105342f1fed771aee9270d
Our source github.com/SarthakShrivastav-a/ecdat, 92 automated tests, runs fully offline.

How to read our numbers

We scanned each repository's default branch as we downloaded it on 18 Sep 2026. Observed means we found it in the project's own code, configuration, certificates or binaries; an algorithm a dependency merely could provide we list separately and never count as use. For the snapshot we make two browser-equivalent connections per site and publish only sector totals. Quantum-year Z is an assumption you set, not a forecast we are making.