PQC Migration Planning Tool

#!/usr/bin/env python3
"""PQC Migration Prioritization Tool"""

import json
from datetime import datetime, timedelta

def calculate_priority_score(asset):
    """Calculate migration priority (0-100)"""
    score = 0

    # Data classification (0-25 points)
    classification = asset.get('data_classification', 'public')
    classification_scores = {
        'top-secret': 25,
        'secret': 20,
        'confidential': 15,
        'internal': 10,
        'public': 5
    }
    score += classification_scores.get(classification, 5)

    # Data retention period (0-20 points)
    retention_years = asset.get('retention_years', 1)
    if retention_years >= 10:
        score += 20
    elif retention_years >= 5:
        score += 15
    elif retention_years >= 2:
        score += 10
    else:
        score += 5

    # System exposure (0-20 points)
    if asset.get('internet_facing', False):
        score += 20
    elif asset.get('partner_accessible', False):
        score += 15
    elif asset.get('internal_only', False):
        score += 10

    # Algorithm vulnerability (0-20 points)
    algorithm = asset.get('algorithm', '').upper()
    key_size = asset.get('key_size', 0)

    if 'RSA' in algorithm:
        if key_size <= 2048:
            score += 20
        elif key_size <= 3072:
            score += 15
        else:
            score += 10
    elif 'ECC' in algorithm or 'ECDSA' in algorithm:
        score += 18
    elif 'DH' in algorithm:
        score += 17

    # Compliance requirements (0-15 points)
    if asset.get('fedramp', False) or asset.get('cmmc', False):
        score += 15
    elif asset.get('hipaa', False) or asset.get('pci_dss', False):
        score += 12
    elif asset.get('gdpr', False):
        score += 10

    return min(score, 100)  # Cap at 100

def generate_migration_plan(inventory_file):
    """Generate phased migration plan"""

    with open(inventory_file) as f:
        inventory = json.load(f)

    assets = inventory.get('assets', [])

    # Calculate priority for each asset
    for asset in assets:
        asset['priority_score'] = calculate_priority_score(asset)

    # Sort by priority
    assets.sort(key=lambda x: x['priority_score'], reverse=True)

    # Assign to phases
    critical = [a for a in assets if a['priority_score'] >= 70]
    high = [a for a in assets if 50 <= a['priority_score'] < 70]
    medium = [a for a in assets if 30 <= a['priority_score'] < 50]
    low = [a for a in assets if a['priority_score'] < 30]

    # Generate timeline
    start_date = datetime.now()

    plan = {
        "plan_date": start_date.isoformat(),
        "inventory_file": inventory_file,
        "total_assets": len(assets),

        "phases": {
            "Phase 1 - Discovery": {
                "start_date": start_date.isoformat(),
                "end_date": (start_date + timedelta(weeks=8)).isoformat(),
                "duration": "8 weeks",
                "activities": [
                    "Complete cryptographic asset inventory",
                    "Identify all quantum-vulnerable systems",
                    "Assess vendor PQC readiness",
                    "Establish governance framework",
                    "Create compliance baseline"
                ],
                "assets": []
            },

            "Phase 2 - Pilot": {
                "start_date": (start_date + timedelta(weeks=8)).isoformat(),
                "end_date": (start_date + timedelta(weeks=12)).isoformat(),
                "duration": "4 weeks",
                "activities": [
                    "Deploy hybrid PQC in test environment",
                    "Benchmark performance impact",
                    "Test interoperability",
                    "Train security teams",
                    "Update security policies"
                ],
                "assets": []
            },

            "Phase 3 - Critical Assets": {
                "start_date": (start_date + timedelta(weeks=12)).isoformat(),
                "end_date": (start_date + timedelta(weeks=52)).isoformat(),
                "duration": "10 months",
                "activities": [
                    "Migrate top-secret and secret data systems",
                    "Upgrade internet-facing services",
                    "Deploy PQC for long-lived data",
                    "Update PKI infrastructure"
                ],
                "assets": critical
            },

            "Phase 4 - High Priority": {
                "start_date": (start_date + timedelta(weeks=52)).isoformat(),
                "end_date": (start_date + timedelta(weeks=78)).isoformat(),
                "duration": "6 months",
                "activities": [
                    "Migrate FedRAMP/CMMC systems",
                    "Upgrade internal services",
                    "Deploy hybrid certificates"
                ],
                "assets": high
            },

            "Phase 5 - Standard Migration": {
                "start_date": (start_date + timedelta(weeks=78)).isoformat(),
                "end_date": (start_date + timedelta(weeks=104)).isoformat(),
                "duration": "6 months",
                "activities": [
                    "Migrate remaining vulnerable systems",
                    "Phase out classical-only crypto",
                    "Update documentation"
                ],
                "assets": medium + low
            }
        },

        "compliance_milestones": {
            "2025": "All new systems PQC-capable (CNSA 2.0)",
            "2030": "All NSS using PQC (CNSA 2.0)",
            "2033": "Classical crypto phased out (CNSA 2.0)"
        }
    }

    return plan

def print_migration_plan(plan):
    """Pretty print the migration plan"""
    print("\\n" + "="*80)
    print("PQC MIGRATION ROADMAP")
    print("="*80)
    print(f"Generated: {plan['plan_date']}")
    print(f"Total Assets: {plan['total_assets']}")

    for phase_name, phase_data in plan['phases'].items():
        print(f"\\n{phase_name}")
        print("-" * 80)
        print(f"Duration: {phase_data['duration']}")
        print(f"Start: {phase_data['start_date'][:10]}")
        print(f"End: {phase_data['end_date'][:10]}")

        print(f"\\nActivities:")
        for activity in phase_data['activities']:
            print(f"  • {activity}")

        if phase_data['assets']:
            print(f"\\nAssets to Migrate: {len(phase_data['assets'])}")
            # Show top 5 assets
            for asset in phase_data['assets'][:5]:
                print(f"  [{asset['priority_score']:3d}] {asset.get('name', 'Unnamed')}")
                print(f"       {asset.get('algorithm', 'Unknown')} - {asset.get('usage', 'General')}")
            if len(phase_data['assets']) > 5:
                print(f"  ... and {len(phase_data['assets']) - 5} more")

    print("\\n" + "="*80)
    print("CNSA 2.0 COMPLIANCE TIMELINE")
    print("="*80)
    for year, requirement in plan['compliance_milestones'].items():
        print(f"{year}: {requirement}")

    print("\\n" + "="*80)

if __name__ == "__main__":
    import sys
    if len(sys.argv) < 2:
        print("Usage: python migration_planner.py inventory.json")
        sys.exit(1)

    inventory_file = sys.argv[1]
    plan = generate_migration_plan(inventory_file)

    # Save plan
    output_file = "pqc-migration-plan.json"
    with open(output_file, 'w') as f:
        json.dump(plan, f, indent=2)

    print_migration_plan(plan)

    print(f"\\nMigration plan saved to: {output_file}")

python shared/generate_timeline.py \
  --plan pqc-migration-plan.json \
  --output reports/migration-timeline.html \
  --format gantt

python shared/estimate_resources.py \
  --inventory crypto-inventory.json \
  --output reports/resource-estimate.html

# Outputs:
# - Estimated timeline (months)
# - Team size recommendations
# - Hardware/software requirements
# - Training needs