eoncore.css

eoncore.css · v0.1

Cryptography you can check.

Classless CSS for Eoncore. Plain HTML gets the house style; a short class picks a variant.

What the handshake actually negotiates

TLS 1.3 separates key exchange from the cipher suite. Listing supported suites tells you nothing about the group a server picks; you have to read the ServerHello. We do, for every host, and we show you which ones still fall back to classical key exchange.

The hybrid group X25519MLKEM768 combines a classical curve with ML-KEM from FIPS 203. A server that offers it but prefers x25519 is not quantum-safe in practice.

Harvest now, decrypt later only needs one recorded handshake.

Inside an article

Wrap long text in <article> and it switches to Bitter at 18/29 with a 68-character measure. Everything else (UI, tables, forms) stays in Source Sans 3.

Headings are always Bitter SemiBold
Code and identifiers are IBM Plex Mono
Press ⌘ K to search

Marked text uses a yellow wash.

Buttons and tags

Primary button edge None Bottom Full

Hover and press the yellow button. The edge is one variable: --button-edge.

Quantum-safe Hybrid offered RSA-1024 Unscanned

Tags are status, not actions: tinted background, no solid fill, a dot instead of a button shape. <span class="tag safe">

Forms

What does a scan touch?

Only the TLS handshake. We send a ClientHello per group and read what the server answers. No application data, no credentials.

How long does it take?

About two seconds per host for a quick scan, twenty for a full one.

Notes

Tables and code

Host	Negotiated group	Certificate	Status	Last scan
api.example.nl	`X25519MLKEM768`	ECDSA P-256	Safe	2 min
mail.example.nl	`x25519`	RSA-2048	Hybrid offered	14 min
legacy-vpn.example.nl	`secp256r1`	RSA-1024	Critical	1 h
intranet.example.nl	–	–	Unscanned	–

Example data. 4 of 640 hosts shown.

$ eon scan api.example.nl
supported_groups: X25519MLKEM768 (0x11ec) x25519 secp256r1
negotiated:       X25519MLKEM768
result:           quantum-safe