Licensing the Cryptographic Concentration Framework

You are free to

• Share – copy and redistribute the material in any medium or format, for any purpose, including commercial
• Adapt – remix, transform, and build upon the material for any purpose, including commercial

Under the following terms

• Attribution – You must give appropriate credit to Steve Vaile and Marin Ivezic, Applied Quantum, provide a link to the licence, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensors endorse you or your use.
• No additional restrictions – You may not apply legal terms or technological measures that legally restrict others from doing anything the licence permits.
• For the Apache-2.0 kit – Redistribution keeps the LICENSE and NOTICE files, with the author line in the NOTICE.

Suggested attribution

Provenance and publication history

The Cryptographic Concentration Framework is the original work of Steve Vaile and Marin Ivezic, published by Applied Quantum. It grew out of Applied Quantum’s post-quantum migration practice, where clean vendor registers kept sitting on top of shared cryptographic ancestry, and out of a question the vendor-substitutability test cannot answer: how concentrated is the estate beneath the vendor layer? The method was drafted and adjudicated through four external review rounds before it reached release candidate, and every canonical figure in the documents comes from the Apache-2.0 reference implementation.

A pilot cycle runs in October 2026, and v1.0 final publishes in November 2026. Open items are dated on the roadmap, and corrections are published as dated entries on the errata page.

The framework consumes a cryptographic bill of materials conforming to the Applied Quantum CBOM Profile, v1.0-RC or later. The Profile versions independently, carries its own licence page, and is owned by neither consuming framework.

What this framework defines

The adjacent-work record on the provenance page maps the nearest published second-line work and documents where it stops: at the vendor layer. What follows is what this framework defines beneath it, and each item carries a dated public history in this release candidate, the documents’ version records and the roadmap.

• Measurement beneath the vendor layer, per important business service, at six named layers where a single defect crosses nominally independent vendors: Algorithm, Implementation Lineage, Trust Root, Key Custody Platform, Protocol and Negotiation, and Key Generation.
• The executing implementation family as the layer-2 unit, exclusive by construction, so the index is a valid partition that two assessors converge on and that respondents cannot improve by selective disclosure.
• Failure-domain reach as a co-equal companion metric, overlapping by nature, evidence-tiered, and bounded where lineage or design is undisclosed, with the bound attributed to the supplier that declined.
• Effective Coverage, distinguishing a service protected end to end from one protected only at the institution’s own endpoints.
• Closed-left interpretation bands with the Highly concentrated boundary at 4,900, derived from the 70% largest-share bound rather than chosen.
• A three-state supplier disclosure record separating explicit refusal from silence, with the normative rule that similarity of vulnerability alone is never evidence of shared lineage.
• Determinations recorded before computation. The judgment trail lives in the Determination Log, and any reported figure includes five mandatory companions, its limitations and a maturity gate. Reporting the figure without them is non-conformant.
• The second-line boundary as design. The framework excludes loss estimation, likelihood and CVSS scoring, and discovery tooling, and the exclusions are deliberate.
• The reference implementation as arbiter. Every canonical figure comes from the engine and its ten test vectors. Any implementation that reproduces all ten is conformant.
• Validation by retrodiction. The Universal Framework ships with an annex re-running the layer-6 reading over the 2017 ROCA record, with further retrodictions committed on the roadmap.
• The Discovery Coverage Attestation reservation. Coverage asserted against named, digest-pinned reference sets rather than the estate, a mandatory gap register, scanner provenance attested separately from findings, and the stated non-goal that the predicate does not establish the reference set is right. Reserved at /predicates/coverage/v1, specified in v1.1.

What attribution requires in practice

CC BY 4.0 is one of the most permissive open licences in existence. It permits commercial use, derivative works, and redistribution without restriction. It imposes one binding condition, attribution, which is the legal requirement that makes the licence valid.

Proper attribution means:

1. Credit Steve Vaile and Marin Ivezic, Applied Quantum as the original authors

2. Provide a link to ccframework.org or the licence

3. Indicate what changes were made (if any)

4. Do not add restrictions that prevent others from using the original

A measurement method differs from prose guidance in one way that matters here: its value is comparability. A concentration figure means something across institutions and across years only if the units, the bands and the reach semantics that produced it are the published ones. A derivative that renames the metrics or moves the band boundaries strips the attribution and destroys the comparability the framework exists to create. Reuse the definitions, credit the source, and extend through a sector extension, which is exactly what the framework’s structure provides for.

An institution that runs the assessment, credits the framework, and defends the result in review is doing exactly what the licence intends. A consultancy that executes it for clients with attribution, or a tool vendor that embeds the Apache-2.0 engine and vectors and keeps the NOTICE, strengthens the whole measurement effort and is encouraged.

An organisation that takes this method, removes the attribution, adds its own branding, and presents it to clients as proprietary methodology has violated the licence twice over: by removing the required attribution, and by applying restrictions that CC BY 4.0 explicitly prohibits. Adding a proprietary copyright notice to a derivative of CC BY 4.0 material does not convert it into proprietary intellectual property. The original licence terms follow the work.

A note to institutions evaluating concentration measurement and advisory

If a consulting firm or vendor has presented a cryptographic concentration methodology, a below-vendor dependency model, or a resilience metric as part of an engagement, you may want to compare it against this publicly available framework.

Indicators that a methodology may be derived from this one:

• A six-layer decomposition matching or closely paralleling Algorithm, Implementation Lineage, Trust Root, Key Custody Platform, Protocol and Negotiation, and Key Generation
• A concentration index computed over exclusive executing units per business service, or an “implementation family” unit with matching semantics
• A reach or blast-radius figure that is evidence-tiered and carries a bound under supplier non-disclosure, particularly one distinguishing evidenced from bounded readings
• Closed-left interpretation bands with a Highly concentrated boundary at or near 4,900, or bands derived from a largest-share bound
• A supplier lineage record separating explicit refusal from silence, or data requests carrying named non-response consequences and an accountable individual
• Board reporting built on one institution-level figure with mandatory companions and a maturity gate
• Use of terms originated here, including “failure-domain reach,” “executing implementation family,” Effective Coverage as defined here, or the framework’s epigraph, “Switching vendors moves the contract, not the dependency.”

If a firm has adopted this framework and credited it properly, that reflects well on their judgment. Assessments built on shared definitions are what make cross-institution comparison possible, and that is exactly the use both licences encourage.

If a firm is presenting this framework’s structure and original concepts as proprietary work without attribution, you should know that the same methodology is available here at no cost, in its original and most current form, with a reference implementation that reproduces every published figure, maintained by the practitioners who built it.

Ask your firm which public methodologies their approach builds on. You are better served by advisers who are transparent about their sources than by firms presenting repackaged open work as proprietary innovation.

Disclaimer

The framework and its machine-readable companions are provided as-is, without warranty of any kind, express or implied. They do not constitute legal, regulatory, or professional advice. Organisations should seek qualified professional guidance for their specific circumstances.

The licensors do not waive any rights or authorise any use beyond what the licences permit. For the full legal texts, see the CC BY 4.0 Legal Code and the Apache License 2.0.