What Is Cryptographic Discovery?
Cryptographic discovery is the systematic process of identifying every use of cryptographic algorithms, keys, certificates, and libraries across an organization's infrastructure. It is the foundation of any post-quantum migration program. CISA, NSA, and NIST all identify cryptographic inventory as the essential first step before prioritization or migration planning can begin.
Discovery is difficult because cryptographic usage is distributed across many layers. Network protocols implement cryptography in their handshakes. Applications call cryptographic libraries directly. Firmware contains embedded cryptographic implementations. Hardware security modules store private keys. Cloud providers handle cryptography in managed services. Supply-chain software carries cryptographic dependencies that are not always visible to the organization using it.
Discovery Methods
No single tool or method captures all cryptographic usage. A complete inventory typically requires a combination of automated scanning, code analysis, manual review, and supply-chain assessment.
Network scanning and TLS inspection
Active scanning of network services to identify TLS versions, cipher suites, certificate details, and key exchange groups. Passive monitoring of traffic captures algorithms used in actual connections, including those to internal services not visible to external scanners.
Static code analysis
Analysis of source code and compiled binaries to identify calls to cryptographic libraries, direct algorithm implementations, hardcoded keys, and embedded certificates. Effective for own-developed software but requires access to source code.
Certificate inventory
Enumeration of all certificates in use, including TLS server certificates, client certificates, code signing certificates, and CA certificates. Records signature algorithms, key sizes, validity periods, and issuing CAs.
Software composition analysis
Identification of cryptographic library versions in application dependencies and container images. Determines whether dependencies use quantum-vulnerable algorithms and whether updates are available.
Firmware and device extraction
For IoT devices, industrial control systems, and embedded hardware, firmware must be extracted and analyzed for cryptographic implementations. This is often the most labor-intensive part of discovery.
The CBOM Output
A Cryptographic Bill of Materials (CBOM) is the structured output of the discovery process. It records every cryptographic component in use: the algorithm name, key size, certificate details, library name and version, the system or service where it is used, and the owner or team responsible.
CBOM formats are being standardized. CycloneDX, a software supply chain security standard maintained by OWASP, has added CBOM support. NIST is also developing guidance on CBOM content and structure. Organizations should produce a CBOM in a structured format that can be updated as systems change.
The CBOM is the input to risk scoring and migration planning. Each entry is assessed for its vulnerability to quantum attack and assigned a migration priority based on data sensitivity, data lifetime, and system criticality.
Common Discovery Challenges
Third-party and supply-chain cryptography is often the most difficult to discover. Organizations using managed cloud services, SaaS applications, and commercial software may not have visibility into the cryptographic implementations of those products. Discovery in this area requires vendor questionnaires, security review processes, and contractual requirements for transparency.
Encrypted traffic creates a discovery gap. If internal traffic is encrypted, passive network monitoring cannot inspect the cryptographic details of those sessions. Decryption appliances or agent-based monitoring may be needed to fill this gap without modifying application code.
Legacy and air-gapped systems present special challenges. Systems that cannot be remotely scanned must be discovered through physical access, documentation review, or agent installation. Air-gapped systems in operational technology environments require field surveys.
Maintaining the Inventory
A one-time discovery effort produces a snapshot that becomes stale. New systems are deployed, software is updated, certificates are renewed, and new vendors are onboarded. The CBOM must be maintained as a living document.
Automated CBOM generation tools can monitor systems continuously and alert when new cryptographic components are detected or existing ones change. Integrating CBOM updates into the software development lifecycle, such as triggering scans on every code commit and flagging new cryptographic library dependencies, helps keep the inventory current.