Cryptographic Inventory Probe

Status note: this project is conceptual. It describes an approach we think is worth building and testing. Nothing has been implemented, and no results are claimed.

The question

Post-quantum migration planning stalls at the same place in most organisations: nobody can say where public-key cryptography is in use. The information exists, but distributed across TLS configurations, code-signing pipelines, embedded firmware, third-party libraries, and hardware security modules — none of which is indexed as a cryptographic dependency.

Manual inventory is accurate and does not scale. Questionnaires scale and are not accurate, because they ask people who do not know. The question is whether a useful first-pass inventory can be assembled from evidence the estate already emits.

The approach

Four independent signals, deliberately chosen because each is blind to what the others see:

• Observed sessions. Passive analysis of negotiated handshakes at network boundaries reveals key exchange and signature algorithms actually in use, which frequently differs from what configuration files claim.
• Artefact scanning. Dependency manifests, SBOMs, and binaries indicate which cryptographic primitives are linked, including transitive dependencies nobody selected deliberately.
• Certificate estate. Issued certificates, internal and public, give key types, sizes, and expiry, and expose issuance paths that are not otherwise documented.
• Lifecycle correlation. Cross-referencing findings against asset records to separate systems that can be changed on a deployment cadence from those that cannot.

The output would be a ranked list rather than a complete register: assets sorted by the product of data sensitivity, service life, and difficulty of change.

What would make it useful

The value is not completeness — completeness is unattainable — but ordering. A partial inventory that correctly identifies the twenty assets that must be addressed first is more useful than a comprehensive register delivered eighteen months later.

Two properties would determine whether the approach is worth anything in practice: whether the four signals disagree in informative ways, and whether the difficult category — long-lived assets with fixed cryptography — can be identified without a manual survey.

Why we are interested

The migration question is frequently framed as cryptographic and is mostly logistical. If discovery can be made cheap and repeatable, the rest of the transition becomes an ordinary lifecycle problem rather than a research one.

Related reading: The Cryptographic Horizon.