Cryptographic Inventory Guide

A cryptographic inventory is the foundation of any successful PQC migration. You cannot protect what you don't know exists, and you cannot migrate what you cannot find. This guide provides a systematic approach to discovering, documenting, and maintaining a complete catalog of cryptographic assets.

Organizations are often surprised by the extent of their cryptographic footprint. Cryptography is embedded in certificates, APIs, databases, file systems, hardware, cloud services, and countless applications. Building a comprehensive inventory requires methodical discovery across all layers of your infrastructure.

Cryptographic Asset Categories

Cryptographic assets fall into several categories, each requiring different discovery methods:

Discovery Methods

Effective cryptographic discovery combines multiple techniques across network, application, and infrastructure layers.

Network-Based Discovery

Scan network services to identify TLS configurations and certificate usage:

# Scan TLS configuration with SSLyze
sslyze --regular --json_out=results.json example.com:443

# Quick certificate check with OpenSSL
echo | openssl s_client -connect example.com:443 2>/dev/null | \
  openssl x509 -noout -text | grep "Public Key Algorithm\|Signature Algorithm"

# Scan internal network range for TLS services
nmap -sV --script ssl-enum-ciphers -p 443,8443,9443 192.168.1.0/24

Code-Based Discovery

Static analysis identifies cryptographic usage in source code:

# Search for cryptographic function calls
grep -rn "RSA\|ECDSA\|AES\|SHA256\|generateKey\|encrypt\|decrypt" ./src/

# Find certificate file references
grep -rn "\\.pem\|\\.crt\|\\.key\|\\.pfx\|\\.p12" ./

# Semgrep rules for crypto detection
semgrep --config p/crypto-audit ./src/

Infrastructure Discovery

Examine infrastructure components for cryptographic assets:

• Certificate Stores: Windows Certificate Store, macOS Keychain, Java Keystore
• Secret Managers: HashiCorp Vault, AWS Secrets Manager, Azure Key Vault
• Configuration Management: Ansible, Terraform, Kubernetes Secrets
• Cloud Provider APIs: List KMS keys, certificates, and HSM configurations

Inventory Documentation

Each cryptographic asset should be documented with sufficient detail for migration planning:

Cryptographic Bill of Materials (CBOM)

A CBOM is an emerging standard for documenting cryptographic components in software, similar to SBOM (Software Bill of Materials). CBOMs provide:

• Standardized format: Machine-readable documentation of crypto usage
• Supply chain visibility: Track cryptography in dependencies
• Automated analysis: Identify quantum-vulnerable components programmatically
• Compliance evidence: Demonstrate cryptographic governance

Common Discovery Locations

Don't overlook these frequently missed cryptographic locations:

Inventory Maintenance

A cryptographic inventory is a living document that requires ongoing maintenance:

• Automate where possible: Integrate discovery into CI/CD and monitoring
• Regular reviews: Quarterly inventory audits minimum
• Change triggers: Update immediately when deploying new systems
• Owner accountability: Assign clear ownership for each asset category
• Integration: Connect inventory to CMDB and security tools

Frequently Asked Questions

Next Steps

Start building your cryptographic inventory today:

1. Download the template - Use our Cryptographic Inventory Template
2. Begin network discovery - Scan TLS endpoints and certificate usage
3. Catalog key systems - Start with PKI, TLS termination, key management
4. Assign ownership - Identify responsible teams for each asset category
5. Plan for automation - Evaluate tools for continuous discovery