Discovering cryptography: tools for the post-quantum cryptography transition

Before an organisation can migrate to post-quantum cryptography (PQC), it needs to understand where cryptography is used today. In a complex technology environment, cryptography can be found across application source code, software libraries, containers, network protocols, certificates, infrastructure and third-party products.

This makes cryptographic discovery an important early step in PQC migration. The UK's National Cyber Security Centre (NCSC) has set a target for organisations to complete a full discovery exercise by 2028, identifying cryptography across their estate and producing an initial migration plan.

What can open-source tools achieve?

Open-source tools provide an accessible and affordable starting point for cryptographic discovery. Static analysis can identify cryptographic algorithms, libraries and APIs within source code and configuration files, while other tools can detect cryptographic assets within containers, directories and packaged software. Some can also generate a Cryptography Bill of Materials (CBOM), helping structure discovered cryptographic assets and their relationships.

Network discovery provides another perspective. Active scanners can analyse TLS-enabled services to identify supported protocols, cipher suites and certificates. Although these tools are not necessarily purpose-built for PQC, their findings can identify cryptography requiring further assessment. Passive network monitoring can complement this by observing cryptographic protocols in network traffic.

Used together, these approaches can provide valuable visibility across software and operational environments. However, open-source tooling can require significant expertise to configure, tune and interpret. Coverage also depends on the rules, parsers, protocols and environments supported, potentially requiring multiple tools and additional work to combine their outputs into a useful inventory.

What do commercial platforms add?

Commercial (paid) cryptographic discovery platforms are rapidly increasing in number and often combine several discovery techniques within a single capability. Depending on the platform, this can include source-code and filesystem analysis, endpoint sensors, application-runtime monitoring, network analysis and visibility across servers and cloud workloads.

The value is therefore not necessarily access to an entirely different form of discovery. Instead, organisations may be paying for breadth, integration, automation and management at scale. Centralised inventories and dashboards can bring findings from different discovery techniques together, while ongoing monitoring can reduce the manual effort involved in maintaining visibility as the cryptographic estate changes.

This does not remove every limitation. Coverage still depends on where sensors can be deployed, which systems can be accessed and which cryptographic implementations the platform understands. Commercial tooling should therefore not be confused with complete discovery.

The remaining discovery challenge

Some of the most difficult areas demonstrate why tooling alone is unlikely to provide complete visibility of an organisation’s cryptography. Third party products may contain cryptographic implementations that organisations cannot inspect directly, making supplier information and engagement an important part of discovery. Operational technology and legacy equipment may not support agents or sensors, or be suitable for active scanning, meaning passive monitoring may provide only a partial view based on observable network traffic.

Similarly, passive monitoring can miss dormant or rarely used cryptography if it is not exercised during the observation period. Custom or unusual cryptographic implementations may also fall outside the rules or parsers used by discovery tools.

Finding a cryptographic asset is also different from understanding its importance. Technical findings need to be connected with asset inventories, system ownership and business dependencies to determine what actually needs to migrate and how it should be prioritised.

Ultimately, there is no single tool that provides complete visibility across an organisation’s cryptographic estate. The objective is not to find the perfect scanner, but to combine appropriate discovery techniques, existing organisational knowledge and supplier information to answer three questions: What cryptography do we have, where is it used, and what depends on it?