Can a network sensor build a cryptographic inventory?

A large part of it, yes, but not all of it. Every TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. connection announces, before any encryption starts, which key-exchange groups the client offers and which one the server picks, as well as the TLS version; SSH works in a similar way. A sensor that sees those handshakes can list, per server and per client, where quantum-vulnerable key exchange is still used and where hybrid post-quantum key exchange already is, for every device on the segment, including printers, appliances and machines that cannot run an agent. What it cannot see: cryptography inside applications and databases, keys and certificates stored on disk, code signing, encrypted backups, segments that are not monitored, and connections whose handshake never crosses the sensor. NQCI, the NetSenX crypto inventory (in preview), is visible on every plan and active from the Pro plan; it needs the packet-capture sensor, off by default, switched on for a Linux agent or a sensor on a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port. The basic macOS mode does not see handshakes. Combine it with a certificate inventory and supplier questionnaires.

This answer is part of the guide: Post-quantum readiness: where to start

← All 33 questions on Post-quantum cryptographyAll topics