What should a cryptographic inventory include?

For each place where cryptography protects something, record what is protected, how, and who can change it. Practical fields: the system or service and its owner; what it protects, with the data type and how many years it must stay secret; the protocol, such as TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS., SSH, IPsec, S/MIME, code signing, or disk and database encryption; the algorithms for key exchange, signatures and encryption, with key sizes; certificates, their issuer and expiry; the library or product version and whether the vendor has a post-quantum plan; and whether the algorithm can be changed by configuration. Add a priority derived from Mosca's inequality. Sources differ by layer: network observation for what crosses the wire, certificate management and scanners for certificates, software composition analysis and supplier questionnaires for what sits inside applications. An inventory that lists only certificates misses key exchange, and one built only from the network misses data at rest. Keep it current, because each update can change the answer, and date every entry: auditors and tenders ask when it was last checked.

This answer is part of the guide: Post-quantum readiness: where to start

← All 33 questions on Post-quantum cryptographyAll topics