Search papers, labs, and topics across Lattice.
This paper introduces a static method for discovering and assessing cryptographic assets in software systems, addressing the critical lack of visibility that complicates security governance and post-quantum migration. By classifying cryptographic components into Crypto-Material, Crypto-Artifacts, and Crypto-Invocations, the authors developed a scanner that achieved an F1 score of 0.75 in asset discovery and accurately identified 91% of vulnerabilities in both synthetic and real-world environments. The scanner demonstrated efficiency by processing over 57,000 files in under six minutes, uncovering significant cryptographic assets and vulnerabilities relevant to post-quantum migration.
Static discovery of cryptographic assets can reveal hidden vulnerabilities and streamline post-quantum migration in software systems.
Modern software systems rely on cryptography for data protection, authentication, and trust establishment, yet organizations often lack a structured view of the cryptography deployed across source code, configuration, dependencies, and cryptographic files. This lack of visibility complicates security governance and post-quantum migration planning. This paper presents a static approach for discovering and assessing cryptographic assets in software systems. We introduce a classification of Crypto-Material, Crypto-Artifacts, and Crypto-Invocations, derive an extensible scanner-independent rule repository from it, and implement a static scanner that applies these rules to produce CBOM-oriented output. We evaluate the approach on a synthetic benchmark with known ground truth and on a real-world infrastructure of ten deployed services. The scanner achieves an F1 score of 0.75 for asset discovery and correctly annotates 91% of expected weaknesses and vulnerabilities. In the realworld setting, it processes 57 610 files in under six minutes and discovers 370 cryptographic assets, including six CVE-linked vulnerabilities and 52 post-quantum migration candidates. Real-world coverage is assessed against a manually compiled reference list rather than an exhaustive one. These results show that classification-driven static discovery can provide practical cryptographic transparency for governance and post-quantum migration planning.
