CDRICryptographic Discovery
Reference Index

Independent reference · Edition 01

Find the source.
Understand the scope.

An editorial index of cryptographic discovery tools, formats and public references. Documented facts, linked to their primary sources.

Explore the 12 records

The starting point

What is cryptographic discovery?

Cryptographic discovery identifies where and how cryptography is used in software, systems and services.

Editorial synthesis based on NCCoE’s migration project.

  1. 01 / DISCOVERY

    Observe

    Identify cryptographic assets and their use within the scope of an observation.

  2. 02 / INVENTORY

    Organise

    Bring findings together with context and relationships. Keep the observation scope and date.

  3. 03 / CBOM

    Represent

    Describe cryptographic assets and dependencies in a machine-readable model, such as CycloneDX CBOM.

Discovery → inventory → CBOM is an editorial explanation of the relationship, not a prescribed process. A CBOM does not by itself establish complete discovery coverage. Sources: NCCoE · CycloneDX CBOM guide.

The reference index

Tools, formats & guidance

12 records · A–Z
Source checks: 22 September 2026

Open a record for its scope, output, status and sources. Inclusion is not endorsement; the index is a selected starting set, not an exhaustive catalogue. How to read these fields ↗

CBOMkitSource-code scanning, CBOM storage and a web viewer. Uses sonar-cryptography for analysis.open sourcestatic
Type
open source
Method
static
Output format
CBOM objects; serialization not documented in the cited overview.
Status
open
Source version / date
Project description, 23 June 2025; software release not specified.
Last checked
2026-09-22

Primary sources

Describes the source-scanning service, not every tool in the wider CBOMkit family. No software execution was performed.

CBOMkit-theiaCryptographic assets in container images and local directories, including certificates and security configuration.open sourcestatic
Type
open source
Method
static
Output format
CBOM; serialization not documented in the cited descriptions.
Status
open
Source version / date
Project descriptions, 6 November 2024 and 23 June 2025; software release not specified.
Last checked
2026-09-22

Primary sources

Static means inspection of image or filesystem contents. It does not imply observation of a running container.

CISA discovery and inventory strategyStrategy for migrating to automated post-quantum cryptography discovery and inventory tools.editorialnot applicable
Type
editorial
Method
not applicable
Output format
Not applicable — reference publication.
Status
not applicable
Source version / date
Publication date on the indexed cover: 15 August 2024.
Last checked
2026-09-22

Primary sources

Metadata-only record: title and cover date verified from the indexed primary publication. Direct retrieval returned an access error; the full text was not reviewed. No detailed technical or legal claims are made here.

CryptoNext COMPASSVendor-described discovery across networks, applications, data at rest and key management, with a structured inventory.commercialmixed
Type
commercial
Method
mixed
Output format
Not documented — the cited product page does not specify an export serialization.
Status
not applicable
Source version / date
Public product page; release and publication date not stated.
Last checked
2026-09-22

Primary sources

Mixed reflects the vendor's description of multiple sources and active/passive collection. Capabilities have not been independently tested by CDRI.

CycloneDX CBOMA model for describing cryptographic assets and their dependencies, including algorithms, keys, certificates and protocols.editorialnot applicable
Type
editorial
Method
not applicable
Output format
CycloneDX CBOM; JSON examples documented in the guide.
Status
standard
Source version / date
Authoritative Guide to CBOM, second edition, 21 October 2025; covers CycloneDX 1.7.
Last checked
2026-09-22

Primary sources

The standard label refers to CycloneDX. CBOM is a representation of findings and dependencies, not a discovery scanner. CDRI does not certify conformance.

ETSI TR 104 016A Repeatable Framework for Quantum-Safe Migrations. Includes asset inventories and dependency analysis within a wider migration process.editorialnot applicable
Type
editorial
Method
not applicable
Output format
Not applicable — technical report.
Status
not applicable
Source version / date
V1.1.1, October 2024.
Last checked
2026-09-22

Primary sources

Listed as a published technical report. Its framework is ETSI's work; CDRI does not introduce a migration framework or infer binding obligations from this report.

IBM Quantum Safe ExplorerSource-code analysis to identify cryptographic artifacts and generate a cryptographic inventory.commercialstatic
Type
commercial
Method
static
Output format
CycloneDX CBOM in JSON, documented in the 2.x scanning instructions.
Status
not applicable
Source version / date
IBM Quantum Safe Explorer 2.x documentation.
Last checked
2026-09-22

Primary sources

Facts checked against indexed IBM documentation. Direct page retrieval was unavailable during review. This record does not assert coverage of every language or deployed environment.

NCCoE / NIST SP 1800-38BQuantum Readiness: Cryptographic Discovery. Describes discovery-tool architecture, example scenarios and a functional demonstration plan.editorialnot applicable
Type
editorial
Method
not applicable
Output format
Not applicable — practice-guide draft.
Status
draft
Source version / date
Volume B, preliminary draft, December 2023.
Last checked
2026-09-22

Primary sources

The linked document identifies itself as a preliminary draft. It describes example implementations; inclusion here is not an endorsement of participants or products.

NCSC PQC migration timelinesUK guidance placing discovery and assessment within post-quantum migration planning, including systems, services and dependencies.editorialnot applicable
Type
editorial
Method
not applicable
Output format
Not applicable — guidance publication.
Status
not applicable
Source version / date
Published 20 March 2025.
Last checked
2026-09-22

Primary sources

The initial discovery and assessment exercise is explicitly distinguished from a formal item-by-item asset register. This record makes no claim of a universal legal deadline.

NIST CSWP 48Maps NCCoE migration-project capabilities to NIST CSF 2.0 and SP 800-53 Rev. 5, including cryptographic discovery and inventory capabilities.editorialnot applicable
Type
editorial
Method
not applicable
Output format
Not applicable — mapping publication.
Status
draft
Source version / date
Initial public draft, 18 September 2025; public comment period closed.
Last checked
2026-09-22

Primary sources

The source remains labelled Initial Public Draft. A closed comment period does not establish final publication. Mapping to controls is not certification.

sonar-cryptographySonarQube plugin analysing Java and Python source code for cryptographic assets and finding locations.open sourcestatic
Type
open source
Method
static
Output format
CBOM object; serialization not documented in the cited overview.
Status
open
Source version / date
Project description, 23 June 2025; software release not specified.
Last checked
2026-09-22

Primary sources

Language coverage is bounded to this dated primary description, not a claim about every current release.

SSLyzeServer SSL/TLS configuration, certificates, cipher suites and supported curves, observed through network connections.open sourcenetwork
Type
open source
Method
network
Output format
JSON scan results.
Status
open
Source version / date
PyPI release 6.3.1, 29 March 2026; AGPLv3.
Last checked
2026-09-22

Primary sources

This record concerns the documented TLS endpoint scanner. It does not imply an inventory of cryptography inside application source code.