Purpose and boundaries
CDRI is an independent editorial reference for locating and reading primary material about cryptographic discovery. It is neither a standard nor a framework. Records do not award scores, rank products or attest to security, compliance or fitness for a particular use.
The initial selection brings together public guidance, a representation format and documented discovery tools. It is not exhaustive and has no preferred vendor. Alphabetical order is for navigation only.
Where CDRI fits
NCCoE’s work documents example discovery architectures; CSWP 48 maps project capabilities to NIST resources. CISA’s publication concerns automated discovery and inventory. NCSC guidance and ETSI’s report address the wider migration process. CycloneDX provides a model for representing cryptographic assets.
CDRI adds a common reading surface: source, scope, observation method, output and publication status, with uncertainties made explicit. It does not replace these initiatives or claim their endorsement.
Sources and selection
Records use primary sources only: issuing bodies, project maintainers and vendors’ own documentation. Publisher-maintained package descriptions can be used for open-source software. News coverage, reseller copy and unsourced aggregations are not evidence for record claims.
Technical capabilities are reported as documented by their source. CDRI has not executed or benchmarked the listed tools. A source check confirms support for the limited facts recorded here; it is not validation of product performance.
Each record identifies its source version or date where available and the date of the editorial check. A dated project description is not treated as a current software release. Where only an indexed primary excerpt was accessible, the record explicitly limits what was checked.
A relevant tool or publication may be included if its identity, scope and primary source can be established. Missing information is left unfilled using the field conventions below. Corrections require the same source discipline as new records.
How to read the fields
Type
- open source
- Software identified as open source by its primary project or publisher source. Its own licence applies.
- commercial
- A vendor product. This label does not imply a particular price or licensing model.
- editorial
- A reference document, guidance publication or specification. This is CDRI’s content category, not a claim that the source is authored by CDRI.
Method
- static
- Inspection of source code, files or images without observing the target executing.
- runtime
- Observation of cryptographic use during execution.
- network
- Observation through network traffic or connections to exposed services.
- mixed
- Multiple observation approaches explicitly described by the source.
These are editorial descriptors of documented collection scope, not a technical standard. They are not applied to a publication as though the document were itself a scanner.
Status
- draft
- The cited source explicitly identifies the publication as a draft.
- standard
- The record concerns a published specification recognised as a standard by its issuing body.
- open
- The record concerns an open-source software project. It is not a maturity or quality grade.
- in force
- Reserved for an instrument whose applicability and effective status are explicitly established by its issuing source. Not assigned to tools or ordinary guidance.
Status labels describe different kinds of source; they are not a scale. A published technical report or a commercial product can legitimately have “not applicable” as its status.
Missing and inapplicable information
- not applicable
- The field does not fit the kind of record, such as a scanner method for a reference document.
- not documented
- The checked source does not establish the requested fact. This does not mean the capability is absent.
“Output format” describes the documented discovery or inventory output, not the PDF or HTML format of a reference publication. When a source mentions a CBOM but does not identify its serialization, that limit is retained.
Updates and corrections
The initial maintenance cycle is a manual weekly review. The editor checks source changes, versions, links and status, then revises affected records. The last-checked date changes only when a source has actually been reviewed; it is not automatically refreshed.
Material changes receive a dated note in the revision history. Source outages or conflicting documentation are recorded rather than silently resolved by inference. A missed review leaves the previous date visible.
To suggest a correction, send the record link, the disputed field and a primary source through Contact. Suggestions do not automatically change a record.
Revision history
— Initial set of 12 source-checked records prepared for editorial approval. CISA is a metadata-only record; the IBM Explorer record uses indexed primary documentation, with access limits disclosed.
Rights and attribution
All rights reserved. Quotation with attribution to CDRI and a link to the relevant record is welcome. This site is not offered under a Creative Commons licence. Referenced publications, trademarks and software retain their respective owners’ rights and licences.
Suggested attribution: “CDRI — Cryptographic Discovery Reference Index, [record name], [record link], accessed [date].”