🤖 AI Summary
This study addresses the challenge that organizations lack structured awareness of cryptographic assets in software, which impedes effective security governance and post-quantum migration. To bridge this gap, the authors propose a static analysis approach that introduces the first taxonomy tailored for Cryptographic Bill of Materials (CBOM) and designs an extensible, scanner-agnostic rule library to enable efficient discovery and risk assessment of cryptographic assets. Empirical evaluation demonstrates that the method processes 57,610 files within six minutes, accurately identifying 370 cryptographic assets with an F1 score of 0.75. It further uncovers six CVE-listed vulnerabilities and 52 candidates requiring post-quantum migration, achieving a vulnerability labeling accuracy of 91%.
📝 Abstract
Modern software systems rely on cryptography for data protection, authentication, and trust establishment, yet organizations often lack a structured view of the cryptography deployed across source code, configuration, dependencies, and cryptographic files. This lack of visibility complicates security governance and post-quantum migration planning. This paper presents a static approach for discovering and assessing cryptographic assets in software systems. We introduce a classification of Crypto-Material, Crypto-Artifacts, and Crypto-Invocations, derive an extensible scanner-independent rule repository from it, and implement a static scanner that applies these rules to produce CBOM-oriented output. We evaluate the approach on a synthetic benchmark with known ground truth and on a real-world infrastructure of ten deployed services. The scanner achieves an F1 score of 0.75 for asset discovery and correctly annotates 91% of expected weaknesses and vulnerabilities. In the realworld setting, it processes 57 610 files in under six minutes and discovers 370 cryptographic assets, including six CVE-linked vulnerabilities and 52 post-quantum migration candidates. Real-world coverage is assessed against a manually compiled reference list rather than an exhaustive one. These results show that classification-driven static discovery can provide practical cryptographic transparency for governance and post-quantum migration planning.