Discovery
Build an inventory you can review
What you will understand
Connect observations to owners, systems, and explicitly recorded unknowns.
Last reviewed:
Understand the context
A cryptographic inventory records where and why cryptography is used, not simply which algorithm strings occur in source files. Establish a boundary first: repositories, services, environments, third-party dependencies, and evidence that owners are authorized to provide. Record exclusions so a later reader can interpret coverage honestly.
Plan the work
For each observation capture the system, owner, purpose, algorithm and parameters when known, provider and version, evidence source, observation date, and confidence or unresolved questions. Connect keys and certificates to their lifecycle owner rather than collecting private material. Never copy production secrets into a discovery report.
Evidence to review
Combine appropriately scoped source and dependency discovery with separate architecture documents, certificate exports, provider documentation, and approved runtime observations. Reconcile conflicting evidence with the owner. Mark a source reference as a candidate until context confirms its role. A dependency declaration does not establish that every transitive use is known.
Limits and next steps
The local QuantumSafe Scanner prototype performs supported file-local source and dependency discovery, with warnings and coverage limits. Its sample JSON is not a complete CBOM or deployment inventory. Review missed wrappers and unsupported inputs, then build a backlog for evidence that requires another method or access boundary.
Evidence and limitations
Educational guidance with referenced standards; no customer system has been assessed for this article. Implementation and protocol support must be verified for the selected environment.