← Back to Blog Guide

How to Inventory Your Cryptographic Assets: Post Quantum Cryptography Migration Step 1

9 min read
How to Inventory Your Cryptographic Assets: Post Quantum Cryptography Migration Step 1 - QNSQY post-quantum encryption guide

Why Inventory Is Step One

You cannot migrate what you do not know about. Cryptographic inventory is the mandatory first phase of any Post Quantum Cryptography migration. NIST, NSA CNSA 2.0, CISA, ENISA, and UK NCSC all emphasize inventory as the baseline deliverable.

What to Catalog

At a minimum, capture for every cryptographic usage:

  1. Asset: the system, service, library, or database.
  2. Primitive: KEM, signature, hash, KDF, AEAD.
  3. Algorithm: RSA-2048, ECDSA P-256, AES-256-GCM, SHA-256, etc.
  4. Key size: 2048, 3072, 256-bit, etc.
  5. Usage: TLS, code signing, at-rest encryption, authentication.
  6. Data sensitivity: confidentiality lifetime.
  7. Owner: team responsible.
  8. Migration priority: computed from Mosca X+Y>Z.

Where to Look

  • Web services: TLS certificates, cipher suites, key_shares.
  • SSH: host keys, user auth keys, KEX algorithms.
  • Code signing: certificate authorities, signing tools, artifact repositories.
  • Databases: TDE, KMS, backup encryption.
  • Backups: tape encryption, cloud archive encryption, key wrapping.
  • VPN: IPsec config, WireGuard peers.
  • Email: S/MIME, PGP, TLS.
  • Identity: JWT, SAML, X.509 certificates.
  • Secrets management: Vault, Secrets Manager, KMS.
  • Hardware: HSM firmware, TPM, smartcards.
  • Third-party: SaaS vendors, API keys, OAuth clients.

Automated Discovery Tools

  • QNSQY scan (via qnsqy scan command) identifies classical crypto in data at rest.
  • CryptoSense / SandboxAQ commercial crypto inventory platforms.
  • evolutionQ PQRisk consulting-led inventory.
  • Homegrown scripts: grep for OpenSSL calls, certificate parsing.
  • Agent-based scanners: emerging category.

Categorize by CNSA 2.0 / NIST IR 8547

Use the NIST IR 8547 schedule as your categorization framework:

  • Deprecated after 2030: RSA-2048, ECDSA P-256, 80-bit security symmetric.
  • Disallowed after 2035: all quantum-vulnerable.
  • Approved: ML-KEM, ML-DSA, SLH-DSA, FN-DSA, LMS, AES-256, SHA-384+.

Output Deliverable

A spreadsheet or database with per-asset rows, sortable by migration priority. Integrate into your GRC tool. Review quarterly.

Frequently Asked Questions

How long does inventory take?

For a medium enterprise (500-5000 employees), 3-6 months to establish initial inventory. Ongoing maintenance thereafter. Large enterprises can take 12+ months.

Should I start with production or dev/test?

Production first for risk. Dev/test can be added next; prototyping new PQC deployment tends to land there first.

What are the best free tools?

nmap with cipher detection scripts, sslscan, testssl.sh, and custom scripts using openssl/python. Commercial tools (SandboxAQ, CryptoSense) automate discovery at scale.

How often should I re-inventory?

Quarterly at minimum. New deployments, vendor updates, and library refreshes can change the crypto landscape.

Sources

  1. NIST IR 8547
  2. NSA/CISA/NIST Factsheet

Related Articles

Protect Your Data Before Q-Day Arrives

QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.

Try QNSQY

Originally published at quantumsequrity.com/blog/how-to-inventory-cryptographic-assets.