Cryptographic inventory before migration.

Abstract

NIST's post-quantum standards are final and migration deadlines are set, yet most organisations cannot answer the first question a migration asks: where is our cryptography? Algorithms are published and available, so the bottleneck is not cryptographic. It is an inventory and integration problem — which services negotiate which cipher suites, which certificates chain to what, which embedded device holds a key in firmware nobody can rebuild. This paper sets out a method for building a cryptographic bill of materials across a large regulated estate, ranking exposure by data confidentiality lifetime rather than by system, and sequencing a crypto-agile migration that treats the next algorithm change as a configuration rather than a rebuild.

What the paper covers

• Discovery across code, network traffic, certificates, protocols and hardware, and where each method goes blind.
• Modelling harvest-now-decrypt-later exposure by how long each dataset must stay confidential, not by how sensitive it looks today.
• Hybrid key establishment and staged rollout with rollback, including where hybrid modes break legacy middleboxes.
• A crypto-agility target architecture, and the organisational conditions under which it survives the transition after this one.
• What changes when the estate is national infrastructure — energy, telecom, finance, defence — rather than a single application.

Who it is for

Heads of security and infrastructure architects at organisations that will have to migrate under a regulatory deadline, and the technical teams who will do the work. It assumes familiarity with PKI and TLS, and no prior background in quantum computing.