How to Build a Cryptographic Inventory

A cryptographic inventory is a complete list of every cryptographic asset in your organisation — TLS certificates, SSH keys, code-signing certs, internal PKI, and the algorithms and key lengths they use. It's the foundation of cryptographic risk management and a requirement for NIS2 and DORA compliance.

Why you need a cryptographic inventory

You can't protect what you can't see. Most organisations have thousands of certificates they don't know about — on forgotten servers, shadow IT, and third-party hosting. When RSA-1024 is deprecated or a quantum computer arrives, you need to know where every vulnerable key is before you can replace it.

Step 1: Discover your public cryptographic surface

The fastest way to start a cryptographic inventory is to scan your public surface — every internet-facing host. QROS Explore does this automatically:

• Search by country and port to find every HTTPS endpoint in your jurisdiction
• For each host, QROS reports the TLS certificate (algorithm, key length, issuer, expiry, CN/SAN domains)
• SSH keys are indexed from SSH banners (key type, fingerprint)
• Web technologies (nginx, Apache, WordPress, etc.) are identified with their versions and CVEs

Step 2: Assess cryptographic risk

Once you have the inventory, assess each asset:

• Algorithm risk — RSA-1024 = broken, RSA-2048 = quantum-vulnerable, ECC-P256 = quantum-vulnerable
• Key length risk — keys below 2048 bits (RSA) or 224 bits (ECC) are below the modern security floor
• Expiry risk — certificates expiring within 30/60/90 days
• Quantum risk — every RSA and ECC key is Shor-vulnerable; QROS scores this

Step 3: Build a PQC migration roadmap

Use the risk scores to prioritise which assets to migrate to post-quantum cryptography (PQC) first:

• Highest risk: internet-facing RSA-1024 and expired certificates
• Medium risk: RSA-2048 on critical infrastructure (quantum-vulnerable but not yet broken)
• Lower risk: AES-256 (Grover-halved but still 128-bit secure)

Step 4: Maintain the inventory

A cryptographic inventory is not a one-time exercise. Certificates expire, new servers are deployed, and algorithms are deprecated. QROS continuously scans your public surface and updates the inventory — so it's always current for your next compliance audit.

FAQ