{"id":26316,"date":"2026-10-20T23:00:12","date_gmt":"2026-10-21T07:00:12","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/10\/20\/why-the-tools-you-already-own-wont-make-you-pqc-ready\/"},"modified":"2026-10-20T23:00:12","modified_gmt":"2026-10-21T07:00:12","slug":"why-the-tools-you-already-own-wont-make-you-pqc-ready","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2026\/10\/20\/why-the-tools-you-already-own-wont-make-you-pqc-ready\/","title":{"rendered":"Why the Tools You Already Own Won\u2019t Make You PQC-Ready"},"content":{"rendered":"<div class=\"rich-text_richText__UyrDZ\" data-anchor-headings=\"true\" data-component=\"rich-text\" data-reader-view=\"false\">\n<div class=\"payload-richtext\">\n<div class=\"callout-block_highlight__zUB32\" data-accent-bar=\"true\" data-background=\"highlight-gray\" data-component=\"callout-block\">\n<p class=\"callout-block_heading__sSD7c\" data-subtitle=\"lg\">Key takeaways<\/p>\n<div class=\"rich-text_richText__UyrDZ\" data-component=\"rich-text\" data-reader-view=\"false\">\n<div class=\"payload-richtext\">\n<ul class=\"list-bullet\">\n<li class=\"\" value=\"1\">Source scanners, SBOMs, certificate managers, network monitors, and vendor questionnaires each answer a different question, and none of them inspects the cryptography inside the software you actually run.<\/li>\n<li class=\"\" value=\"2\">The gap is the final software artifact: compiled binaries, packages, and COTS products where no source, manifest, or vendor disclosure exists.<\/li>\n<li class=\"\" value=\"3\">Binary analysis fills that gap and can produce a CBOM that ties each cryptographic asset to the component containing it.<\/li>\n<li class=\"\" value=\"4\">You don\u2019t need PQC support to start. Finding today\u2019s RSA and ECC exposure can begin now.<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n<p>Ask a security team where its quantum-vulnerable cryptography lives in the software being run, and the answer usually arrives in pieces. The code scanner reports on first-party repositories, the dependency inventory lists declared packages, the certificate platform tracks the certificates it manages, and vendor questionnaires fill in the rest.\u00a0<\/p>\n<p>Each tool reports accurately on what it was built to see. The trouble is the layer none of them inspects: the cryptography compiled into the commercial and third-party software the organization runs every day.<\/p>\n<h2 id=\"a-visibility-problem-most-teams-dont-know-they-have\"><strong>A Visibility Problem Most Teams Don&#8217;t Know They Have<\/strong><\/h2>\n<p>The gap is rarely obvious from inside a mature security program, because every tool in the stack produces clean, confident output. The National Cybersecurity Center of Excellence (NCCoE) at NIST put the underlying problem plainly in its <a href=\"https:\/\/www.nccoe.nist.gov\/sites\/default\/files\/2023-08\/mpqc-fact-sheet.pdf\"><span style=\"text-decoration:underline\">post-quantum migration project materials<\/span><\/a>: &#8220;Organizations are often unaware of the breadth and scope of application and function dependencies on public-key cryptography.&#8221;<\/p>\n<p>That lack of awareness matters more now that the post-quantum algorithms are finalized and migration deadlines are being set. A post-quantum cryptography (PQC) program can&#8217;t sequence a migration around algorithms it hasn&#8217;t found, and the ones most likely to be missed are the <a href=\"https:\/\/federalnewsnetwork.com\/it-modernization\/2026\/05\/risk-compliance-exchange-2026-nists-bill-newhouse-john-hopkins-apls-prathibha-rama-on-prepping-for-pqc-world\/\"><span style=\"text-decoration:underline\">ones buried in software nobody on the security team wrote<\/span><\/a>, noted Prathibha Rama,<em> <\/em>computer engineering and security researcher at the Johns Hopkins University Applied Physics Laboratory.<\/p>\n<h2 id=\"what-each-tool-in-the-stack-can-see\"><strong>What Each Tool in the Stack Can See<\/strong><\/h2>\n<p>None of the tools below is broken. Each was designed to answer a specific question, and each answers it well. The blind spot appears only when a team asks them to answer a question none of them was designed for: what cryptography is inside the software we run?<\/p>\n<h3><strong>Source-Code Analysis<\/strong><\/h3>\n<p>Static application security testing (SAST) and code scanners see the cryptographic API calls in code the organization writes. That makes them useful for catching a developer who reaches for MD5 in a new service. They can&#8217;t analyze what they can&#8217;t read, however, and most of the software in a typical enterprise arrives without source: commercial applications, prebuilt libraries, SDKs, drivers, and appliance firmware. Even for first-party code, a source scan describes intent, not the final build, which can link in a different library version or pull in cryptography through the build toolchain.<\/p>\n<h3><strong>Software Composition Analysis (SCA) and Dependency SBOMs<\/strong><\/h3>\n<p>Software composition analysis (SCA) tools and the software bills of materials (SBOMs) typically generate a list the packages an application declares in its manifest and lock files. They answer &#8220;which components are supposed to go into this build?&#8221; and they answer it well. Similarly, SBOMs generated from the final build is a more comprehensive list of components in the <a href=\"https:\/\/www.reversinglabs.com\/glossary\/software-bill-of-materials-sbom#during-and-after-the-build\"><span style=\"text-decoration:underline\">software as distributed<\/span><\/a>.\u00a0 Without additional analysis, they can&#8217;t report is which algorithms those components run, what key sizes they use, or whether a vendor statically linked or copied a cryptographic library into its own code, where no manifest records it, noted vice John Gallagher, vice president at Viako, <a href=\"https:\/\/www.reversinglabs.com\/blog\/esf-steps-up-guidance-with-call-for-binary-analysis-reproducible-builds\"><span style=\"text-decoration:underline\">in a report on RL Blog<\/span><\/a><em>.<\/em><\/p>\n<p style=\"padding-inline-start:40px\"><em>&#8220;Generating an SBOM based on binary code analysis can catch transitive dependencies that can lead to security and privacy issues compared to generating an SBOM through source code analysis.&#8221;<\/em><br \/><em>\u2014<\/em><a href=\"https:\/\/www.reversinglabs.com\/blog\/esf-steps-up-guidance-with-call-for-binary-analysis-reproducible-builds\"><span style=\"text-decoration:underline\">John Gallagher<\/span><\/a><\/p>\n<h3><strong>Certificate and Key Management<\/strong><\/h3>\n<p>Certificate lifecycle and key management platforms track the certificates and keys they issue or discover in keystores, directories, and endpoints. They are essential for renewals and revocation, but their view stops at the credentials they know about. Certificates and keys bundled inside application packages or hard-coded into binaries often never reach a managed store. Many quantum-relevant algorithms also never appear in a certificate at all, including the key-exchange mechanisms, symmetric ciphers, and hash functions that applications call directly.<\/p>\n<h3><strong>Network and Runtime Monitoring<\/strong><\/h3>\n<p>Network analysis tools observe the algorithms negotiated in live handshakes, and runtime tools see the code paths that execute while they are watching. Both report what happens in traffic and memory during an observation window. Neither sees cryptography that protects data at rest, signs code or firmware, runs in batch jobs outside the window, or sits on fallback paths that execute only when something fails. Encrypted handshakes also limit what passive observers can see; TLS 1.3, for example, encrypts the server&#8217;s certificate in transit.<\/p>\n<h3><strong>Vendor Questionnaires and Attestations<\/strong><\/h3>\n<p>For commercial software, many organizations fall back on asking the vendor. A questionnaire reflects what the vendor knows and chooses to disclose, and vendors often have incomplete visibility into the third-party components inside their own products. Federal guidance anticipates this: the 2023 <a href=\"https:\/\/www.nccoe.nist.gov\/sites\/default\/files\/2023-08\/quantum-readiness-fact-sheet.pdf\"><span style=\"text-decoration:underline\">quantum-readiness factsheet<\/span><\/a> from CISA, the NSA, and NIST warns that &#8220;discovery tools may not be able to identify embedded cryptography used internally within products, hindering discoverability or documentation,&#8221; and directs organizations to their vendors instead. An attestation can help, but it rests on trust rather than evidence.<\/p>\n<p>Similarly, Gartner\u2019s guidance for cybersecurity leaders is to<a href=\"https:\/\/www.gartner.com\/en\/documents\/7076398\"> <span style=\"text-decoration:underline\">select cryptographic discovery tools and processes<\/span><\/a> that support an ongoing crypto-agility program, not just a one-time inventory. That is a different job from the one vendor questionnaires are designed to do.<\/p>\n<h2 id=\"the-layer-between-the-tools\"><strong>The Layer Between the Tools<\/strong><\/h2>\n<p>Put the five views side by side and the uncovered layer comes into focus. It is the final software artifact: the compiled binaries, packages, containers, and installers that run in production, including every commercial off-the-shelf (COTS) product the organization has bought. Coverage of that layer depends on source code the organization doesn&#8217;t have, manifests vendors don&#8217;t publish, traffic that may never be observed, or disclosures that may never come.<\/p>\n<p>Independent research points to the same fragmentation. In a benchmark of cryptographic asset discovery tools presented at the <a href=\"https:\/\/link.springer.com\/chapter\/10.1007\/978-3-032-35586-7_19\"><span style=\"text-decoration:underline\">ARES 2026 conference<\/span><\/a>, researchers described &#8220;a fragmented open-source landscape, with significant gaps observed in some categories and strengths in others,&#8221; and found &#8220;deficits in detection completeness and accuracy.&#8221; Their recommendation was to orchestrate several tools rather than rely on any one.<\/p>\n<h2 id=\"what-closes-the-gap\"><strong>What Closes the Gap<\/strong><\/h2>\n<p>The missing view is filled by analyzing the software artifact itself. Binary analysis inspects the compiled package directly, so it can identify the algorithms, certificates, keys, and protocols inside whether or not source code, a manifest, or a vendor disclosure exists. The results can be recorded as a cryptography bill of materials (CBOM) in CycloneDX format, which ties each cryptographic asset to the component that contains it.<\/p>\n<p>Supply chain guidance has been moving in this direction for broader reasons. The Enduring Security Framework (ESF), a public-private working group led by the NSA and CISA, recommended in <a href=\"https:\/\/media.defense.gov\/2023\/Dec\/11\/2003355557\/-1\/-1\/0\/ESF_SECURING_THE_SOFTWARE_SUPPLY_CHAIN%20RECOMMENDED%20PRACTICES%20FOR%20MANAGING%20OPEN%20SOURCE%20SOFTWARE%20AND%20SOFTWARE%20BILL%20OF%20MATERIALS.PDF\"><span style=\"text-decoration:underline\">December 2023 guidance<\/span><\/a> that &#8220;before shipping the software package to customers, the developer or supplier should perform binary composition analysis to verify the contents of the package.&#8221; The same logic applies to cryptography. Reading source code is not the same as knowing what shipped, noted Matt Rose, former field CISO at ReversingLabs.<\/p>\n<p style=\"padding-inline-start:40px\"><em>&#8220;It is the final examination of a package for software supply chain risk, which allows for trust in that piece of software that you are either developing for your customers or that you are buying to help operate your business.&#8221;<\/em><br \/>\u2014<a href=\"https:\/\/www.linkedin.com\/in\/mattarose\/\"><span style=\"text-decoration:underline\">Matt Rose<\/span><\/a>\u00a0<\/p>\n<p>Artifact-level analysis doesn&#8217;t replace the rest of the stack. Network tools still show what production traffic negotiates, and certificate platforms still manage renewals. What artifact analysis adds is the baseline inventory the other tools assume someone already has.<\/p>\n<h2 id=\"a-quick-test-for-your-stack\"><strong>A Quick Test for Your Stack<\/strong><\/h2>\n<p>A team can find out in an afternoon whether its current tools share this blind spot. Pick three business-critical commercial applications the organization runs and try to answer these questions from tool output alone, without asking the vendor:<\/p>\n<ul class=\"list-bullet\">\n<li class=\"\" value=\"1\">Which cryptographic algorithms and key sizes does each application contain?<\/li>\n<li class=\"\" value=\"2\">Are any certificates or keys embedded in the installation packages, and which components use them?<\/li>\n<li class=\"\" value=\"3\">Does any of the software still rely on deprecated primitives such as SHA-1, MD5, or DES?<\/li>\n<li class=\"\" value=\"4\">When the vendor ships an update that claims to remove a deprecated algorithm, can the team verify that before deployment?<\/li>\n<li class=\"\" value=\"5\">Can the answers be exported in a machine-readable format for auditors, customers, or the PQC program office?<\/li>\n<\/ul>\n<p>If any answer depends on a vendor&#8217;s word or on source code the team doesn&#8217;t have, the stack has a visibility gap. The good news is that closing it doesn&#8217;t require you to already support for post-quantum algorithms, especially since new cryptography is not a simple drop-in replacement. The first job of a cryptographic inventory is to find the quantum-vulnerable cryptography already in production, such as RSA and elliptic-curve cryptography (ECC), and that work can start now. For a primer on what that inventory should contain, see, <a href=\"https:\/\/www.reversinglabs.com\/blog\/what-a-cbom-is\"><span style=\"text-decoration:underline\">What a CBOM Is, and Why an SBOM Won&#8217;t Answer the Quantum Question.<\/span><\/a><\/p>\n<\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Key takeawaysSource scanners, SBOMs, certificate managers, network monitors, and vendor questionnaires each answer a different question, and none of them inspects the cryptography inside the software you actually run.The gap is the final software artifact: compiled binaries, packages, and COTS products where no source, manifest, or vendor disclosure exists.Binary analysis fills that gap and can produce a CBOM that ties each cryptographic asset to the component containing it.You don\u2019t need PQC su<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[32775],"tags":[],"class_list":["post-26316","post","type-post","status-publish","format-standard","hentry","category-reversinglabs"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26316","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=26316"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26316\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=26316"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=26316"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=26316"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}