It should connect algorithms, certificates, public-key metadata, protocols, libraries and dependencies to their locations, owners, relationships, evidence and lifecycle—not merely produce a spreadsheet of algorithm names.
Core inventory records
- Algorithms and parameters, including purpose, mode, key size or named group when available.
- Certificates and public-key metadata, including fingerprints, issuers, validity and presented relationships.
- Protocols and negotiated cryptographic characteristics tied to an endpoint or service.
- Libraries and dependencies that introduce or implement cryptographic behavior.
- Evidence, confidence, discovery source, scanner version and coverage state for every assertion.
- Ownership, application and infrastructure relationships needed to plan change.
Identity, evidence and relationships
A certificate can be identified by its SHA-256 fingerprint and observed at several endpoints. Those observations should map to one certificate asset with separate evidence, rather than creating unrelated copies. A public key can similarly use a fingerprint of its SubjectPublicKeyInfo representation.
Relationships make the inventory actionable: a certificate protects a service, a service supports an application, an application depends on a library and a team owns the migration decision. Source-specific scanners should feed this shared model rather than produce incompatible inventories.
A living inventory
- Collect
Run approved discovery sources with bounded, versioned behavior.
- Normalize
Deduplicate assets and preserve source-specific evidence.
- Reconcile
Connect ownership and relationships without rewriting historical observations.
- Monitor
Repeat discovery, review drift and retire stale assets with evidence.
Frequently asked questions
Does a cryptographic inventory contain private keys?
It should not. Inventory systems should retain the minimum metadata needed to identify and assess an asset. Private key material, passwords, credentials and access tokens do not belong in the inventory.
Is a certificate inventory enough?
No. Certificates are important, but cryptography also exists in protocols, software libraries, signing workflows, dependencies and application code.
How does an inventory support PQC migration?
It identifies public-key assets and dependencies, connects them to owners and systems, and provides the evidence needed to prioritize replacement and verify progress.