Why Existing Security Tools Miss Cryptography Hidden in Software Binaries
Summary
Source scanners, SBOMs, certificate tools, network monitors, and vendor questionnaires may miss cryptography embedded in compiled software. The article explains how binary analysis can inventory those assets for post-quantum migration planning.
Key points
- Source scanners, dependency inventories, certificate platforms, network monitoring, and vendor questionnaires each have visibility limits.
- Compiled third-party applications and other software artifacts may contain cryptography that is absent from source, manifests, managed stores, observed traffic, or vendor disclosures.
- Binary analysis can inspect software packages directly and identify cryptographic assets, including algorithms, certificates, keys, and protocols.
- A cryptography bill of materials (CBOM) in CycloneDX format can connect cryptographic assets to the components that contain them.
- The article recommends starting inventory work by finding existing quantum-vulnerable cryptography, including RSA and elliptic-curve cryptography; PQC support is not required to begin.
- A suggested practical test is to check whether existing tools can identify cryptographic algorithms and key sizes in three business-critical commercial applications and verify changes in updates.
Article Details
- Topic
- Cryptographic discovery gaps in commercial software and the role of binary analysis in post-quantum readiness
People
John GallagherVice president at Viako; cited on the value of binary code analysis for identifying transitive dependencies.Matt RoseFormer field CISO at ReversingLabs; discussed examining final software packages for supply-chain risk.Prathibha RamaComputer engineering and security researcher at the Johns Hopkins University Applied Physics Laboratory; discussed cryptography hidden in software organizations did not write.