Hidden Ciphers and Where to Find Them: Static Discovery and Assessment of Cryptographic Assets in Software

Computer Science > Cryptography and Security [Submitted on 5 Aug 2026] Hidden Ciphers and Where to Find Them: Static Discovery and Assessment of Cryptographic Assets in Software Christian Näther, Eduard Hirsch Modern software systems rely on cryptography for data protection, authentication, and trust establishment, yet organizations often lack a structured view of the cryptography deployed across source code, configuration, dependencies, and cryptographic files. This lack of visibility complicates security governance and post-quantum migration planning. This paper presents a static approach for discovering and assessing cryptographic assets in software systems. We introduce a classification of Crypto-Material, Crypto-Artifacts, and Crypto-Invocations, derive an extensible scanner-independent rule repository from it, and implement a static scanner that applies these rules to produce CBOM-oriented output. We evaluate the approach on a synthetic benchmark with known ground truth and on a real-world infrastructure of ten deployed services. The scanner achieves an F1 score of 0.75 for asset discovery and correctly annotates 91% of expected weaknesses and vulnerabilities. In the realworld setting, it processes 57 610 files in under six minutes and discovers 370 cryptographic assets, including six CVE-linked vulnerabilities and 52 post-quantum migration candidates. Real-world coverage is assessed against a manually compiled reference list rather than an exhaustive one. These results show that classification-driven static discovery can provide practical cryptographic transparency for governance and post-quantum migration planning. Comments: 22 pages, 8 figures, 5 tables, accepted at ICICS 2026 Subjects: Cryptography and Security (cs.CR); Software Engineering (cs.SE) Cite as: arXiv:2608.04857 [cs.CR]   (or arXiv:2608.04857v1 [cs.CR] for this version)   https://doi.org/10.48550/arXiv.2608.04857 Focus to learn more Submission history From: Christian Näther [view email] [v1] Wed, 5 Aug 2026 13:50:44 UTC (147 KB) Access Paper: HTML (experimental) view license Current browse context: cs.CR < prev   |   next > new | recent | 2026-08 Change to browse by: cs cs.SE References & Citations NASA ADS Google Scholar Semantic Scholar Export BibTeX Citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Demos Related Papers About arXivLabs Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)