MODULE m3 · 8.0 HOURS

Cryptographic Asset Identification and Management

0% complete

LEARNING OBJECTIVES

Module objectives

  1. Explain the concept and necessity of Cryptographic Inventory.
  2. Learn how to systematically classify encryption algorithms, libraries, and usage in an organization.
  3. Identify metadata management elements for Crypto-agility.
  4. Evaluate the risk of identified cryptographic assets to determine Post-Quantum migration priorities.

Cryptographic Inventory

Cryptographic asset identification is the process of systematically listing all cryptographic algorithms, protocols, libraries, and the systems and data they are applied to within an organization. This is the first step in preparing for the migration to Post-Quantum Cryptography (PQC), and identifying dependencies on the cryptographic algorithms being protected is key [S1].

1. Key Management Targets

  • Algorithms and Protocols: TLS, SSH, code signing, data encryption (AES, RSA, ECC, etc.), etc.
  • Infrastructure: Certificate Authorities (CA), Key Management Systems (KMS), HSM, cloud key storage.
  • Software: Encryption library versions (OpenSSL, BoringSSL, etc.) and static/dynamic linkage status.

2. Crypto-agility

Crypto-agility refers to the ability to quickly replace encryption algorithms while minimizing code changes. For this, systems should not be hard-coded to specific algorithms but should have an abstraction layer that allows selecting algorithms through configuration files.

3. Risk Assessment Criteria

  • Data Lifecycle: Does the encrypted data need to remain secret in the future? (e.g., data at risk of being stolen now and decrypted in the future)
  • Migration Difficulty: Is hardware replacement needed, or is software update sufficient?
  • Regulation and Compliance: Alignment with NIST PQC standard application timelines.

WORKED EXAMPLES

Worked examples

  1. System scan result example: Identifying an asset as 'Using TLS 1.2(ECDHE-RSA-AES128-GCM-SHA256)'. In this case, recognize that RSA and ECDHE are exposed to quantum threats and categorize targets for ML-KEM/ML-DSA migration.
  2. Crypto-agility self-checklist: If 'Is the algorithm hard-coded?' is 'Yes', increase risk score. If 'Is it possible to select cryptographic algorithms via configuration files?' is 'No', increase migration difficulty.

LAB PROTOCOL

Cryptographic Asset Identification and Risk Assessment Lab

  1. 1

    Search source code of sample projects for keywords 'AES', 'RSA', 'ECC' to find where they are used.

  2. 2

    Record identified cryptographic implementations (including libraries) in 'Cryptographic Asset Inventory CSV'.

  3. 3

    Calculate risk scores for each asset based on 'security lifespan', 'quantum threat level', and 'data importance'.

  4. 4

    Classify migration priorities (P0~P3) based on the calculated scores.

Safety check
  • Do not scan private keys or actual service certificates of systems currently in operation.
  • Use only dummy certificates (for testing) isolated within the virtual environment for testing.
  • Do not include actual secret values or encryption key values in the analysis results (CSV, documents).

Lab deliverables

  • Cryptographic Asset Inventory CSV file (including algorithm, usage, library, library version).
  • Priority-based cryptographic asset risk assessment report (Markdown).

ASSIGNMENT

Cryptographic Agility Analysis and Migration Roadmap Establishment

Deliverables

Rubric

  • Were cryptographic assets comprehensively identified?
  • Are risk assessment criteria objective and valid?
  • Does the migration roadmap follow the logical order of Post-Quantum technology migration?
  • Are specific technical suggestions included for improving cryptographic agility?

KNOWLEDGE CHECK

Knowledge check

1What is the primary purpose of Cryptographic Inventory?
2Which of the following is the most appropriate definition of Crypto-agility?

FIELD CHECK

Completion criteria

  • Submit Cryptographic Asset Identification Inventory CSV and complete risk assessment.
  • Author a report stating the migration difficulty and risk priority of each cryptographic asset.
  • Achieve 100% correct answers in the quiz.

MODULE SOURCES

Module sources

  1. MIT OpenCourseWare | Free Online Course Materialsocw.mit.edu · university