Skip to content

How to check if my app still uses RSA or ECC

Inventory the cryptography in your code, mark what a quantum computer would break, score readiness and produce a CycloneDX 1.6 CBOM, the starting point of every migration. Uses pqblocks-scan.

The problem

You cannot migrate cryptography you have not found. RSA and ECC hide in key generation, TLS settings, JWT libraries and vendored code. Regulators and customers increasingly ask for a Cryptography Bill of Materials (CBOM), and NIST IR 8547 and CNSA 2.0 put dates on retiring these algorithms.

Install

pip install git+https://github.com/PQBlocks/cbom-scanner

Complete working code

crypto_audit.py
"""Find quantum-vulnerable cryptography in source code and grade readiness (pqblocks-scan)."""
from pqblocks_scan.cbom import CBOMGenerator
from pqblocks_scan.discovery import Discovery
from pqblocks_scan.scorer import CARSScorer

source = '''
from cryptography.hazmat.primitives.asymmetric import rsa, ec
key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
signer = ec.generate_private_key(ec.SECP256R1())
import hashlib
digest = hashlib.sha256(b"data").hexdigest()
'''

assets = Discovery().discover_source(source, "app.py").assets
for a in sorted(assets, key=lambda a: a.line_number):
    status = "QUANTUM-VULNERABLE" if a.is_quantum_vulnerable else "ok"
    print(f"app.py:{a.line_number:<3} {a.algorithm:<12} {status}")

grade = CARSScorer.evaluate(assets)
cbom = CBOMGenerator.generate(assets)
print("readiness:", grade.score, grade.letter, "| CBOM spec", cbom["specVersion"])
assert any(a.is_quantum_vulnerable for a in assets)

Output:

app.py:3   RSA-2048     QUANTUM-VULNERABLE
app.py:4   ECDSA-P256   QUANTUM-VULNERABLE
app.py:6   SHA-256      ok
readiness: 47.17 D | CBOM spec 1.6

How it works

  1. Discovery parses Python by syntax tree (other languages by pattern) and records each algorithm with its line number.
  2. Each finding is classified: RSA and ECDSA are quantum-vulnerable (Shor); SHA-256 is not.
  3. CARSScorer turns the findings into a readiness score and an A–F grade, following the CARS model.
  4. CBOMGenerator writes a CycloneDX 1.6 CBOM you can store with your SBOM or hand to auditors.

Scan a whole repository

The package also ships a command-line scanner that writes CBOM and SARIF for a directory and can gate CI on the grade. See its README and the examples/ci_gate.py script.

Things to know

  • Static scanning finds algorithms named in code. Algorithms chosen at runtime or hidden behind library defaults need a TLS probe (pqblocks-tls-interop) or data-flow analysis (pqblocks-lint).
  • Alpha status: files the scanner cannot parse are reported as scan errors, never silently skipped.

Next steps