CryptoScan: A Source-Code-Independent Framework for Legacy Cryptographic Discovery

Abstract Quantum computers with sufficient fault-tolerant computational capability could undermine widely deployed public-key cryptographic systems, particularly those based on RSA and elliptic-curve cryptography. The possibility of harvest-now, decrypt-later attacks further increases the urgency of preparing sensitive information for the post-quantum era. Although standardized post-quantum cryptographic algorithms are now available, organizational migration requires a prerequisite that remains difficult to achieve: identifying where and how cryptography is used across complex information systems. This paper defines the legacy cryptographic discovery problem and proposes CryptoScan, a layered, source-code-independent framework for identifying cryptographic usage in heterogeneous and legacy computing environments. The framework is designed to combine evidence from certificates and keystores, cryptographic configuration files, job scripts, binary and library signatures, passive network observations, and structured human knowledge. Its proposed workflow includes evidence collection, normalization, cross-layer reconciliation, confidence assessment, risk assessment, and cryptographic inventory reporting. A preliminary Python prototype implements the initial discovery capabilities for certificate and key-file analysis and rule-based configuration scanning. Initial tests using controlled laboratory files demonstrate the feasibility of detecting selected cryptographic artifacts and configuration indicators without requiring application source code. The paper also introduces an exploratory risk-ranking model based on algorithm vulnerability, protected-data lifetime, and exposure, while treating evidence confidence and migration complexity as separate assessment dimensions. The proposed framework is intended to support the development of more comprehensive cryptographic inventories and cryptographic bill-of-materials-oriented reporting. The paper identifies the technical limitations of the preliminary implementation and outlines a proposed reproducible evaluation strategy for assessing detection accuracy, evidence coverage, false positives, and operational effort. The framework provides a foundation for further research into cryptographic discovery and migration readiness in legacy environments. Keywords: Cryptographic inventory; post-quantum cryptography; cryptographic discovery; cryptographic bill of materials (CBOM); source-code-independent analysis; legacy systems; crypto-agility; quantum readiness; cryptographic migration planning.