Quantum Readiness Starts With Knowing Your Crypto

Quantum computing sounds like science fiction, but its implications for cryptography are concrete enough that security teams at GitHub, Santander, and Microsoft have started working on the practical problems it introduces. Their first question: how do you understand cryptographic usage across hundreds of thousands—or millions—of lines of code, whether on-premises or in the cloud?

Classical computers solve problems sequentially; quantum computers tackle multiple steps at once. That parallelism threatens to break the mathematical foundations that protect most digital communications today. Post-quantum cryptography (also called quantum-resistant cryptography) aims to build systems that resist both quantum and classical attacks while still interoperating with existing networks. Before organizations can migrate, though, they need to know precisely what cryptographic primitives they depend on, where those primitives appear, and how data reaches them.

What Is a Cryptography Bill of Materials?

A Cryptography Bill of Materials (CBOM) is a detailed record of every cryptographic software component inside a system. Generating one is harder than it sounds. The challenges include:

  • API variability: different libraries expose similar functionality through different interfaces.
  • Data flow complexity: you must trace sources of data interprocedurally to sinks like an initialization vector, a key size, or an algorithm selection.
  • API modeling scope: the model must cover enough libraries to be useful.
  • Abstraction unification: different crypto concepts need a common representation.

The data-flow problem is particularly tricky on large codebases, which is where static analysis tools like CodeQL come in.

Building a CBOM With CodeQL

CodeQL treats source code as data you can query. The cross-organizational team used its custom query capabilities to build informative reports on cryptographic usage. Their approach involved defining an open-source crypto abstraction model using CodeQL's abstract classes to represent cryptographic concepts, then extending those abstractions to cover specific cryptographic APIs. Over time, as more APIs were modeled, the CBOM results improved. All of this work is open source, so other organizations can reuse the queries directly.

CodeQL Modeling Architecture diagram

From Single Repositories to Thousands

A top-level application's CBOM is incomplete if it ignores the open-source dependencies that make up most enterprise software. Analyzing those dependencies across an entire organization requires scaling beyond single repositories.

Multi-repository variant analysis (MRVA) does exactly that: it runs one CodeQL query against up to a thousand repositories at once. That makes it practical to hunt for cryptographic issues across hundreds of thousands of codebases.

Diagram of a workflow on how you can apply multi repository variant analysis to generate a CBOMs

The workflow above shows how these pieces fit together: write queries, model crypto APIs, run variant analysis across your fleet, and compile the results into a CBOM that covers both first-party code and third-party dependencies.

Driving Action From the CBOM

Once the CBOM is generated, it must lead to remediation. This is still an emerging area, and generative AI tools can help. GitHub Copilot Chat, for instance, can explain identified issues and suggest updated algorithms, guiding developers toward fixes rather than just flagging problems.

A Roadmap to Cryptographic Agility

Post-quantum cryptography demands a fundamental rethink of how cryptography is used across the software supply chain. The goal is cryptographic agility: knowing what you have, where it lives, and how it is used. The path to that state involves:

  1. Understanding the risks to current cryptographic usage.
  2. Locating and assessing cryptographic components in the supply chain.
  3. Generating a comprehensive CBOM.
  4. Scaling the analysis across the whole organization.

Once those steps are complete, you can begin to make meaningful changes—before quantum machines force the issue.

Getting Started at Your Organization

A ready-made GitHub Action produces a cryptographic report covering first-party code and third-party dependencies for a repository. Setup instructions are available in the project's documentation. The workflow also offers options to control third-party dependency analysis, source code autobuilding for CodeQL, and thresholds for including source bytes.

If a workflow run cannot analyze certain open-source dependencies, those are reported for out-of-band analysis, and the results are cached publicly for subsequent runs. This means your team can immediately begin assessing its cryptographic exposure using the same techniques demonstrated at Black Hat Europe 2023, with additional guidance available from Microsoft's quantum-safe security resources.