Hybrid key exchange in Apache httpd
Configure Apache httpd to prefer a hybrid post-quantum key exchange group, with the settings, notes and checked versions for this server.
Read perspectivePerspectives
A clearer perspective on cryptography
Start with better questions. Build on evidence.
Server configuration
Hybrid key exchange in Envoy
Configure Envoy to prefer a hybrid post-quantum key exchange group, with the settings, notes and checked versions for this server.
Read perspectiveHybrid key exchange in Go crypto/tls
Configure Go crypto/tls to prefer a hybrid post-quantum key exchange group, with the settings, notes and checked versions for this server.
Read perspectiveHybrid key exchange in HAProxy
Configure HAProxy to prefer a hybrid post-quantum key exchange group, with the settings, notes and checked versions for this server.
Read perspectiveHybrid key exchange in IIS (Windows Schannel)
Configure IIS (Windows Schannel) to prefer a hybrid post-quantum key exchange group, with the settings, notes and checked versions for this server.
Read perspectiveHybrid key exchange in Java JSSE
Configure Java JSSE to prefer a hybrid post-quantum key exchange group, with the settings, notes and checked versions for this server.
Read perspectiveHybrid key exchange in nginx
Configure nginx to prefer a hybrid post-quantum key exchange group, with the settings, notes and checked versions for this server.
Read perspectiveHybrid key exchange in OpenSSL
Configure OpenSSL to prefer a hybrid post-quantum key exchange group, with the settings, notes and checked versions for this server.
Read perspectiveHybrid key exchange in OpenSSH sshd
Configure OpenSSH sshd to prefer a hybrid post-quantum key exchange group, with the settings, notes and checked versions for this server.
Read perspectiveTerminology
CADI versus certificate lifecycle management
Certificate lifecycle management automates issuing, renewing and revoking certificates. Cryptographic asset discovery and inventory covers keys, algorithms, libraries, signatures and suppliers as well. Why post-quantum migration needs the second, and how the two fit together.
Read perspectiveCBOM versus SBOM, and what a CBOM profile adds
A software bill of materials lists components. A cryptographic bill of materials lists the algorithms, keys, certificates and protocols a system depends on. Learn how the two relate, what CycloneDX supports, and why the PKI Consortium is defining CBOM profiles.
Read perspectiveWhat is CADI? Cryptographic asset discovery and inventory explained
CADI stands for cryptographic asset discovery and inventory. Learn what it covers, how it relates to CBOM, crypto-agility and cryptographic posture management, and what to look for in a tool.
Read perspectiveWhat is cryptographic discovery?
Cryptographic discovery identifies cryptographic assets and their context. Learn how it supports inventories, investigations, and migration planning.
Read perspectivePost-quantum readiness
Using a CBOM to plan post-quantum migration
The PKI Consortium's PQC migration profile turns "can this interface become quantum-safe?" into fields a supplier can declare and an operator can plan with. What the profile asks for, and how an observed inventory fits beside it.
Read perspectiveSix questions to ask suppliers about post-quantum readiness
Six practical questions to connect supplier PQC roadmaps with the products, versions and configurations you use, and identify the evidence needed for migration planning.
Read perspectiveEnvironments
Cryptography in IoT and OT estates, and what an inventory has to capture
Devices run for fifteen years, ship with fixed flash and RAM, and are updated by parties that are neither vendor nor operator. What the PKI Consortium's IoT CBOM work and TNO's survey say, and how to inventory such estates honestly.
Read perspectivePractical scope
How to inventory cryptography in container images
Container images carry certificates, keys, trust stores and cryptographic libraries that a network scan never sees. How image-layer discovery works, what it finds, what it cannot prove, and when a registry is a useful first scope.
Read perspectiveWhy an estate-wide cryptographic inventory is the wrong first step
Complete inventories take years, stay incomplete and rarely lead to action. Start with a golden image, a container registry or one network segment, and let ownership follow the evidence.
Read perspectiveFive questions for your first cryptographic assessment
Define the scope, evidence, ownership, and next steps for a useful first cryptographic discovery assessment.
Read perspectiveResearch
What the TNO market survey says about CADI tooling
TNO surveyed cryptographic asset discovery and inventory (CADI) tools for the Dutch government in 2025. A summary of its findings on maturity, cost, European origin, integration and OT, and what they mean for your first inventory.
Read perspective