A cryptography inventory has to name the module, not just the line

Most of the cryptography your program runs was written by somebody else. A scan that stops at first-party code will faithfully report the SHA-256 on line 137 of a file you wrote and miss the MD5 inside a transitive module you have never opened, and the second finding is usually the one that decides how long a post-quantum migration actually takes.... Weiterlesen