The Magnetic Pull of Mutable Protection: Worked Examples in Cryptographic Agility
summary
Scans use GitHub CodeQL multi-repository variant analysis to build a cryptographic bill of materials for each repository, running across the top 1,000 GitHub projects and an analyzed set of ~4,500 dependencies. The pipeline emits CycloneDX CBOMs via GitHub Actions, caches CodeQL databases, and flags insecure primitives: >100 projects use MD4 (84 named later), thousands use RSA, and SHA‑1 persists. The system is automated, open sourced, and yields actionable lists of vulnerable APIs and unknown key sizes for remediation.
AI-written summary · about
chapters (12)
- 0:00Cryptographic agility project intro
- 4:36The dark arts of modern cryptography
- 8:11Quantum computing timeline
- 15:20Cryptographic agility as a necessity
- 16:25Cryptographic bill of materials
- 22:44CodeQL for crypto analysis
- 27:41Raw data to crypto BOM
- 30:50Multi-repo variant analysis
- 36:04Auto crypto BOM generation
- 37:29Open-source library risks
- 41:43Rethinking crypto standards
- 42:48Call to action
related talks
38mFortifying Your Codebase with GitHub
52mSecurity as Code: A DevSecOps Approach
49mProtect Your Code with GitHub Security Features
23mStopping vulnerabilities at the source
19mFlipping the script on application security
58mSecuring Code in the Age of AI
19mSecuring the Software Factory
44mAn intro to improving the security of your code with free analysis tools