Agreeing with the laboratory to the last digit

A cryptographic module that is submitted for validation must show that its noise source carries the entropy that its design claims, and the laboratory estimates it with the methods of NIST SP 800-90B. The vendor had its own implementation of the estimators, and every difference between it and the laboratory’s was a week of correspondence about whose was right.

In parallel the company had to plan its move to post-quantum cryptography, which began with a question that no one could answer: where, in a product line of fourteen years, is public-key cryptography used, and by what.

GraphAtlas runs the estimators on the kernel with every operation defined, so that the output is the same on any machine and agrees with the laboratory’s to the last digit. The first run on a submission reproduced the laboratory’s figures from the previous evaluation to the last digit, and a difference that had been a week of correspondence became a comparison of two receipts, which takes a minute.

The post-quantum inventory reads the build artefacts of the product lines and lists each use of an algorithm that a quantum computer would break, with the library it comes from and the product that ships it.

The entropy assessment passed the first time at the laboratory, and the 1,240 assets of the inventory are the schedule of the migration, ordered by how long each product stays in the field.