Python Cryptographic Scanning

Overview

QCecuring’s CBOM scanner analyzes Python source code to discover all cryptographic operations — from the standard library’s hashlib and ssl modules to third-party libraries like cryptography, PyCryptodome, and pyOpenSSL. The scanner identifies algorithms, key sizes, cipher suites, and deprecated patterns, feeding everything into your Cryptographic Bill of Materials.

Key capabilities

• Detect usage of hashlib functions (MD5, SHA-1, SHA-256, SHA-512, SHA-3) and flag deprecated hashes.
• Scan cryptography library calls for key generation, signing, encryption — capture algorithm and key size.
• Identify PyCryptodome / PyCrypto usage including AES modes, RSA key sizes, and legacy ciphers.
• Analyze ssl module configurations for TLS versions, cipher suites, and certificate verification settings.
• Detect pyOpenSSL usage for certificate operations and TLS context configuration.
• Find hardcoded keys, IVs, and algorithm strings in source code.
• Scan requirements.txt, Pipfile, pyproject.toml, and setup.py for crypto library dependencies and versions.

Typical use cases

• Security teams auditing Python applications for deprecated cryptographic algorithms before PQC migration.
• DevSecOps teams integrating crypto scanning into Python CI/CD pipelines.
• Compliance programs requiring inventory of all cryptographic operations in Python codebases.
• Organizations assessing PQC readiness across their Python application portfolio.

Detected patterns

Library	What’s Scanned
hashlib	Hash algorithm selection (md5, sha1, sha256, sha3_256, etc.)
cryptography	Key generation (RSA, EC, Ed25519), signing, encryption, X.509 operations
PyCryptodome	AES modes, RSA operations, legacy ciphers (DES, 3DES, Blowfish, RC4)
ssl	TLS protocol versions, cipher suite configuration, cert verification
pyOpenSSL	SSL context setup, certificate operations, key handling
paramiko	SSH key types, algorithms, host key verification
jose / PyJWT	JWT signing algorithms (HS256, RS256, ES256, etc.)

High-level integration flow

1. QCecuring scans Python repositories via Git integration or local filesystem access.
2. AST-based analysis identifies crypto function calls, imports, and configuration patterns.
3. Dependency files are parsed to identify crypto library versions and known vulnerabilities.
4. Discovered crypto usage is normalized into CycloneDX CBOM format with algorithm details.
5. Results feed into the centralized CBOM inventory with PQC readiness scoring per finding.