JAVA CRYPTOGRAPHY · OBSERVED AT RUNTIME

Crypto CensusKnow your cryptography. Plan what comes next.

Observe the cryptography your Java application actually uses. Trace it to your code, assess quantum exposure, and carry the evidence into your security workflow.

Start with Maven →

Explore a real CBOM

FROM EXECUTION TO EVIDENCE 01—03

Your Java applicationTests · staging · representative workloads

JVM

JCA / JSSE calls

Crypto Census agentObserve → attribute → assess

Graceful JVM shutdown

03Cryptographic evidenceCBOM

AlgorithmAES-GCM

Application call siteCardVault.seal:31

Evidence formatCycloneDX 1.6

Illustrative evidence · Your workload determines what is observed.

Understand the evidence

Learn what runtime observation reveals, where its limits are, and how a CBOM complements your software SBOM.

Read the concepts

Make it part of CI

Collect evidence from test JVMs, seal available reports after failures, and keep test, policy, and delivery outcomes separate.

Build your workflow

Connect your security tools

Preserve original evidence and choose an enterprise destination with explicit capabilities, verification, and limits.

Compare delivery options

An inventory grounded in execution

An algorithm in a dependency does not tell you whether your application uses it. Crypto Census observes JCA and JSSE calls inside the JVM and records algorithms, observable key sizes, risk verdicts, and application call sites in a CycloneDX 1.6 CBOM. Representative tests and staging workloads determine the evidence you collect.

Start with a small working example, follow the system architecture, or jump to the configuration map. If a report is missing or a delivery fails, the troubleshooting guides connect symptoms to specific checks.

Java 17+ is required at runtime. Current positioning is tests and staging; production overhead is not benchmarked. Read the compatibility matrix and safety boundaries before deployment.