ASVS 5.0 V11.1.2 (Level 2) requires a cryptographic inventory that is performed, maintained and regularly updated. It must list every key, algorithm and certificate the application uses, and document where each key can and cannot be used and which types of data it may protect.
Why it matters
You cannot rotate, upgrade or revoke what you cannot list. When a library announces a break, or a certificate expires at 2 a.m., the inventory is the difference between a ten minute fix and a day of grepping.
It also supports other requirements. Crypto agility (V11.2.2), migration planning (V11.1.4) and key policy (V11.1.1) all assume this list exists.
How to implement it
Keep the inventory in version control next to the code, so changes go through review. One YAML file per service works well:
keys:
- id: orders-data-key
type: AES-256-GCM
store: cloud-kms
owner: payments-team
allowed_use: encrypt order PII at rest
forbidden_use: signing, tokens, other services
data_classes: [customer-address, phone]
rotation_days: 90
certificates:
- id: api-public-tls
algorithm: ECDSA P-256
expires: 2027-03-01
owner: platform-team
algorithms:
- use: password hashing
algorithm: argon2id
library: argon2-cffi
Fill it from three sources: the KMS or vault listing, a certificate scan of your domains, and a code search for crypto calls. Review it every quarter and whenever a service is added.
How to test it
Pick five crypto calls from the code at random and look each one up in the inventory. Then pick five inventory rows and confirm the key actually exists in the named store. Mismatches in either direction are findings. Also check that every certificate has an expiry date and an owner, and that no key lists a use that conflicts with another row.
Common mistakes
- An inventory built once for an audit and never touched again
- Listing algorithms but not the keys or certificates
- No forbidden use column, so one key quietly serves five purposes
- Ignoring third party libraries that bring their own crypto
Quick check
What three item types must the inventory cover?
Keys, algorithms and certificates.
Why record forbidden uses?
It stops key reuse across purposes and data types, which weakens isolation if one use is compromised.
Sources
- OWASP ASVS
- NIST SP 800-57 Part 1
