Coverage Declaration

Why a cryptographic inventory must name what it could not reach.

A cryptographic inventory is a claim about an environment. Read closely, most inventories make a narrower claim than their readers take them to make. The document reports what a discovery effort found. The reader treats it as a description of what is there.

Those are not the same claim, and the distance between them is where cryptographic risk decisions quietly go wrong.

The precondition nobody states

Michael Osborne has argued that quantum safety cannot be a property of an algorithm. An algorithm specification has no side channel, no random number generator, no key store, and no protocol context. The properties that determine whether a deployed system resists a quantum adversary belong to implementations, so the claim composes across algorithms, protocols, products, and services — and a single classical dependency anywhere in that chain defeats it.

The argument is correct, and it carries a precondition it does not state. Composing a property across four layers assumes the chain has been enumerated end to end. Where coverage is unknown, two very different statements collapse into one sentence:

The first is a report about a search. The second is a claim about an environment. Only the second supports a migration decision, and nothing in a conventional inventory tells the reader which one they are holding.

Discovery theater

Call the failure mode discovery theater: output that is authoritative in form and silent about its own coverage. Discovery theater is not fraud, and it is rarely deliberate. It is what you get when the artifact has no place to record a limitation, so the limitation goes unrecorded.

Every discovery method has a boundary. Network observation sees what traverses the observed path. Endpoint methods reach hosts that accept an agent. Code analysis reaches repositories the analyst was given. Device interrogation reaches interfaces that answer. These are not defects — they are the shape of the instruments. The defect is delivering results as though the instrument had no shape.

The consequence is asymmetric in an unhelpful direction. An inventory that overreports is corrected by the next engineer who looks. An inventory that underreports is indistinguishable from a clean environment, and it is filed, reported upward, and used to scope a multi-year migration.

What a coverage declaration contains

The remedy is not a better search. Every search has limits. The remedy is to make the limits part of the deliverable — a residual stated alongside the findings, naming what the effort could not observe. At minimum:

• Scope boundary. What was in scope and what was excluded, including exclusions the client requested.
• Unreached assets. Systems, network segments, and asset classes that no method in the engagement could observe, identified specifically rather than gestured at.
• Method boundaries. What each method used can and cannot see, so a reader can judge whether an absence is meaningful.
• Obstructed observation. Points where an intermediary, a re-encryption boundary, or an opaque device prevented the method from seeing through — a known limit rather than an unknown one.
• Currency. When the observation was made, since an inventory describes a moment.

None of this requires a new instrument. It requires that the artifact have somewhere to put a limitation.

Where it belongs

If a Cryptographic Bill of Materials is to serve as the source of truth for cryptographic usage, then the schema needs a place to state what the discovery pass could not reach. Otherwise the source of truth is silent about its own completeness, and every downstream consumer — a risk register, a migration plan, a supervisory report — inherits that silence without being told it is there.

This is a specification question rather than a philosophical one, and it is answerable. A coverage declaration is structured, machine-readable, and comparable across tools. Its absence is a gap in the format, not a limit of the field.

Software solved this in 2021

The NTIA minimum elements for a software bill of materials include an element called Known Unknowns. Where the full dependency graph is not enumerated, the author must explicitly say so — and the default reading of the data is that it is incomplete unless the author affirmatively states otherwise. CISA's 2025 revision strengthened it: known unknowns must now be categorized rather than merely flagged, and the element formerly called Depth was renamed Coverage.

So the principle is settled federal practice for software. It has simply not been carried across to cryptography yet. Executive Order 14412 directs CISA, in coordination with NIST, to publish minimum elements for a cryptographic bill of materials within 270 days of June 22, 2026 — guidance due in March 2027.

Which reframes the question. It is not whether coverage belongs in a cryptographic inventory. It is whether CBOM will inherit an element that SBOM has carried for five years.

The test

The practical version fits in four words. When an inventory is presented as complete, ask:

A team that has thought about coverage will answer immediately, because the residual is already written down. A team that has not will treat the question as an accusation. The distinction is diagnostic, and it takes one sentence to apply.

It is diagnostic because a residual cannot be improvised. Writing unknown in a field satisfies a schema and tells the reader nothing. Producing a real one — specific, itemized, defensible, and honest about its own confidence — requires understanding a methodology well enough to know precisely where it stops. That is a harder form of knowledge than knowing how to run it.

Which is the part that will not be solved by a mandate. Adding an element to a specification is straightforward, and it is coming. Filling that element honestly is the entire body of work, and most organizations delivering inventories today could not do it if asked tomorrow.

None of this is an argument against discovery tools, which are indispensable and improving quickly. It is an argument about the artifact they produce. An inventory that cannot state its own limits is not a stronger claim than one that can. It is the same claim with the uncertainty removed from the page and left in the reader.