Detecting Cryptographically Relevant Software Packages with Collaborative LLMs
This research provides an efficient first-pass filter for identifying cryptographic software packages, which is a critical step for organizations transitioning to post-quantum cryptography and improving crypto-agility. This is an incremental improvement for IT security and cryptography practitioners.
This paper addresses the challenge of identifying cryptographically relevant software packages within IT systems, which is crucial for crypto-agility and post-quantum cryptography. The authors propose a collaborative framework using multiple LLMs to assess software relevance and aggregate their outputs via majority voting. Evaluated on over 65,000 Fedora Linux packages, the method suggests that LLM ensembles can efficiently filter cryptographic software, reducing manual workload.
IT systems are facing an increasing number of security threats, including advanced persistent attacks and future quantum-computing vulnerabilities. The move towards crypto-agility and post-quantum cryptography (PQC) requires a reliable inventory of cryptographic assets across heterogeneous IT environments. Due to the sheer amount of packets, it is infeasible to manually detect cryptographically relevant software. Further, static code analysis pipelines often fail to address the diversity of modern ecosystems. Our research explores the use of large language models (LLMs) as heuristic tools for cryptographic asset discovery. We propose a collaborative framework that employs multiple LLMs to assess software relevance and aggregates their outputs through majority voting. To preserve data privacy, the approach operates on-premises without reliance on external servers. Using over 65,000 Fedora Linux packages, we evaluate the reliability of this method through statistical analysis, inter-model agreement, and manual validation. Preliminary results suggest that~LLM ensembles can serve as an efficient first-pass filter for identifying cryptographic software, resulting in reduced manual workload and assisting PQC transition. The study also compares on-premises and online LLM configurations, highlighting key advantages, limitations, and future directions for automated cryptographic asset discovery.