Skip to content

Crypto Functions

Use Crypto Functions to explore the source calls that make up your cryptographic inventory. Each entry identifies a detected API call, its source location, available settings, and assessment. Use these details to investigate an asset or prepare a change. A detected call is an inventory record, not necessarily a security weakness. The report file is crypto-functions.json.

Use it to review

  • source file, line, rule, and code evidence;
  • operation and identified library;
  • captured, resolved, unresolved, defaulted, or missing parameter values;
  • evidence type, confidence, and locations showing how a value reaches the call;
  • parameter policy findings and remediation;
  • the five assessment dimensions, their reasoning, and follow-up needs;
  • algorithm metadata and PQC alternatives when available;
  • source-level FIPS assessment and missing runtime/provider context;
  • the call's role within a related operation;
  • assessment source, group ID, and whether group assessment was applied.

Parameter summary

The report summary separates detected, resolved, unresolved, and missing evidence and counts functions with unresolved parameters. The library name identifies the call and is not counted as a security setting.

For a parameter detail:

  • trust value as concrete only when resolution is RESOLVED;
  • use evidenceKind to distinguish resolved source evidence, runtime defaults, external boundaries, and unresolved values;
  • use flowPath to review source/use locations when available;
  • review policyFindings only as assessments of resolved values.

Supporting parameter evidence and coding-pattern signals can be attached to the relevant call. They do not each represent another cryptographic function in the inventory.

Some rows include final conclusions from an operation group. Use these fields together:

Field Meaning
groupId The operation group that contributed final context, or null.
assessmentSource Whether the assessment comes from the call alone, includes related context, or uses the group's completed assessment.
groupAssessmentApplied true when completed group assessment was applied to the function row.

When these fields are present, open the matching group before deciding remediation. The group can explain retained parameters, conflicts, source sequence, and earlier configuration that are not obvious from a single API call.

Typical review

Expand a file section to find its calls. Open a row, confirm the source is the intended library/API, and inspect security-critical parameters. Read Assessment, Reasoning, and Remediation for the relevant dimensions, then evaluate the call in its Operation Group. In the standalone viewer, file sections can be collapsed independently to focus the inventory.

Use Interpret Results for the evidence-review sequence and Assessment Dimensions for result meanings. Rescan after remediation and compare the new report rather than editing generated JSON.