Crypto Census
Documentation website · What the badges measure
See which cryptography your Java application actually uses.
Crypto Census observes JCA/JSSE calls at runtime and writes a CycloneDX 1.6 Cryptography Bill of Materials (CBOM): algorithms, key sizes when observable, risk verdicts, and application call sites. Use it in tests and staging to find broken cryptography and plan post-quantum migration. No server or paid tier is required.
Quick start
Prerelease: 0.1.0 is not published to Maven Central yet. First build and install from source, using JDK 21+ for the full quality gates. For external prerelease testing, follow the separate public snapshot procedure once a snapshot is available. The agent itself requires Java 17+. Add this plugin under <build><plugins> in the Maven application whose tests you want to observe:
<plugin>
<groupId>com.developmentsprint</groupId>
<artifactId>census-maven-plugin</artifactId>
<version>0.1.0</version>
<executions>
<execution>
<goals>
<goal>prepare-agent</goal>
<goal>check</goal>
</goals>
</execution>
</executions>
</plugin>
Run your application tests with Maven:
mvn verify
Census attaches to forked Surefire/Failsafe JVMs, prints findings, and writes target/cryptocensus/cbom.json. For example, a test that initializes AES-GCM with a 256-bit key produces a finding like:
[quantum-safe ] cipher AES-256-GCM (encrypt) AES-GCM with a 256-bit key (CNSA 2.0)
at com.acme.CardVault.seal:31 x1
By default, broken algorithms, unknown verdicts, missing evidence, and incomplete collection fail the build. Set a stricter threshold to also reject classical public-key cryptography:
mvn verify -Dcensus.failOn=quantum-vulnerable
Tests must fork a JVM. If you already configure argLine, JaCoCo, or Failsafe, use the Maven recipes; command-line -DargLine can prevent attachment. Review exceptions explicitly using the Maven reference.
For a standalone JVM, acquire the agent and run:
java -javaagent:census-agent.jar=output=cbom.json,app=payments-api -jar payments-api.jar
The agent writes at graceful JVM shutdown. Exercise representative workloads before stopping it.
Business context and migration planning
Opt in with mvn verify -Dcensus.enrichment=true -Dcensus.assessment=true to produce a local
JSON/HTML advisory report. Add natural Java flow/protection annotations, or enter context in the
offline page and reassess saved evidence without rerunning tests. Priority, declared readiness
and missing coverage remain separate. Start with the observe/enrich/reassess workflow.
Compatibility
Java 17+ is required. CI gates cover Temurin and Semeru/OpenJ9, Windows and Linux, embedded Tomcat, Open Liberty, WildFly, and OpenTelemetry coexistence. Exact versions and exclusions are in Compatibility; the conformance matrix defines the tests and deprecation ratchet. An unlisted runtime is unverified.
Understand the evidence
Census observes executed JCA/JSSE entry points; it complements source scanners. Unexecuted paths and APIs that bypass JCA are invisible. The policy distinguishes known weakness from missing information; unknown fails by default, and quantum-safe does not imply CNSA 2.0 compliance. See observation and risk policy.
The agent observes without changing application cryptographic operations, bounds collection and output, and records collection health. It runs inside the application: hostile code can forge or suppress evidence. Exploratory enrichment measurements show substantial synthetic overhead and a full-capacity publication limit; they do not establish production suitability. Current positioning remains tests and staging. Read the complete safety guarantees and limitations before deployment.
Guides
Roadmap
Production overhead benchmarks and sampling; periodic/on-demand flushing; additional PSS/OAEP/GCM/PBE parameters and named curves; additional provider correlation and request-to-connection adapters; explicit async context propagation; a Gradle plugin; keystore/truststore inventory; and additional FIPS, APM, and macOS conformance rows. Artifact SBOMs, provenance and reproducible-build configuration remain release-assurance work.
License
Copyright 2026 Development Sprint, LLC. Apache License 2.0.
Explicit artifact and deployment mappings, including named-loader selectors and local application-server URLs, are described in source catalogs.
For delivery to a company HTTPS receiver, see CBOM delivery. Delivery profiles also support guarded Dependency-Track delivery and experimental Sonatype SBOM Manager, JFrog Artifactory, and Anchore Enterprise adapters. Each guide distinguishes stored evidence from imported inventory and documents verification limits.
