Enterprise Cryptographic Discovery & Analysis Tool (ECDAT)
National Technical Research Organisation (NTRO) · Blockchain & Cybersecurity · Software
A well-specified, buildable tool on a genuinely current priority with an authoritative risk framework handed to you — do source scanning thoroughly, be honest about the crypto you cannot statically detect, and align the CBOM to a real standard.
Data: Open-source code repositories (GitHub), libraries (OpenSSL) may be used
What it actually is
Quantum computers will eventually break today's public-key cryptography, and migrating to quantum-safe algorithms first requires knowing where all your existing crypto actually is. The ask is a tool that scans code, binaries, libraries and infrastructure to inventory every cryptographic artefact, assess which are vulnerable to future quantum attack, and recommend post-quantum alternatives.
What to build
A cryptographic-discovery tool that scans source code repositories, binaries, libraries and container images to identify and catalogue all cryptographic artefacts — algorithms, key sizes, certificates, protocols and libraries — classifies each by type, key lifetime and business criticality, applies a structured quantum-risk framework such as Mosca's inequality to compare data lifetime plus migration time against the expected arrival of a cryptographically relevant quantum computer, flags the systems most exposed, recommends post-quantum or hybrid alternatives per artefact, and produces a standardised cryptographic bill of materials report with an interactive visualisation of the scan and risks.
Smallest thing that wins the room
Scan a real repository that uses RSA and ECC, and show the tool producing a cryptographic bill of materials listing each artefact with its algorithm and key size, ranking them by quantum risk using Mosca's framework, and recommending a specific post-quantum replacement for the most exposed one.
How crowded this one gets
A guess, projected from the 2025 statements — the last year where both the submission counts and the winners were published.
Quieter than 80% of the 226 · #46 of 226 by expected field
Few teams are likely to go here. The best odds on the board come from statements like this.
Why: defence, intelligence and space bodies drew small fields.
This is a guess, not a fact
Nobody has published 2026’s numbers yet. This is an analysed estimate from last year’s pattern, so please do not take it as the truth — check the live counter on the SIH portal before you decide anything. The range covers the middle half of likely outcomes, so one statement in two lands outside it. Entry closes at 500 ideas per statement, so no range goes past that — a statement that reaches the cap fills and shuts rather than drawing an unlimited crowd. The model reads only three things a team can see before choosing — software or hardware, the theme, and what kind of body posted it — and those explain about a quarter of the variation in last year’s field sizes (R² 0.25 on held-out statements). Trust the band more than the number, and the ordering more than either. It cannot see how good your idea is, which is the part that actually decides it.
The scores
The number is the shorthand. The line under it is the reason.
Acceptance potential
4/5A strong pick — post-quantum migration is a genuine current priority for exactly NTRO's constituency, the tool is buildable on open code, Mosca's framework gives your risk assessment an authoritative basis, and CBOM tooling is early enough that a solid entry stands out rather than competing with mature products.
Feasibility
4/5Static scanning for cryptographic usage in source code and libraries is achievable with pattern matching and AST analysis, open repositories and OpenSSL are named as fair game, the CBOM concept has emerging standards to follow, and Mosca's framework is a simple published formula — so the whole tool is buildable.
Innovation scope
3/5Cryptographic discovery and CBOM generation are an emerging but increasingly defined area, so your room is in scan coverage across artefact types and in the risk-classification and recommendation logic rather than in a novel concept.
Clarity
5/5The description enumerates exactly what to catalogue, names the Mosca framework, specifies the classification dimensions, the recommendation requirement, the CBOM report and the interactive GUI, making the deliverable precisely defined.
Effort
HeavyScanners across code, binaries, libraries and container images, the classification and risk engine, the recommendation logic and the CBOM report and GUI are focused pieces, with broad scan coverage the main effort.
Demo-ability
EasyScanning a real repo and producing a CBOM with quantum-risk rankings and PQC recommendations is a clean, concrete demo with a tangible artifact at the end.
In its favour
- Green flag: Open code repositories and OpenSSL are named as fair game, so you have unlimited real material to scan and demonstrate on
- Green flag: Mosca's inequality is a simple published formula, so your quantum-risk scoring rests on an established framework rather than invention
- Green flag: The CBOM concept has emerging standards like CycloneDX crypto to align to, giving your output an authoritative format
- Green flag: Post-quantum migration is a genuine live priority, so the impact case is current and NTRO cares directly
Against it
- Red flag: Statically finding all crypto usage is hard — dynamically loaded, wrapped or obfuscated crypto is missed, so honest coverage claims matter and a security judge will probe what you cannot detect
- Red flag: Binary and container scanning is significantly harder than source scanning, so teams tend to do source only while claiming full coverage
- Red flag: The PQC recommendations must reflect the finalised NIST standards, and recommending a withdrawn or unsuitable algorithm undermines credibility
- Red flag: Business-criticality classification needs context the scanner cannot infer alone, so that dimension may be shallow without user input
What you will be writing
- Source code crypto scanning (Semgrep / AST analysis)
- Binary and library inspection
- CBOM standard (CycloneDX crypto) generation
- Mosca's inequality risk framework
- PQC algorithm recommendation (NIST PQC standards)
- Interactive risk-visualisation GUI
- Post-quantum cryptography
- Cryptographic inventory
- Security risk assessment
Prior art to read before you start
cryptographic bill of materials · quantum risk assessment · crypto discovery and PQC migration
Analysed by Claude Opus. Every score above is a judgment call with its reasoning attached — kindly cross-check this against the official statement on the SIH portal before your team commits to it.