What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A useful post-quantum cryptography (PQC) inventory records each cryptographic use separately, especially key establishment and digital signatures. The distinction matters because they protect different things, map to different PQC standards, and require separate discovery, risk analysis, testing, and migration tracking. Start with one record per use or dependency—not a single label such as “system uses encryption.”
What a cryptographic inventory records
NIST describes a cryptographic inventory as “a descriptive record of the cryptography used across an organization’s systems, applications, services, devices, and data flows.” In practice, it is a maintained map of where cryptography is used, what function it serves, what depends on it, and who is responsible for changing it.
As an Amazon Associate I earn from qualifying purchases.
Record metadata, not secrets. An inventory may contain key type, owner, associated algorithm, application, expiration, and lifecycle status; it should not contain secret key material. Capture protocols and services such as TLS, SSH, VPNs, code signing, email encryption, and certificate-based authentication, along with the systems and data that depend on them. (NIST NCCoE, Migration to Post-Quantum Cryptography FAQ.)
Keep key establishment and signatures in separate tracks
Key establishment and signatures solve different problems. Key establishment lets parties create a shared secret, often over a public channel; symmetric cryptography can then use the resulting shared key to protect communications. Digital signatures authenticate a signer and help detect unauthorized modification. A single connection or application can use both functions, so recording only the system name or certificate algorithm will miss part of its cryptographic exposure.
#1 Best Overall
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
| Inventory track | What to record | What the function does | PQC standards in the initial NIST set |
|---|---|---|---|
| Key establishment / key exchange | Protocol and negotiated mechanism, algorithm and parameters, endpoints, purpose, owners, data flow, dependent symmetric protection, and relevant key lifecycle metadata | Establishes a shared secret between parties | ML-KEM, specified in FIPS 203 |
| Digital signature | Signature algorithm, signing role, signer or issuer, certificate chain where applicable, validity and expiration, relying parties, and signing and verification locations | Authenticates the signatory and detects unauthorized modification | ML-DSA in FIPS 204; SLH-DSA in FIPS 205 |
A certificate’s signature algorithm is not the same thing as a connection’s key-establishment mechanism. For example, a certificate chain may use one signature algorithm while a TLS connection negotiates a separate mechanism for establishing its shared secret. Inventory the certificate issuer signature and the protocol’s negotiated key establishment as distinct records or linked records. NIST’s descriptions of key-establishment and signature schemes support this operational separation. (NIST NCCoE FAQ; NIST, FIPS 204.)
Use a record model that supports migration decisions
Use one record per cryptographic use or dependency. Link related records to the same asset, service, data flow, or certificate chain, rather than compressing multiple functions into a free-text “encryption” field. A practical record can include these fields:
Rank #2
- Manufacturer Information: Manufactured by Hirsch Secure, Inc. - formerly Identiv
- Phishing-Resistant Security: FIDO Alliance-certified SecureKey stores site-specific cryptographic credentials on-device to help defend against phishing, password theft and replay attacks
- Passwordless and Multi-Factor Authentication: Supports FIDO2, U2F and WebAuthn for passwordless sign-in, 2FA and MFA
- USB-A and NFC Connectivity: Works with compatible laptops, desktops and mobile devices across Windows, macOS, Linux, ChromeOS, Android and iOS
- Multi-Protocol Support: Supports HOTP and PIV, with SecureKey Manager for FIDO2 PIN and device management
- Asset and accountability: system, application, service or device; environment; business owner; technical owner.
- Context: data flow, endpoints, protocol, purpose, protected data sensitivity, and how long confidentiality is required.
- Cryptographic function: key establishment, digital signature, encryption, hashing, authentication, or another function. Keep key establishment and signatures distinct even when they occur in the same session.
- Implementation: algorithm, library or provider, parameters or security level when known, and current versus target status.
- Key-establishment details: key type, negotiated protocol mechanism, participating endpoints, key lifecycle metadata, and dependent symmetric protection.
- Signature details: signature algorithm and role—such as certificate issuer, code signer, document or message signer—plus certificate chain, validity and expiration, relying parties, and signing and verification locations.
- Evidence and change tracking: discovery evidence, confidence, date observed, dependency links, operational constraints, migration owner, planned action, test or interoperability result, and status.
For example, a single service might have linked records for its negotiated TLS key establishment and its server certificate’s issuer signature. If the service also signs software releases, that signing use belongs in another signature record with its own signers, verifiers, and dependencies. These are illustrative record relationships, not claims about a particular deployment.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Map the inventory to NIST’s PQC standards and transition guidance
NIST approved three initial PQC Federal Information Processing Standards on August 13, 2024. Assign them to the matching function track rather than treating “PQC” as one interchangeable replacement:
Rank #3
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
| Standard | Algorithm | Inventory function |
|---|---|---|
| FIPS 203 | ML-KEM | Key establishment |
| FIPS 204 | ML-DSA | Digital signatures |
| FIPS 205 | SLH-DSA | Digital signatures |
NIST’s PQC standardization process began in 2016, according to the NCCoE project page. NIST IR 8547, an initial public draft published November 12, 2024, describes an expected transition approach; its public comment period closed January 10, 2025. NIST’s project overview summarizes the draft schedule as deprecating and ultimately removing quantum-vulnerable algorithms from NIST standards by 2035, with high-risk systems transitioning earlier. Treat that as the schedule described by draft-transition guidance, not a universal organizational deadline. Check current revisions, applicable sector or jurisdiction rules, and relevant contractual requirements before assigning a firm date.
Prioritize records by exposure and migration difficulty
NIST highlights long-lived sensitive data as a concern in the transition, and notes that organizations cannot effectively prioritize or migrate cryptography they have not identified. Use inventory evidence to rank work by the consequences of leaving a use in place and the effort required to change it.
Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-A & NFC): The Thetis PRO-A features integrated USB Type A and NFC for a near-instant account unlock. Simply unfold the key and hold it to your smartphone’s NFC antenna to authenticate on the go.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
- Confidentiality horizon: prioritize sensitive data that must remain confidential for a long time, particularly where quantum-vulnerable public-key key establishment protects its transfer or storage.
- Criticality and exposure: consider the importance and reachability of the affected system, as well as the business impact of disruption.
- Dependency breadth: identify shared libraries, services, protocols, certificate chains, and relying systems whose migration could affect many assets.
- Lead time and constraints: surface hardware, software, service-provider, interoperability, and operational dependencies that could lengthen migration.
- Function-specific risk: assess key establishment for confidentiality exposure and signatures for authentication and integrity dependencies. Do not infer one track’s status from the other.
NIST NCCoE’s migration project includes work on cryptographic visibility and risk management, as well as interoperability and benchmarking. Those concerns are useful when deciding what evidence the inventory must preserve and what testing a migration plan will need.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsUse a workbook as a starting point, not a complete discovery program
NIST’s FAQ says the PQC Coalition provides a PQC Inventory Workbook that can serve as a starting point for centralized tracking at the system or asset level. A workbook can help establish common fields, ownership, and migration status, but the cited NIST material does not claim it performs automated discovery or provides complete governance on its own. The inventory still needs evidence from the organization’s hardware, software, services, and data flows, plus a process for maintaining records.
Best Value
- Embedded Fingerprint Sensor - Advanced embedded fingerprint sensor which facilitates a world-class one-of-a-kind password-less experience. A powerful security chip with state-of-the-art cryptographic algorithms ensures protection of online accounts and passwords.
- Password-less Future - Created with FIDO2 certification, experience a password-less future in an interoperable authentication process and make daily log-in experiences easy, instant, and protective for an advanced and revolutionary style of password-less security. **Note: FIDO2 does not support Mac log-in.
- U2F Backwards Compatibility - Thetis FIDO2 Fingerprint Key is backwards compatible with any and all websites that follow U2F protocols and work side-by-side with the newest Chrome browser and other popular operating systems such as: Windows, MacOS, Linux, and more. Note: Only Enterprise Users using Azure Active Directory can access Windows Hello log-in via Thetis FIDO2 Fingerprint Security Key.
- Multi-layered Authentication - Created with world-renowned HOTP (One Time Password) technology which creates a password-less solution to standard tokens. The leading multi-factored authentication process is with Thetis security key.
- Take It Anywhere - Designed to be small and compact to fit and be taken anywhere: car keys, pocket, purse, etc.
If evaluating discovery or migration tools, compare capabilities rather than assuming a product covers the full problem:
- Coverage across hardware, software, and services.
- Ability to distinguish key establishment from certificate and other signature uses.
- Quality and exportability of discovery evidence.
- Dependency mapping and links to asset or configuration management.
- Ownership, risk, and migration-status workflows.
- Support for migration tracking, interoperability testing, and benchmarking.
Turn the inventory into a migration workflow
- Define the unit of inventory. Track each cryptographic use or dependency as its own record, linked to an asset, service, protocol, or data flow.
- Discover and document evidence. Identify algorithms, protocols, implementations, certificate chains, endpoints, owners, protected data, and dependencies. Record when and how each fact was observed and how confident the team is in it.
- Classify by function. Mark key establishment, signature, and other cryptographic functions independently. For protocols where negotiation is observable, record the negotiated mechanism rather than inferring it from a certificate.
- Map standards and status. Associate each use with its function track and relevant current or target standard. Keep unknown parameters or incomplete evidence visibly marked for follow-up instead of guessing.
- Prioritize and assign ownership. Rank records using data sensitivity and retention horizon, system criticality and exposure, dependency breadth, and migration lead time. Assign a migration owner and planned action.
- Test the change across dependencies. Record test and interoperability outcomes for the affected endpoints, relying parties, certificate chains, and dependent systems as relevant to that use.
- Maintain the record. Update status and evidence as implementations, certificates, services, or dependencies change; use the observed date to distinguish current facts from stale inventory.
NIST’s materials do not establish a universal inventory coverage target, migration cost, or time-to-migrate figure. Set coverage and scheduling measures for the organization’s own scope and risk, and revisit them as standards, transition guidance, and applicable rules evolve.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
