CRACY Cryptographic Assessment Tool

Details

Name of the digital solution

CRACY Cryptographic Assessment Tool

Description

Under the Cyber Resilience Act (CRA), manufacturers must protect data confidentiality and integrity using state-of-the-art cryptographic mechanisms. However, manual cryptographic auditing is highly complex, error-prone and economically prohibitive for most SMEs. Developed by ExcID for the EU-funded CRACY project, the CRACY Cryptographic Assessment Tool is a powerful, automated static analysis platform that scans software repositories, inventories cryptographic assets and flags non-compliant algorithms before they reach production. It utilizes a dual-engine analysis to ensure codebases align with the strict guidelines of the European Cybersecurity Certification Group (ECCG). First, it automatically generates a Cryptography Bill of Materials (CBOM), a machine readable inventory of every algorithm, certificate and key used in the product. It then evaluates this CBOM against machine readable European policies via the Open Policy Agent (OPA), actively flagging deprecated algorithms (like SHA-1 or 3DES) and insufficient key sizes. Second, it performs static analysis directly on the source code via custom Semgrep rules to detect hardcoded secrets, exposed private keys and insecure encryption modes (like ECB). Crucially for European digital sovereignty, the tool is Free and Open-Source Software (FOSS) and can be deployed entirely on premises via Docker containers. This ensures a manufacturer proprietary source code never has to leave their secure internal CI/CD pipelines. Its findings can automatically be injected via API into the central CRACY REPO to streamline formal CRA conformity assessments