TRELYAN Assure: a signed, checkable record of the cryptography patterns found in your code

What a TRELYAN Assure pack contains

• A cryptographic bill of materials (CBOM) in the CycloneDX 1.6 format, built from the scan's matches.
• An evidence list: each detector match with its location (file and line for code; the manifest or certificate for dependencies and certificates).
• The class each matching pattern stands for (listed below).
• What was scanned: the catalog version and every detector rule, the files scanned, and the files skipped with the reason.
• The SHA-256 hash of every scanned file, so you can confirm which bytes were scanned.
• The commit the scanned folder was at, when it is a git repository.

The algorithm classes:

• Breakable by Shor's algorithm: RSA, DSA, elliptic-curve cryptography (including X25519) and finite-field Diffie-Hellman.
• Reduced, not broken, margin under Grover's algorithm: AES-128 and AES-192, both still approved by NIST.
• Classically weak or retired: MD5, SHA-1, Triple DES and RC4, regardless of quantum computing.
• Post-quantum schemes: ML-KEM, ML-DSA and SLH-DSA (NIST FIPS 203, 204 and 205) and XMSS (NIST SP 800-208).

Packs are signed with ML-DSA-65, a parameter set of ML-DSA, the signature algorithm standardized in NIST FIPS 204.

What a pack does not claim

• No grade and no overall verdict.
• No claim that all cryptography was found, or that any algorithm is absent.
• A match is a text-pattern hit to review, not proof that the algorithm is used. Patterns can match inside unrelated words.
• A dependency match classifies the whole library by its main algorithm family, not the functions your code calls.
• It does not see cryptography that is obfuscated, wrapped, built at run time or inside compiled binaries. Folders excluded by default (vendor, node_modules, .venv, target and .git) are not scanned and not listed file by file.
• A pack is a point-in-time record of one codebase, not a continuous inventory.
• A pack is not an audit, an attestation or a certification.

TRELYAN Verify

TRELYAN Verify is a command-line tool that checks a pack offline, with no network connection and no TRELYAN service. TRELYAN gives you the fingerprint of its public key through a separate channel agreed in writing, and you pass it to the tool with --expect-key. The check passes only if the signature is valid, the contents are unchanged, and the public key carried in the pack matches that fingerprint. It is included at no extra charge with every pilot.

How a paid pilot works

• A fixed fee for a fixed scope, with terms agreed in writing before work starts: which repositories, which commit, where the scan runs, and how the code is accessed and handled.
• You receive a signed pack for each codebase in scope.
• TRELYAN installs nothing in your network.

Who it is for

Engineering and security teams preparing to move to post-quantum cryptography. That work starts with knowing where today's cryptography is.

• On 13 August 2024, NIST published three post-quantum cryptography standards: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA).
• On 24 June 2026, OMB Memorandum M-26-15 told federal agencies that their migration plan should rest on a continuously updated inventory of all cryptographic assets, populating a central cryptographic bill of materials (CBOM).

Technology

• TRELYAN builds the scanner, the pack format and the verifier itself, in Rust.
• Given the same files, the same scanner and catalog versions and the same settings, the scanner reports the same matches in the same order.
• Formats and algorithms: CycloneDX 1.6, SHA-256, and ML-DSA-65 as specified in FIPS 204.
• No TRELYAN cryptographic module has a FIPS 140-3 (CMVP) validation.

Status

TRELYAN Inc. is an early-stage company. The scanner, the pack format and the verifier are built and tested internally. We are looking for our first pilot customers. Before the first pilot we will create the production signing key and package TRELYAN Verify for customers. To discuss a pilot, write to contact@trelyan.ch.