Regulators Can Inspect a Cryptographic Inventory Without Taking a Copy. The Rules Were Written for Weapons Inspectors.

What the IAEA Learned in Iraq in 1991

On April 18, 1991, fifteen days after the UN Security Council adopted Resolution 687, Iraq told the International Atomic Energy Agency (IAEA) that it had nothing to declare under the resolution. Nine days later it sent a declaration of nuclear material and facilities. From May 14 to 22, IAEA inspectors acting under the resolution worked in and around the Tuwaitha Nuclear Research Centre to check whether that declaration was accurate and complete. They also made one short-notice visit to Tarmiya, a site chosen by the UN Special Commission.

During the second inspection, from June 22 to July 4, inspectors made short-notice visits to six sites. At two of them, Abu Ghraib and Falluja, Iraqi authorities denied the inspectors access and moved material out after the chief inspector had ordered that nothing leave. Photographs supported the inspectors’ suspicion that the material was related to undeclared uranium enrichment activities. On July 7 Iraq disclosed a substantial clandestine enrichment program. On July 18 the IAEA Board of Governors found that Iraq had not complied with its safeguards agreement, according to the IAEA’s chronology of its actions in Iraq in 1990–91. Iraq’s declared nuclear material had been under IAEA safeguards before the war. At the time the IAEA concentrated its safeguards on nuclear material at declared facilities, so its inspectors could confirm what Iraq listed and still miss what it left out.

Supervisors who now ask banks, insurers, telecom operators and government suppliers for a cryptographic bill of materials (CBOM) face the IAEA’s 1991 problem in a smaller form. A CBOM is a declaration. A supervisor can check its entries one by one and still learn nothing about cryptography the firm never listed. Supervisors can test a firm’s CBOM without receiving a copy if they adopt two rules from nuclear safeguards and chemical weapons inspections: the inspector chooses what gets examined, and anything the firm keeps covered must be shown compliant by other means.

The regulators I talk to have moved through two stages. At first they asked only whether a cryptographic inventory existed. Many firms answered with inventories assembled from interviews. Several of those regulators are now preparing to test what they receive: how much of the estate the inventory covers, and the process that produced it.

Auditors have started the same work. When the US Government Accountability Office (GAO) examined the cryptographic inventories of 24 federal agencies, it found that one of the 24 had a complete inventory of its priority systems. GAO tested completeness by comparing each inventory with the high-value assets and high-impact systems that agencies list in their cybersecurity metrics reports.

In August I wrote about why a CBOM is dangerous to circulate and about what a firm can prove about one without handing it over: commitments, attested discovery runs and sampled proofs over a committed inventory. Both pieces dealt with disclosure at a distance. A supervisor who wants to examine the inventory where it is kept needs procedure as well as cryptography. The negotiators of the treaties described below wrote most of that procedure between 1992 and 2010.

Under Executive Order 14412, the US Secretary of Homeland Security, through the Cybersecurity and Infrastructure Security Agency (CISA) and in coordination with the National Institute of Standards and Technology (NIST), has until March 19, 2027, to publish guidance on the minimum elements of a CBOM. Supervisors who adopt those elements will need a way to test what they receive.

Chemical Weapons, Nuclear Safeguards and New START Inspections

The Chemical Weapons Convention (CWC) entered into force in 1997 and is implemented by the Organisation for the Prohibition of Chemical Weapons (OPCW) in The Hague. OPCW inspectors visit declared chemical weapons facilities and industrial plants on a routine schedule. Article IX of the Convention also gives every state party the right to request a challenge inspection of any facility or location in the territory of another state party, or in any other place under that state’s jurisdiction or control.

Part X of the Convention’s Verification Annex sets out the procedure that inspectors and the inspected state follow in a challenge inspection, including the most detailed managed-access rules I know of in any treaty. No state party had requested one by November 2024, when Stefano Costanzi of American University described the mechanism as never used in a statement to the OPCW’s Conference of the States Parties.

Through its safeguards system, the IAEA verifies that states party to the Non-Proliferation Treaty do not divert nuclear material to weapons. Under a comprehensive safeguards agreement, based on a model the IAEA Board approved in 1971 and published as INFCIRC/153, a state declares its nuclear material and IAEA inspectors verify the declaration.

In 1993, two years after the Iraq inspections, the IAEA launched Programme 93+2 to increase its capability to verify both the correctness and the completeness of a state’s declarations. On May 15, 1997, its Board approved the result, the Model Additional Protocol, as the IAEA Safeguards Glossary records. Under the protocol, states make wider declarations, and IAEA inspectors gain complementary access to locations beyond declared facilities to assure the absence of undeclared material and activities.

New START, the US–Russian treaty that limited each side to 1,550 deployed strategic warheads, entered into force in February 2011 and allowed each party ten Type One inspections a year at sites with deployed strategic systems as well as non-deployed ones. Both sides paused inspections in March 2020 because of COVID-19. In August 2022 Russia suspended its cooperation with the inspection provisions. The treaty expired on February 5, 2026. The annex on inspection activities to its protocol records, step by step, how inspectors counted warheads they were not allowed to see uncovered.

Under Managed Access, the Inspected Party Still Has to Demonstrate Compliance

Managed access is the arms-control term for arrangements that let an inspected party protect sensitive information during an inspection without letting it decide what the inspectors conclude. Part X spells the arrangements out. Paragraph 38 makes the extent of access inside the inspection site a matter for negotiation on a managed-access basis. Paragraph 41 requires the inspected state to allow the greatest degree of access consistent with its constitutional rules on property and searches. The same paragraph lets the state protect its national security and forbids it to invoke these provisions “to conceal evasion” of its obligations.

Paragraph 48 lists measures the inspected state may take to keep information unrelated to chemical weapons out of view. They include:

• removing sensitive papers from office spaces;
• shrouding sensitive displays, stores and equipment, including computer and electronic systems;
• logging off computer systems and switching off devices that display data;
• restricting sample analysis to whether chemicals on the Convention’s schedules are present or absent;
• asking the inspectors to choose a given percentage or number of buildings themselves, a method that can also apply to the interior and contents of sensitive buildings;
• in exceptional cases, admitting only individual inspectors to certain parts of the site.

Paragraph 49 puts the burden back on the inspected state. For any object, building, structure, container or vehicle the inspectors could not fully access, or that was protected under paragraph 48, the state must make every reasonable effort to show that it is not used for purposes related to the concern behind the inspection. Paragraph 50 gives examples of how, from partly removing a shroud to letting inspectors look into an enclosed space from its entrance.

Article IX of the Convention gives the inspected state both the right and the obligation to make every reasonable effort to demonstrate compliance. Paragraph 59 of Part X then requires the inspection team to assess, in its report, how much access the state granted and how far that access let the inspectors fulfill their mandate.

Paragraph 17 of Part IX extends the same rules to routine inspections of industrial plants: a state party whose plant site has been selected for inspection has the right to manage access to its plants under Part X, Section C. The OPCW therefore inspects commercial chemical producers under managed-access rules every year. For a supervisor inspecting a firm, those inspections are the closer precedent.

The IAEA’s Model Additional Protocol follows the same structure. Article 7 provides for managed-access arrangements, at a state’s request, to prevent the dissemination of proliferation-sensitive information, to meet safety or physical-protection requirements, or to protect proprietary or commercially sensitive information. Under the same article, a state may not use those arrangements to stop the IAEA from doing what it needs to provide credible assurance that no undeclared nuclear material or activities exist at the location in question. Where a state cannot give access to certain locations, Article 5 requires it to make every reasonable effort to satisfy the IAEA’s requirements without delay through other means.

US and Russian negotiators wrote the same rule into New START. When inspectors viewed the front section of a designated missile, the inspected party could cover each reentry vehicle individually, provided the covers did not stop inspectors from confirming that the number of reentry vehicles matched the number declared for that missile. Each inspector could view the front section for up to 15 minutes, from no more than five meters away. If the escort declared another object on the front section to be non-nuclear, the escort had to demonstrate that to the inspectors’ satisfaction.

By 1995 the IAEA’s Standing Advisory Group on Safeguards Implementation (SAGSI) had recommended that the IAEA draw on the elements of Part X, including its managed-access provisions, to make safeguards more effective. David Gualtieri, Barry Kellman, Kenneth Apt and Edward Tanzman analyzed that recommendation in the Michigan Journal of International Law in 1995, two years before the IAEA Board approved the Model Additional Protocol.

The UK–Norway Initiative, a verification research partnership between a nuclear-weapon state and a non-nuclear-weapon state that began in 2007, tested managed access in exercises in Norway in 2008 and 2009 and at the UK’s Atomic Weapons Establishment in December 2010.

In the 2010 exercise the host withheld the facility’s design plans and would not discuss how the containers used in dismantlement were built. The inspectors left with an incomplete picture of the facility and could not identify the routes by which material might be diverted. Without the container design, they could not judge whether their seals and radiation detector would work. The initiative’s 2015 working paper to the NPT Review Conference concluded that access arrangements have to be agreed in detail well before an inspection. It also concluded that inspectors should not expect to negotiate substantial terms at the point of inspection.

A firm under CBOM inspection could shroud fields it considers sensitive, such as hostnames, network locations or key storage paths, under redaction tiers it has agreed with the supervisor before the visit. For each shrouded entry it would then owe the inspector another way to confirm the entry: a handshake with the endpoint during the inspection, an attestation from the hardware security module, or a configuration export with identifiers masked.

A firm that shrouds an entry and offers nothing else leaves the inspector unable to reach any conclusion about it. The inspector should record that in the report, as paragraph 59 of Part X requires of OPCW teams.

The Inspector Chooses What Gets Examined

Under paragraph 48 of Part X, an inspected state that restricts access can ask the inspectors to choose a given percentage or number of buildings themselves. The state limits how much the inspectors see. The inspectors decide which part they see.

The OPCW uses inspector-side randomness in routine industrial inspections as well. Paragraph 11 of Part IX of the Verification Annex has the OPCW’s Technical Secretariat select plant sites for inspection at random. In a 2011 note the Secretariat set out a probabilistic method in which each site is weighted by its relevance. In 2018 it carried out 169 inspections of what the Convention calls other chemical production facilities. High-relevance sites made up 16 percent of the inspectable pool and received 26 percent of those inspections, according to the Secretariat’s report on the method.

New START gave the choice to the inspecting party. The inspection team leader designated the launcher whose missile would be examined. Within an hour of the inspection site being named, the inspected party had to put pre-inspection restrictions in place. Until the designation was complete, it could not begin work on installing or removing reentry vehicles or front sections at that base.

IAEA inspectors choose which items they measure and take samples from bulk items selected at random. The IAEA also publishes the formula it uses to size those samples. Term 9.10 of the Safeguards Glossary gives the number of items to verify in each stratum, a group of similar items, as:

$$$n = N\left(1-\beta^{1/D}\right)$$$

Here $$N$$ is the number of items in the stratum and $$\beta$$ is the accepted probability of missing every defect. $$D$$ is the smallest number of defective items needed to divert the goal amount of material. The sample size $$n$$ is rounded up. For a CBOM of 10,000 entries treated as one stratum, an inspector who wants a 90 percent chance of drawing at least one bad entry when 100 entries are wrong needs a random sample of 228 entries. When only 10 entries are wrong, the inspector needs 2,057 for the same confidence.

The formula is an approximation; the exact calculation gives one entry fewer in each case. I have assumed that a check identifies a bad entry whenever one is drawn.

A supervisor sampling a CBOM has to meet two conditions. The randomness has to be drawn after the firm commits to its CBOM snapshot, so that the firm cannot prepare the entries that will be picked. The supervisor can take it from a public randomness beacon, as in the sampling layer I proposed in August. The sample also has to come partly from populations the firm did not assemble for the CBOM: external scan results, Certificate Transparency logs, a draw from the asset register, or handshakes captured on a network segment the inspector selects.

An inspector who samples only from the CBOM learns whether the listed entries are right. An inspector who also samples from outside it learns whether anything is missing, which is the test GAO applied when it compared agency inventories with lists of high-value assets.

A supervisor can also restrict changes to systems in scope from notice of an inspection until the sampled entries have been examined, as New START did with its pre-inspection restrictions, so that a firm cannot reconfigure the systems most likely to be picked. The firm would still apply emergency fixes and record them in a change log the inspectors can read. A supervisor responsible for several hundred firms can apply the OPCW’s weighting across institutions and inspect the most exposed firms more often, while no firm can predict its turn.

Yes-or-No Questions and Information Barriers

Paragraph 48 of Part X also lets an inspected state limit sample analysis to whether chemicals on the Convention’s schedules are present or absent. The inspectors get that answer without an unrestricted analysis of the sample. The IAEA’s Safeguards Glossary calls a check of this kind an attributes test, one with a yes-or-no answer, and gives seal verification as its example.

Under New START, an object declared non-nuclear had to pass a threshold test. The escort took two background neutron readings at least 50 meters from the missile’s front section and computed a comparison number from them: the average background count plus four times its square root. The escort then measured the object at a point the inspectors chose. If the average reading was at or below the comparison number, the object was recorded as non-nuclear, under Section VI of Part Five of the annex.

Arms-control researchers built information barriers to apply the yes-or-no test to measurements that would reveal classified information. In the UK–Norway Initiative’s description, an information barrier processes measurement data against criteria agreed in advance, and the inspector sees only an unclassified result, typically pass or fail.

From 1996 to 2002 the United States, Russia and the IAEA worked together in the Trilateral Initiative on how the IAEA could verify weapon-origin plutonium without seeing its classified characteristics, as Thomas Shea, head of the IAEA’s Trilateral Initiative office, reported in 2001. Los Alamos demonstrated the first prototype attribute verification system with an information barrier at a Trilateral workshop in June 1999.

By the IAEA’s General Conference in 2002, the United States and Russia had agreed to close the initiative. They judged it a success and left each state to conclude its own implementation agreement with the IAEA. Shea later named instrument authentication as one of its unresolved problems: how one side could check equipment built for verification without making the other sides trust it less.

The UK–Norway Initiative built its own information barrier, which reports only whether the isotopic ratio of a plutonium sample is above an agreed threshold. Its designers wrote two versions of the analysis software, one in Ada and one in assembly language, to find out which would be easier to authenticate. The initiative’s 2015 working paper describes the device as a research tool and calls authenticating equipment to both parties’ satisfaction an elaborate and time-consuming process.

The host and the inspector need different assurances from the same device. The host needs confidence that the device leaks nothing sensitive, while the inspector needs confidence that it measures what it claims and has not been altered. Each protection the host adds to keep its data hidden is one more component the inspector has to trust without seeing inside it.

A Princeton-led team proposed in 2014 to avoid this problem by never measuring the sensitive information. In Nature, Alexander Glaser, Boaz Barak and Robert Goldston described a zero-knowledge protocol for comparing a submitted warhead with a trusted reference using neutron measurements. Their paper calls electronic information barriers vulnerable to tampering and snooping. In the protocol, the host preloads the detectors so that, with a genuine item, each total count comes out close to a value the inspector already knows. The inspector randomly decides, immediately before the test, which detector goes with which item.

In 2016 Sébastien Philippe and colleagues demonstrated a non-electronic version using superheated-emulsion detectors, with which inspectors could confirm that two objects are identical without learning their geometry or composition. The same year an MIT group led by R. Scott Kemp proposed a different physical method in PNAS, based on nuclear resonance fluorescence, in which the information is protected by a cryptographic hash that needs neither electronics nor software.

A supervisor inspecting a CBOM in place faces the software version of the same choice. Evaluation code can run inside the firm against the full inventory and return yes-or-no answers to questions such as whether any internet-facing entry still uses RSA-2048 for key establishment, or whether every certificate in the payment path chains to an approved root. The code could be a jointly reviewed program run under supervision, or it could run in a trusted execution environment or a zkVM.

Whoever designs the evaluator has to settle the questions Trilateral Initiative participants never closed. For a CBOM evaluator, those questions are who wrote the query, who runs it and how each side confirms that the code that ran is the code it reviewed. I would start with the simplest version. The supervisor writes the query and the firm reviews it for what it could leak. The program then runs under the inspectors’ observation against the committed inventory. Both sides record the hash of the code, the commitment it read and the result.

Longer term, a firm could give a supervisor the same answers through the zero-knowledge proofs I described in August, with no one in the room. A supervisor holding such a proof still knows nothing about whether the committed CBOM matches the estate, which the supervisor can test only by sampling outside the CBOM.

Gross, Partial and Bias Defects in a Cryptographic Inventory

The IAEA Safeguards Glossary defines a defect as a statistically significant difference between the amount of material an operator declares and the amount the IAEA measures, and it distinguishes three levels. In a gross defect, an item has been falsified so that all or most of the declared material is missing. In a partial defect, some fraction of the declared material is still present. In a bias defect, the item has been slightly falsified and only a small fraction is missing. Inspectors at a facility can spot gross and partial defects because of the larger quantities involved, but they need high-precision chemical and physical measurement to find a bias defect, according to the IAEA’s description of its safeguards laboratories.

I would borrow the three levels to classify how a declared CBOM entry can be wrong.

• Gross defect. The entry describes cryptography that is not there: a system decommissioned years ago, a library the build no longer links, an entry copied from a template. An inspector finds it with one yes-or-no check.
• Partial defect. The entry is right in kind and wrong in a detail that changes the risk, such as a service declared as using only hybrid ML-KEM (CRYSTALS-Kyber) key establishment that still accepts a classical-only fallback, or an RSA key recorded at the wrong length. To find it, the inspector has to examine the attributes of the sampled entry as well as its existence.
• Bias defect. The same small error appears in many entries, usually introduced by tooling: a scanner that reads a library’s version from the package manifest instead of the binary actually loaded, or one that drops a field from every cipher-suite record. Each entry looks plausible. The error shows up only when an inspector re-runs the classification on a random sample with an independent method and compares the two sets of results statistically, much as the IAEA turns to high-precision measurement to find bias defects.

If the sample shows gross defects, I would first check whether the firm still maintains its inventory, then look for stale imports and scoping errors. For a bias defect, I would start with the discovery tool and the other firms that use it. Cryptography missing from the CBOM altogether is a completeness failure, the kind the IAEA met in Iraq in 1991. Supervisors need different methods to find it.

Finding Cryptography Missing From the CBOM

The IAEA wrote the Additional Protocol for completeness. Article 4 says the IAEA will not seek to verify a state’s expanded declarations mechanistically or systematically. The IAEA uses complementary access selectively, to assure the absence of undeclared material and activities and to resolve questions about the correctness and completeness of what a state has declared. Under the protocol the IAEA can also collect environmental samples beyond declared locations when it considers that necessary. Inspectors taking a swipe sample choose where to look without relying on the state’s declaration.

The cryptographic equivalents of a swipe sample are observations a supervisor can make without the firm’s inventory: the TLS handshakes on a network segment the inspector selects, the protocols and cipher suites an external scan finds on the firm’s public address ranges, and the certificates issued for its domains. The handshakes and scan results show cryptography in use whether or not the CBOM lists it, and the certificates show what was issued in the firm’s name. The firm’s asset register needs testing too, since systems the register never recorded will also be missing from a CBOM built from it.

Part X of the CWC also limits what inspectors keep. Paragraph 44 restricts an inspection team to collecting facts related to the concern it is investigating and requires it to discard material that turns out to be irrelevant. A supervisor capturing handshake metadata should keep the algorithms and parameters, with the time and endpoint of each observation, and discard everything else.

Certificate Transparency as an Independent Ledger

In nuclear material accountancy, the IAEA compares the quantities in an operator’s books with the quantities its inspectors measure. Its aim is to keep the differences small compared with the amount needed for a nuclear explosive device.

One class of cryptographic asset has an independent public record. Certificate authorities log publicly trusted TLS certificates in Certificate Transparency logs, specified in RFC 6962 in 2013 and revised as RFC 9162 in 2021. Since July 2018, Chrome has required Certificate Transparency for publicly trusted certificates issued after April 30, 2018.

A supervisor can query those logs for every certificate issued for a firm’s domains and compare the result with the external certificates in the CBOM without any help from the firm. When a logged certificate is missing from the CBOM, the supervisor should check whether the firm’s servers present it, because the logs also hold certificates that expired, were replaced or were never installed. Private PKI, SSH host keys, IPsec and keys embedded in devices do not appear in the logs.

Limits of the Arms-Control Comparison

Nuclear accountancy works because uranium and plutonium are conserved and can be measured. A firm’s cryptography can be copied without trace and changes with each deployment. Many algorithms are negotiated at connection time, so a CBOM describes a moving estate at a single moment.

The IAEA and the OPCW employ dedicated inspectorates. Under New START, each party sent its own inspection teams. A financial or telecom supervisor faces hundreds or thousands of firms, usually with a small technical staff, so I built the protocol below on sampling and yes-or-no checks.

A state hiding a weapons program has its security at stake. Most firms that hand over a weak CBOM have under-invested in discovery. A supervisor should answer with tests and escalate only for the firms that fail them. I am borrowing inspection methods from arms control. Nothing about a firm with a poor inventory resembles a state hiding a weapons program.

Information barriers have been under development since the late 1990s. The engineering for a software CBOM evaluator is simpler, but the trust problem is the same. I would not expect a jointly trusted evaluator to be ready for the first round of CBOM inspections.

States accept treaty inspections by consent, and every managed-access rule in force was negotiated. Supervisors act under statutory powers. Shrouding rules, the burden to demonstrate compliance by other means and the inspector’s right to choose all have to be written into supervisory procedure, or a firm can cite confidentiality to end the inspection.

No state party had requested a challenge inspection under the CWC by November 2024, so the procedure itself had not been tested in practice. Its managed-access rules also apply in the OPCW’s routine inspections of industrial plants, under paragraph 17 of Part IX. New START’s procedures were used until 2020, between two parties with long experience of inspecting each other.

A Managed-Access Protocol for CBOM Inspection

I would ask supervisors to write eight steps into their inspection procedures.

1. Commit before scheduling. The firm publishes a digest and timestamp of its CBOM snapshot on a regular schedule, as in the commitment layer I proposed in August. The inspectors examine the latest snapshot committed before notice.
2. Agree redaction tiers before the visit. The firm names the fields it will shroud, and the supervisor approves them in writing. Inspectors record any field shrouded on inspection day without that approval as a limit on access.
3. Inspect in place. Named inspectors examine the CBOM in a reading room or a supervised session, with a full log, and no copy leaves the firm. Inspectors record the facts related to the inspection and keep nothing else, as paragraph 44 of Part X requires of OPCW teams.
4. Keep the burden with the firm. For every shrouded entry the firm provides evidence the inspector can check, such as a handshake with the endpoint during the inspection or a hardware attestation.
5. Let the inspector choose. The sample is drawn with randomness generated after the commitment, from the CBOM and from populations the firm did not assemble for it: external scans, Certificate Transparency logs, the asset register and observed traffic. Changes to systems in scope are restricted from notice until the sampled entries have been examined, with emergency fixes logged.
6. Ask yes-or-no questions first. Inspectors start with presence checks and threshold tests on the sampled entries and move to fuller listings only where a check fails or cannot be completed. Paragraph 45 of Part X sets the same order for OPCW teams, which begin with the least intrusive procedures. Each answer is recorded as yes, no or inconclusive, with the entries it covered. The two sides agree a limit on the number of questions in advance, because a supervisor who asks enough of them can work out what the shrouds protect.
7. Classify the findings. Listed entries are graded as gross, partial or bias defects, and cryptography found outside the CBOM is reported separately. In their report, the inspectors also assess how much access the firm granted and whether it was enough, as paragraph 59 of Part X requires.
8. Leave the CBOM with the firm. The supervisor keeps the findings and their supporting evidence under access controls, much as the OPCW holds the detailed appendix to a challenge-inspection report under paragraph 59. It also keeps the commitment and the record of the sample. The inventory stays where it was.

In 1991 IAEA inspectors checked what Iraq declared, but the evidence of what it had left out came from sites outside that declaration. Six years passed between those inspections and the IAEA Board’s approval of the Model Additional Protocol, with which the IAEA strengthened its inspectors’ ability to verify completeness. Supervisors asking for CBOMs can start from the IAEA’s 1997 position. The treaty texts are public. None of the eight steps above needs new technology.

From the author