> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scanoss.com/llms.txt
> Use this file to discover all available pages before exploring further.

# What a Project Uses, Reaches and Blocks

> The Cryptography page shows the cryptography a project ships, how much of it your code reaches, and what your policies say about the part it reaches.

A project's **Cryptography** page answers three questions in order: what cryptography the project ships, how much of it your code actually reaches, and what policy says about the part it reaches. It answers "which cryptography does this project use, and what does it put at risk?" without opening findings one by one.

To open it, select a project, then **Cryptography** in the sidebar. It's there only when your organisation has cryptography scanning, and every role that can read the project can open it. It was called **Algorithms** before; links to the old page still work and open the **Assets** tab with the same filters.

The page lists the cryptography in the project's current findings, so an asset you remove from the code drops off after the next scan. Under the title, the page names the scan its counts come from. **Export** makes a new CBOM of that scan.

The page has three tabs: **Overview**, **Libraries**, and **Assets**. The tab is in the address, so a link opens the same view.

## Overview

**Overview** opens on a funnel. The line above it counts the occurrences and the libraries they sit in. The funnel starts from the distinct assets they collapse to: one algorithm used at 500 call sites is one asset, the same count the Dashboard and the CBOM use. The steps then narrow that number:

| Step | What it counts |
| - | - |
| **Distinct assets** | Every asset in the project, decided or not. |
| **Reached** | Assets with at least one finding that a call path from your entry points reaches. |
| **Weak or quantum-vulnerable** | Reached assets with a reachable finding of **High** or **Critical** severity, or one a quantum computer could break. |
| **Blocking a policy** | Of those, the assets with an open finding that a policy blocks. |

Each step is a link. The first three open the **Assets** tab filtered to what they count. **Blocking a policy** scrolls to **Needs attention**, which lists them. When Earnie traced no call path at all, the funnel stops at distinct assets and says reachability wasn't analysed, rather than showing every later step as zero.

### Where Reached Crypto Comes From

Beside the funnel, **Where reached crypto comes from** splits the reached assets by where their reachable findings live:

* **Your code.**
* **Direct dependency.** A library your project declares.
* **Transitive dependency.** A library that arrives through another library.
* A dependency whose relationship the scanner didn't resolve.

Assets whose reachability is unknown are shown hatched, apart from the rest. An asset reached from two places counts under both, and the panel says so.

### Needs Attention

**Needs attention** lists every open, reached finding that a policy attached to the project blocks, asks approval for, or warns about, with its strongest verdict. Each row shows:

* the asset, and the library it lives in (or your code);
* the route from your entry point to the cryptographic call, with the libraries it crosses in call order;
* the policy and its verdict (**Block**, **Require approval**, or **Warn**);
* the post-quantum status.

These are the same verdicts the pull request gate and MCP give. A finding you've decided leaves the list, whatever a policy says of it. Select the asset to open that finding in [Review](https://docs.scanoss.com/en/latest/earnie/using-earnie/triaging-findings.md#reading-the-proof-of-a-crypto-finding).

Under the table, three tiles open presets of the **Assets** tab: how many assets are quantum-vulnerable and how many of those are reached, how many carry a key size, and how many certificates and pieces of key material the project holds.

## Libraries

**Libraries** has one row per library that ships cryptography, and one for your own code.

* **How it gets in** says whether your project declares the library or it arrives through another one. For a transitive library it also shows the chain of declarations that brings it in, with its depth.
* The other columns count occurrences, assets, and how many of those assets are reached, and sum what policy says: for example **1 blocked**, **1 needs approval**, **3 warned**, **Inventory only** for a library nothing reaches, or **No policy verdict**.
* The **Occurrences** column is left out when it equals **Assets** on every row.

Select a row to split that library's assets into reached, not reached, and undecided, three counts that sum to its assets, and to list the reached ones. Review's **Components** view links here with **View in Cryptography**.

## Assets

**Assets** lists every asset type: algorithms, protocols, certificates, and key material. Above the table, four presets choose what it lists:

| Preset | What it lists |
| - | - |
| **All assets** | The full list, one row per asset name, for example AES-256-GCM, TLS 1.1, or an X.509 certificate. |
| **Post-quantum** | The quantum-vulnerable assets, reached first, which is the order a migration takes them in, with **Reached** and **Quantum** status columns. |
| **Export control** | Every asset with a key size, reached or not, under the export evidence of the project's findings. It states evidence, never a classification. |
| **Certificates and keys** | Certificates and key material, with a **Type** column. |

A preset leaves out a column no row fills, such as **Key size** on certificates. Choosing a preset clears the filters, and the search, filters, and sort then work within it. The preset is in the address.

In **All assets**, spellings that differ only in capitalisation or surrounding spaces, such as `aes-256-gcm` and `AES-256-GCM`, are one row, so a row can hold more than one asset. Every count on the tab is of assets, never of rows, and agrees with the **Overview**.

Two counts sit above the table: **High or critical** (assets with an open finding of that severity) and **Only in dependencies**. Each one opens the table filtered to what it counts. Under them, two charts split the same assets:

* **Post-quantum status**: **Vulnerable**, **Safe**, **Not applicable**, and **Not assessed**.
* **Severity**: from **Critical** to **Info**. An asset whose findings are all decided has no severity, so the chart leaves it out and says how many assets it covers.

Each name under a chart is a link that opens the table filtered to it, keeping the other filters you've set, and the one in force is marked. A status or severity that no asset has is left out.

### What Each Column Shows

| Column | What it shows |
| - | - |
| **Asset** | The asset's name, with its family and primitive, or its type, underneath. |
| **Key size** | The key sizes, in bits, that the scanner reported for this asset. Empty when it reported none. |
| **Quantum status** | The worst post-quantum verdict across the asset's occurrences, from worst to best: **Vulnerable**, **Not assessed**, **Safe**, or **Not applicable**. |
| **Severity** | The highest severity among the asset's open findings. Empty when every finding of the asset has been decided. |
| **Where** | How many files of your own code use it, and how many findings sit inside dependencies, for example "3 files · 2 in dependencies", or **Only in dependencies**. |
| **Open findings** | Findings that still count towards the gate. See [What Counts as Open](#what-counts-as-open). |

### What Counts as Open

A finding leaves **Open findings** and **Severity** only when it no longer counts towards the gate: when it's suppressed, or closed by a correction saved to Scan Configuration. The same rule decides the [merge gate](https://docs.scanoss.com/en/latest/earnie/using-earnie/merge-gate.md), so this page and the gate always agree. For the crypto decisions:

* **False positive** and **Accepted risk** remove a finding from the gate, so it's no longer open.
* **Confirm usage** keeps a finding in the gate, so it stays open.

Counts ignore decisions, so deciding a finding never makes an asset disappear from this page. See [the cryptography decisions](https://docs.scanoss.com/en/latest/earnie/using-earnie/triaging-findings.md#cryptography) in Triaging findings.

### Opening an Asset

Select an asset to see its details beside the table, or in a panel from the right on a narrower screen:

* **Quantum readiness** says whether a quantum computer could break it.
* **Where it is used** counts files in your code, findings inside dependencies, and assets, and names the libraries that implement it.
* **Open in Review** opens [Review](https://docs.scanoss.com/en/latest/earnie/using-earnie/triaging-findings.md), filtered to that asset, with the first file that implements it open. For an asset that appears only inside dependencies, it opens Review's **Components** view, filtered to the packages that contain it.

### Searching and Filtering

* **Search** matches names, families, primitives, and libraries.
* The filters narrow by asset type, primitive, quantum status, severity, policy verdict, and where it's used.
* A link from the funnel, a tile, or the Dashboard can also narrow the list in ways the filter bar has no control for. Each one shows as a chip under the filters: **High or critical**, **Weak or quantum-vulnerable**, **Reached by your code**, and **Reachable, still open**. Select a chip to drop it.

The address holds the filters, the sort, and the selected asset. Switching tabs drops them. When the filters leave nothing to show, the page names the ones that are on, and **Clear filters** brings every row back.

## When the Page Is Empty

* **This organization does not run cryptography detection:** cryptography scanning isn't enabled for your organisation. The sidebar has no **Cryptography** entry then, so you see this only from a direct link.
* **No cryptographic assets in this project:** no scan with cryptography enabled has found an asset in this project yet.
* **Couldn't load the cryptography:** Earnie couldn't fetch the data. Select **Retry**.

## What's Next

For the project's cryptography across scans, see the [Cryptography tab](https://docs.scanoss.com/en/latest/earnie/using-earnie/dashboard.md#the-cryptography-tab) on the Dashboard. To decide individual crypto findings, see [Triaging findings](https://docs.scanoss.com/en/latest/earnie/using-earnie/triaging-findings.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.