A static-analysis tool called Kestrel identified the mathematical fingerprints of ML-KEM and ML-DSA in stripped native binaries after the programs went through several build changes. ML-KEM matched all 128 of 128 table values in every applicable test cell, while the ML-DSA reference matched 255 of 256 in every column.
Kestrel looks for number-theoretic-transform constant tables, fixed values stored in binary data. It derives fingerprints from public scheme parameters, normalizes the binary data and compares collections of matching values instead of requiring one exact sequence.
Testing the signal through build changes
For its ground truth, the evaluation used open implementations with known source labels. The set spanned reference C-derived, vectorized, Go, RustCrypto and Chrome-deployed lineages, alongside classical or non-cryptographic negatives and hybrid positive cases.
Each source program was compiled into applicable unoptimized, optimized, stripped, statically linked and obfuscated variants. The resulting matrix tested whether the table signal held up as the code was compiled and transformed.
A stock-system sweep
In a stock-system sweep, Kestrel scanned 6,224 binaries and produced zero false positives. The highest negative score was 27, below a threshold of 32, while genuine detections scored 128.
The same sweep found 24 ML-KEM paths representing 12 distinct programs that had not been catalogued previously.
Using table configuration alone, the evaluation attributed the ssh binary to a C-reference lineage and the container binaries to a from-specification lineage. That is narrower than identifying a particular library, which the method cannot do when different libraries share identical from-specification tables.
A useful signal with a sharp boundary
The detector also separated genuine table evidence from a simple bluff. A real ML-KEM-1024 binary scored 128 of 128 and was detected, while a strings-only bluff scored 0 of 128 and was not detected.
The zero observed false positives still need careful interpretation. Under a uniform-random model, a threshold of 32 produced a per-window bound of 6.4e-9. The model implied approximately four expected false positives across the 6,224-binary sweep and approximately 27 across an 8 GB image, so this is a conservative calculation rather than an empirical real-world probability.
Designed evasion tests showed where the signal weakened. Reordering a table kept the score at 128 of 128, while padding lowered it to 86 of 128 and splitting lowered it to 64 of 128. XOR rewriting reduced the score to 8 of 128 and escaped detection in that tested construction.
A related boundary appeared when the constants were generated at runtime. That tested binary completed a correct ML-KEM key exchange but scored 8 of 128 and was not detected.
The stated coverage is limited to lattice schemes with stored transform tables, namely ML-KEM and ML-DSA. It excludes SLH-DSA, FFT-based signatures and code-based schemes.
Raw bytes still yielded evidence
The method was also tested on a forensic disk image. In a 200 MB ext4 image, conventional file recovery failed, but a raw scan of unallocated space detected an ML-KEM table at offset 0x8c6420 with a score of 128 of 128.
In a mixed image, a raw scan reports the predominant lineage rather than reliable per-file attribution, which still requires scanning files individually.
The complete stock-system sweep took 583.6 seconds. The reported mean was 93.8 milliseconds per binary across 2,704 MB of code. Performance and memory remain specific to the tested hardware and workload.
Taken together, the evaluation presents Kestrel as a focused aid for migration checks and forensic review when an implementation leaves its transform tables in native binary data. It does not establish that every implementation will be found, or that a detected primitive is executed or used by every binary.
Paper data and sources
Original title: Static Detection of Post-Quantum Cryptographic Algorithms in Stripped Binaries for Digital Forensic Examination and Migration Assurance
Authors: Muhammad Shaheer Bin Junaid
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-25
DOI: Not available
Original paper · Full text