Cryptographic Bill of Materials(CBOM)

A Cryptographic Bill of Materials (CBOM) is a machine-readable inventory of the cryptographic assets used within a system. It records which algorithms are in use, where, with what key lengths, in which libraries, and how they're configured (modes, padding, randomness sources).

Why CBOMs exist

PQC migration guidance from NIST, ENISA, NCSC, and others converges on the same first step: you cannot migrate cryptography you haven't inventoried. Cryptographic usage is typically scattered across application code, TLS configuration, certificate authorities, HSMs, embedded firmware, and third-party dependencies, and most organizations have no single accurate view of it.

A CBOM answers concretely:

• Which services still use RSA-2048 key exchange, and are any of them handling data that needs decades of confidentiality?
• Which TLS libraries in the dependency tree don't yet support hybrid PQC key exchange?
• Where are certificates signed with algorithms that will need reissuing under a new PKI hierarchy?

What goes into a CBOM

A thorough CBOM typically captures the following, per cryptographic asset:

• Algorithm and parameters (e.g., RSA-2048, AES-256-GCM, ECDSA P-256)
• Purpose (key exchange, signing, encryption at rest, authentication)
• Location (service, library, configuration file, hardware module)
• Quantum vulnerability classification (broken by Shor's, weakened by Grover's, or unaffected)
• Dependency chain (which library or vendor component introduces this cryptographic usage)

Standardization

The CycloneDX specification (maintained by OWASP) added native CBOM support, allowing cryptographic asset data to be expressed in the same tooling ecosystem already used for SBOM generation. This lets organizations extend existing software supply chain security tooling to cover cryptographic inventory rather than building a parallel process from scratch.

Relationship to PQC migration

A CBOM is the foundational artifact every major PQC migration framework, including NIST's, ENISA's, and the UK NCSC's, lists as step one. Without it, migration prioritization (which systems are highest-risk, which have the longest data-confidentiality requirements) is guesswork rather than evidence-based planning.