A Cryptographic Bill of Materials is to cryptography what an SBOM is to software dependencies: a structured, machine-readable inventory of what is actually in use.
Where an SBOM lists packages and versions, a CBOM lists algorithms, key sizes, certificates, protocols, and where each one appears.
Why it exists
Every post-quantum mandate — CNSA 2.0, NIST IR 8547, sector regulators — assumes an organisation can answer a question most cannot:
Which of our systems use quantum-vulnerable cryptography, and where?
Without that, a migration plan is guesswork and progress cannot be measured. The CBOM is the artefact that makes everything downstream tractable.
What goes in one
- Algorithms — key exchange, signature, symmetric, hash, with parameters
- Protocol versions — which TLS versions each endpoint accepts
- Certificates — issuer, key type and size, signature algorithm, validity
- Where each appears — the host, service, or component using it
- Quantum classification — vulnerable, hybrid, or post-quantum
The classification is what turns an inventory into a plan. A list of algorithms is data. A list sorted by whether each finding is retroactively decryptable is a work queue.
CycloneDX
CycloneDX added support for cryptographic assets, and it is the format worth using. It is machine-readable, already understood by supply-chain tooling, and producing it means a cryptographic inventory can be consumed by the systems that already ingest SBOMs.
The alternative — a spreadsheet — decays immediately, because cryptographic posture changes with every deployment.
External versus complete
An externally observable CBOM covers what internet-facing services negotiate. That is the part an attacker sees first, and the part most exposed to harvest now, decrypt later.
It is not the whole estate. Internal service-to-service traffic, data at rest, code signing, and hardware security modules all carry cryptography no external scan can see. A complete CBOM needs both.
Starting outside-in is still the right order: it needs no agents, no access, and no change control, and it tends to find the systems that were forgotten.