CBOM guide · updated 2 November 2026
What is a CBOM?
A CBOM, or cryptography bill of materials, is a machine-readable inventory of the cryptography in a system: which algorithms, keys and certificates exist, what they do, and where they sit in the code.
Why it exists
Post-quantum migration starts with knowing what you have. NIST's final transition report tells organisations to begin with cryptographic inventories, and the UK's NCSC wants full discovery done by 2028. See the full deadlines. A spreadsheet goes stale the day it is written. A CBOM is generated from the code, so it can be rebuilt on every change.
CBOM and SBOM
| SBOM | CBOM | |
|---|---|---|
| Lists | Software components and their versions | Cryptographic assets and their dependencies |
| Answers | Which library am I shipping? | Which algorithm am I relying on, and where? |
| Used for | Vulnerable dependency tracking | Crypto-agility and post-quantum migration |
The CycloneDX guide defines a CBOM as an object model to describe cryptographic assets and their dependencies. CBOM support arrived in CycloneDX 1.6, with the model developed by IBM Research, so a CBOM can sit in the same file format as an SBOM.
What one looks like
This is a real entry, shortened, from the CBOM of Functor's own code. It records ECDSA, marks it as having no quantum security, and gives its exact location.
{
"type": "cryptographic-asset",
"bom-ref": "crypto/algorithm/ecdsa",
"name": "ECDSA",
"cryptoProperties": {
"assetType": "algorithm",
"algorithmProperties": {
"primitive": "signature",
"cryptoFunctions": ["sign", "verify"],
"classicalSecurityLevel": 128,
"nistQuantumSecurityLevel": 0
},
"oid": "1.2.840.10045.4.3.2"
},
"evidence": {
"occurrences": [
{ "location": "chain/crates/functor-core/src/block.rs", "line": 116 }
]
}
}The field nistQuantumSecurityLevel is the one that matters for migration. A value of 0 means the algorithm meets no NIST post-quantum security category, which is true of RSA, ECDSA, Ed25519 and ECDH.
How to use one
- Generate it from source, so nobody has to maintain it by hand.
- Sort by what the asset protects. Long-lived secrets go first, because of harvest now, decrypt later.
- Keep it in the build, so a new use of a weak algorithm shows up in review.
- Give it to auditors and customers in place of a questionnaire answer.
A source scan has limits. It finds cryptography in code, but not keys in a hardware module or the settings of a server you run. Treat it as the base of the inventory and add those by hand.
Quantum Core produces a CycloneDX 1.6 CBOM checked against the official schema, locally. Functor's own CBOM is published in full.
What does CBOM stand for?
Cryptography bill of materials, sometimes written cryptographic bill of materials.
Is a CBOM required by law?
Not generally. It is a format. What is expected is the inventory, for example in NIST's and the NCSC's migration guidance.
Which standard should I use?
CycloneDX 1.6 or later is the widely used format for cryptographic assets.