Why a Cryptography Bill of Materials Is Essential for Post-Quantum Readiness
Summary
A CBOM inventories cryptographic assets and maps them to software components, helping organizations find quantum-vulnerable algorithms that an SBOM may miss and prioritize post-quantum migration.
Key points
- A CBOM records cryptographic algorithms, certificates, protocols, keys, parameters, and their dependencies on software components.
- An SBOM identifies software components but may not show which cryptographic algorithms an application uses, their key sizes, or bundled certificates.
- Cryptography can be hidden in closed-source products, statically linked libraries, firmware, container images, and vendor SDKs.
- The article recommends analyzing compiled software artifacts to establish a more reliable inventory than source scans, manifests, or vendor questionnaires alone.
- A useful CBOM should cover built and purchased software, map assets to components, use a standard format, and be regenerated with each release.
- Organizations can use the inventory to prioritize migration by business risk; the article identifies RSA, ECC, SHA-1, MD5, and DES as examples to assess.
- NIST finalized three post-quantum standards in August 2024; the article also cites draft transition timelines and the risk of harvest-now, decrypt-later attacks.
Article Details
- Topic
- Cryptography bills of materials (CBOMs) for discovering cryptographic assets and supporting post-quantum cryptography migration
People
Charlie JonesIdentified as former senior director of product management at ReversingLabs; quoted on aligning cryptographic inventories with migration plans.Dustin MoodyIdentified as a mathematician and head of the PQC standardization project at NIST; quoted on integrating finalized post-quantum standards.Jen EasterlyIdentified as former director of CISA; quoted on preparing for post-quantum cryptography migration.Michael OsborneQuoted as CTO of IBM Quantum Safe on CBOMs and cryptographic asset dependencies.
Vendors
CISAFederal guidance acknowledges the gap. The 2023 quantum-readiness factsheet from CISA, the NSA, and NIST recommends automated discovery across network protocols, applications, and development pipelines, while cautioningIBMpiece of software and their relationships to the components that provideuse them. The concept came out of IBM Research and was standardized in OWASP CycloneDX 1.6, released in April 2024 and ratified two months laterNISTFederal guidance acknowledges the gap. The 2023 quantum-readiness factsheet from CISA, the NSA, and NIST recommends automated discovery across network protocols, applications, and development pipelines, while cautioningNSAFederal guidance acknowledges the gap. The 2023 quantum-readiness factsheet from CISA, the NSA, and NIST recommends automated discovery across network protocols, applications, and development pipelines, while cautioningReversingLabstool for tracking a vulnerable library version, a license obligation, or a component's origin. But as ReversingLabs' guidance on going beyond the SBOM puts it, an SBOM on its own "is merely a list of ingredients." UtimacoMany organizations are already moving. A 2025 Utimaco survey of more than 200 organizations in the U.S., the UK, and Germany found that 20% had begun migrating to PQC and another 34% planned to start within one to three
Products
CycloneDXthe components that provideuse them. The concept came out of IBM Research and was standardized in OWASP CycloneDX 1.6, released in April 2024 and ratified two months later as Ecma International's ECMA-424 standard.liboqsAdopt quantum-safe libraries. Open-source projects such as the Open Quantum Safe project's liboqs give developers tested implementations to build on.OpenSSLdepends on how those ingredients are used. An SBOM entry showing that an application ships a particular OpenSSL version confirms that a cryptographic library is present. It says nothing about which of the library's