cid 81765b9a68f1c070622a790c501609770430414d00b8a1f034cf70cde3c3ee23 · original · open access · via openalex
Title: The Anatomy of Cryptography Bills of Materials: Standardization and Practice in CycloneDX Authors: Basil Hess Venue: Communications in computer and information science Year: 2026 Canonical: doi:10.1007/978-3-032-28946-9_1 URL: https://doi.org/10.1007/978-3-032-28946-9_1 Collector: openalex OA: true ABSTRACT The migration to post-quantum cryptography (PQC) and increasing regulatory requirements such as the EU Cyber Resilience Act and DORA, increase the demand for comprehensive visibility into cryptographic assets across software systems. A Cryptography Bill of Materials (CBOM) provides a standardized inventory of cryptographic algorithms, protocols, certificates, and related material used within software components and services. This paper presents the anatomy of CBOMs as standardized in OWASP CycloneDX (ECMA-424), examining the object model for cryptographic assets, dependency relationships, and evidence capture. We analyze how CBOMs integrate with the broader xBOM ecosystem, including Software (SBOM), Operations (OBOM), Hardware (HBOM), and SaaS BOMs, to provide full-stack cryptographic transparency. Through practical use cases, we demonstrate how CBOMs enable policy-based compliance evaluation, support hybrid PQC migration strategies, and facilitate cryptographic agility. We discuss challenges in CBOM generation including naming ambiguities, configuration-driven cryptography, and the distinction between provision of cryptography and consumption. Finally, we outline evolution toward future CBOM revisions.