Engineering
Building a CBOM: the CycloneDX fields that matter
A cryptographic bill of materials is only useful if it captures the right fields. Here's a real sample and how to read it.
The CBOM is a graph, not a list
CycloneDX 1.6 added cryptoProperties, the fields that turn an SBOM into a CBOM. The ones that matter:
{
"type": "cryptographic-asset",
"cryptoProperties": {
"assetType": "algorithm",
"algorithmProperties": {
"primitive": "signature",
"parameterSetIdentifier": "RSA-2048",
"nistQuantumSecurityLevel": 0
}
}
}A nistQuantumSecurityLevel of 0 is the flag: this asset offers no quantum resistance. Multiply that across every certificate, library and key handle and you have your migration backlog.
Reading it
Don't read a CBOM top to bottom. Query it: "every code-signing key whose signatures must verify past 2035", "which services transitively depend on this OpenSSL 1.1.1 container". That's what Dhiti Discover's Cryptographic Asset Graph is for, the questions a flat inventory can't answer.