Advancing Cryptographic Transparency: CBOM Standardization in CycloneDX
summary
CycloneDX already embeds a Cryptography BOM: CBOM became part of CycloneDX 1.6 and is now an ECMA-backed standard, and 1.7 (released last week) adds standardized algorithm naming, an endorsed list of elliptic curves, and certificate lifecycle states (preactive through destroyed). The spec adds directed dependencies and an evidence model with confidence scores, a combiner primitive to mark hybrid PQC+classical constructions, links to HSM and SaaS descriptors, and supports configuration-driven inventories; a raw scan found 164 OpenSSL occurrences but context changes risk, and migration timelines target completion by 2033.
AI-written summary · about
chapters (15)
- 0:00Conference introduction
- 1:26What is CBOM
- 2:49Why CBOM now and challenges
- 6:22CycloneDX features
- 7:50CycloneDX evolution
- 9:36CycloneDX object model
- 13:14Dependencies and hybrid cryptography
- 15:40Configuration-driven cryptography
- 17:04Hardware and HSM cryptography
- 18:29Cloud services cryptography
- 18:50Manufacturing BOM for cryptographic modules
- 19:54CycloneDX 1.7 cryptography features
- 21:03Naming ambiguities in algorithms
- 22:30Standardizing cryptographic definitions
- 24:17Tooling and CBOM adoption
related talks
21mCryptography at Scale: Building a Practical Cryptographic...
37mSecuring OSS across the whole supply chain and beyond
23mTowards declaring crypto algorithms in SBOMs: crypto_algorithms_open_dataset
42mBoF: State of SBOM Tools
31mOpenChain’s Strategic Direction for 2027 in Global Practices
36mUse Cryptography; Don't Learn It
44mNavigating Open Source and Open Standards for Better Cybersecurity
46mSCA for Containers: The Good, the Bad, and the Truth