Creating a Cryptography Bill of Materials (CBOM)

The Cryptography Bill of Materials (CBOM) is a .json file that is produced to summarize the static code cryptographic inventory. It includes details about the cryptographic artifacts, dependencies between protocols and cryptographic libraries, and vulnerabilities. This file can then be shared with the software supply chain to help manage the life cycle of the cryptography in applications.

To learn more about the CBOM schema and to see examples, visit the github.com/IBM/CBOM GitHub repository.

In IBM Quantum Safe Explorer, the CBOM is exported as a .json file. Whenever a project scan is initiated, IBM Quantum Safe Explorer will generate an updated CBOM file so that you have the most up-to-date schema.