Short answer: A Cryptography Bill of Materials (CBOM) is, according to an OWASP CycloneDX guide, an object model to describe cryptographic assets and their dependencies, supported in CycloneDX version 1.6 and higher. The guide calls discovering and reporting on cryptographic assets the first step on the migration journey to quantum-safe systems. These are the format maintainers' own descriptions, and a CBOM is an inventory, not a security guarantee.
What a CBOM is
An OWASP CycloneDX guide defines a Cryptography Bill of Materials (CBOM) as an object model to describe cryptographic assets and their dependencies. It says support for CBOM is included in CycloneDX version 1.6 and higher. The guide says the overall design goal is an abstraction that allows modeling and representing cryptographic assets in a structured object format.
Why dependencies matter
The guide says cryptography is typically buried deep within components used to compose and build systems and applications, and that it makes sense to minimize the effort through alignment and reuse of concepts and components used to implement Software Supply Chain Security (SSCS). It also lists capturing crypto asset dependencies as a goal: to understand the impact of a cryptographic asset, it is important to capture its dependencies, because cryptographic libraries implement certain algorithms and protocols but that does not by itself show how applications use them.
How assets are described
A CycloneDX use-case page lists properties for describing assets. It says assetType specifies the category of the cryptographic asset, such as algorithm, certificate, protocol or related-crypto-material, and that cryptoFunctions lists the cryptographic functions an algorithm performs, such as key generation, encryption, decryption, signing or verification. A second CycloneDX page says CycloneDX can represent algorithms, keys, certificates and their relationships to software components.
Why inventorying comes first
The OWASP CycloneDX guide says discovering, managing and reporting on cryptographic assets is necessary as the first step on the migration journey to quantum-safe systems and applications. A CycloneDX use-case page says inventorying cryptographic assets is a foundational best practice for post-quantum cryptography (PQC) readiness, as emphasized by NIST SP 1800-38B.
The same use-case page says that by cataloging algorithms and their dependencies, a CBOM enables proactive identification of weak implementations, supports cryptographic agility and facilitates compliance with emerging standards. The CycloneDX capabilities page says such granularity allows organizations to assess the robustness of their cryptographic implementations and address weaknesses like the use of deprecated algorithms or expired certificates. These are the CycloneDX project's own descriptions of its format.
What this does not tell you
These pages are from the project that maintains the format, so treat their benefit claims as the project's claims. This article summarises them and does not describe any tool, deployment, or compliance outcome. A CBOM is an inventory format, and none of the pages claims that it makes a system quantum-safe.
FAQ
What is a CBOM?
The OWASP CycloneDX guide defines it as an object model to describe cryptographic assets and their dependencies.
Which CycloneDX version supports it?
Version 1.6 and higher, according to the guide.
What kinds of assets can it describe?
A CycloneDX page lists assetType values of algorithm, certificate, protocol and related-crypto-material, and says it can represent algorithms, keys and certificates and their relationships to software components.
Why does it matter for post-quantum migration?
The guide says discovering, managing and reporting on cryptographic assets is necessary as the first step on the migration journey to quantum-safe systems. A CycloneDX page cites NIST SP 1800-38B for inventorying as a foundational best practice.
Does a CBOM make a system quantum-safe?
No source here says so. It is an inventory format that helps identify what needs attention.
All field notes