Full Report
Post-quantum readiness depends on knowing where cryptography lives in the software you run, and a list of components can't tell you that.
Analysis Summary
# Best Practices: Post-Quantum Cryptography (PQC) Readiness via CBOM
## Overview
These practices address the critical visibility gap in software security regarding cryptographic assets. While Software Bills of Materials (SBOMs) identify components, a Cryptography Bill of Materials (CBOM) identifies the specific algorithms, protocols, and keys residing within those components. This is essential for migrating away from quantum-vulnerable algorithms (like RSA and ECC) to quantum-resistant standards.
## Key Recommendations
### Immediate Actions
1. **Adopt a CBOM Standard:** Commit to using the **OWASP CycloneDX 1.6/1.7** (ECMA-424) standard for cryptographic inventory to ensure machine-readability and interoperability.
2. **Audit High-Risk Dependencies:** Identify applications utilizing legacy primitives known to be quantum-vulnerable, specifically **RSA, ECC, SHA-1, MD5, and DES**.
3. **Differentiate SBOM from CBOM:** Ensure security teams understand that a library version (found in an SBOM) does not necessarily indicate which specific algorithm or key size is actually being invoked (found in a CBOM).
### Short-term Improvements (1-3 months)
1. **Inventory Cryptographic Assets:** Catalog algorithms, certificates, protocols, and related materials (public/private/secret keys) across all internal and third-party software.
2. **Map Dependencies:** Document the relationships between software components and the cryptographic assets they provide or rely upon to understand the "blast radius" of future algorithm deprecations.
3. **Identify "Shadow" Cryptography:** Use binary analysis or scanning tools to find cryptography compiled into commercial applications, statically linked libraries, and firmware where source code is unavailable.
### Long-term Strategy (3+ months)
1. **Continuous PQC Readiness Assessment:** Integrate CBOM generation into the CI/CD pipeline to maintain an up-to-date inventory of algorithm families and elliptic curves.
2. **Supply Chain Enforcement:** Require third-party software vendors to provide a CBOM alongside their SBOM as part of the procurement and risk management process.
3. **Migration Pathing:** Use CBOM data to create a prioritized replacement schedule for transitioning to NIST-approved PQC algorithms.
## Implementation Guidance
### For Small Organizations
- Focus on identifying cryptographic assets in public-facing applications using open-source scanning tools.
- Maintain a basic CBOM for primary internal codebases to avoid "rolling your own" crypto mistakes.
### For Medium Organizations
- Implement automated CBOM generation for all internal software development.
- Start requesting CBOMs from critical SaaS and software vendors to assess external quantum risk.
### For Large Enterprises
- Centralize cryptographic inventory using automated platforms that can analyze binary and closed-source software.
- Use **CycloneDX 1.7** to standardize lists of algorithm families across global business units.
- Establish a "Crypto-Agility" task force to manage the transition from legacy RSA/ECC to PQC standards.
## Configuration Examples
While specific code snippets depend on the tool used, a valid **CycloneDX 1.6+** CBOM should include:
- `cryptoProperties`: Defining the asset type (algorithm, certificate, or protocol).
- `oid`: Object Identifiers for specific algorithms.
- `keySize`: E.g., 2048 for RSA.
- `dependencies`: Linking a component (e.g., OpenSSL) to the specific algorithm being used (e.g., AES-GCM).
## Compliance Alignment
- **OWASP CycloneDX 1.6/1.7:** The technical standard for CBOM data structures.
- **ECMA-424:** The international standard for cryptographic bill of materials.
- **NIST PQC Standards:** The target algorithms for migration identified through CBOM discovery.
## Common Pitfalls to Avoid
- **Relying Solely on SBOMs:** Assuming that knowing the library (e.g., OpenSSL) is sufficient for quantum readiness.
- **Ignoring Statically Linked Code:** Failing to scan compiled binaries where cryptography is "baked in" and not listed as a separate file.
- **Manual Inventory:** Attempting to track certificates and algorithms in spreadsheets; cryptography changes too frequently for manual tracking.
## Resources
- **OWASP CycloneDX Standard:** [https://cyclonedx.org](https://cyclonedx.org)
- **Ecma International (ECMA-424):** [https://ecma-international.org](https://ecma-international.org)
- **NIST Post-Quantum Cryptography Project:** [https://csrc.nist.gov/projects/pqc-dig-sig](https://csrc.nist.gov/projects/pqc-dig-sig)