About CBOM

The Cryptographic Bill of Materials (CBOM) is an open specification for enumerating cryptographic dependencies in software systems, infrastructure, and hardware. It provides a standardized, machine-readable format for understanding what cryptography is deployed where — the critical first step in post-quantum migration and cryptographic compliance.

Why We Built This

With NIST's 2035 deadline for deprecating classical asymmetric cryptography and CNSA 2.0 requiring post-quantum algorithms in National Security Systems by 2030, every organization needs a complete inventory of their cryptographic dependencies. Existing approaches — extending SBOM formats with cryptographic properties — fall short because cryptographic inventory has fundamentally different requirements: different lifecycle cadences, different stakeholders, infrastructure-layer coverage, and protocol negotiation complexity that software inventory formats weren't designed to handle.

Maintained By

Attested Intelligence Holdings LLC specializes in cryptographic compliance infrastructure and standards development. The company maintains the CBOM specification, the cbom.io website, and open source CBOM tooling.

Related Resources

• mldsa.io — ML-DSA (Module-Lattice-Based Digital Signature Algorithm) resources
• mlkem.io — ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) resources

License

• Specification: CC-BY-4.0
• Code: Apache License 2.0

Contact

For specification feedback, partnership inquiries, or general questions: info@attestedintelligence.com