CBOM Generator
A post-quantum migration starts with knowing where your cryptography is. This generator builds a cryptographic bill of materials (CBOM) in CycloneDX 1.7 JSON: list the components and services of a system, add the algorithms, certificates, protocols and keys they use, and the JSON builds as you type. Each algorithm is checked against NIST IR 8547 (final, October 2026), which deprecates RSA, ECDSA, EdDSA, DH, ECDH and MQV after 2030 and disallows them after 2035.
Want to see the format first? Download the sample CBOM (a fictional web app, valid CycloneDX 1.7) or open it in the CBOM Analyzer.
1. The system
2. Components and services
The parts of the system that use cryptography. Each crypto asset is attached to one or more of these, written as a dependency in the CBOM.
3. Cryptographic assets
One entry per algorithm, certificate, protocol or key. For algorithms, pick from the catalogue to fill the CycloneDX fields, OID and NIST category from NIST sources, then adjust.
A cipher, signature scheme, KEM, key agreement or hash, e.g. RSA-2048, AES-256-GCM, ML-KEM-768.
Name at least one cryptographic asset, or press Load sample, to see the CBOM.
TL;DRWhat this generator does
4 points
- Name the components and services of a system, then add each cryptographic asset: an algorithm, a certificate, a protocol or related material such as a key.
- For algorithms, pick from a catalogue built from NIST sources to fill the CycloneDX fields: primitive, family, parameter set, OID where NIST registers one, classical bits and the NIST quantum security level.
- The CycloneDX 1.7 JSON builds live as you type. Each asset shows whether it is quantum-vulnerable and its NIST IR 8547 (final, October 2026) dates.
- Load sample fills a fictional web app: TLS 1.2 and 1.3, an RSA-2048 certificate, ECDSA P-256 code signing, AES-256-GCM at rest, SHA-1 in a legacy integration and a hybrid X25519MLKEM768 pilot. Everything runs in your browser. Copying and downloading your JSON are available with a paid plan; the sample file is a free download.
Sources
- CycloneDX specification overview (1.7, released 21 October 2025) and the Authoritative Guide to CBOM, 2nd edition. Two values in the guide's examples are wrong: ML-KEM-1024's OID is 2.16.840.1.101.3.4.4.3 (NIST CSOR), and FIPS 204 claims category 2 for ML-DSA-44. The catalogue here uses the NIST values.
- NIST IR 8547 (final, 27 October 2026), FIPS 203, 204 and 205, and the NIST Computer Security Objects Register for OIDs.
- OMB M-26-15 (24 June 2026) and Executive Order 14412 (22 June 2026).
- Open-source CBOM tools: CBOMkit, sonar-cryptography, cbomkit-theia and cbomkit-action (Post-Quantum Cryptography Alliance).
Frequently asked questions
What is a CBOM?
A cryptographic bill of materials (CBOM) is an inventory of the cryptography in a piece of software or hardware: algorithms, certificates, protocols and keys, and where each is used. CycloneDX added CBOM support in version 1.6; the current version is 1.7 (21 October 2025). OMB M-26-15 calls a continuously updated inventory of all cryptographic assets "the foundation of the migration plan" and says the data should populate a central CBOM.
What does a CBOM example look like?
Each crypto asset is a component of type "cryptographic-asset" with a cryptoProperties object. Its assetType is algorithm, certificate, protocol or related-crypto-material. An algorithm carries fields such as primitive (for example signature or kem), parameterSetIdentifier, cryptoFunctions, classicalSecurityLevel, nistQuantumSecurityLevel and an OID. Download our sample CBOM to see a full, valid CycloneDX 1.7 file for a fictional web app.
What is a CycloneDX CBOM?
It is a CycloneDX BOM that lists cryptographic assets. CycloneDX 1.7 is also published as ECMA-424. In 1.7, the only required cryptoProperties field is assetType; 1.7 adds algorithmFamily and ellipticCurve, and deprecates algorithmRef, signatureAlgorithmRef, subjectPublicKeyRef and cryptoRefArray in favour of relatedCryptographicAssets. A 1.6 CBOM stays valid, but new output should use the 1.7 names, which this generator does.
How do I create a cryptographic bill of materials?
Start with discovery. OMB M-26-15 lists software composition analysis of SBOMs, static and dynamic application security testing to find cryptographic functions in code, and network scanners to detect protocols and cipher suites. Open-source tools from CBOMkit, a Post-Quantum Cryptography Alliance (Linux Foundation) project, include a SonarQube plugin that detects cryptographic assets in source code, cbomkit-theia for container images and directories, and a GitHub Action. Use this generator to record what scanners miss, such as HSM keys, certificates and partner integrations, or to learn the format.
Which algorithms are quantum vulnerable?
NIST IR 8547 (final, October 2026) lists RSA, ECDSA, EdDSA, finite-field DH, ECDH and MQV as quantum-vulnerable and deprecates them after 2030 and disallows them after 2035, at every key size. OMB M-26-15 also lists DSA and tells agencies to treat any asymmetric algorithm not definitively known to be quantum-resistant as quantum-vulnerable. Symmetric algorithms with at least 128 bits of classical security, such as AES-128, AES-192 and AES-256, are believed to meet at least NIST category 1.
Is a CBOM required?
For US federal agencies, OMB M-26-15 builds the PQC migration on a cryptographic inventory and a central CBOM. Executive Order 14412 (22 June 2026) asks CISA, with NIST, to publish the minimum elements of a CBOM within 270 days, which by our arithmetic is about 19 March 2027. These bind federal agencies, not the private sector, but suppliers to agencies should expect to be asked for one.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.