Browser-local CBOM comparison

Spot the drift.

Paste an earlier and a later CycloneDX CBOM to see what cryptography was added, removed, or changed. Both documents stay on this device.

Local onlyValidate a CBOM

Earlier

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "version": 1,
  "metadata": { "component": { "bom-ref": "app", "type": "application", "name": "sample-gateway", "version": "1.0" } },
  "components": [
    { "bom-ref": "tls", "type": "cryptographic-asset", "name": "TLS 1.2", "cryptoProperties": { "assetType": "protocol" } },
    { "bom-ref": "aes", "type": "cryptographic-asset", "name": "AES-128-CBC", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "block-cipher", "parameterSetIdentifier": "128/CBC" } } },
    { "bom-ref": "rsa", "type": "cryptographic-asset", "name": "RSA-2048", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "signature", "parameterSetIdentifier": "2048" } } },
    { "bom-ref": "sha", "type": "cryptographic-asset", "name": "SHA-1", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "hash" } } }
  ],
  "dependencies": [
    { "ref": "app", "dependsOn": ["tls"] },
    { "ref": "tls", "dependsOn": ["aes", "rsa", "sha"] }
  ]
}

Later

Comparison result

Differences detected

Added: +2 added
Removed: −3 removed
Changed: ~0 changed
Unchanged: =1 same

5 differences found

2 added, 3 removed, 0 changed, 1 unchanged.

Vulnerable cryptography retired

SHA-1 no longer appears in the newer inventory.

Added2

TLS 1.3protocol
Protocol readiness depends on the negotiated algorithms inside it.
AES-256-GCMalgorithm
AES-256 is considered sufficient against Grover-style attacks.

Removed3

TLS 1.2protocol
Protocol readiness depends on the negotiated algorithms inside it.
AES-128-CBCalgorithm
Symmetric crypto survives, but prefer AES-256 key sizes.
SHA-1algorithm
SHA-1 is broken classically; replace with SHA-2 or SHA-3.

Changed0

Nothing changed.

Assets are matched by name. Readiness labels are explanatory heuristics — not certification. Never paste private keys or secrets.