CBOM.net

Known-good starting points

Examples you can use.

Study a small CycloneDX 1.7 CBOM, load it into the Playground, or use the supplier questions to improve what you receive.

Minimal application CBOM

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "version": 1,
  "metadata": { "component": { "bom-ref": "app", "type": "application", "name": "sample-gateway" } },
  "components": [
    { "bom-ref": "tls", "type": "cryptographic-asset", "name": "TLS 1.3", "cryptoProperties": { "assetType": "protocol" } },
    { "bom-ref": "aes", "type": "cryptographic-asset", "name": "AES-256-GCM", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "block-cipher", "parameterSetIdentifier": "256/GCM" } } },
    { "bom-ref": "rsa", "type": "cryptographic-asset", "name": "RSA-2048", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "signature", "parameterSetIdentifier": "2048" } } }
  ],
  "dependencies": [
    { "ref": "app", "dependsOn": ["tls"] },
    { "ref": "tls", "dependsOn": ["aes", "rsa"] }
  ]
}
Open in Playground

Procurement checklist

Ask suppliers for CBOMs you can actually use.

  • 01Which product release and configuration does this CBOM represent?
  • 02How was cryptography discovered, and what could the method miss?
  • 03Are dependsOn and provides relationships distinguished?
  • 04Are algorithm variants, parameters, curves, and modes specific?
  • 05How often will an updated CBOM be supplied?
  • 06Does the file contain metadata only, never private key material?