Glossary
Decode the vocabulary.
Plain-language definitions of the formats, algorithms, and policy terms you will meet while building a CBOM — written for engineers and program leaders alike.
29 of 29 terms
- Algorithm Cryptography
- A defined mathematical procedure for encryption, signing, or hashing — for example AES-256-GCM or ML-DSA. In a CBOM, each algorithm is its own asset so it can be tracked and replaced.
- assetType Formats
- The CycloneDX field that says what kind of cryptographic asset a component is: algorithm, protocol, certificate, or related material such as a key. Tools rely on it to interpret the rest of the entry.
- Asymmetric encryption Cryptography
- Cryptography using a public key and a private key, such as RSA or elliptic-curve schemes. These are the families most exposed to future quantum computers.
- bom-ref Formats
- A unique identifier for an element inside a CycloneDX document. Relationships like dependsOn and provides point at bom-refs, so every asset needs one.
- CBOM Formats
- A Cryptography Bill of Materials: a structured inventory of the cryptographic assets inside software or hardware — algorithms, protocols, certificates, and keys — and how they relate to each other.
- Certificate Cryptography
- A signed document binding a public key to an identity, usually following the X.509 standard. In a CBOM, certificates are tracked with their issuer and signature algorithm.
- CNSA 2.0 Policy
- The US National Security Agency's Commercial National Security Algorithm Suite 2.0 — its timeline for moving national-security systems to post-quantum algorithms between 2025 and 2033.
- Component Formats
- One entry in a CycloneDX document. A component can be an application, a library, or — for a CBOM — a cryptographic asset with cryptoProperties attached.
- CRQC Quantum
- A cryptographically relevant quantum computer: one large and reliable enough to break today's public-key cryptography. It does not exist yet, which is exactly why inventories are built now.
- Crypto-agility Quantum
- The ability to swap cryptographic algorithms without redesigning the system. A CBOM is a prerequisite: you cannot replace what you have not inventoried.
- cryptoProperties Formats
- The CycloneDX object that carries everything cryptographic about a component — its assetType plus algorithm, protocol, or certificate details.
- CycloneDX Formats
- An open standard for software bills of materials, maintained by OWASP. Versions 1.6 and 1.7 added native support for cryptographic assets, making it the common CBOM format.
- Dependency graph Formats
- The map of relationships in a CycloneDX document: which application uses which protocol, and which protocol provides which algorithm. Built from dependsOn and provides entries.
- Digital signature Cryptography
- A mathematical proof that data came from a holder of a private key — used in certificates, code signing, and protocols. Today's schemes (RSA, ECDSA) migrate to ML-DSA.
- Executive Order 14412 Policy
- The 2026 US executive order directing federal agencies to inventory their cryptography and prepare for post-quantum migration — a major driver of CBOM adoption.
- Harvest now, decrypt later Quantum
- An attack where adversaries record encrypted traffic today to decrypt it once a capable quantum computer exists. It makes long-lived secrets urgent to protect, even before CRQCs arrive.
- Hash function Cryptography
- A one-way function that maps data to a fixed-length fingerprint — SHA-256, SHA-3, and the broken SHA-1. Hashes mostly survive quantum attacks; output length is what matters.
- HMAC Cryptography
- A keyed hash used to verify both the integrity and authenticity of a message. Its post-quantum outlook follows the underlying hash function.
- Key establishment Cryptography
- How two parties agree on a shared secret — today usually ECDH or finite-field Diffie–Hellman. These move to ML-KEM, the NIST key-encapsulation standard.
- ML-DSA Quantum
- The NIST standard for post-quantum digital signatures, published as FIPS 204 and derived from CRYSTALS-Dilithium. The planned successor to RSA and ECDSA signatures.
- ML-KEM Quantum
- The NIST standard for post-quantum key establishment, published as FIPS 203 and derived from CRYSTALS-Kyber. The planned successor to ECDH key exchange.
- OMB M-26-15 Policy
- US Office of Management and Budget guidance implementing the post-quantum executive order, including expectations for agency cryptographic inventories.
- Post-quantum cryptography Quantum
- Algorithms designed to resist attacks from quantum computers while running on ordinary hardware. NIST standardized the first families in 2024: ML-KEM, ML-DSA, and SLH-DSA.
- Protocol Cryptography
- A ruleset that combines algorithms into a working system — TLS, IPsec, SSH. In a CBOM, a protocol asset links to the algorithms it negotiates.
- SBOM Formats
- A Software Bill of Materials: the inventory of software components in a product. A CBOM extends the same idea to cryptography, and CycloneDX carries both in one document.
- SLH-DSA Quantum
- The NIST hash-based signature standard, FIPS 205, derived from SPHINCS+. A conservative backup to ML-DSA based on different mathematics.
- Symmetric encryption Cryptography
- Encryption where the same key encrypts and decrypts — the AES family. Quantum computers only weaken it modestly; moving to 256-bit keys is the standard answer.
- TLS Cryptography
- Transport Layer Security, the protocol protecting most internet traffic. A CBOM records the TLS version and the cipher suites and key exchange it negotiates.
- X.509 Cryptography
- The standard format for public-key certificates used in TLS, code signing, and identity systems. Certificate readiness follows the issuer's signature algorithm.
Keep going
Put the vocabulary to work.
Learn the five-minute CBOM essentials, then build your first inventory with the guided Builder.