Cryptographic Algorithm

Introduction

Inventorying cryptographic assets is a foundational best practice for post-quantum cryptography (PQC) readiness, as emphasized by NIST SP 1800-38B. CycloneDX Cryptography Bill of Materials (CBOM) provides a structured way to document algorithms, keys, and protocols, helping organizations assess risks, ensure compliance, and prepare for the transition to quantum-safe systems.

Cryptographic algorithms form the core of data security but are vulnerable to evolving threats, including quantum advancements. By cataloging algorithms and their dependencies, CBOM enables proactive identification of weak implementations, supports cryptographic agility, and facilitates compliance with emerging standards.

Highlighted fields

PropertyUsage Description
assetTypeSpecifies the category of the cryptographic asset, such as algorithm, certificate, protocol, or related-crypto-material.
primitiveFundamental cryptographic routines, such as encryption, hashing, or key agreement, used as building blocks for cryptographic systems and protocols.
parameterSetIdentifierRepresents the specific configuration or attributes of a cryptographic algorithm, such as key length or digest size that define its operational characteristics.
modeDefines the operational mode of a cryptographic block cipher, such as CBC or GCM, determining how the algorithm processes data for encryption or decryption.
certificationLevelThe certification that the implementation of the cryptographic algorithm has received, if any. Certifications include revisions and levels of FIPS 140 or Common Criteria of different Extended Assurance Levels (CC-EAL).
cryptoFunctionsLists the cryptographic functions the algorithm supports, such as key generation, encryption, decryption, signing, or verification, detailing its capabilities within a cryptographic system.
classicalSecurityLevelRepresents the algorithm's security strength against classical computational attacks, often measured in bits, indicating the effort required to break the encryption using traditional computing methods
nistQuantumSecurityLevelSpecifies the algorithm's security level as defined by NIST in the context of quantum-resistant cryptography, assessing its robustness against potential quantum computing attacks.
oidThe object identifier, a globally unique identifier assigned to the algorithm, facilitating unambiguous reference across systems and standards.
The example demonstrates the use of multiple cryptographic primitives, combining a symmetric cipher and a hash function to achieve both data confidentiality and integrity.

Examples

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:e8c355aa-2142-4084-a8c7-6d42c8610ba2",
  "version": 1,
  "metadata": {
    "timestamp": "2024-01-09T12:00:00Z",
    "component": {
      "type": "application",
      "name": "my application",
      "version": "1.0"
    }
  },
  "components": [
    {
      "type": "cryptographic-asset",
      "name": "AES-128-GCM",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "ae",
          "parameterSetIdentifier": "128",
          "mode": "gcm",
          "executionEnvironment": "software-plain-ram",
          "implementationPlatform": "x86_64",
          "certificationLevel": [ "none" ],
          "cryptoFunctions": [ "keygen", "encrypt", "decrypt", "tag" ],
          "classicalSecurityLevel": 128,
          "nistQuantumSecurityLevel": 1
        },
        "oid": "2.16.840.1.101.3.4.1.6"
      }
    },
    {
      "name": "SHA512withRSA",
      "type": "cryptographic-asset",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "signature",
          "parameterSetIdentifier": "512",
          "executionEnvironment": "software-plain-ram",
          "implementationPlatform": "x86_64",
          "certificationLevel": [ "none" ],
          "cryptoFunctions": [ "sign", "verify" ],
          "nistQuantumSecurityLevel": 0
        },
        "oid": "1.2.840.113549.1.1.13"
      }
    }
  ]
}

Related Guides and Resources