CBOM: Cryptography Bill of Materials

Name: ScanRook
Author: ScanRook

A CBOM inventories every cryptographic asset in your software: the crypto libraries you link against, the certificates baked into your images, the private keys that should never have shipped, and the protocol versions your services negotiate. ScanRook generates a CycloneDX 1.6 CBOM alongside its SBOM during container scans — no extra tooling, no separate pass.

Why You Need a CBOM

Post-quantum migration and crypto policy enforcement both start with an inventory.

You cannot migrate cryptography you do not know you have. NIST has finalized post-quantum algorithms, and regulators are already asking organizations to produce migration timelines. The first deliverable in every one of those timelines is the same: a complete inventory of cryptographic assets. That is a CBOM.

Beyond quantum readiness, a CBOM answers day-to-day security questions: Is anything in production still signed with SHA-1? Did an expired certificate ship inside that image? Is there an RSA-1024 key pair in a config directory? Did a developer accidentally bake a private key into a layer? These issues hide inside images that pass every vulnerability scan, because they are not CVEs — they are cryptographic hygiene failures.

ScanRook emits its CBOM in CycloneDX 1.6 format using the standard cryptographic-asset component type with cryptoProperties, so it plugs into any toolchain that already consumes CycloneDX.

What ScanRook Collects

Four collectors run over the extracted image filesystem and package inventory.

Crypto libraries

The package inventory and ELF dynamic dependencies are classified against a curated list of cryptographic libraries (OpenSSL, BoringSSL, GnuTLS, libsodium, mbedTLS, wolfSSL, libgcrypt, NSS, Bouncy Castle, pyca/cryptography, golang.org/x/crypto, ring, rustls, and more). Each match includes the version and any CVE findings from the same scan.

Certificates

The extracted filesystem is walked for .pem, .crt, .cer, .der, .p12, and .pfx files plus PEM CERTIFICATE blocks in config directories. Each certificate is parsed for subject, issuer, expiry, signature algorithm, and key algorithm/size, then flagged for weaknesses.

Private keys

PEM private key blocks (RSA, EC, PKCS#8, OpenSSH) found in the image are reported as CBOM entries AND raised as HIGH severity findings — private key material should never ship inside an image. Encrypted PKCS#12 containers are noted without any cracking attempt.

Protocol hints

Known configuration files (nginx ssl_protocols, openssl.cnf MinProtocol, sshd_config) are parsed for TLS/SSH protocol versions where trivially extractable. These are best-effort and always marked with confidence: heuristic.

Weakness Flags

Certificates are automatically flagged for common cryptographic weaknesses.

Flag	Meaning
`expired`	Certificate notAfter date is in the past.
`expires-soon`	Certificate expires within 90 days.
`sha1-signature`	Certificate is signed with SHA-1, which is broken for collision resistance.
`weak-rsa`	RSA key is shorter than 2048 bits.
`weak-ec`	Elliptic curve key uses a curve weaker than 256 bits.

Generating a CBOM

Pass --cbom to any container or auto-detect scan. Requires scanner 1.18 or newer.

CBOM generation is available on all plan tiers. Add the flag to your scan command:

# CBOM section embedded in the scan report
scanrook scan image.tar --cbom

# Additionally write a standalone CycloneDX 1.6 CBOM file
scanrook scan image.tar --cbom --cbom-out cbom.cdx.json

The report JSON gains a top-level cbom section with the collected assets and a summary block (crypto library count, certificate count, expired/weak certificates, private keys). The optional --cbom-out file is pure CycloneDX 1.6 JSON, suitable for handing to compliance tooling.

Viewing CBOMs in the Dashboard

Every scan detail page has a CBOM tab next to the SBOM tab.

When a scan completes with CBOM enabled, the job detail page in the dashboard shows a CBOM tab with summary cards (crypto libraries, certificates, expired, weak, private keys), a color-coded certificate table, a crypto library table with linked CVE counts, a private key list, and collapsed protocol hints.

Scans produced by scanner versions older than 1.18, or run without --cbom, show an empty state in the tab — everything else about the scan is unaffected.