You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: SBOM/en/0x30-Use_Cases.md
+79-20
Original file line number
Diff line number
Diff line change
@@ -86,9 +86,7 @@ CycloneDX is capable of describing the following types of components:
86
86
> system or design. They also aid Software Asset Management (SAM) and IT Asset Management (ITAM) systems in classifying
87
87
> the inventory of software and constituent parts.
88
88
89
-
90
-
Component identity is an essential requirement for managing inventory. CycloneDX supports multiple methods to assert
91
-
identity including:
89
+
CycloneDX supports multiple methods to assert identity including:
92
90
93
91
- Coordinates: The combination of the group, name, and version fields form the coordinates of a component.
94
92
- Package URL: [Package URL](https://github.com/package-url/purl-spec) (PURL) standardizes how software package metadata is represented so that packages can universally be identified and located regardless of what vendor, project, or ecosystem the packages belongs to.
@@ -102,26 +100,24 @@ information.
102
100
The following example illustrates component identity in CycloneDX.
CycloneDX also supports several identifiers specific to hardware devices. Refer to https://cyclonedx.org/capabilities/hbom/
@@ -519,6 +515,69 @@ Bill of Material (MBOM). The SBOM references the MBOM that describes the environ
519
515
all other considerations necessary to replicate a build with utmost precision. This capability allows other parties to
520
516
independently verify inputs and outputs from a build which can increase the software's assurance.
521
517
518
+
## Cryptography Asset Management
519
+
CycloneDX can describe a comprehensive inventory of cryptographic assets, encompassing keys,
520
+
certificates, tokens, and more. This is a requirement of the [OMB M-23-02](https://www.whitehouse.gov/wp-content/uploads/2022/11/M-23-02-M-Memo-on-Migrating-to-Post-Quantum-Cryptography.pdf),
521
+
where such a system is characterized as a [...”software or hardware implementation of one or more cryptographic algorithms
522
+
that provide one or more of the following services: (1) creation and exchange of encryption keys; (2) encrypted connections;
523
+
or (3) creation and validation of digital signatures.”]
524
+
525
+
CycloneDX provides a structured framework for organizations to catalog and track their cryptographic resources, facilitating
526
+
efficient management and ensuring security and compliance standards are met. By maintaining a detailed record of
527
+
cryptographic assets, including their usage, expiration dates, and associated metadata, CycloneDX enables proactive
528
+
monitoring and streamlined auditing processes. With CycloneDX, organizations can effectively safeguard their cryptographic
529
+
infrastructure, mitigate risks associated with unauthorized access or misuse, and maintain the integrity and confidentiality
530
+
of sensitive data across diverse digital environments.
531
+
532
+
## Identifying Weak Cryptographic Algorithms
533
+
CycloneDX enables organizations to discover weak algorithms or flawed implementations that could compromise security.
534
+
Through analysis of cryptographic data, including algorithms, key management practices, and usage patterns, organizations
535
+
can pinpoint areas of concern and prioritize remediation efforts. CycloneDX facilitates proactive identification of
536
+
weaknesses and vulnerabilities, allowing organizations to enhance the resilience of their cryptographic infrastructure
537
+
and mitigate the risk of exploitation, thereby bolstering overall cybersecurity posture and safeguarding sensitive data
538
+
against potential threats.
539
+
540
+
## Post-Quantum Cryptography (PQC) Readiness
541
+
CycloneDX is crucial in preparing applications and systems for an impending post-quantum reality, aligning with
542
+
guidance from the National Security Agency (NSA) and the National Institute of Standards and Technology (NIST). As
543
+
quantum computing advancements threaten the security of current cryptographic standards, CycloneDX provides a structured
544
+
approach to inventorying cryptographic assets and evaluating their resilience against quantum threats.
545
+
546
+
Most notably, public key algorithms like RSA, DH, ECDH, DSA or ECDSA are considered not quantum-safe. These algorithms
547
+
occur in various components and may be hardcoded in applications but are more commonly and preferably used via dedicated
548
+
cryptographic libraries or services. Developers often don’t directly interact with cryptographic algorithms such as RSA
549
+
or ECDH but use them via protocols like TLS 1.3 or IPsec, by using certificates, keys, or other tokens. With upcoming
550
+
cryptographic agility it becomes less common to put in stone (or software) the algorithms that will be used. Instead,
551
+
they are configured during deployment or negotiated in each network protocol session. CycloneDX is designed with these
552
+
considerations in mind and to allow insight into the classical and quantum security level of cryptographic assets and
553
+
their dependencies.
554
+
555
+
By cataloging cryptographic algorithms and their respective parameters, CycloneDX enables organizations to identify vulnerable
556
+
or weak components that require mitigation or replacement with quantum-resistant alternatives recommended by NSA and NIST.
557
+
Through comprehensive analysis and strategic planning facilitated by CycloneDX, organizations can proactively transition to
558
+
post-quantum cryptographic primitives, ensuring the long-term security and integrity of their systems and applications.
559
+
560
+
## Assess Cryptographic Policies and Advisories
561
+
A cryptographic inventory in machine-readable form brings benefits if one wants to check for compliance with
562
+
cryptographic policies and advisories. An example of such an advisory is [CNSA 2.0](https://media.defense.gov/2022/Sep/07/2003071834/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS_.PDF),
563
+
which was announced by NSA in September of 2022. CNSA 2.0 states, among other things, that National Security Systems (NSS)
564
+
for firmware and software signing needs to support and prefer CNSA 2.0 algorithms by 2025 and exclusively use them by 2030.
565
+
The advised algorithms are the stateful hash-based signature schemes LMS and XMSS from [NIST SP 800-208](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-208.pdf).
566
+
With a cryptographic inventory that documents the use of LMS and XMSS by such systems, compliance with CNSA 2.0 can be
567
+
assessed in an automated way.
568
+
569
+
## Identify Expiring and Long-Term Cryptographic Material
570
+
An RSA certificate expiring in one week poses less cryptographic risk than the same certificate expiring in 20 years.
571
+
Service downtime due to an expired certificate is another risk to be considered. Therefore, we argue that an inventory
572
+
that captures the life cycle of cryptographic material as allowed by CycloneDX gives context to an inventory that is
573
+
instrumental for managing cryptographic risk.
574
+
575
+
## Ensure Cryptographic Certifications
576
+
Higher cryptographic assurance is provided by certifications such as [FIPS 140-3](https://csrc.nist.gov/pubs/fips/140-3/final)
577
+
(levels 1 to 4) or [Common Criteria](https://www.commoncriteriaportal.org/) (EAL1 to 7). To obtain these certifications,
578
+
cryptographic modules need to undergo certification processes. For regulated environments such as FedRAMP, such
579
+
certifications are important requirements. CycloneDX allows the capture of certification levels of cryptographic assets
| BOM Lifecycles | bom.metadata.lifecycles[]| The stage in which data in the BOM was captured |
28
-
| BOM Generation Tools | bom.metadata.tools[]| The tool(s) used to create the BOM |
29
-
| Component Hash | bom.components[].hashes[]| The hash values of the file or package |
30
-
| Component License | bom.components[].licenses[]| The license(s) in which the component is released under |
31
-
| Component Evidence | bom.components[].evidence[].identity.*| The evidence of identity including the methods, techniques, and confidence of how components were identified |
32
-
| External References | bom.components[].externalReferences[]| Locations to advisories, version control and build systems, etc |
33
-
| Services | bom.services[].*| A complete inventory of services including endpoint URLs, data classifications, etc which the product and/or individual components rely on |
34
-
| Known Unknowns | bom.compositions[].*| Assertions on the completeness of the inventory of components and services, along with the completeness of dependency relationships |
| BOM Lifecycles | bom.metadata.lifecycles[]| The stage in which data in the BOM was captured |
28
+
| BOM Generation Tools | bom.metadata.tools[]| The tool(s) used to create the BOM |
29
+
| Component Hash | bom.components[].hashes[]| The hash values of the file or package |
30
+
| Component License | bom.components[].licenses[]| The license(s) in which the component is released under |
31
+
| Component Evidence | bom.components[].evidence[].identity.*| The evidence of identity including the methods, techniques, and confidence of how components were identified |
32
+
| Cryptographic Properties | bom.components[].cryptoProperties.*| The properties specific to cryptographic assets detailing the algorithms, keys, protocols, and other cryptographic material |
33
+
| External References | bom.components[].externalReferences[]| Locations to advisories, version control and build systems, etc |
34
+
| Services | bom.services[].*| A complete inventory of services including endpoint URLs, data classifications, etc which the product and/or individual components rely on |
35
+
| Known Unknowns | bom.compositions[].*| Assertions on the completeness of the inventory of components and services, along with the completeness of dependency relationships |
CycloneDX can describe cryptographic assets and their dependencies. Discovering, managing, and reporting on cryptographic
4
+
assets is necessary as the first step on the migration journey to quantum-safe systems and applications. Cryptography is
5
+
typically buried deep within components that are used to compose and build systems and applications.
6
+
7
+
Advances in quantum computing introduce the risk of previously-secure cryptographic algorithms becoming compromised
8
+
faster than ever before. In May of 2022, the White House released a [National Security Memorandum](https://www.whitehouse.gov/briefing-room/statements-releases/2022/05/04/national-security-memorandum-on-promoting-united-states-leadership-in-quantum-computing-while-mitigating-risks-to-vulnerable-cryptographic-systems/)
9
+
outlining the government’s plan to secure critical systems against potential quantum threats. This memorandum contains
10
+
two key takeaways for both agency and commercial software providers: document the potential impact of a breach, and have
11
+
an alternative cryptography solution ready.
12
+
13
+
As cryptographic systems evolve from using classical primitives to quantum-safe primitives, there is expected to be more
14
+
widespread use of cryptographic agility, or the ability to quickly switch between multiple cryptographic primitives.
15
+
Cryptographic agility serves as a security measure or incident response mechanism when a system’s cryptographic
16
+
primitive is discovered to be vulnerable or no longer complies with policies and regulations.
17
+
18
+
As part of an agile cryptographic approach, organizations should seek to understand what cryptographic assets they are
19
+
using and facilitate the assessment of the risk posture to provide a starting point for mitigation.
20
+
21
+
22
+
### Algorithm Example
23
+
A cryptographic algorithm is added in the components array of the BOM. The examples below list the algorithm
0 commit comments