What a CBOM Is and Why It Matters for PQC Migration
A Cryptography Bill of Materials (CBOM) is an inventory of every cryptographic algorithm, key, and protocol used across a codebase or system — the crypto equivalent of a Software Bill of Materials (SBOM). Before any organization can plan a migration to post-quantum cryptography, it needs to know exactly where quantum-vulnerable algorithms like RSA, ECDSA, and Diffie-Hellman are actually used. CycloneDX 1.6 formalized a schema for cryptographic assets, and CBOMs are increasingly expected as part of regulatory and compliance work in fintech and critical infrastructure.
What This Tool Detects
| Risk Category | Meaning | Examples |
|---|---|---|
| Vulnerable | Broken by a sufficiently large quantum computer (Shor's algorithm) | RSA, ECDSA, ECDH, Diffie-Hellman, DSA, EdDSA |
| Broken | Already broken classically, unrelated to quantum computing | MD5, DES, RC4 |
| Weak | Deprecated or under classical attack pressure | SHA-1, 3DES, Blowfish |
| Safe | Quantum-resistant as-is (Grover's algorithm gives only a quadratic speedup) | AES-256, SHA-256/384/512, ChaCha20 |
| Post-Quantum | Already migrated to a NIST PQC algorithm | ML-KEM, ML-DSA, SLH-DSA, HQC, Falcon |
From Web Scan to Full Migration Pipeline
This web tool is a fast entry point — paste a snippet, see what's in it, done. For a real migration project, KF-Cipher's desktop tools go further: the File Scanner and Fintech Scanner perform AST-based static analysis across entire codebases (including Mobile APK static analysis and database crypto metadata scanning for the Fintech Scanner), score results against NIST FIPS 203/204/205, and can generate full CycloneDX CBOMs suitable for audit and compliance reporting.