CBOM Output Format

Overview

The CBOM (Cryptographic Bill of Materials) format follows the CycloneDX 1.6 specification, which introduced native first-class CBOM support. It provides a comprehensive inventory of all cryptographic assets discovered during scanning and validates against the official CycloneDX 1.6 JSON schema.

.\certscanner-windows-amd64.exe -host example.com `
  -outputformat cbom `
  -output compliance.cbom.json

./certscanner-linux-x64 -host example.com \
  -outputformat cbom \
  -output compliance.cbom.json

# Intel Macs
./certscanner-darwin-amd64 -host example.com \
  -outputformat cbom \
  -output compliance.cbom.json

# Apple Silicon Macs
./certscanner-darwin-arm64 -host example.com \
  -outputformat cbom \
  -output compliance.cbom.json

CBOM Schema Structure

Complete Schema Reference

Custom Properties Reference

Sample CBOM Output

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4a3f9c2d-1b7e-4f08-82a1-9e0c3d5f6a7b",
  "version": 1,
  "metadata": {
    "timestamp": "2026-05-10T09:00:17-04:00",
    "tools": {
      "components": [
        {
          "type": "application",
          "name": "TYCHON Quantum Crypto Manager",
          "version": "1.1.97",
          "properties": [
            { "name": "vendor", "value": "Tychon LLC" }
          ]
        }
      ]
    },
    "properties": [
      { "name": "scan:type",      "value": "remote" },
      { "name": "scan:target",    "value": "example.com:443" },
      { "name": "observer:hostname", "value": "scanner-host" }
    ]
  },
  "components": [
    {
      "type": "cryptographic-asset",
      "bom-ref": "cipher:example.com:443:TLS_AES_256_GCM_SHA384",
      "name": "TLS_AES_256_GCM_SHA384",
      "version": "TLSv1.3",
      "description": "TLS cipher suite TLS_AES_256_GCM_SHA384 on example.com:443",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "cipher-suite",
          "parameterSetIdentifier": "TLS_AES_256_GCM_SHA384",
          "executionEnvironment": "tls-connection"
        }
      },
      "properties": [
        { "name": "cipher:key-length",  "value": "256" },
        { "name": "cipher:is-preferred","value": "true" }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "cert:example.com:443:123456789012345678901234567890",
      "name": "example.com",
      "description": "X.509 certificate for example.com:443",
      "hashes": [
        { "alg": "SHA-256", "content": "ab:cd:ef:12:34:56:78:90:..." }
      ],
      "cryptoProperties": {
        "assetType": "certificate",
        "certificateProperties": {
          "subjectName": "CN=example.com,O=Example Corp,C=US",
          "issuerName": "CN=DigiCert TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US",
          "notValidBefore": "2024-03-01T00:00:00Z",
          "notValidAfter": "2025-03-01T23:59:59Z",
          "certificateFormat": "X.509",
          "certificateExtension": "DER/PEM"
        }
      },
      "properties": [
        { "name": "cert:serial-number",       "value": "123456789012345678901234567890" },
        { "name": "cert:signature-algorithm", "value": "SHA256-RSA" },
        { "name": "cert:public-key-algorithm","value": "RSA" },
        { "name": "cert:public-key-size",     "value": "2048" }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "ssh:example.com:22:ssh-ed25519",
      "name": "SSH Host Key (ssh-ed25519)",
      "description": "SSH host key for example.com:22",
      "cryptoProperties": {
        "assetType": "related-crypto-material",
        "relatedCryptoMaterialProperties": {
          "type": "public-key",
          "format": "SSH",
          "size": 256
        }
      },
      "properties": [
        { "name": "ssh:key-type",          "value": "ssh-ed25519" },
        { "name": "ssh:fingerprint-sha256","value": "SHA256:abc123..." }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "ipsec-tunnel:VPN-HQ",
      "name": "VPN-HQ",
      "version": "IKEv2",
      "description": "IPSec tunnel configuration: VPN-HQ",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "ipsec",
          "version": "IKEv2",
          "ikev2TransformTypes": {
            "encr":  ["AES-256-GCM"],
            "integ": ["SHA256"],
            "dh":    ["group19"]
          }
        }
      },
      "properties": [
        { "name": "ipsec:implementation", "value": "strongSwan" },
        { "name": "pqc:is-ready",         "value": "false" }
      ]
    },
    {
      "type": "application",
      "bom-ref": "vpn-client:Cloudflare-WARP:2024.6.415",
      "name": "Cloudflare WARP",
      "version": "2024.6.415",
      "description": "VPN client application: Cloudflare WARP",
      "properties": [
        { "name": "application:vendor",          "value": "Cloudflare Inc." },
        { "name": "application:active",          "value": "true" },
        { "name": "pqc:is-ready",               "value": "true" },
        { "name": "pqc:supported-algorithms",   "value": "Kyber768,X25519Kyber768Draft00" }
      ]
    }
  ],
  "services": [
    {
      "bom-ref": "service:example.com:443",
      "name": "example.com:443",
      "description": "Network service on example.com port 443",
      "endpoints": ["example.com:443"],
      "properties": [
        { "name": "port",     "value": "443" },
        { "name": "status",   "value": "open" },
        { "name": "protocol", "value": "TLS" }
      ]
    }
  ]
}

Cryptographic Asset Types

Use Cases & Integration

# Generate quarterly compliance report
.\certscanner-windows-amd64.exe -host production-systems.txt -cipherscan `
  -tags "Q4-2025,compliance-audit" `
  -outputformat cbom -output Q4-crypto-inventory.cbom.json

# Continuous compliance monitoring
.\certscanner-windows-amd64.exe -mode local -scanfilesystem -scanmemory `
  -outputformat cbom -output daily-crypto-inventory.cbom.json

# Validate with CycloneDX CLI
cyclonedx validate --input-file daily-crypto-inventory.cbom.json `
  --input-format json --input-version v1_6

# Generate quarterly compliance report
./certscanner-linux-x64 -host production-systems.txt -cipherscan \
  -tags "Q4-2025,compliance-audit" \
  -outputformat cbom -output Q4-crypto-inventory.cbom.json

# Continuous compliance monitoring
./certscanner-linux-x64 -mode local -scanfilesystem -scanmemory \
  -outputformat cbom -output daily-crypto-inventory.cbom.json

# Validate with CycloneDX CLI
cyclonedx validate --input-file daily-crypto-inventory.cbom.json \
  --input-format json --input-version v1_6

# Generate quarterly compliance report
./certscanner-darwin-arm64 -host production-systems.txt -cipherscan \
  -tags "Q4-2025,compliance-audit" \
  -outputformat cbom -output Q4-crypto-inventory.cbom.json

# Continuous compliance monitoring
./certscanner-darwin-arm64 -mode local -scanfilesystem \
  -outputformat cbom -output daily-crypto-inventory.cbom.json

# Validate with CycloneDX CLI
cyclonedx validate --input-file daily-crypto-inventory.cbom.json \
  --input-format json --input-version v1_6

Metadata Properties Reference

TYCHON Quantum Crypto Manager includes comprehensive metadata in the metadata.properties array:

Schema Validation

# Install (macOS / Linux)
brew install cyclonedx/cyclonedx/cyclonedx-cli

# Validate
cyclonedx validate --input-file compliance.cbom.json \
  --input-format json --input-version v1_6

curl -LO https://dependencytrack.org/docker-compose.yml
docker compose up -d
# then import via the web UI at http://localhost:8080

go test ./evidence/cbom/... -v