Neu: Mondoo erweitert Schwachstellenmanagement auf Shadow AI. Finden und beheben · Erleben Sie es live auf der Black Hat USA, Stand 5100, AI Zone, 1. bis 6. August.
EinloggenAssessment anfordern

Cryptography Bill of Materials

Know your cryptography,
before quantum breaks it.

xgrep inventories every cryptographic asset in your code and emits a CycloneDX 1.6 Cryptography Bill of Materials (CBOM). It is the inventory that post-quantum migration and crypto-compliance start from, produced fully offline from a single binary.

Read the docsExplore xgrep
Bash
$ xgrep sbom --cbom .


  cryptographic-asset  AES-256-GCM     src/crypto/seal.go:19    quantum-safe
  cryptographic-asset  RSA-2048        src/auth/token.go:41     quantum-vulnerable
  cryptographic-asset  SHA-256         src/util/digest.go:8     quantum-safe


  CycloneDX 1.6 CBOM · run `xgrep sbom --cbom -o cbom.json .` to save it

You can’t migrate what you can’t see.

A cryptographically relevant quantum computer would break the public-key cryptography (RSA, ECDSA, classic Diffie-Hellman) that protects data in transit and at rest today. Both NIST and the EU now direct organizations to inventory their cryptography as the first step of the transition. A CBOM is that inventory.

NIST (United States)

NIST finalized the first post-quantum standards in August 2024: FIPS 203 (ML-KEM), 204 (ML-DSA), and 205 (SLH-DSA). Its transition roadmap, NIST IR 8547, deprecates quantum-vulnerable algorithms from 2030 and disallows them after 2035, and names a cryptographic inventory as the essential first step. The NCCoE Migration to PQC project builds that same discipline, and US federal agencies already inventory their cryptography under OMB M-23-02.

European Union

Commission Recommendation (EU) 2024/1101 of 11 April 2024 calls on member states to adopt a coordinated roadmap for the transition to post-quantum cryptography. The resulting NIS Cooperation Group roadmap sets targets: quantum-vulnerable public-key cryptography should no longer be used stand-alone for high-risk use cases after 2030, and for medium-risk use cases after 2035.

An inventory, not a findings list.

A CBOM is fundamentally different from a vulnerability report. Strong, correctly-used cryptography is listed as an asset, not flagged as a problem, so you get a complete map of what you use and where.

Complete map
Every cryptographic asset xgrep finds is recorded: ciphers, hashes, MACs, signatures, protocols, and key material, each tied to the file and line that uses it.
Zero finding noise
CBOM detection runs as its own rule category that is off in a normal scan. Your weak-crypto security rules keep reporting vulnerabilities in xgrep scan exactly as before.
Enriched assets
Each asset carries the detail you need to tell strong from weak at a glance, including its NIST quantum-security level (see below).

Spot quantum-vulnerable assets at a glance.

Every algorithm asset carries a nistQuantumSecurityLevel. A value of 0 marks an asset that a quantum computer would break, so planning a migration is a matter of filtering the CBOM for the assets that need to move.

A quantum-vulnerable RSA key in the CBOM (CycloneDX 1.6)
JSON
{
  "type": "cryptographic-asset",
  "name": "RSA-2048",
  "cryptoProperties": {
    "assetType": "algorithm",
    "algorithmProperties": {
      "primitive": "pke",
      "parameterSetIdentifier": "2048",
      "nistQuantumSecurityLevel": 0
    }
  }
}

Standards-based, ecosystem-ready.

xgrep produces the CBOM with the upstream CycloneDX Go library, so the output conforms to the official CycloneDX 1.6 schema and drops straight into the broader ecosystem: CBOMkit, CBOM viewers, and post-quantum migration tooling.

Cryptographic assets are detected across 15 languages, including their common crypto libraries (for example Java JCA and BouncyCastle, or Go’s standard library and x/crypto).

JavaKotlinScalaGoPythonC#JavaScriptTypeScriptRubyPHPRustSwiftDartElixirErlang

Learn more about the format in the CycloneDX CBOM specification.

Generate a CBOM.

One command, no build and no network. It runs anywhere xgrep runs, including CI, straight from a single binary.

Inventory your cryptography and save the CBOM
Bash
# Print the cryptographic inventory
xgrep sbom --cbom .


# Write a CycloneDX 1.6 CBOM to a file
xgrep sbom --cbom -o cbom.json .
Bash
# Run it with npx, no install required
npx @mondoohq/xgrep sbom --cbom .