Mondoo

Cryptography Bill of Materials

Know your cryptography,
before quantum breaks it.

xgrep inventories every cryptographic asset in your code and emits a CycloneDX 1.6 Cryptography Bill of Materials (CBOM). It is the inventory that post-quantum migration and crypto-compliance start from, produced fully offline from a single binary.

Read the docsExplore xgrep
Bash
$ xgrep sbom --cbom .


  cryptographic-asset  AES-256-GCM     src/crypto/seal.go:19    quantum-safe
  cryptographic-asset  RSA-2048        src/auth/token.go:41     quantum-vulnerable
  cryptographic-asset  SHA-256         src/util/digest.go:8     quantum-safe


  CycloneDX 1.6 CBOM · run `xgrep sbom --cbom -o cbom.json .` to save it

You can’t migrate what you can’t see.

A cryptographically relevant quantum computer would break the public-key cryptography (RSA, ECDSA, classic Diffie-Hellman) that protects data in transit and at rest today. Both NIST and the EU now direct organizations to inventory their cryptography as the first step of the transition. A CBOM is that inventory.

NIST (United States)

NIST finalized the first post-quantum standards in August 2024: FIPS 203 (ML-KEM), 204 (ML-DSA), and 205 (SLH-DSA). Its transition roadmap, NIST IR 8547, deprecates quantum-vulnerable algorithms from 2030 and disallows them after 2035, and names a cryptographic inventory as the essential first step. The NCCoE Migration to PQC project builds that same discipline, and US federal agencies already inventory their cryptography under OMB M-23-02.

European Union

Commission Recommendation (EU) 2024/1101 of 11 April 2024 calls on member states to adopt a coordinated roadmap for the transition to post-quantum cryptography. The resulting NIS Cooperation Group roadmap sets targets: quantum-vulnerable public-key cryptography should no longer be used stand-alone for high-risk use cases after 2030, and for medium-risk use cases after 2035.

An inventory, not a findings list.

A CBOM is fundamentally different from a vulnerability report. Strong, correctly-used cryptography is listed as an asset, not flagged as a problem, so you get a complete map of what you use and where.

Complete map
Every cryptographic asset xgrep finds is recorded: ciphers, hashes, MACs, signatures, protocols, and key material, each tied to the file and line that uses it.
Zero finding noise
CBOM detection runs as its own rule category that is off in a normal scan. Your weak-crypto security rules keep reporting vulnerabilities in xgrep scan exactly as before.
Enriched assets
Each asset carries the detail you need to tell strong from weak at a glance, including its NIST quantum-security level (see below).

Spot quantum-vulnerable assets at a glance.

Every algorithm asset carries a nistQuantumSecurityLevel. A value of 0 marks an asset that a quantum computer would break, so planning a migration is a matter of filtering the CBOM for the assets that need to move.

A quantum-vulnerable RSA key in the CBOM (CycloneDX 1.6)
JSON
{
  "type": "cryptographic-asset",
  "name": "RSA-2048",
  "cryptoProperties": {
    "assetType": "algorithm",
    "algorithmProperties": {
      "primitive": "pke",
      "parameterSetIdentifier": "2048",
      "nistQuantumSecurityLevel": 0
    }
  }
}

Standards-based, ecosystem-ready.

xgrep produces the CBOM with the upstream CycloneDX Go library, so the output conforms to the official CycloneDX 1.6 schema and drops straight into the broader ecosystem: CBOMkit, CBOM viewers, and post-quantum migration tooling.

Cryptographic assets are detected across 15 languages, including their common crypto libraries (for example Java JCA and BouncyCastle, or Go’s standard library and x/crypto).

JavaKotlinScalaGoPythonC#JavaScriptTypeScriptRubyPHPRustSwiftDartElixirErlang

Learn more about the format in the CycloneDX CBOM specification.

Generate a CBOM.

One command, no build and no network. It runs anywhere xgrep runs, including CI, straight from a single binary.

Inventory your cryptography and save the CBOM
Bash
# Print the cryptographic inventory
xgrep sbom --cbom .


# Write a CycloneDX 1.6 CBOM to a file
xgrep sbom --cbom -o cbom.json .
Bash
# Run it with npx, no install required
npx @mondoohq/xgrep sbom --cbom .