Skip to content
Declara
⌘K
engineercompliance-owner

Review the cryptography an SBOM declares

Was this page helpful?

This page reflects our reading of Cyber Resilience Act, Annex I Part I(2)(e); NIST SP 800-131A; BSI TR-02102 as of . It is not legal advice. Review process.

CycloneDX 1.6 and later can carry a cryptographic bill of materials (CBOM) inside the SBOM, as components of type cryptographic-asset. Declara keeps those apart from your packages (they are never matched against advisories and do not count in the inventory or the quality score) and reads each against NIST SP 800-131A and BSI TR-02102 when the SBOM arrives.

It is a record of what the SBOM declares, not an assessment of how the product uses it.

What each status means

  • Disallowed: the guidance says not to use it for protection any more. For example MD5, SHA-1 for signatures, DES and Triple DES, RC4, SSL, TLS 1.0 and 1.1, RSA below 2048 bits, curves below 224 bits.
  • Legacy: still accepted for now, with an end date or a stronger recommendation. For example RSA from 2048 to 2999 bits: NIST accepts it until 2030, BSI recommends 3000.
  • On current lists: for example AES, SHA-2 and SHA-3, ChaCha20, P-256 and larger curves, Ed25519, TLS 1.2 and 1.3, ML-KEM, ML-DSA and SLH-DSA.
  • Not judged: not on these lists, or not enough was declared to tell. Never treated as safe.

Every status shows the guidance it rests on.

Steps

  1. Upload a CycloneDX 1.6 or later SBOM that includes cryptographic assets. A file that holds only cryptographic assets is refused, so it cannot empty the inventory; put the CBOM inside the SBOM.
  2. On the product page, follow N cryptographic assets under the version.
  3. Read each version's table, worst first.

What you should see

The same summary feeds the confidentiality requirement on the essential requirements record and a "Cryptography" field in the technical file.

On Growth and Partner, a Post-quantum readiness summary and column show which declared public-key cryptography a large quantum computer would break (RSA, finite-field and elliptic-curve, whatever the key size). Other plans see where it is available.

When a new SBOM declares disallowed cryptography that the version (or, for a version's first SBOM, the product's latest other version) did not already declare, the workspace is emailed and a crypto.disallowed event goes to your integrations. Mute the email under Settings → Notifications. It is not an exploited vulnerability, and no clock starts.

Related