CBOM-Lens
CLI tool to scan filesystems, containers, and network ports for cryptographic assets and generate a CycloneDX CBOM 1.6 or 1.7.
CBOM-Lens discovers certificates, keys, secrets, and algorithms across local files, container images, and services, and emits a consistent Cryptographic Bill of Materials (CBOM) that can be uploaded to a CBOM-Repository or consumed by external applications.
---
Why CBOM-Lens
The first known CBOM producer to emit the CycloneDX 1.7 cryptography registry. 1.7 added two registry-backed fields to algorithmProperties, algorithmFamily and ellipticCurve, and CBOM-Lens writes them. The evidence for that claim, and the method for disproving it, is in Appendix: registry adoption.
Post-quantum algorithms are detected, not guessed. ML-DSA (FIPS 204), SLH-DSA (FIPS 205, all 12 parameter sets), ML-KEM (FIPS 203), XMSS, XMSS-MT and HSS-LMS are recognised from their OIDs and modelled with key sizes, signature sizes and NIST security categories transcribed from the standards, each with its citation recorded next to the value in the source. Where no authoritative source exists, the field is omitted rather than invented — stateful hash-based signatures carry no nistQuantumSecurityLevel because SP 800-208 assigns them none, and HQC and FN-DSA are not claimed at all because no OID has been assigned to them.
A wrong answer is treated as worse than no answer. Both registry fields are closed enumerations — 93 families, 246 curves — where a single out-of-vocabulary value invalidates the entire document, so CBOM-Lens maps through total tables and omits on a miss instead of passing a string through. Curves that could only be guessed, such as one inferred from a signature digest or borrowed from a different certificate on the same port, are deliberately left unmapped. The vendored schema snapshot means validation runs fully offline.
Details in CycloneDX 1.7 cryptography registry and PQC support.
---
Features
- Multiple scan targets
- Local filesystem (certificates, keys, secrets).
- Container images from Docker/Podman.
- Network ports using nmap (TLS and SSH detection).
- CycloneDX CBOM 1.6 and 1.7 output
- Stable, content-based bom-ref identifiers to correlate the same cryptographic assets across sources.
- Privacy-aware handling of private keys and algorithm components.
- First known producer to emit the 1.7 cryptography registry fields algorithmFamily and ellipticCurve — see below.
- Flexible operation modes
- One-shot manual runs (good for CI and ad-hoc scans).
- Timer mode with cron expressions or ISO-8601 durations.
- Discovery mode managed by ILM Core.
- Integration-ready
- Optional upload to a CBOM-Repository.
- Designed to integrate into various applications.
For a conceptual overview and background, see the Overview.
---