CBOM e emetse Cryptographic Bill of Materials. Ke lenane le hlophisitsoeng, le ka baloang ke mochini la letlotlo le leng le le leng la cryptographic ka har'a sesebelisoa kapa sistimi: li-algorithms, boholo ba senotlolo, litifikeiti, lilaebrari tsa cryptographic, le liprothokholi tse sebelisoang, hammoho le kamoo li amanang le likarolo tse li kenyang tšebetsong. Bili ea Lisebelisoa tsa Software (SBOM) Likarabo tsa "ke khoutu efe e teng ts'ebelisong ena," CBOM e araba potso e fokolang, 'me bakeng sa mekhatlo e mengata, e thata: "cryptography e sebetsa hokae, hona ke ea mofuta ofe hantle."
Tlhaloso ea CBOM, ka mantsoe a hlakileng #
Lihlopha tse ngata tsa tšireletso li ka hlahisa lethathamo le felletseng la lilaebrari tsa mohloli o bulehileng tseo software ea tsona e itšetlehileng ka tsona. Ke ba fokolang haholo ba ka arabang hore na RSA-2048 e ntse e sebelisoa hokae, hore na ke lits'ebeletso life tse itšetlehileng ka SHA-1, kapa hore na ke eng e ka robehang haeba TLS 1.0 e ne e ka emisoa hosane. Lekhalo leo ke lona CBOM e koalang. Hase mofuta o mocha oa cryptography 'me ha se sesebelisoa sa ho skena ka bosona: ke tlhahiso, 'mapa o ngotsoeng oa ts'ebeliso ea cryptographic ho pholletsa le codebase, moaho, kapa thepa eohle.
Hangata CBOM e tlaleha:
- Li-algorithms le liparamente tsa tsona: li-algorithms tsa encryption le tsa signature, boholo ba linotlolo, mekhoa ea cipher (mohlala, ho tšoaea RSA-1024 kapa li-cipher suites tsa CBC feela e le tsa khale)
- disetifikeiti: Lisetifikeiti tsa X.509, bafani ba tsona, le nako ea ho fela
- Linotlolo le thepa ea cryptographic: linotlolo tsa sechaba, tsa poraefete, le tsa sephiri, li-vector tsa ho qala, le thepa e amanang le tsona
- Lilaeborari tsa cryptographic le li-module: ke laeborari efe e kenyang tshebetsong algorithm e fanoeng, le mofuta wa yona
- Melao-motheo: TLS, IPsec, le diprothokholo tse ding tsa tshireletso di a sebediswa, ho kenyeletswa le mefuta e sa sebetseng e ntseng e sebetsa
- likamano tsa: ke karolo efe e bitsang laeborari efe, le hore na ke protocol efe e itšetlehileng ka algorithm efe ka tlas'a eona
CBOM khahlano le SBOM: phapang ke efe #
An SBOM thathamisa likarolo tsa software le lintho tse itšetlehileng ka tsona. CBOM e tšesaane ebile e tebile: e nka cryptography ka hare ho likarolo tseo 'me e e hlalosa ka mantsoe a cryptographic le SBOM ha e so ka e etsetsoa ho hapa. Lenane la batho ba itšetlehileng ka lona le ka u bolella hore sesebelisoa se sebelisa laeborari e itseng ea TLS; le ke ke la u bolella hore na ke li-cipher suites life tseo laeborari e hlophisitsoeng ho li lumella, kapa hore na setifikeiti se ka morao ho sona se haufi le ho fela. Ha e le hantle, tse peli lia tlatsana. Mekhatlo e nang le batho ba hōlileng tsebong SBOM Mokhoa ona o qala ka potlako ho CBOM, hobane ts'ebetso e tšoanang ea ho sibolla eo likarolo tsa eona li ka atolosoang ho etsa 'mapa oa cryptography eo likarolo tseo li e sebelisang.
Hobaneng ho le bohlokoa hona joale #
Likhatello tse tharo tse arohaneng li sutumelletsa lenane la li-cryptographic ho tloha ho ntho e monate ho ba le eona ho ea ho tlhoko e ngotsoeng:
Post-quantum cryptography (PQC) ho falla. Pele mokhatlo o ka tloha ho cryptography ea khale, o hloka 'mapa o nepahetseng oa moo cryptography eo e sebelisoang teng. CBOM ke 'mapa oo. E lumella sehlopha sa ts'ireletso ho bona teko ea PQC pelecisely (mohlala, tšebeletso e 'ngoe le e 'ngoe e sebelisang setifikeiti se fanoeng ke CA e itseng ho RSA-2048) 'me u latele tsoelo-pele ea phallo ha nako e ntse e ea, ho e-na le ho hakanya hore na e pepesehetse eng.
Bokgoni ba ho tjheseletsa tjhelete ya crypto. Li-algorithms tse sa sebetseng hantle le litlhophiso tse fokolang ha li ipolele. CBOM e sebelisa SHA-1, bolelele ba linotlolo tse khutšoane, kapa TLS 1.0/1.1 e ntseng e butsoe, kahoo sehlopha se ka beha pele seo e hlileng e ka se sebelisang ho e-na le ho hlahloba sistimi ka letsoho.
Matla a taolo. Khopolo ena e tlohile ho tloha mokhoeng o motle oa AppSec ho ea tlhokong e totobetseng ea mmuso. Ka la 22 Phuptjane 2026, White House e saenne Executive Order 14412, "Ho Sireletsa Sechaba Khahlanong le Litlhaselo tse Tsoetseng Pele tsa Cryptographic," e neng e laela CISA le NIST ho phatlalatsa likarolo tse fokolang bakeng sa CBOM matsatsing a 270, e leng lekhetlo la pele bili ea lisebelisoa tsa cryptographic e bitsoa ntho ea khale e hlalositsoeng leano la 'muso oa federal. Tataiso ea bofalli ea PQC ea NIST ka boeona e khothaletsa ho kopanya SBOM ka CBOM ha mekhatlo e ntse e itokisetsa li-algorithms tse sireletsehileng ka quantum.
Mokhoa oa ho hlahisa CBOM #
Khopolo ena e simolohile e le katoloso ea CycloneDX SBOM standard, e bolokiloeng tlasa OWASP, e kentseng mofuta o ikhethileng oa karolo ea crypto-asset ho CycloneDX v1.6. Karolo eo e tlaleha mofuta oa khale oa cryptographic, mofuta o fapaneng, le mokhoa o sebelisoang, hammoho le mehala ea API le libaka tsa khoutu moo ts'ebetso ea cryptographic e etsahalang teng, e leng se lumellang CBOM ho hlahisoa ka tsela e tšoanang le SBOM ke: ho tsoa tlhahlobong e sa fetoheng ea khoutu ea mohloli, lipontšo tsa ho itšetleha, 'me, ka ho eketsehileng, tlhahlobo ea binary bakeng sa linyeoe tseo mohloli o sa fumaneheng.
Ha e le hantle, ho hlahisa CBOM e ka sebelisoang ho itšetlehile ka mofuta o tšoanang oa tlhahlobo ea sebopeho sa software e seng e sebelisitsoe bakeng sa SBOM tlhahiso, e atolositsoeng ho lemoha mehala ea laeborari ea cryptographic, khoutu ea ho sebetsana le setifikeiti, le tlhophiso ea protocol, ebe e amahanngoa le mefokolo e tsejoang (li-algorithms tse sa sebetseng, linotlolo tse khutšoane, litifikeiti tse feliloeng ke nako kapa tse tla fela haufinyane) kahoo setoko se fetoha ntho eo sehlopha se ka e etsang ho fapana le lethathamo le sa fetoheng.
Seo CBOM e sa se akaretseng #
CBOM e hlalosa se kentsweng khoutung le ditlamo tsa kopo. Ha e nke tlhophiso ya tshebetso jwalo ka dikemiso tsa ho potoloha ha dinotlolo, tshebediso ya mojule wa tshireletso ya hardware, kapa tshireletso ya nako ya ho sebetsa ya cipher suite ho seva e phelang. Boemo bo felletseng ba cryptographic bo kopanya CBOM le moelelo oo wa tshebetso; CBOM ke lenane la dintho tse qalang, eseng setshwantsho sohle.
Xygeni's ASPM sethala se hlahisa COM haufi le SBOM le AI-BOM e le karolo ea lenane la eona la thepa le kopaneng, kahoo kotsi ea cryptographic e lutse ponong e tšoanang le boemo bo setseng ba ts'ireletso ea ts'ebeliso ea hau.
LBH #
Tjhe, leha khutsufatso ena e sebelisitsoe ka mahlakoreng a mabeli historing. Makala a mang, ho kenyeletsoa le lisebelisoa tsa bongaka, a sebelisitse "bili ea thepa ea ts'ireletso ea inthanete" ho hlalosa lenane le pharaletseng la tšireletso. Sechabeng sa AppSec le ketane ea phepelo ea software, CBOM joale e bua ka ho khetheha ka thepa ea cryptographic.
An SBOM e le 'ngoe feela e ke ke ea u joetsa hore na ke li-algorithms life, boholo ba linotlolo, kapa litifikeiti tse sebelisoang, empa ke feela likarolo le lilaebrari life tse teng. CBOM e eketsa lera leo. Lihlopha tse ngata li haha CBOM e le katoloso ea se seng se ntse se le teng SBOM lenaneo ho ena le ho ba boiteko bo arohaneng le ba pele.
Litlhoko lia hlaha ho e-na le ho rarolloa. Taelo ea Phethahatso 14412 (Phuptjane 2026) ke leano la pele la ho reha CBOM ka kotloloho, le tataisang CISA le NIST ho hlalosa likarolo tse fokolang, ka tataiso e lebelletsoeng mathoasong a 2027. Ha ho ISO/IEC standard bakeng sa CBOM se se se ntse se le teng. Sebopeho se sebetsang se sebelisoang kajeno ke katoloso ea CycloneDX CBOM.
Mokhatlo ofe kapa ofe o rerang ho falla ha cryptography ka mor'a quantum, o sebetsang lefapheng le laoloang moo bohloeki ba cryptographic bo hlahlojoang, kapa o itšetlehile ka litlhoko tse hlahang tsa lenane la cryptographic la 'muso oa federal o lokela ho tšoara tlhahiso ea CBOM e le ntho ea bohlokoa nakong e haufi ho e-na le e tlang.
