As organisations begin preparing for the transition to Post-Quantum Cryptography (PQC), one question deserves particular attention: Do you actually know where cryptography is being used throughout your organisation?
You cannot protect what you cannot identify
Most organisations rely on encryption, digital signatures and other cryptographic technologies every day. They protect websites, financial transactions, customer records, email, VPNs, cloud services and countless other systems.
But much of this cryptography is hidden inside applications, operating systems, devices and third-party services. Before organisations can replace vulnerable cryptographic technologies, they must first identify them. This is where a Cryptography Bill of Materials (CBOM) becomes important.
What exactly is a CBOM?
A CBOM is a structured inventory of the cryptographic technologies used within an application, system or organisation. Think of it as a detailed stocktake of your cryptographic infrastructure.
Just as a manufacturer maintains a list of components used in a product, a CBOM identifies the cryptographic components on which digital systems depend.
- Algorithms: RSA, elliptic curve cryptography (ECC), AES and others.
- Certificates: Digital certificates used to establish trust and authenticate systems.
- Cryptographic keys: Their types, purposes and lifecycle information, without disclosing secret key material.
- Protocols: TLS, SSH and other technologies that secure communications.
- Software libraries: Components implementing cryptographic functions.
- Dependencies: Which applications and systems rely on particular cryptographic technologies.
Importantly, a CBOM can identify relationships between components, not simply provide a list of algorithms. The international CycloneDX standard supports CBOMs as structured, machine-readable representations of cryptographic assets.
Why is this important for PQC Transition?
Many existing public-key cryptographic systems, including widely used RSA and elliptic curve implementations, would be vulnerable to sufficiently powerful, fault-tolerant quantum computers running Shor's algorithm.
Such machines are not currently known to be capable of breaking production-strength RSA or ECC, but organisations must prepare before that capability emerges.
The transition to PQC involves identifying vulnerable cryptography, evaluating alternatives, testing compatibility and progressively replacing or upgrading affected systems. Without an accurate inventory, organisations may overlook critical dependencies.
Consider a business that upgrades its website security but fails to identify vulnerable cryptographic mechanisms embedded in its VPN infrastructure, digital signing systems or legacy applications. Its transition would remain incomplete. A CBOM helps expose these dependencies.
What might a CBOM reveal?
Consider a hypothetical organisation with the following cryptographic assets:
| System | Cryptography identified | PQC consideration |
|---|---|---|
| Customer website | RSA certificate and ECDHE key agreement | Review authentication and key establishment |
| Corporate VPN | Classical elliptic curve key agreement | Investigate PQC-capable alternatives |
| Document signing | RSA digital signatures | Plan quantum-resistant signatures |
| Database storage | AES-256 encryption | Assess key management and associated public-key dependencies |
| Legacy application | Outdated cryptographic library | Investigate upgrade requirements |
Not every cryptographic algorithm needs replacing. For example, AES-256 is generally regarded as suitable symmetric encryption for the post-quantum era, while commonly used RSA and ECC public-key mechanisms require transition planning.
PQC Transition should be based on actual cryptographic risks rather than indiscriminately replacing every security technology.
A CBOM is the beginning, not the entire solution
Creating a CBOM does not automatically make an organisation quantum-safe. It provides the visibility needed to make informed decisions.
Organisations must still assess the sensitivity and longevity of protected information, evaluate business risks, prioritise systems, engage suppliers and develop realistic migration plans.
Furthermore, a CBOM must be maintained as systems and dependencies change. An inventory created once and then forgotten will quickly lose its value.
What does this mean for Australian organisations?
Australia's cybersecurity authorities have recognised the importance of cryptographic discovery and inventory as part of preparing for PQC. The Australian Signals Directorate's guidance on planning for post-quantum cryptography identifies CBOMs as an effective method for documenting cryptographic dependencies.
For boards and senior executives, the immediate question should not simply be whether their organisation has implemented PQC. A more useful starting question is:
Can our technology and security teams demonstrate that we know where vulnerable cryptography exists across our organisation?
If the answer is no, cryptographic discovery should become a priority.
My perspective
I believe the CBOM should become a standard starting point for any serious organisational PQC Transition programme.
It transforms a potentially overwhelming technical challenge into something more manageable: discover the assets, understand their dependencies, assess the risks and develop a transition plan.
It also provides a practical starting point for discussions between boards, CISOs, technology teams and external suppliers.
Before you can plan your transition to post-quantum security, you need to know what cryptography you have today. And that is precisely what a CBOM helps you establish.