Provide a standards-based Cryptographic Bill of Materials (CBOM) for IBM VTS and TSSC

IBM should provide a standards-based Cryptographic Bill of Materials (CBOM) for its products as a standard product deliverable, preferably based on the CycloneDX CBOM specification.

Customers increasingly require transparency into the cryptographic technologies and components used by the products they operate. This information is essential for maintaining an authoritative cryptographic inventory, assessing cryptographic dependencies and risks, supporting compliance requirements, and preparing for cryptographic transitions, particularly the migration toward quantum-safe cryptography and achieving cryptographic agility.

A customer should not have to reverse-engineer a product or raise individual support cases to determine which cryptographic components and dependencies are used by that product. IBM, as the product vendor, has the necessary knowledge of the product implementation and is therefore best positioned to provide an authoritative and complete CBOM.

The CBOM should:

• follow an established industry standard, preferably CycloneDX CBOM;

be provided in a standardized, machine-readable format;

cover the relevant cryptographic components and dependencies of the delivered product in accordance with the applicable CBOM specification;

be maintained and updated together with product releases and relevant maintenance levels;

be readily available to customers as part of the standard product documentation or software delivery;

not require customers to raise individual support cases or requests to obtain an inventory of the cryptographic technologies used by the product.

Considering IBM's stated ambition to act as its own first client, or “Client Zero,” I would expect cryptographic transparency and inventory capabilities such as CBOM to be applied to IBM's own products as well and to be made available to IBM customers by default. A standards-based CBOM should therefore become a standard deliverable across the IBM product portfolio, rather than something that customers need to request and clarify individually for each product.

Providing CBOMs consistently would enable customers to understand their cryptographic dependencies, identify exposure to cryptographic technologies that may require transition or replacement, and plan the move toward quantum-safe cryptography while improving their overall cryptographic agility, without having to reverse-engineer individual IBM products.

References:

• https://www.zurich.ibm.com/cbom/

https://cyclonedx.org/capabilities/cbom/

https://github.com/CycloneDX/specification