{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "$comment": "CBOM (Cryptography Bill of Materials) template — QianHeng PQC. Replace the example components with your inventory. quantumRisk: HIGH (Shor-breakable / legacy), MEDIUM (Grover-weakened symmetric/hash), LOW (256-bit symmetric), NONE (PQC), REVIEW (key/cert material).",
  "metadata": {
    "timestamp": "2026-06-19T00:00:00",
    "tools": [{ "name": "manual / pqc-crypto-scan", "version": "1.0" }],
    "component": { "type": "application", "name": "<your-system-name>" }
  },
  "components": [
    {
      "type": "cryptographic-asset",
      "name": "RSA-2048",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": { "primitive": "pke/signature", "parameterSetIdentifier": "2048", "cryptoFamily": "rsa" },
        "oid": "1.2.840.113549.1.1.1"
      },
      "properties": [
        { "name": "quantumRisk", "value": "HIGH" },
        { "name": "purpose", "value": "TLS server certificate / key transport" },
        { "name": "migrationTarget", "value": "ML-KEM (key) + ML-DSA (signature), hybrid first" },
        { "name": "owner", "value": "<team>" },
        { "name": "migrationPriority", "value": "P1" }
      ],
      "evidence": { "occurrences": [{ "location": "config/tls/server.crt" }] }
    },
    {
      "type": "cryptographic-asset",
      "name": "ECDSA-P256",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": { "primitive": "signature", "parameterSetIdentifier": "secp256r1", "cryptoFamily": "ecc" }
      },
      "properties": [
        { "name": "quantumRisk", "value": "HIGH" },
        { "name": "purpose", "value": "code signing / JWT" },
        { "name": "migrationTarget", "value": "ML-DSA-65 (or dual ECDSA+ML-DSA)" },
        { "name": "migrationPriority", "value": "P1" }
      ]
    },
    {
      "type": "cryptographic-asset",
      "name": "SM2",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": { "primitive": "pke/signature", "cryptoFamily": "ecc" }
      },
      "properties": [
        { "name": "quantumRisk", "value": "HIGH" },
        { "name": "purpose", "value": "国密 signature / key exchange (Shor-breakable like ECC)" },
        { "name": "migrationTarget", "value": "hybrid SM2 + ML-KEM/ML-DSA pending domestic PQC standard" },
        { "name": "migrationPriority", "value": "P1" }
      ]
    },
    {
      "type": "cryptographic-asset",
      "name": "AES-256-GCM",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": { "primitive": "ae", "parameterSetIdentifier": "256", "cryptoFamily": "symmetric" }
      },
      "properties": [
        { "name": "quantumRisk", "value": "LOW" },
        { "name": "purpose", "value": "data-at-rest / record encryption (Grover-only, keep)" },
        { "name": "migrationPriority", "value": "P3" }
      ]
    },
    {
      "type": "cryptographic-asset",
      "name": "ML-KEM-768",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": { "primitive": "kem", "parameterSetIdentifier": "ML-KEM-768", "cryptoFamily": "lattice", "nistQuantumSecurityLevel": 3 }
      },
      "properties": [
        { "name": "quantumRisk", "value": "NONE" },
        { "name": "purpose", "value": "TARGET — hybrid X25519MLKEM768 key establishment" },
        { "name": "standard", "value": "FIPS 203" }
      ]
    },
    {
      "type": "cryptographic-asset",
      "name": "tls/server.key",
      "cryptoProperties": { "assetType": "relatedCryptoMaterial" },
      "properties": [
        { "name": "quantumRisk", "value": "REVIEW" },
        { "name": "location", "value": "config/tls/server.key" }
      ]
    }
  ]
}