Towards declaring crypto algorithms in SBOMs: crypto_algorithms_open_dataset
summary
A publicly released dataset provides YAML definitions per algorithm (name, ID, category, strength) and reference code including a crypto_detect.py scanner that keyword-matches across billions of files and thousands of projects; the dataset goes CC licensed in 2024 and aligns with SPDX while moving to the Software Transparency Foundation in 2025. Keyword matching is fast and precise for AES-128 vs AES-256 but produces context false positives (commented code, variable names), and AST-based or ML-enhanced detection is being explored.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 2:27Crypto ID impact across industries
- 3:50Open Crypto Algorithms dataset
- 6:05From keyword matching to open dataset
- 9:16Saving time with standardized crypto
- 9:40Live demo: crypto detection script
- 12:35Keyword matching challenges
- 15:30Future: community-driven development
- 17:38Call to action
- 18:00Q&A
related talks
14mKnow Your Crypto: Standardizing and Detecting Crypto Algorithms the Open Source Way
32mCryptographic Governance: Software Supply Chain Security With CBOM
31mOpen Source SCA
24mAdvancing Cryptographic Transparency: CBOM Standardization in CycloneDX
51mThe SBOM Era: Leaving No Open Source Project Behind With Osskb.org
43mExtending SBOMs to Describe AI Systems
22mSBOM and Security Transparency - How it all fits together
57mCode Genome - Fingerprinting Code to Build Trustworthy SBOMs