Publications  /  Research Paper

Automated Cryptographic Bill of Materials Generation for Quantum Readiness Assessment: A Multi-Language Static Analysis Approach

Gunjan Jain
Published April 22, 2026 DOI: 10.5281/zenodo.19687320 Publisher: Zenodo
CBOM Static Analysis 6 Languages

Abstract

Quantum readiness requires organizations to inventory every cryptographic algorithm in their codebase -- a task that is infeasible to perform manually at scale. We present a multi-language cryptographic code scanner that performs static analysis across six programming languages (JavaScript/TypeScript, Python, Go, Java, Rust, C/C), identifies cryptographic API usage, classifies algorithms by quantum risk level, and generates a Cryptographic Bill of Materials (CBOM) in CycloneDX format. The scanner also detects embedded secrets (30+ patterns), analyzes binary files for cryptographic constants (AES S-box, SHA-256 initial values), and provides a CI/CD quality gate for enforcing post-quantum migration policies. We describe the pattern matching architecture, evaluate coverage across real-world codebases, and demonstrate integration with FTQC attack cost estimation for actionable quantum risk timelines.

Cite this paper

Jain, G. (2026). Automated Cryptographic Bill of Materials Generation for Quantum Readiness Assessment: A Multi-Language Static Analysis Approach. Zenodo. https://doi.org/10.5281/zenodo.19687320