{
  "$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "serialNumber": "urn:uuid:c016b9d1-a223-595a-a229-6f31210f0528",
  "version": 1,
  "metadata": {
    "timestamp": "2026-11-13T00:00:00Z",
    "component": {
      "type": "application",
      "bom-ref": "subject",
      "name": "Government CBOM Profile",
      "description": "Public bodies: citizen-facing services and APIs, identity and credential systems, smart cards, document and records signing, inter-agency networks, administrative access and long-retention records."
    },
    "properties": [
      {
        "name": "netrascale:profile:status",
        "value": "v0.1 draft - CBOM Community Profile, not a compliance determination"
      },
      {
        "name": "netrascale:profile:licence",
        "value": "CC-BY-4.0"
      }
    ]
  },
  "components": [
    {
      "type": "cryptographic-asset",
      "bom-ref": "proto-tls13-services",
      "name": "TLS 1.3 (citizen-facing services and APIs)",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cipherSuites": [
            {
              "name": "TLS_AES_256_GCM_SHA384"
            }
          ]
        }
      },
      "properties": [
        {
          "name": "netrascale:profile:guidance",
          "value": "Record each public service and API endpoint; note whether hybrid post-quantum key exchange is offered."
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "alg-x25519",
      "name": "X25519 key exchange",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "key-agree",
          "parameterSetIdentifier": "255",
          "executionEnvironment": "software-plain-ram",
          "implementationPlatform": "generic",
          "cryptoFunctions": [
            "keygen"
          ],
          "classicalSecurityLevel": 128,
          "nistQuantumSecurityLevel": 0
        },
        "oid": "1.3.101.110"
      },
      "properties": [
        {
          "name": "netrascale:profile:guidance",
          "value": "Quantum-vulnerable key establishment: highest priority where data must stay confidential for years (harvest-now, decrypt-later). Plan hybrid X25519 + ML-KEM."
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "alg-rsa-3072-sig",
      "name": "RSA-3072 signatures (document and records signing)",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "signature",
          "parameterSetIdentifier": "3072",
          "executionEnvironment": "software-plain-ram",
          "implementationPlatform": "generic",
          "cryptoFunctions": [
            "sign",
            "verify"
          ],
          "classicalSecurityLevel": 128,
          "nistQuantumSecurityLevel": 0
        },
        "oid": "1.2.840.113549.1.1.11"
      },
      "properties": [
        {
          "name": "netrascale:profile:guidance",
          "value": "Quantum-vulnerable. Signed records can need to stay verifiable for decades: inventory signing keys and plan ML-DSA (FIPS 204)."
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "alg-ecdsa-p384",
      "name": "ECDSA P-384 (smart cards and credentials)",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "signature",
          "parameterSetIdentifier": "384",
          "executionEnvironment": "software-plain-ram",
          "implementationPlatform": "generic",
          "cryptoFunctions": [
            "sign",
            "verify"
          ],
          "classicalSecurityLevel": 192,
          "nistQuantumSecurityLevel": 0
        },
        "oid": "1.2.840.10045.4.3.3"
      },
      "properties": [
        {
          "name": "netrascale:profile:guidance",
          "value": "Quantum-vulnerable. Card and credential lifecycles are long: record card generations, issuance systems and renewal dates."
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "cert-credentials",
      "name": "Citizen and staff credential certificates (smart cards, identity wallets)",
      "cryptoProperties": {
        "assetType": "certificate",
        "certificateProperties": {}
      },
      "properties": [
        {
          "name": "netrascale:profile:guidance",
          "value": "Record the issuing CA, signature algorithm and validity period for each credential type; see the PKI CBOM Profile (pkicbom.com)."
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "proto-ipsec",
      "name": "IPsec (inter-agency and site-to-site networks)",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "ipsec",
          "version": "2.0"
        }
      },
      "properties": [
        {
          "name": "netrascale:profile:guidance",
          "value": "Record the IKE key exchange group and authentication method on each tunnel."
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "alg-aes-256-gcm",
      "name": "AES-256-GCM (records at rest and backups)",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "ae",
          "parameterSetIdentifier": "256",
          "executionEnvironment": "software-plain-ram",
          "implementationPlatform": "generic",
          "cryptoFunctions": [
            "encrypt",
            "decrypt"
          ],
          "classicalSecurityLevel": 256,
          "nistQuantumSecurityLevel": 5
        },
        "oid": "2.16.840.1.101.3.4.1.46"
      },
      "properties": [
        {
          "name": "netrascale:profile:guidance",
          "value": "Symmetric: considered quantum-resistant at 256-bit. Keep; record key custody (see the Sovereign Custody CBOM Profile)."
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "proto-ssh-admin",
      "name": "SSH (administrative access)",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "ssh",
          "version": "2.0"
        }
      },
      "properties": [
        {
          "name": "netrascale:profile:guidance",
          "value": "Record host and user key algorithms on every administrative path, including suppliers' remote access."
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "alg-ml-kem-1024",
      "name": "ML-KEM-1024",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "kem",
          "parameterSetIdentifier": "1024",
          "executionEnvironment": "software-plain-ram",
          "implementationPlatform": "generic",
          "cryptoFunctions": [
            "encapsulate",
            "decapsulate"
          ],
          "classicalSecurityLevel": 256,
          "nistQuantumSecurityLevel": 5
        }
      },
      "properties": [
        {
          "name": "netrascale:profile:guidance",
          "value": "Target state: NIST FIPS 203. NSA CNSA 2.0 requires ML-KEM-1024 for US national security systems; civil systems typically use ML-KEM-768."
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "alg-ml-dsa-87",
      "name": "ML-DSA-87",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "signature",
          "parameterSetIdentifier": "87",
          "executionEnvironment": "software-plain-ram",
          "implementationPlatform": "generic",
          "cryptoFunctions": [
            "sign",
            "verify"
          ],
          "classicalSecurityLevel": 256,
          "nistQuantumSecurityLevel": 5
        }
      },
      "properties": [
        {
          "name": "netrascale:profile:guidance",
          "value": "Target state: NIST FIPS 204. NSA CNSA 2.0 requires ML-DSA-87 for US national security systems; civil systems typically use ML-DSA-65."
        }
      ]
    }
  ]
}