{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,29]],"date-time":"2026-07-29T16:00:27Z","timestamp":1785340827729,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":50,"publisher":"ACM","license":[{"start":{"date-parts":[[2026,4,12]],"date-time":"2026-04-12T00:00:00Z","timestamp":1775952000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,4,12]]},"DOI":"10.1145\/3794763.3794831","type":"proceedings-article","created":{"date-parts":[[2026,7,29]],"date-time":"2026-07-29T15:18:58Z","timestamp":1785338338000},"page":"463-467","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["BF-CBOM: Uncovering Cryptographic Assets Through Comparative CBOM Analysis at Scale"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-8745-7800","authenticated-orcid":false,"given":"Roman","family":"B\u00f6gli","sequence":"first","affiliation":[{"name":"University of Bern, Bern, Switzerland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-1735-0617","authenticated-orcid":false,"given":"Jonas","family":"Spieler","sequence":"additional","affiliation":[{"name":"University of Bern, Bern, Switzerland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2582-5557","authenticated-orcid":false,"given":"Timo","family":"Kehrer","sequence":"additional","affiliation":[{"name":"University of Bern, Bern, Switzerland"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,7,29]]},"reference":[{"key":"e_1_3_3_1_2_2","volume-title":"Docker\/Compose","year":"2025","unstructured":"2025. Docker\/Compose. https:\/\/github.com\/docker\/compose"},{"key":"e_1_3_3_1_3_2","volume-title":"Redis","year":"2025","unstructured":"2025. Redis. https:\/\/github.com\/redis\/redis"},{"key":"e_1_3_3_1_4_2","volume-title":"Streamlit","year":"2025","unstructured":"2025. Streamlit. https:\/\/github.com\/streamlit\/streamlit"},{"key":"e_1_3_3_1_5_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-95764-2_19"},{"key":"e_1_3_3_1_6_2","doi-asserted-by":"publisher","DOI":"10.1145\/2430502.2430513"},{"key":"e_1_3_3_1_7_2","doi-asserted-by":"publisher","unstructured":"Gilles Brassard. 1994. Quantum computing: the end of classical cryptography? SIGACT News 25 4 (1994) 15\u201321. 10.1145\/190616.190617","DOI":"10.1145\/190616.190617"},{"key":"e_1_3_3_1_8_2","unstructured":"Roman B\u00f6gli. 2025. BF-CBOM: Your Best Friend for Cryptography Bill of Materials (DEMO). (2025). https:\/\/youtu.be\/-YdBPHsyymU"},{"key":"e_1_3_3_1_9_2","doi-asserted-by":"publisher","DOI":"10.5281\/zenodo.17853399"},{"key":"e_1_3_3_1_10_2","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom63139.2024.00077"},{"key":"e_1_3_3_1_11_2","volume-title":"Cdxgen","year":"2025","unstructured":"CycloneDX. 2025. Cdxgen. https:\/\/github.com\/CycloneDX\/cdxgen"},{"key":"e_1_3_3_1_12_2","unstructured":"CycloneDX. 2024. CycloneDX Bill of Materials Specification (ECMA-424). https:\/\/github.com\/CycloneDX\/specification"},{"key":"e_1_3_3_1_13_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME58944.2024.00097"},{"key":"e_1_3_3_1_14_2","volume-title":"SPARQL Query (CBOM- vs. SBOM-related Publications)","year":"2025","unstructured":"dblp.org. 2025. SPARQL Query (CBOM- vs. SBOM-related Publications). https:\/\/web.archive.org\/web\/20251207133728\/https:\/\/sparql.dblp.org\/lyS1l5"},{"key":"e_1_3_3_1_15_2","unstructured":"DeepSeek. 2025. . https:\/\/www.deepseek.com\/"},{"key":"e_1_3_3_1_16_2","unstructured":"DeepSeek API Platform. 2025. . https:\/\/platform.deepseek.com\/"},{"key":"e_1_3_3_1_17_2","doi-asserted-by":"publisher","unstructured":"Pete Ford. 2023. The Quantum Cybersecurity Threat May Arrive Sooner Than You Think. Computer 56 2 (2023) 134\u2013136. 10.1109\/MC.2022.3227657","DOI":"10.1109\/MC.2022.3227657"},{"key":"e_1_3_3_1_18_2","volume-title":"CodeQL","year":"2025","unstructured":"GitHub. 2025. CodeQL. https:\/\/codeql.github.com"},{"key":"e_1_3_3_1_19_2","volume-title":"SBOM vs. CBOM vs. Post-Quantum Cryptography (Jan\u201921-Nov\u201925)","author":"Trends Google","year":"2025","unstructured":"Google Trends. 2025. SBOM vs. CBOM vs. Post-Quantum Cryptography (Jan\u201921-Nov\u201925). https:\/\/trends.google.com\/trends\/explore?date=2021-01-01%202025-12-01&q=SBOM,CBOM,%2Fm%2F0bhc70l"},{"key":"e_1_3_3_1_20_2","doi-asserted-by":"publisher","unstructured":"Sivana Hamer Jacob Bowen Md.\u00a0Nazmul Haque Robert Hines Chris Madden and Laurie\u00a0A. Williams. 2025. Closing the Chain: How to reduce your risk of being SolarWinds Log4j or XZ Utils. Computing Research Repository (CoRR) (2025). 10.48550\/ARXIV.2503.12192","DOI":"10.48550\/ARXIV.2503.12192"},{"key":"e_1_3_3_1_21_2","doi-asserted-by":"publisher","unstructured":"David Joseph Rafael Misoczki Marc Manzano Joe Tricot Fernando\u00a0Dominguez Pinuaga Olivier Lacombe Stefan Leichenauer Jack Hidary Phil Venables and Royal Hansen. 2022. Transitioning organizations to post-quantum cryptography. Nature 605 7909 (2022) 237\u2013243. 10.1038\/S41586-022-04623-2","DOI":"10.1038\/S41586-022-04623-2"},{"key":"e_1_3_3_1_22_2","doi-asserted-by":"publisher","unstructured":"Nils Lohmiller Sabrina Kaniewski Michael Menth and Tobias Heer. 2025. A Survey of Post-Quantum Cryptography Migration in Vehicles. IEEE Access 13 (2025) 10160\u201310176. 10.1109\/ACCESS.2025.3528562","DOI":"10.1109\/ACCESS.2025.3528562"},{"key":"e_1_3_3_1_23_2","doi-asserted-by":"publisher","unstructured":"Alexey Melnikov and Ian Fette. 2011. The WebSocket Protocol. RFC 6455. 10.17487\/RFC6455","DOI":"10.17487\/RFC6455"},{"key":"e_1_3_3_1_24_2","doi-asserted-by":"publisher","unstructured":"Christian N\u00e4ther Daniel Herzinger Stefan-Lukas Gazdag Jan-Philipp Stegh\u00f6fer Simon Daum and Daniel Loebenberger. 2024. Migrating Software Systems Toward Post-Quantum Cryptography-A Systematic Literature Review. IEEE Access 12 (2024) 132107\u2013132126. 10.1109\/ACCESS.2024.3450306","DOI":"10.1109\/ACCESS.2024.3450306"},{"key":"e_1_3_3_1_25_2","unstructured":"National Institute of Standards and Technology (NIST). 2024. NIST Releases First 3 Finalized Post-Quantum Encryption Standards. (2024). https:\/\/www.nist.gov\/news-events\/news\/2024\/08\/nist-releases-first-3-finalized-post-quantum-encryption-standards"},{"key":"e_1_3_3_1_26_2","doi-asserted-by":"publisher","unstructured":"Sabato Nocera Simone Romano Massimiliano\u00a0Di Penta Rita Francese and Giuseppe Scanniello. 2025. On the adoption of software bill of materials in open-source software projects. J. Systems and Software (JSS) 230 (2025) 112540. 10.1016\/J.JSS.2025.112540","DOI":"10.1016\/J.JSS.2025.112540"},{"key":"e_1_3_3_1_27_2","unstructured":"OASIS. 2023. Static Analysis Results Interchange Format (SARIF). https:\/\/docs.oasis-open.org\/sarif\/sarif\/v2.1.0\/sarif-v2.1.0.html"},{"key":"e_1_3_3_1_28_2","doi-asserted-by":"publisher","unstructured":"David Ott Kenny Paterson and Dennis Moreau. 2023. Where Is the Research on Cryptographic Transition and Agility?66 4 (2023) 29\u201332. 10.1145\/3567825","DOI":"10.1145\/3567825"},{"key":"e_1_3_3_1_29_2","unstructured":"OWASP Foundation. 2024. Authoritative Guide to CBOM: Implement Cryptography Bill of Materials for Post-Quantum Systems and Applications. https:\/\/cyclonedx.org\/guides\/OWASP_CycloneDX-Authoritative-Guide-to-CBOM-en.pdf"},{"key":"e_1_3_3_1_30_2","doi-asserted-by":"publisher","unstructured":"Sebastian Paul and Melanie Niethammer. 2019. On the importance of cryptographic agility for industrial automation. at - Automatisierungstechnik 67 5 (2019) 402\u2013416. 10.1515\/AUTO-2019-0019","DOI":"10.1515\/AUTO-2019-0019"},{"key":"e_1_3_3_1_31_2","doi-asserted-by":"publisher","unstructured":"Kyrylo Petrenko Atefeh Mashatan and Farid Shirazi. 2019. Assessing the quantum-resistant cryptographic agility of routing and switching IT network infrastructure in a large-size financial organization. Journal of Information Security and Applications (JISA) 46 (2019) 151\u2013163. 10.1016\/J.JISA.2019.03.007","DOI":"10.1016\/J.JISA.2019.03.007"},{"key":"e_1_3_3_1_32_2","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-28901-1"},{"key":"e_1_3_3_1_33_2","volume-title":"CBOMkit","author":"(PQCA) Post-Quantum Cryptography Alliance","year":"2025","unstructured":"Post-Quantum Cryptography Alliance (PQCA). 2025. CBOMkit. https:\/\/github.com\/PQCA\/cbomkit"},{"key":"e_1_3_3_1_34_2","volume-title":"IBM is donating its CBOM toolset to the Linux Foundation","author":"Research IBM","year":"2025","unstructured":"IBM Research. 2025. IBM is donating its CBOM toolset to the Linux Foundation. https:\/\/research.ibm.com\/blog\/cryptographic-cbom-linux-foundation"},{"key":"e_1_3_3_1_35_2","doi-asserted-by":"publisher","unstructured":"Dirk Riehle. 2025. The Software Bill of Materials. Computer 58 4 (2025) 115\u2013120. 10.1109\/MC.2025.3530276","DOI":"10.1109\/MC.2025.3530276"},{"key":"e_1_3_3_1_36_2","doi-asserted-by":"publisher","DOI":"10.1145\/2491411.2491446"},{"key":"e_1_3_3_1_37_2","volume-title":"Cryptobom-Forge","author":"Research Santander Security","year":"2024","unstructured":"Santander Security Research. 2024. Cryptobom-Forge. https:\/\/github.com\/Santandersecurityresearch\/cryptobom-forge"},{"key":"e_1_3_3_1_38_2","doi-asserted-by":"publisher","DOI":"10.18420\/SICHERHEIT2024_003"},{"key":"e_1_3_3_1_39_2","doi-asserted-by":"publisher","DOI":"10.1109\/MODELS50736.2021.00010"},{"key":"e_1_3_3_1_40_2","doi-asserted-by":"publisher","unstructured":"Alexander Schulthei\u00df Paul\u00a0Maximilian Bittner Alexander Boll Lars Grunske Thomas Th\u00fcm and Timo Kehrer. 2023. RaQuN: A Generic and Scalable n-Way Model Matching Algorithm. 22 5 (2023) 1495\u20131517. 10.1007\/s10270-022-01062-5","DOI":"10.1007\/s10270-022-01062-5"},{"key":"e_1_3_3_1_41_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-50815-8_3"},{"key":"e_1_3_3_1_42_2","doi-asserted-by":"publisher","DOI":"10.1109\/SFCS.1994.365700"},{"key":"e_1_3_3_1_43_2","doi-asserted-by":"publisher","DOI":"10.1201\/9781003475286"},{"key":"e_1_3_3_1_44_2","volume-title":"SonarQube","year":"2025","unstructured":"SonarSource. 2025. SonarQube. https:\/\/www.sonarsource.com\/"},{"key":"e_1_3_3_1_45_2","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3623347"},{"key":"e_1_3_3_1_46_2","doi-asserted-by":"publisher","unstructured":"Lucas Tate Rebecca Jones Doug Dennis Tatyana Benko and Jody Askren. 2024. Comparing Bills of Materials. Computing Research Repository (CoRR) (2024). 10.48550\/ARXIV.2411.10384","DOI":"10.48550\/ARXIV.2411.10384"},{"key":"e_1_3_3_1_47_2","volume-title":"SPDX Specification v3.0.1","author":"Foundation The Linux","year":"2025","unstructured":"The Linux Foundation. 2025. SPDX Specification v3.0.1. https:\/\/spdx.github.io\/spdx-spec\/v3.0.1\/"},{"key":"e_1_3_3_1_48_2","doi-asserted-by":"publisher","DOI":"10.18653\/V1\/2021.FINDINGS-ACL.188"},{"key":"e_1_3_3_1_49_2","doi-asserted-by":"publisher","unstructured":"Laurie Williams Giacomo Benedetti Sivana Hamer Ranindya Paramitha Imranur Rahman Mahzabin Tamanna Greg Tystahl Nusrat Zahan Patrick Morrison Yasemin Acar Michel Cukier Christian K\u00e4stner Alexandros Kapravelos Dominik Wermke and William Enck. 2025. Research Directions in Software Supply Chain Security. Trans. on Software Engineering and Methodology (TOSEM) 34 5 (2025) 1\u201338. 10.1145\/3714464","DOI":"10.1145\/3714464"},{"key":"e_1_3_3_1_50_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00219"},{"key":"e_1_3_3_1_51_2","doi-asserted-by":"publisher","DOI":"10.1109\/DSN58291.2024.00018"}],"event":{"name":"ICPC '26: 34th IEEE\/ACM International Conference on Program Comprehension","location":"Rio de Janeiro , Brazil","acronym":"ICPC '26","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering"]},"container-title":["Proceedings of the 2026 34th IEEE\/ACM International Conference on Program Comprehension"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3794763.3794831","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,29]],"date-time":"2026-07-29T15:19:55Z","timestamp":1785338395000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3794763.3794831"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,12]]},"references-count":50,"alternative-id":["10.1145\/3794763.3794831","10.1145\/3794763"],"URL":"https:\/\/doi.org\/10.1145\/3794763.3794831","relation":{},"subject":[],"published":{"date-parts":[[2026,4,12]]},"assertion":[{"value":"2026-07-29","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}