Skip to content

Commit 32f92a9

Browse files
CortezFrazierJrclaude
CortezFrazierJr
and
claude
committed
Add cryptographic algorithm scanning with CycloneDX 1.7 CBOM output
Introduce a new experimental feature (--x-crypto-scan) that detects cryptographic algorithm usage across 10 ecosystems (Python, Java, Go, Node, Rust, Ruby, C#, PHP, Swift, Elixir) and produces CycloneDX 1.7 CBOM output for FIPS compliance assessment. Key features: - Rust-based crypto detection engine (extlib/cryptoscan) with pattern matching for imports, API calls, dependency manifests, and config files - Auto-detection of ecosystems present in the project - FIPS 140-3 compliance classification (approved/deprecated/not-approved) - CycloneDX 1.7 CBOM file output (--crypto-cbom-output) - Detailed FIPS compliance report (--crypto-fips-report) with remediation recommendations and key-size warnings - Crypto scan results displayed in the analysis scan summary - 56 passing integration tests covering all 10 ecosystems Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 8b1c5ff commit 32f92a9

45 files changed

Lines changed: 5555 additions & 52 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎Cargo.lock‎

Lines changed: 161 additions & 45 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
[workspace]
22
members = [
33
"extlib/berkeleydb",
4+
"extlib/cryptoscan",
45
"extlib/millhone",
56
"tools/diagnose",
67
"tools/rendergraph",

‎Makefile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -126,8 +126,8 @@ lint-cargo:
126126
@cargo clippy
127127

128128
# Build cargo deps needed by the CLI and move them into place for cabal.
129-
build-embedded-rust-bins: target/release/berkeleydb target/release/millhone
130-
cargo build --release --bin millhone --bin berkeleydb
129+
build-embedded-rust-bins: target/release/berkeleydb target/release/cryptoscan target/release/millhone
130+
cargo build --release --bin millhone --bin berkeleydb --bin cryptoscan
131131

132132
# Runs linter on only modified files
133133
#

‎docs/features/crypto-scanning.md‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
2+
# Crypto Scanning
3+
4+
Crypto Scanning is the name of FOSSA's cryptographic algorithm detection feature.
5+
6+
Crypto Scanning analyzes source code, dependency manifests, and configuration files
7+
in your project, identifies cryptographic algorithm usage, and classifies each
8+
finding against FIPS 140-3 compliance requirements. Results can be uploaded to
9+
FOSSA, exported as a CycloneDX 1.7 CBOM (Cryptography Bill of Materials), or
10+
printed as a FIPS compliance report.
11+
12+
Crypto Scanning can be run as part of `fossa analyze`. To enable it, add the
13+
`--x-crypto-scan` flag when you run `fossa analyze`:
14+
15+
```sh
16+
fossa analyze --x-crypto-scan
17+
```
18+
19+
## How Crypto Scanning Works
20+
21+
When `--x-crypto-scan` is enabled, the CLI:
22+
23+
1. **Detects Ecosystems**: Identifies which language ecosystems are present in your
24+
project (e.g., Python, Java, Go, Rust, Node.js, Ruby, C#/.NET, PHP, Swift, Elixir).
25+
2. **Scans Source Files**: Uses pattern-based detection across four categories:
26+
- **Dependency analysis**: Known crypto libraries in dependency manifests
27+
(e.g., `pyca/cryptography` in `requirements.txt`, `ring` in `Cargo.toml`)
28+
- **Import pattern matching**: Crypto-related imports
29+
(e.g., `import javax.crypto.Cipher`, `from cryptography.hazmat.primitives import hashes`)
30+
- **API call pattern matching**: Crypto API invocations
31+
(e.g., `Cipher.getInstance("AES/GCM/NoPadding")`, `hashlib.sha256()`)
32+
- **Configuration file scanning**: TLS configs, OpenSSL configs, security properties
33+
3. **Classifies Algorithms**: Maps each detected algorithm to its FIPS 140-3 status
34+
(approved, deprecated, or not approved) and assesses key sizes against NIST minimums.
35+
4. **Produces Results**: Outputs findings as part of the standard analysis pipeline,
36+
with optional CycloneDX CBOM export and FIPS compliance reporting.
37+
38+
## Supported Ecosystems
39+
40+
| Ecosystem | Crypto Libraries Detected | File Types Scanned |
41+
|---|---|---|
42+
| **Python** | cryptography, pycryptodome, hashlib, ssl | `*.py`, `requirements.txt`, `pyproject.toml` |
43+
| **Java** | JCA/JCE, BouncyCastle, Conscrypt | `*.java`, `*.kt`, `pom.xml`, `build.gradle` |
44+
| **Go** | crypto/*, x/crypto | `*.go`, `go.mod` |
45+
| **Rust** | ring, rust-crypto, openssl, rustls | `*.rs`, `Cargo.toml` |
46+
| **Node.js** | crypto (builtin), crypto-js, node-forge, jose | `*.js`, `*.ts`, `package.json` |
47+
| **Ruby** | OpenSSL, rbnacl, bcrypt-ruby | `*.rb`, `Gemfile`, `*.gemspec` |
48+
| **C#/.NET** | System.Security.Cryptography, BouncyCastle | `*.cs`, `*.csproj`, `packages.config` |
49+
| **PHP** | openssl/sodium extensions, phpseclib | `*.php`, `composer.json` |
50+
| **Swift** | CryptoKit, CommonCrypto | `*.swift`, `Package.swift`, `Podfile` |
51+
| **Elixir** | :crypto, Comeonin (bcrypt/argon2), JOSE | `*.ex`, `*.exs`, `mix.exs` |
52+
53+
## Data Sent to FOSSA
54+
55+
When crypto scan results are uploaded to FOSSA (the default behavior without `--output`),
56+
the following data is sent:
57+
58+
- Algorithm names and classifications (e.g., "AES-256-GCM", "SHA-256")
59+
- File paths where algorithms were detected
60+
- Detection confidence levels
61+
- FIPS compliance status per algorithm
62+
- Providing library names (e.g., "openssl", "ring")
63+
64+
No source code content is sent to FOSSA. Only metadata about detected
65+
cryptographic algorithm usage is transmitted.
66+
67+
## CycloneDX 1.7 CBOM Output
68+
69+
To export a local CycloneDX 1.7 CBOM file instead of (or in addition to)
70+
uploading to FOSSA, use the `--crypto-cbom-output` flag:
71+
72+
```sh
73+
fossa analyze --crypto-cbom-output /path/to/cbom.json
74+
```
75+
76+
This produces a standards-compliant CycloneDX 1.7 JSON file with:
77+
78+
- `cryptographic-asset` component types
79+
- `cryptoProperties` with `algorithmProperties` (primitive, mode, key size, FIPS level)
80+
- `provides` dependency relationships linking libraries to their algorithms
81+
- Algorithm OIDs where applicable
82+
83+
The `--crypto-cbom-output` flag implies `--x-crypto-scan` and does not need to
84+
be combined with it explicitly.
85+
86+
## FIPS Compliance Report
87+
88+
To print a FIPS compliance summary to stdout, use the `--crypto-fips-report` flag:
89+
90+
```sh
91+
fossa analyze --crypto-fips-report
92+
```
93+
94+
The report includes:
95+
96+
- **Summary statistics**: Total algorithms detected, FIPS-approved count,
97+
deprecated count, non-FIPS count, and overall compliance percentage
98+
- **Per-algorithm breakdown**: Each detected algorithm with its FIPS status
99+
- **Remediation suggestions**: For non-FIPS algorithms, recommended FIPS
100+
alternatives (e.g., "Replace ChaCha20-Poly1305 with AES-256-GCM")
101+
- **Key size warnings**: Flags algorithms with key sizes below NIST minimums
102+
103+
The `--crypto-fips-report` flag implies `--x-crypto-scan` and does not need to
104+
be combined with it explicitly.
105+
106+
### Example output
107+
108+
```
109+
FIPS Compliance Report
110+
======================
111+
112+
Summary: 23 algorithms detected
113+
Approved: 15 (65%)
114+
Deprecated: 3 (13%)
115+
Not Approved: 5 (22%)
116+
117+
Remediation Suggestions:
118+
ChaCha20-Poly1305 -> AES-256-GCM
119+
BLAKE2b -> SHA-256 / SHA-3
120+
X25519 -> ECDH P-256
121+
bcrypt -> PBKDF2
122+
MD5 -> SHA-256
123+
```
124+
125+
## Combining Flags
126+
127+
All crypto scanning flags can be combined:
128+
129+
```sh
130+
# Scan, upload results, export CBOM, and print FIPS report
131+
fossa analyze --x-crypto-scan --crypto-cbom-output cbom.json --crypto-fips-report
132+
133+
# Local-only: export CBOM without uploading
134+
fossa analyze --output --crypto-cbom-output cbom.json
135+
136+
# FIPS report only
137+
fossa analyze --output --crypto-fips-report
138+
```
139+
140+
## FIPS Compliance Reference
141+
142+
### FIPS-Approved Algorithms
143+
144+
| Category | Algorithms |
145+
|---|---|
146+
| Symmetric Encryption | AES-128/192/256 (all modes except ECB deprecated by 2030) |
147+
| Hash Functions | SHA-256, SHA-384, SHA-512, SHA-3 family, SHAKE128/256 |
148+
| Signatures | RSA >= 2048-bit, ECDSA (P-256/P-384/P-521), EdDSA, ML-DSA |
149+
| Key Exchange | ECDH (P-256/P-384/P-521), DH >= 2048-bit, ML-KEM |
150+
| MACs | HMAC, CMAC, GMAC, KMAC |
151+
| KDFs | HKDF, PBKDF2, SP 800-108 KDFs |
152+
153+
### Common Non-FIPS Algorithms
154+
155+
| Algorithm Found | Recommended FIPS Alternative |
156+
|---|---|
157+
| ChaCha20-Poly1305 | AES-256-GCM |
158+
| BLAKE2/BLAKE3 | SHA-256 / SHA-3 |
159+
| X25519/X448 | ECDH P-256/P-384 |
160+
| MD5 | SHA-256 |
161+
| RC4, Blowfish, DES | AES |
162+
| Argon2, scrypt, bcrypt | PBKDF2 |

‎docs/references/experimental/crypto-scanning/README.md‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Crypto Scanning
2+
3+
FOSSA supports the ability to detect cryptographic algorithm usage in your project source tree and assess FIPS 140-3 compliance via an opt-in flag (`--x-crypto-scan`).
4+
5+
The core idea behind this feature is that organizations subject to FIPS compliance requirements need visibility into which cryptographic algorithms their software uses, whether those algorithms are FIPS-approved, and what remediation steps are needed for non-compliant usage.
6+
7+
_Important: For support and other general information, refer to the [experimental options overview](../README.md) before using experimental options._
8+
9+
## Discovery
10+
11+
Crypto Scanning automatically detects which language ecosystems are present in your project by examining manifest files (e.g., `requirements.txt`, `pom.xml`, `go.mod`, `Cargo.toml`, `package.json`, `Gemfile`, `*.csproj`, `composer.json`, `Package.swift`, `mix.exs`).
12+
13+
Ten ecosystems are supported: Python, Java, Go, Rust, Node.js, Ruby, C#/.NET, PHP, Swift, and Elixir.
14+
15+
## Analysis
16+
17+
The scanner uses four detection methods, applied in order of specificity:
18+
19+
| Detection Method | Description | Example |
20+
|---|---|---|
21+
| Dependency manifest | Known crypto libraries in lock/manifest files | `cryptography` in `requirements.txt` |
22+
| Import statement | Crypto-related import/require patterns | `import "crypto/aes"` in Go |
23+
| API call | Direct crypto API invocations | `Cipher.getInstance("AES/GCM/NoPadding")` in Java |
24+
| Configuration file | TLS/SSL/crypto configuration entries | `ssl_protocols TLSv1.3` in nginx config |
25+
26+
Each detected algorithm is classified with:
27+
28+
- **FIPS status**: Approved, deprecated, or not approved per NIST SP 800-131A Rev. 2
29+
- **Key size assessment**: Whether the key size meets NIST minimum requirements
30+
- **Confidence level**: High, medium, or low based on detection method specificity
31+
- **Providing library**: The library or framework providing the algorithm
32+
33+
## Output Formats
34+
35+
| Flag | Output |
36+
|---|---|
37+
| `--x-crypto-scan` | Include crypto findings in standard FOSSA upload |
38+
| `--crypto-cbom-output FILE` | Write CycloneDX 1.7 CBOM JSON to a local file |
39+
| `--crypto-fips-report` | Print FIPS compliance summary to stdout |
40+
41+
Both `--crypto-cbom-output` and `--crypto-fips-report` imply `--x-crypto-scan`.
42+
43+
## More Detail
44+
45+
For the full list of supported ecosystems, detected libraries, FIPS compliance reference, and usage examples, see [the Crypto Scanning feature documentation](../../../features/crypto-scanning.md).

‎docs/references/subcommands/analyze.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,27 @@ For more detail about how Vendetta works, how to use file filtering during
177177
scanning, or what information is sent to FOSSA's servers, see
178178
[the Vendetta feature documentation](../../features/vendetta.md).
179179

180+
### Cryptographic Algorithm Scanning
181+
182+
Crypto Scanning detects cryptographic algorithm usage across 10 language ecosystems
183+
and classifies findings against FIPS 140-3 compliance requirements. Results can be
184+
uploaded to FOSSA, exported as a CycloneDX 1.7 CBOM, or printed as a FIPS
185+
compliance report.
186+
187+
#### Enabling Crypto Scanning
188+
189+
| Name | Description |
190+
|--------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
191+
| `--x-crypto-scan` | Enable cryptographic algorithm detection during analysis. This experimental feature scans source files, imports, API calls, and config files for crypto usage across 10 ecosystems. |
192+
| `--crypto-cbom-output FILE` | Write a CycloneDX 1.7 CBOM (Cryptography Bill of Materials) JSON file to the specified path. Implies `--x-crypto-scan`. |
193+
| `--crypto-fips-report` | Print a FIPS 140-3 compliance summary to stdout with per-algorithm status and remediation suggestions. Implies `--x-crypto-scan`. |
194+
195+
#### More detail
196+
197+
For more detail about how Crypto Scanning works, supported ecosystems and
198+
libraries, FIPS compliance reference, and CycloneDX CBOM output format, see
199+
[the Crypto Scanning feature documentation](../../features/crypto-scanning.md).
200+
180201
### Experimental Options
181202

182203
_Important: For support and other general information, refer to the [experimental options overview](../experimental/README.md) before using experimental options._
@@ -191,6 +212,7 @@ In addition to the [standard flags](#specifying-fossa-project-details), the anal
191212
| `--experimental-force-first-party-scans` | Force [first party scans](../../features/first-party-license-scans.md) to run |
192213
| `--experimental-block-first-party-scans` | Force [first party scans](../../features/first-party-license-scans.md) to not run. This can be used to forcibly turn off first-party scans if your organization defaults to first-party scans. |
193214
| `--experimental-analyze-path-dependencies` | License scan path dependencies, and include them in the final analysis. For more information, see the [path dependency overview](../experimental/path-dependency.md). |
215+
| [`--x-crypto-scan`](../experimental/crypto-scanning/README.md) | Enable cryptographic algorithm detection and FIPS compliance assessment. For more information, see the [crypto scanning overview](../experimental/crypto-scanning/README.md). |
194216

195217

196218
### F.A.Q.

0 commit comments

Comments
 (0)