// cbom · CycloneDX 1.7

Cryptographic Inventory

This page is the full ShorSight scan result for beyond-shor.eu: 13 cryptographic assets across 5 libraries, each one backed by the file and line where it was found. Crypto agility starts with knowing what you have — and where it sits.

The scanner does not guess. Every asset carries an evidence grade: literal when an exact crypto API call appears in the code, resolved when it was inferred from imports and usage, name-only when nothing but the identifier matched. Clicking a row opens the evidence, with a link straight to the line in the repository.

What is inventoried is what does cryptographic work in this repository. The hosting provider’s TLS layer, Node’s internal hashes for package integrity and build tooling are deliberately out of scope.

scanner:
shorsight 0.2.0
scanned:
July 31, 2026
commit:
bcdac2fdc0
ML-DSA-65NIST FIPS 204
Verify →

signed: cbom.json

sig: fe68a4ac…0e131a20

13

assets

11

quantum-safe

2

quantum-unsafe

0

quantum-unknown

0

broken / weak

5

libraries

0

CVEs

15

network sinks

Quantum readiness

  • safe11
  • unsafe2
  • unknown0

Classical strength

secure
13
weak
0
broken
0
unknown
0

Where it lives

beyond-shor

  • 📁 beyond-shor local · 13 assets

Algorithms & protocols

quantum:
evidence:
Source
AES-256-GCMalgorithmsafesecuresymmetric-blockliteral
📁 beyond-shor
2
AES-GCMalgorithmsafesecuresymmetric-blockliteral
📁 beyond-shor
5
Classic-McEliecealgorithmsafesecurepqcresolved
📁 beyond-shor
4
EC-P256algorithmunsafesecureasymmetricresolved
📁 beyond-shor
4
FrodoKEM-1344-AESalgorithmsafesecurepqcresolved
📁 beyond-shor
3
HKDFalgorithmsafesecurekdfliteral
📁 beyond-shor
3
HMACalgorithmsafesecuremacresolved
📁 beyond-shor
1
ML-DSA-65algorithmsafesecurepqcresolved
📁 beyond-shor
8
ML-KEM-1024algorithmsafesecurepqcresolved
📁 beyond-shor
4
SHA-256algorithmsafesecurehashliteral
📁 beyond-shor
6
SLH-DSA-SHA2-128falgorithmsafesecurepqcresolved
📁 beyond-shor
1
SLH-DSA-SHA2-128salgorithmsafesecurepqcresolved
📁 beyond-shor
1
X25519algorithmunsafesecureasymmetricresolved
📁 beyond-shor
6

Libraries & vulnerabilities

Version marker: 📌 = exact version resolved from a lockfile, so CVEs are matched precisely. ~ = a manifest range only, so the installed version is not pinned and CVE matching is left unknown. No marker = no version found, e.g. a stdlib module.

Network sinks

// export

Export

Download cbom.json ↓CycloneDX 1.7 — signed with ML-DSA-65, verifiable in your browser
// show CBOM JSON
{
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "serialNumber": "urn:uuid:2e5fb0d4-c4e8-4d24-a117-dbd002a59f76",
  "version": 1,
  "metadata": {
    "timestamp": "2026-07-31T09:40:20.358240+00:00",
    "tools": {
      "components": [
        {
          "type": "application",
          "name": "shorsight",
          "version": "0.2.0"
        }
      ]
    },
    "component": {
      "type": "application",
      "bom-ref": "target/beyond-shor",
      "name": "beyond-shor"
    },
    "properties": [
      {
        "name": "crypto:sinkCount",
        "value": "15"
      },
      {
        "name": "crypto:source",
        "value": "beyond-shor (local)"
      },
      {
        "name": "crypto:provenance",
        "value": "{\"label\": \"beyond-shor\", \"webUrl\": \"https://github.com/BeyondShor/beyond-shor\", \"host\": \"github\", \"commit\": \"bcdac2fdc05d9e6d08ac4fa0301bd6d3698f59c7\", \"pathPrefix\": \"\"}"
      },
      {
        "name": "crypto:sink",
        "value": "{\"symbol\": \"fetch\", \"library\": \"fetch\", \"source\": \"beyond-shor\", \"location\": \"frontend/app/api/article-fields/route.ts\", \"line\": 68}"
      },
      {
        "name": "crypto:sink",
        "value": "{\"symbol\": \"request.headers.get\", \"library\": \"request\", \"source\": \"beyond-shor\", \"location\": \"frontend/app/api/article-fields/route.ts\", \"line\": 40}"
      },
      {
        "name": "crypto:sink",
        "value": "{\"symbol\": \"fetch\", \"library\": \"fetch\", \"source\": \"beyond-shor\", \"location\": \"frontend/components/RbePlayground.tsx\", \"line\": 389}"
      },
      {
        "name": "crypto:sink",
        "value": "{\"symbol\": \"fetch\", \"library\": \"fetch\", \"source\": \"beyond-shor\", \"location\": \"frontend/components/RbePlayground.tsx\", \"line\": 357}"
      },
      {
        "name": "crypto:sink",
        "value": "{\"symbol\": \"fetch\", \"library\": \"fetch\", \"source\": \"beyond-shor\", \"location\": \"frontend/components/RbePlayground.tsx\", \"line\": 333}"
      },
      {
        "name": "crypto:sink",
        "value": "{\"symbol\": \"fetch\", \"library\": \"fetch\", \"source\": \"beyond-shor\", \"location\": \"frontend/components/SignatureVerifier.tsx\", \"line\": 227}"
      },
      {
        "name": "crypto:sink",
        "value": "{\"symbol\": \"fetch\", \"library\": \"fetch\", \"source\": \"beyond-shor\", \"location\": \"frontend/components/SignatureVerifier.tsx\", \"line\": 212}"
      },
      {
        "name": "crypto:sink",
        "value": "{\"symbol\": \"fetch\", \"library\": \"fetch\", \"source\": \"beyond-shor\", \"location\": \"frontend/components/SignatureVerifier.tsx\", \"line\": 131}"
      },
      {
        "name": "crypto:sink",
        "value": "{\"symbol\": \"fetch\", \"library\": \"fetch\", \"source\": \"beyond-shor\", \"location\": \"frontend/components/SignatureVerifier.tsx\", \"line\": 43}"
      },
      {
        "name": "crypto:sink",
        "value": "{\"symbol\": \"fetch\", \"library\": \"fetch\", \"source\": \"beyond-shor\", \"location\": \"frontend/lib/strapi.ts\", \"line\": 30}"
      },
      {
        "name": "crypto:sink",
        "value": "{\"symbol\": \"fetch\", \"library\": \"fetch\", \"source\": \"beyond-shor\", \"location\": \"scripts/sign-articles.mjs\", \"line\": 134}"
      },
      {
        "name": "crypto:sink",
        "value": "{\"symbol\": \"fetch\", \"library\": \"fetch\", \"source\": \"beyond-shor\", \"location\": \"scripts/sign-articles.mjs\", \"line\": 64}"
      },
      {
        "name": "crypto:sink",
        "value": "{\"symbol\": \"fetch\", \"library\": \"fetch\", \"source\": \"beyond-shor\", \"location\": \"scripts/migrate-timeline.mjs\", \"line\": 127}"
      },
      {
        "name": "crypto:sink",
        "value": "{\"symbol\": \"fetch\", \"library\": \"fetch\", \"source\": \"beyond-shor\", \"location\": \"scripts/migrate-timeline.mjs\", \"line\": 113}"
      },
      {
        "name": "crypto:sink",
        "value": "{\"symbol\": \"fetch\", \"library\": \"fetch\", \"source\": \"beyond-shor\", \"location\": \"src/api/article/content-types/article/lifecycles.ts\", \"line\": 91}"
      }
    ]
  },
  "components": [
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/aes-256-gcm",
      "name": "AES-256-GCM",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "ae",
          "algorithmFamily": "AES",
          "parameterSetIdentifier": "256",
          "mode": "gcm",
          "nistQuantumSecurityLevel": 1,
          "cryptoFunctions": [
            "keyderive"
          ]
        },
        "oid": "2.16.840.1.101.3.4.1.46"
      },
      "evidence": {
        "occurrences": [
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 56,
            "additionalContext": "{ name: 'AES-GCM', length: 256 },",
            "symbol": "WebCrypto:AES-GCM"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 53,
            "additionalContext": "return crypto.subtle.deriveKey(",
            "symbol": "crypto.subtle.deriveKey"
          }
        ]
      },
      "properties": [
        {
          "name": "crypto:quantumStatus",
          "value": "safe"
        },
        {
          "name": "crypto:classicalStatus",
          "value": "secure"
        },
        {
          "name": "crypto:family",
          "value": "symmetric-block"
        },
        {
          "name": "crypto:name",
          "value": "AES"
        },
        {
          "name": "crypto:confidence",
          "value": "literal"
        },
        {
          "name": "crypto:rationale",
          "value": "Authenticated encryption; 256-bit key keeps >=128-bit security under Grover."
        },
        {
          "name": "crypto:library",
          "value": "Node.js crypto"
        },
        {
          "name": "crypto:source",
          "value": "beyond-shor"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/aes-gcm",
      "name": "AES-GCM",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "ae",
          "algorithmFamily": "AES",
          "mode": "gcm",
          "cryptoFunctions": [
            "decrypt",
            "encrypt"
          ]
        }
      },
      "evidence": {
        "occurrences": [
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 257,
            "additionalContext": "await crypto.subtle.decrypt({ name: 'AES-GCM', iv: asBuf(bytes) }, combinedKeyServer, asBuf(ciphertext));",
            "symbol": "WebCrypto:AES-GCM"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 255,
            "additionalContext": "await crypto.subtle.decrypt({ name: 'AES-GCM', iv: asBuf(iv) }, combinedKeyServer, asBuf(bytes));",
            "symbol": "WebCrypto:AES-GCM"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 242,
            "additionalContext": "await crypto.subtle.decrypt({ name: 'AES-GCM', iv: asBuf(iv) }, wrongKeyObj, asBuf(ciphertext));",
            "symbol": "WebCrypto:AES-GCM"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 192,
            "additionalContext": "const decryptedBuf = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: asBuf(iv) }, combinedKeyServerObj, asBuf(ciphertext));",
            "symbol": "WebCrypto:AES-GCM"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 184,
            "additionalContext": "const ciphertextBuf  = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: asBuf(iv) }, combinedKeyObj, asBuf(plaintextBytes));",
            "symbol": "WebCrypto:AES-GCM"
          }
        ]
      },
      "properties": [
        {
          "name": "crypto:quantumStatus",
          "value": "safe"
        },
        {
          "name": "crypto:classicalStatus",
          "value": "secure"
        },
        {
          "name": "crypto:family",
          "value": "symmetric-block"
        },
        {
          "name": "crypto:name",
          "value": "AES"
        },
        {
          "name": "crypto:confidence",
          "value": "literal"
        },
        {
          "name": "crypto:rationale",
          "value": "AES-GCM authenticated encryption; key size not statically determinable (128/192/256)."
        },
        {
          "name": "crypto:library",
          "value": "Node.js crypto"
        },
        {
          "name": "crypto:source",
          "value": "beyond-shor"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/classic-mceliece",
      "name": "Classic-McEliece",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "kem",
          "cryptoFunctions": [
            "decrypt",
            "encrypt"
          ]
        }
      },
      "evidence": {
        "occurrences": [
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 222,
            "additionalContext": "wrongKemSecret = await mceliece.decrypt(bytes, kemServerPriv);",
            "symbol": "mceliece.mceliece.decrypt"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 116,
            "additionalContext": "kemSecretServer = await mceliece.decrypt(cyphertext, privateKey);",
            "symbol": "mceliece.mceliece.decrypt"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 110,
            "additionalContext": "const { cyphertext, secret } = await mceliece.encrypt(kemServerPub);",
            "symbol": "mceliece.mceliece.encrypt"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 104,
            "additionalContext": "const { publicKey, privateKey } = await mceliece.keyPair();",
            "symbol": "mceliece.mceliece.keyPair"
          }
        ]
      },
      "properties": [
        {
          "name": "crypto:quantumStatus",
          "value": "safe"
        },
        {
          "name": "crypto:classicalStatus",
          "value": "secure"
        },
        {
          "name": "crypto:family",
          "value": "pqc"
        },
        {
          "name": "crypto:name",
          "value": "Classic McEliece"
        },
        {
          "name": "crypto:confidence",
          "value": "resolved"
        },
        {
          "name": "crypto:rationale",
          "value": "Code-based post-quantum KEM; conservative, large public keys."
        },
        {
          "name": "crypto:library",
          "value": "mceliece"
        },
        {
          "name": "crypto:source",
          "value": "beyond-shor"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/ec-p256",
      "name": "EC-P256",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "key-agree",
          "parameterSetIdentifier": "256",
          "ellipticCurve": "nist/P-256",
          "cryptoFunctions": [
            "sign",
            "verify"
          ]
        }
      },
      "evidence": {
        "occurrences": [
          {
            "location": "beyond-shor::frontend/workers/signature-worker.ts",
            "line": 93,
            "additionalContext": "signature = p256.sign(messageHash, secretKey); // signs H(msg), not msg",
            "symbol": "@noble/curves/nist.js.p256.sign"
          },
          {
            "location": "beyond-shor::frontend/workers/signature-worker.ts",
            "line": 65,
            "additionalContext": "publicKey = p256.getPublicKey(secretKey, true); // compressed 33 B",
            "symbol": "@noble/curves/nist.js.p256.getPublicKey"
          },
          {
            "location": "beyond-shor::frontend/workers/signature-worker.ts",
            "line": 64,
            "additionalContext": "secretKey = p256.utils.randomSecretKey();",
            "symbol": "@noble/curves/nist.js.p256.utils.randomSecretKey"
          },
          {
            "location": "beyond-shor::frontend/workers/signature-worker.ts",
            "line": 49,
            "additionalContext": "return p256.verify(sig, msgHash, pub);",
            "symbol": "@noble/curves/nist.js.p256.verify"
          }
        ]
      },
      "properties": [
        {
          "name": "crypto:quantumStatus",
          "value": "unsafe"
        },
        {
          "name": "crypto:classicalStatus",
          "value": "secure"
        },
        {
          "name": "crypto:family",
          "value": "asymmetric"
        },
        {
          "name": "crypto:name",
          "value": "EC"
        },
        {
          "name": "crypto:confidence",
          "value": "resolved"
        },
        {
          "name": "crypto:rationale",
          "value": "NIST P-256 elliptic curve (use not inferred from a bare curve constant); broken by Shor's algorithm."
        },
        {
          "name": "crypto:library",
          "value": "@noble/curves"
        },
        {
          "name": "crypto:source",
          "value": "beyond-shor"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/frodokem-1344-aes",
      "name": "FrodoKEM-1344-AES",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "kem",
          "parameterSetIdentifier": "1344-AES",
          "nistQuantumSecurityLevel": 5,
          "cryptoFunctions": [
            "unknown"
          ]
        }
      },
      "evidence": {
        "occurrences": [
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 225,
            "additionalContext": "const f = await createFrodoKEM1344AES();",
            "symbol": "@oqs/liboqs-js.createFrodoKEM1344AES"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 124,
            "additionalContext": "const bobFrodo   = await createFrodoKEM1344AES();",
            "symbol": "@oqs/liboqs-js.createFrodoKEM1344AES"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 123,
            "additionalContext": "const aliceFrodo = await createFrodoKEM1344AES();",
            "symbol": "@oqs/liboqs-js.createFrodoKEM1344AES"
          }
        ]
      },
      "properties": [
        {
          "name": "crypto:quantumStatus",
          "value": "safe"
        },
        {
          "name": "crypto:classicalStatus",
          "value": "secure"
        },
        {
          "name": "crypto:family",
          "value": "pqc"
        },
        {
          "name": "crypto:name",
          "value": "FrodoKEM"
        },
        {
          "name": "crypto:confidence",
          "value": "resolved"
        },
        {
          "name": "crypto:rationale",
          "value": "Conservative lattice-based (LWE) post-quantum KEM, 1344-bit parameter set with AES as the internal PRF; NIST level 5."
        },
        {
          "name": "crypto:library",
          "value": "Open Quantum Safe (liboqs-js)"
        },
        {
          "name": "crypto:source",
          "value": "beyond-shor"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/hkdf",
      "name": "HKDF",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "kdf",
          "algorithmFamily": "HKDF",
          "cryptoFunctions": [
            "keyderive"
          ]
        }
      },
      "evidence": {
        "occurrences": [
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 54,
            "additionalContext": "{ name: 'HKDF', hash: 'SHA-256', salt: asBuf(salt), info: new TextEncoder().encode('hybrid-pqc-playground-v1') },",
            "symbol": "WebCrypto:HKDF"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 53,
            "additionalContext": "return crypto.subtle.deriveKey(",
            "symbol": "crypto.subtle.deriveKey"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 52,
            "additionalContext": "const ikmKey = await crypto.subtle.importKey('raw', asBuf(ikm), 'HKDF', false, ['deriveKey']);",
            "symbol": "crypto.subtle.importKey"
          }
        ]
      },
      "properties": [
        {
          "name": "crypto:quantumStatus",
          "value": "safe"
        },
        {
          "name": "crypto:classicalStatus",
          "value": "secure"
        },
        {
          "name": "crypto:family",
          "value": "kdf"
        },
        {
          "name": "crypto:name",
          "value": "HKDF"
        },
        {
          "name": "crypto:confidence",
          "value": "literal"
        },
        {
          "name": "crypto:rationale",
          "value": "HMAC-based key derivation (RFC 5869); sound for deriving keys from high-entropy input."
        },
        {
          "name": "crypto:library",
          "value": "Node.js crypto"
        },
        {
          "name": "crypto:source",
          "value": "beyond-shor"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/hmac",
      "name": "HMAC",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "mac",
          "algorithmFamily": "HMAC",
          "cryptoFunctions": [
            "tag"
          ]
        }
      },
      "evidence": {
        "occurrences": [
          {
            "location": "beyond-shor::frontend/lib/spam.ts",
            "line": 30,
            "additionalContext": "return crypto",
            "symbol": "node:crypto.createHmac"
          }
        ]
      },
      "properties": [
        {
          "name": "crypto:quantumStatus",
          "value": "safe"
        },
        {
          "name": "crypto:classicalStatus",
          "value": "secure"
        },
        {
          "name": "crypto:family",
          "value": "mac"
        },
        {
          "name": "crypto:name",
          "value": "HMAC"
        },
        {
          "name": "crypto:confidence",
          "value": "resolved"
        },
        {
          "name": "crypto:rationale",
          "value": "Security depends on the underlying hash; safe with SHA-2/SHA-3."
        },
        {
          "name": "crypto:library",
          "value": "Node.js crypto"
        },
        {
          "name": "crypto:source",
          "value": "beyond-shor"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/ml-dsa-65",
      "name": "ML-DSA-65",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "signature",
          "algorithmFamily": "ML-DSA",
          "parameterSetIdentifier": "65",
          "nistQuantumSecurityLevel": 3,
          "cryptoFunctions": [
            "keygen",
            "sign",
            "verify"
          ]
        },
        "oid": "2.16.840.1.101.3.4.3.18"
      },
      "evidence": {
        "occurrences": [
          {
            "location": "beyond-shor::frontend/workers/signature-worker.ts",
            "line": 95,
            "additionalContext": "signature = ml_dsa65.sign(msgBytes, secretKey);",
            "symbol": "@noble/post-quantum/ml-dsa.js.ml_dsa65.sign"
          },
          {
            "location": "beyond-shor::frontend/workers/signature-worker.ts",
            "line": 67,
            "additionalContext": "const kp = ml_dsa65.keygen();",
            "symbol": "@noble/post-quantum/ml-dsa.js.ml_dsa65.keygen"
          },
          {
            "location": "beyond-shor::frontend/workers/signature-worker.ts",
            "line": 51,
            "additionalContext": "if (dsa === 'mldsa65') return ml_dsa65.verify(sig, msg, pub);",
            "symbol": "@noble/post-quantum/ml-dsa.js.ml_dsa65.verify"
          },
          {
            "location": "beyond-shor::frontend/components/SignatureVerifier.tsx",
            "line": 255,
            "additionalContext": "const valid     = ml_dsa65.verify(sigBytes, msgBytes, publicKey);",
            "symbol": "@noble/post-quantum/ml-dsa.js.ml_dsa65.verify"
          },
          {
            "location": "beyond-shor::frontend/components/SignatureVerifier.tsx",
            "line": 182,
            "additionalContext": "const valid     = ml_dsa65.verify(sigBytes, rawBytes, publicKey);",
            "symbol": "@noble/post-quantum/ml-dsa.js.ml_dsa65.verify"
          },
          {
            "location": "beyond-shor::scripts/sign-articles.mjs",
            "line": 172,
            "additionalContext": "const sig = ml_dsa65.sign(msg, privateKey);",
            "symbol": "@noble/post-quantum/ml-dsa.js.ml_dsa65.sign"
          },
          {
            "location": "beyond-shor::scripts/generate-pqc-keys.mjs",
            "line": 5,
            "additionalContext": "const { secretKey, publicKey } = ml_dsa65.keygen(seed);",
            "symbol": "@noble/post-quantum/ml-dsa.js.ml_dsa65.keygen"
          },
          {
            "location": "beyond-shor::src/api/article/content-types/article/lifecycles.ts",
            "line": 109,
            "additionalContext": "const sig = ml_dsa65.sign(msg, getPrivateKey());",
            "symbol": "@noble/post-quantum/ml-dsa.js.ml_dsa65.sign"
          }
        ]
      },
      "properties": [
        {
          "name": "crypto:quantumStatus",
          "value": "safe"
        },
        {
          "name": "crypto:classicalStatus",
          "value": "secure"
        },
        {
          "name": "crypto:family",
          "value": "pqc"
        },
        {
          "name": "crypto:name",
          "value": "ML-DSA"
        },
        {
          "name": "crypto:confidence",
          "value": "resolved"
        },
        {
          "name": "crypto:rationale",
          "value": "NIST FIPS 204 post-quantum signature (CRYSTALS-Dilithium)."
        },
        {
          "name": "crypto:library",
          "value": "@noble/post-quantum"
        },
        {
          "name": "crypto:source",
          "value": "beyond-shor"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/ml-kem-1024",
      "name": "ML-KEM-1024",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "kem",
          "algorithmFamily": "ML-KEM",
          "parameterSetIdentifier": "1024",
          "nistQuantumSecurityLevel": 5,
          "cryptoFunctions": [
            "decapsulate",
            "encapsulate",
            "keygen"
          ]
        },
        "oid": "2.16.840.1.101.3.4.4.3"
      },
      "evidence": {
        "occurrences": [
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 219,
            "additionalContext": "wrongKemSecret = ml_kem1024.decapsulate(bytes, kemServerPriv);",
            "symbol": "@noble/post-quantum/ml-kem.js.ml_kem1024.decapsulate"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 97,
            "additionalContext": "kemSecretServer = ml_kem1024.decapsulate(cipherText, secretKey);",
            "symbol": "@noble/post-quantum/ml-kem.js.ml_kem1024.decapsulate"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 91,
            "additionalContext": "const { cipherText, sharedSecret } = ml_kem1024.encapsulate(kemServerPub);",
            "symbol": "@noble/post-quantum/ml-kem.js.ml_kem1024.encapsulate"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 85,
            "additionalContext": "const { publicKey, secretKey } = ml_kem1024.keygen();",
            "symbol": "@noble/post-quantum/ml-kem.js.ml_kem1024.keygen"
          }
        ]
      },
      "properties": [
        {
          "name": "crypto:quantumStatus",
          "value": "safe"
        },
        {
          "name": "crypto:classicalStatus",
          "value": "secure"
        },
        {
          "name": "crypto:family",
          "value": "pqc"
        },
        {
          "name": "crypto:name",
          "value": "ML-KEM"
        },
        {
          "name": "crypto:confidence",
          "value": "resolved"
        },
        {
          "name": "crypto:rationale",
          "value": "NIST FIPS 203 post-quantum KEM (CRYSTALS-Kyber), security level 5."
        },
        {
          "name": "crypto:library",
          "value": "@noble/post-quantum"
        },
        {
          "name": "crypto:source",
          "value": "beyond-shor"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/sha-256",
      "name": "SHA-256",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "hash",
          "algorithmFamily": "SHA-2",
          "parameterSetIdentifier": "256",
          "cryptoFunctions": [
            "digest",
            "keyderive",
            "tag"
          ]
        },
        "oid": "2.16.840.1.101.3.4.2.1"
      },
      "evidence": {
        "occurrences": [
          {
            "location": "beyond-shor::frontend/workers/signature-worker.ts",
            "line": 34,
            "additionalContext": "const buf = await crypto.subtle.digest('SHA-256', msg.slice());",
            "symbol": "crypto.subtle.digest"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 53,
            "additionalContext": "return crypto.subtle.deriveKey(",
            "symbol": "crypto.subtle.deriveKey"
          },
          {
            "location": "beyond-shor::frontend/components/SignatureVerifier.tsx",
            "line": 46,
            "additionalContext": "const hashBuffer = await crypto.subtle.digest('SHA-256', buffer);",
            "symbol": "crypto.subtle.digest"
          },
          {
            "location": "beyond-shor::frontend/lib/spam.ts",
            "line": 30,
            "additionalContext": "return crypto",
            "symbol": "node:crypto.createHmac"
          },
          {
            "location": "beyond-shor::scripts/sign-articles.mjs",
            "line": 67,
            "additionalContext": "return createHash('sha256').update(Buffer.from(buffer)).digest('hex');",
            "symbol": "node:crypto.createHash"
          },
          {
            "location": "beyond-shor::src/api/article/content-types/article/lifecycles.ts",
            "line": 16,
            "additionalContext": "return createHash('sha256').update(content).digest('hex');",
            "symbol": "node:crypto.createHash"
          }
        ]
      },
      "properties": [
        {
          "name": "crypto:quantumStatus",
          "value": "safe"
        },
        {
          "name": "crypto:classicalStatus",
          "value": "secure"
        },
        {
          "name": "crypto:family",
          "value": "hash"
        },
        {
          "name": "crypto:name",
          "value": "SHA-256"
        },
        {
          "name": "crypto:confidence",
          "value": "literal"
        },
        {
          "name": "crypto:rationale",
          "value": "SHA-2; Grover only reduces preimage security to 2^128, still safe."
        },
        {
          "name": "crypto:library",
          "value": "Node.js crypto"
        },
        {
          "name": "crypto:source",
          "value": "beyond-shor"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/slh-dsa-sha2-128f",
      "name": "SLH-DSA-SHA2-128f",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "signature",
          "parameterSetIdentifier": "SHA2-128f",
          "nistQuantumSecurityLevel": 1,
          "cryptoFunctions": [
            "unknown"
          ]
        },
        "oid": "2.16.840.1.101.3.4.3.21"
      },
      "evidence": {
        "occurrences": [
          {
            "location": "beyond-shor::frontend/workers/signature-worker.ts",
            "line": 29,
            "additionalContext": "return variant === 'slhdsa128s' ? mod.slh_dsa_sha2_128s : mod.slh_dsa_sha2_128f;",
            "symbol": "@noble/post-quantum/slh-dsa.js.slh_dsa_sha2_128f"
          }
        ]
      },
      "properties": [
        {
          "name": "crypto:quantumStatus",
          "value": "safe"
        },
        {
          "name": "crypto:classicalStatus",
          "value": "secure"
        },
        {
          "name": "crypto:family",
          "value": "pqc"
        },
        {
          "name": "crypto:name",
          "value": "SLH-DSA"
        },
        {
          "name": "crypto:confidence",
          "value": "resolved"
        },
        {
          "name": "crypto:rationale",
          "value": "NIST FIPS 205 SLH-DSA-SHA2-128f (SPHINCS+): fast signing, larger signatures; NIST level 1."
        },
        {
          "name": "crypto:library",
          "value": "@noble/post-quantum"
        },
        {
          "name": "crypto:source",
          "value": "beyond-shor"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/slh-dsa-sha2-128s",
      "name": "SLH-DSA-SHA2-128s",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "signature",
          "parameterSetIdentifier": "SHA2-128s",
          "nistQuantumSecurityLevel": 1,
          "cryptoFunctions": [
            "unknown"
          ]
        },
        "oid": "2.16.840.1.101.3.4.3.20"
      },
      "evidence": {
        "occurrences": [
          {
            "location": "beyond-shor::frontend/workers/signature-worker.ts",
            "line": 29,
            "additionalContext": "return variant === 'slhdsa128s' ? mod.slh_dsa_sha2_128s : mod.slh_dsa_sha2_128f;",
            "symbol": "@noble/post-quantum/slh-dsa.js.slh_dsa_sha2_128s"
          }
        ]
      },
      "properties": [
        {
          "name": "crypto:quantumStatus",
          "value": "safe"
        },
        {
          "name": "crypto:classicalStatus",
          "value": "secure"
        },
        {
          "name": "crypto:family",
          "value": "pqc"
        },
        {
          "name": "crypto:name",
          "value": "SLH-DSA"
        },
        {
          "name": "crypto:confidence",
          "value": "resolved"
        },
        {
          "name": "crypto:rationale",
          "value": "NIST FIPS 205 SLH-DSA-SHA2-128s (SPHINCS+): small signatures, slow signing; NIST level 1."
        },
        {
          "name": "crypto:library",
          "value": "@noble/post-quantum"
        },
        {
          "name": "crypto:source",
          "value": "beyond-shor"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/x25519",
      "name": "X25519",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "key-agree",
          "algorithmFamily": "ECDH",
          "parameterSetIdentifier": "256",
          "ellipticCurve": "other/Curve25519",
          "cryptoFunctions": [
            "unknown"
          ]
        },
        "oid": "1.3.101.110"
      },
      "evidence": {
        "occurrences": [
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 155,
            "additionalContext": "const x25519SecretServer = x25519.getSharedSecret(serverX25519Priv, clientX25519Pub);",
            "symbol": "@noble/curves/ed25519.js.x25519.getSharedSecret"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 154,
            "additionalContext": "const x25519Secret       = x25519.getSharedSecret(clientX25519Priv, serverX25519Pub);",
            "symbol": "@noble/curves/ed25519.js.x25519.getSharedSecret"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 72,
            "additionalContext": "const serverX25519Pub  = x25519.getPublicKey(serverX25519Priv);",
            "symbol": "@noble/curves/ed25519.js.x25519.getPublicKey"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 71,
            "additionalContext": "const serverX25519Priv = x25519.utils.randomSecretKey();",
            "symbol": "@noble/curves/ed25519.js.x25519.utils.randomSecretKey"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 70,
            "additionalContext": "const clientX25519Pub  = x25519.getPublicKey(clientX25519Priv);",
            "symbol": "@noble/curves/ed25519.js.x25519.getPublicKey"
          },
          {
            "location": "beyond-shor::frontend/workers/playground-worker.ts",
            "line": 69,
            "additionalContext": "const clientX25519Priv = x25519.utils.randomSecretKey();",
            "symbol": "@noble/curves/ed25519.js.x25519.utils.randomSecretKey"
          }
        ]
      },
      "properties": [
        {
          "name": "crypto:quantumStatus",
          "value": "unsafe"
        },
        {
          "name": "crypto:classicalStatus",
          "value": "secure"
        },
        {
          "name": "crypto:family",
          "value": "asymmetric"
        },
        {
          "name": "crypto:name",
          "value": "X25519"
        },
        {
          "name": "crypto:confidence",
          "value": "resolved"
        },
        {
          "name": "crypto:rationale",
          "value": "Curve25519 key agreement; broken by Shor."
        },
        {
          "name": "crypto:library",
          "value": "@noble/curves"
        },
        {
          "name": "crypto:source",
          "value": "beyond-shor"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "lib/noble-curves",
      "name": "@noble/curves",
      "evidence": {
        "occurrences": [
          {
            "location": "frontend/workers/playground-worker.ts"
          },
          {
            "location": "frontend/workers/signature-worker.ts"
          }
        ]
      },
      "version": "2.0.1",
      "purl": "pkg:npm/@noble/curves@2.0.1",
      "properties": [
        {
          "name": "crypto:dependencyScope",
          "value": "direct"
        },
        {
          "name": "crypto:versionPrecision",
          "value": "exact"
        },
        {
          "name": "crypto:cveStatus",
          "value": "unaffected"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "lib/noble-post-quantum",
      "name": "@noble/post-quantum",
      "evidence": {
        "occurrences": [
          {
            "location": "frontend/components/SignatureVerifier.tsx"
          },
          {
            "location": "frontend/workers/playground-worker.ts"
          },
          {
            "location": "frontend/workers/signature-worker.ts"
          },
          {
            "location": "scripts/generate-pqc-keys.mjs"
          },
          {
            "location": "scripts/sign-articles.mjs"
          },
          {
            "location": "src/api/article/content-types/article/lifecycles.ts"
          }
        ]
      },
      "version": "0.5.4",
      "purl": "pkg:npm/@noble/post-quantum@0.5.4",
      "properties": [
        {
          "name": "crypto:dependencyScope",
          "value": "direct"
        },
        {
          "name": "crypto:versionPrecision",
          "value": "exact"
        },
        {
          "name": "crypto:cveStatus",
          "value": "unaffected"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "lib/node-js-crypto",
      "name": "Node.js crypto",
      "evidence": {
        "occurrences": [
          {
            "location": "frontend/app/api/rbe/session/route.ts"
          },
          {
            "location": "frontend/lib/spam.ts"
          },
          {
            "location": "scripts/generate-pqc-keys.mjs"
          },
          {
            "location": "scripts/sign-articles.mjs"
          },
          {
            "location": "src/api/article/content-types/article/lifecycles.ts"
          }
        ]
      },
      "properties": [
        {
          "name": "crypto:dependencyScope",
          "value": "direct"
        },
        {
          "name": "crypto:versionPrecision",
          "value": "unpinned"
        },
        {
          "name": "crypto:cveStatus",
          "value": "unknown"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "lib/open-quantum-safe-liboqs-js",
      "name": "Open Quantum Safe (liboqs-js)",
      "evidence": {
        "occurrences": [
          {
            "location": "frontend/workers/playground-worker.ts"
          }
        ]
      },
      "version": "0.15.1",
      "purl": "pkg:npm/@oqs/liboqs-js@0.15.1",
      "properties": [
        {
          "name": "crypto:dependencyScope",
          "value": "direct"
        },
        {
          "name": "crypto:versionPrecision",
          "value": "unpinned"
        },
        {
          "name": "crypto:cveStatus",
          "value": "unknown"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "lib/mceliece",
      "name": "mceliece",
      "evidence": {
        "occurrences": [
          {
            "location": "frontend/workers/playground-worker.ts"
          }
        ]
      },
      "version": "5.0.4",
      "purl": "pkg:npm/mceliece@5.0.4",
      "properties": [
        {
          "name": "crypto:dependencyScope",
          "value": "direct"
        },
        {
          "name": "crypto:versionPrecision",
          "value": "unpinned"
        },
        {
          "name": "crypto:cveStatus",
          "value": "unknown"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "crypto/aes-256-gcm"
    },
    {
      "ref": "crypto/aes-gcm"
    },
    {
      "ref": "crypto/classic-mceliece"
    },
    {
      "ref": "crypto/ec-p256"
    },
    {
      "ref": "crypto/frodokem-1344-aes"
    },
    {
      "ref": "crypto/hkdf"
    },
    {
      "ref": "crypto/hmac"
    },
    {
      "ref": "crypto/ml-dsa-65"
    },
    {
      "ref": "crypto/ml-kem-1024"
    },
    {
      "ref": "crypto/sha-256"
    },
    {
      "ref": "crypto/slh-dsa-sha2-128f"
    },
    {
      "ref": "crypto/slh-dsa-sha2-128s"
    },
    {
      "ref": "crypto/x25519"
    },
    {
      "ref": "lib/mceliece",
      "provides": [
        "crypto/classic-mceliece"
      ]
    },
    {
      "ref": "lib/noble-curves",
      "provides": [
        "crypto/ec-p256",
        "crypto/x25519"
      ]
    },
    {
      "ref": "lib/noble-post-quantum",
      "provides": [
        "crypto/ml-dsa-65",
        "crypto/ml-kem-1024",
        "crypto/slh-dsa-sha2-128f",
        "crypto/slh-dsa-sha2-128s"
      ]
    },
    {
      "ref": "lib/node-js-crypto",
      "provides": [
        "crypto/aes-256-gcm",
        "crypto/aes-gcm",
        "crypto/hkdf",
        "crypto/hmac",
        "crypto/sha-256"
      ]
    },
    {
      "ref": "lib/open-quantum-safe-liboqs-js",
      "provides": [
        "crypto/frodokem-1344-aes"
      ]
    },
    {
      "ref": "target/beyond-shor",
      "dependsOn": [
        "lib/mceliece",
        "lib/noble-curves",
        "lib/noble-post-quantum",
        "lib/node-js-crypto",
        "lib/open-quantum-safe-liboqs-js"
      ]
    }
  ]
}