{ "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c1028eb1-5ca3-58f5-a0fa-0bc105263647", "version": 1, "metadata": { "timestamp": "2026-06-30T09:00:00Z", "tools": { "components": [ { "type": "application", "name": "cbomkit-theia", "version": "1.4.0", "group": "PQCA" }, { "type": "application", "name": "sonar-cryptography", "version": "1.3.2", "group": "PQCA" } ] }, "authors": [ { "name": "Equipe de Segurança — Banco Meridiano S.A." } ], "component": { "type": "application", "name": "Meridiano Core Banking Platform", "version": "2026.2.0", "bom-ref": "app/meridiano-core", "description": "Plataforma de core banking (contas, ledger, pagamentos, Pix) — inventário criptográfico consolidado." }, "properties": [ { "name": "lastrium:environment", "value": "produção" }, { "name": "lastrium:scan_scope", "value": "monorepo + configs + keystores" } ] }, "components": [ { "type": "cryptographic-asset", "name": "RSA", "bom-ref": "alg/rsa-2048-sign", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "signature", "parameterSetIdentifier": "2048", "cryptoFunctions": [ "sign", "verify" ], "padding": "pkcs1v15", "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 112, "nistQuantumSecurityLevel": 0 }, "oid": "1.2.840.113549.1.1.11" }, "evidence": { "occurrences": [ { "location": "src/auth/jwt_signer.go", "line": 88, "additionalContext": "crypto/rsa.SignPKCS1v15 — assinatura de JWT de sessão" } ] } }, { "type": "cryptographic-asset", "name": "RSA", "bom-ref": "alg/rsa-4096-enc", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "pke", "parameterSetIdentifier": "4096", "cryptoFunctions": [ "encrypt", "decrypt" ], "padding": "oaep", "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 140, "nistQuantumSecurityLevel": 0 }, "oid": "1.2.840.113549.1.1.1" }, "evidence": { "occurrences": [ { "location": "src/crypto/envelope.go", "line": 120, "additionalContext": "rsa.EncryptOAEP — envelope de chave simétrica" } ] } }, { "type": "cryptographic-asset", "name": "RSA", "bom-ref": "alg/rsa-1024-legacy", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "signature", "parameterSetIdentifier": "1024", "cryptoFunctions": [ "verify" ], "padding": "pkcs1v15", "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 80, "nistQuantumSecurityLevel": 0 }, "oid": "1.2.840.113549.1.1.5" }, "evidence": { "occurrences": [ { "location": "src/legacy/partner_gw.go", "line": 44, "additionalContext": "verificação de assinatura de parceiro legado" } ] } }, { "type": "cryptographic-asset", "name": "ECDSA", "bom-ref": "alg/ecdsa-p256", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "signature", "curve": "P-256", "cryptoFunctions": [ "sign", "verify" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 128, "nistQuantumSecurityLevel": 0 }, "oid": "1.2.840.10045.4.3.2" }, "evidence": { "occurrences": [ { "location": "src/mtls/identity.go", "line": 61, "additionalContext": "ecdsa.SignASN1 — identidade mTLS de serviço" } ] } }, { "type": "cryptographic-asset", "name": "ECDSA", "bom-ref": "alg/ecdsa-p384", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "signature", "curve": "P-384", "cryptoFunctions": [ "sign", "verify" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 192, "nistQuantumSecurityLevel": 0 }, "oid": "1.2.840.10045.4.3.3" }, "evidence": { "occurrences": [ { "location": "src/pki/intermediate.go", "line": 30, "additionalContext": "assinatura da CA intermediária" } ] } }, { "type": "cryptographic-asset", "name": "ECDH", "bom-ref": "alg/ecdh-p256", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "key-agree", "curve": "P-256", "cryptoFunctions": [ "keygen" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 128, "nistQuantumSecurityLevel": 0 }, "oid": "1.3.132.1.12" }, "evidence": { "occurrences": [ { "location": "src/transport/handshake.go", "line": 41, "additionalContext": "ECDHE no handshake TLS" } ] } }, { "type": "cryptographic-asset", "name": "X25519", "bom-ref": "alg/x25519", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "key-agree", "curve": "Curve25519", "cryptoFunctions": [ "keygen" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 128, "nistQuantumSecurityLevel": 0 } }, "evidence": { "occurrences": [ { "location": "src/transport/handshake.go", "line": 52, "additionalContext": "X25519 key agreement" } ] } }, { "type": "cryptographic-asset", "name": "DH", "bom-ref": "alg/dh-2048", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "key-agree", "parameterSetIdentifier": "2048", "cryptoFunctions": [ "keygen" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 112, "nistQuantumSecurityLevel": 0 }, "oid": "1.2.840.113549.1.3.1" }, "evidence": { "occurrences": [ { "location": "config/ipsec/ikev2.conf", "line": 7, "additionalContext": "grupo Diffie-Hellman 14 (MODP-2048) no IKEv2" } ] } }, { "type": "cryptographic-asset", "name": "DSA", "bom-ref": "alg/dsa-2048", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "signature", "parameterSetIdentifier": "2048", "cryptoFunctions": [ "verify" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 112, "nistQuantumSecurityLevel": 0 }, "oid": "1.2.840.10040.4.3" }, "evidence": { "occurrences": [ { "location": "src/legacy/doc_sign.go", "line": 15, "additionalContext": "verificação de assinatura DSA legada" } ] } }, { "type": "cryptographic-asset", "name": "Ed25519", "bom-ref": "alg/ed25519", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "signature", "curve": "Curve25519", "cryptoFunctions": [ "sign", "verify" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 128, "nistQuantumSecurityLevel": 0 }, "oid": "1.3.101.112" }, "evidence": { "occurrences": [ { "location": "src/ssh/hostkey.go", "line": 9, "additionalContext": "chave de host SSH Ed25519" } ] } }, { "type": "cryptographic-asset", "name": "SHA-1", "bom-ref": "alg/sha-1", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "hash", "cryptoFunctions": [ "digest" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 80, "nistQuantumSecurityLevel": 0 }, "oid": "1.3.14.3.2.26" }, "evidence": { "occurrences": [ { "location": "src/legacy/fingerprint.go", "line": 9, "additionalContext": "crypto/sha1.New — fingerprint de certificado legado" } ] } }, { "type": "cryptographic-asset", "name": "MD5", "bom-ref": "alg/md5", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "hash", "cryptoFunctions": [ "digest" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 64, "nistQuantumSecurityLevel": 0 }, "oid": "1.2.840.113549.2.5" }, "evidence": { "occurrences": [ { "location": "src/legacy/etag.go", "line": 22, "additionalContext": "md5.Sum — ETag de arquivo (não-segurança)" } ] } }, { "type": "cryptographic-asset", "name": "TripleDES", "bom-ref": "alg/3des", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "block-cipher", "parameterSetIdentifier": "168", "cryptoFunctions": [ "encrypt", "decrypt" ], "mode": "cbc", "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 112, "nistQuantumSecurityLevel": 0 }, "oid": "1.2.840.113549.3.7" }, "evidence": { "occurrences": [ { "location": "src/legacy/pin_block.go", "line": 64, "additionalContext": "des.NewTripleDESCipher — bloco de PIN ISO-0" } ] } }, { "type": "cryptographic-asset", "name": "AES", "bom-ref": "alg/aes-128-gcm", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "ae", "parameterSetIdentifier": "128", "cryptoFunctions": [ "encrypt", "decrypt" ], "mode": "gcm", "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 128, "nistQuantumSecurityLevel": 0 }, "oid": "2.16.840.1.101.3.4.1.6" }, "evidence": { "occurrences": [ { "location": "src/storage/seal.go", "line": 17, "additionalContext": "cipher.NewGCM (AES-128) — selo de cache" } ] } }, { "type": "cryptographic-asset", "name": "RC4", "bom-ref": "alg/rc4", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "stream-cipher", "cryptoFunctions": [ "encrypt", "decrypt" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 40, "nistQuantumSecurityLevel": 0 } }, "evidence": { "occurrences": [ { "location": "src/legacy/tls_compat.go", "line": 88, "additionalContext": "suíte RC4 habilitada para cliente antigo" } ] } }, { "type": "cryptographic-asset", "name": "HMAC-SHA1", "bom-ref": "alg/hmac-sha1", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "mac", "cryptoFunctions": [ "tag", "verify" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 80, "nistQuantumSecurityLevel": 0 }, "oid": "1.2.840.113549.2.7" }, "evidence": { "occurrences": [ { "location": "src/webhook/sign.go", "line": 33, "additionalContext": "HMAC-SHA1 em webhook de parceiro" } ] } }, { "type": "cryptographic-asset", "name": "AES", "bom-ref": "alg/aes-256-gcm", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "ae", "parameterSetIdentifier": "256", "cryptoFunctions": [ "encrypt", "decrypt" ], "mode": "gcm", "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "fips140-2-l1" ], "classicalSecurityLevel": 256, "nistQuantumSecurityLevel": 1 }, "oid": "2.16.840.1.101.3.4.1.46" }, "evidence": { "occurrences": [ { "location": "src/storage/vault.go", "line": 52, "additionalContext": "cipher.NewGCM (AES-256) — cofre de dados sensíveis" } ] } }, { "type": "cryptographic-asset", "name": "AES", "bom-ref": "alg/aes-256-cbc", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "block-cipher", "parameterSetIdentifier": "256", "cryptoFunctions": [ "encrypt", "decrypt" ], "mode": "cbc", "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 256, "nistQuantumSecurityLevel": 1 }, "oid": "2.16.840.1.101.3.4.1.42" }, "evidence": { "occurrences": [ { "location": "src/storage/backup.go", "line": 71, "additionalContext": "AES-256-CBC em backup cifrado" } ] } }, { "type": "cryptographic-asset", "name": "ChaCha20-Poly1305", "bom-ref": "alg/chacha20-poly1305", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "ae", "cryptoFunctions": [ "encrypt", "decrypt" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 256, "nistQuantumSecurityLevel": 1 }, "oid": "1.2.840.113549.1.9.16.3.18" }, "evidence": { "occurrences": [ { "location": "src/transport/quic.go", "line": 14, "additionalContext": "AEAD ChaCha20-Poly1305 no QUIC" } ] } }, { "type": "cryptographic-asset", "name": "SHA-256", "bom-ref": "alg/sha-256", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "hash", "parameterSetIdentifier": "256", "cryptoFunctions": [ "digest" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 128, "nistQuantumSecurityLevel": 1 }, "oid": "2.16.840.1.101.3.4.2.1" }, "evidence": { "occurrences": [ { "location": "src/integrity/digest.go", "line": 23, "additionalContext": "crypto/sha256.Sum256 — integridade de ledger" } ] } }, { "type": "cryptographic-asset", "name": "SHA-384", "bom-ref": "alg/sha-384", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "hash", "parameterSetIdentifier": "384", "cryptoFunctions": [ "digest" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 192, "nistQuantumSecurityLevel": 2 }, "oid": "2.16.840.1.101.3.4.2.2" }, "evidence": { "occurrences": [ { "location": "src/pki/chain.go", "line": 40, "additionalContext": "SHA-384 em assinatura de cadeia" } ] } }, { "type": "cryptographic-asset", "name": "SHA-512", "bom-ref": "alg/sha-512", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "hash", "parameterSetIdentifier": "512", "cryptoFunctions": [ "digest" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 256, "nistQuantumSecurityLevel": 2 }, "oid": "2.16.840.1.101.3.4.2.3" }, "evidence": { "occurrences": [ { "location": "src/integrity/merkle.go", "line": 18, "additionalContext": "SHA-512 em árvore de Merkle" } ] } }, { "type": "cryptographic-asset", "name": "SHA3-256", "bom-ref": "alg/sha3-256", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "hash", "parameterSetIdentifier": "256", "cryptoFunctions": [ "digest" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 128, "nistQuantumSecurityLevel": 2 }, "oid": "2.16.840.1.101.3.4.2.8" }, "evidence": { "occurrences": [ { "location": "src/integrity/sha3.go", "line": 11, "additionalContext": "SHA3-256 (Keccak)" } ] } }, { "type": "cryptographic-asset", "name": "HMAC-SHA256", "bom-ref": "alg/hmac-sha256", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "mac", "cryptoFunctions": [ "tag", "verify" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 128, "nistQuantumSecurityLevel": 1 }, "oid": "1.2.840.113549.2.9" }, "evidence": { "occurrences": [ { "location": "src/webhook/sign.go", "line": 51, "additionalContext": "HMAC-SHA256 em webhooks novos" } ] } }, { "type": "cryptographic-asset", "name": "Argon2id", "bom-ref": "alg/argon2id", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "kdf", "cryptoFunctions": [ "keygen" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 256, "nistQuantumSecurityLevel": 1 } }, "evidence": { "occurrences": [ { "location": "src/auth/password.go", "line": 12, "additionalContext": "Argon2id para hashing de senha" } ] } }, { "type": "cryptographic-asset", "name": "PBKDF2-HMAC-SHA256", "bom-ref": "alg/pbkdf2", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "kdf", "cryptoFunctions": [ "keygen" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 128, "nistQuantumSecurityLevel": 1 } }, "evidence": { "occurrences": [ { "location": "src/auth/legacy_kdf.go", "line": 8, "additionalContext": "PBKDF2 em migração de senhas" } ] } }, { "type": "cryptographic-asset", "name": "ML-KEM-768", "bom-ref": "alg/ml-kem-768", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "kem", "parameterSetIdentifier": "768", "cryptoFunctions": [ "encapsulate", "decapsulate" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 192, "nistQuantumSecurityLevel": 3 }, "oid": "2.16.840.1.101.3.4.4.2" }, "evidence": { "occurrences": [ { "location": "src/transport/pqc.go", "line": 30, "additionalContext": "mlkem768.Encapsulate — KEM híbrido no TLS" } ] } }, { "type": "cryptographic-asset", "name": "ML-KEM-1024", "bom-ref": "alg/ml-kem-1024", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "kem", "parameterSetIdentifier": "1024", "cryptoFunctions": [ "encapsulate", "decapsulate" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 256, "nistQuantumSecurityLevel": 5 }, "oid": "2.16.840.1.101.3.4.4.3" }, "evidence": { "occurrences": [ { "location": "src/transport/pqc.go", "line": 44, "additionalContext": "ML-KEM-1024 para dados de altíssima sensibilidade" } ] } }, { "type": "cryptographic-asset", "name": "ML-DSA-65", "bom-ref": "alg/ml-dsa-65", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "signature", "parameterSetIdentifier": "65", "cryptoFunctions": [ "sign", "verify" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 192, "nistQuantumSecurityLevel": 3 }, "oid": "2.16.840.1.101.3.4.3.18" }, "evidence": { "occurrences": [ { "location": "src/pki/pqc_sign.go", "line": 20, "additionalContext": "ML-DSA-65 (Dilithium) — assinatura PQC" } ] } }, { "type": "cryptographic-asset", "name": "SLH-DSA-SHA2-128s", "bom-ref": "alg/slh-dsa-128s", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "signature", "parameterSetIdentifier": "128s", "cryptoFunctions": [ "sign", "verify" ], "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ], "classicalSecurityLevel": 128, "nistQuantumSecurityLevel": 1 }, "oid": "2.16.840.1.101.3.4.3.20" }, "evidence": { "occurrences": [ { "location": "src/pki/pqc_sign.go", "line": 55, "additionalContext": "SLH-DSA (SPHINCS+) para firmware" } ] } }, { "type": "cryptographic-asset", "name": "MeridianScramble", "bom-ref": "alg/custom-scramble", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "unknown", "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ] } }, "evidence": { "occurrences": [ { "location": "src/internal/scramble.go", "line": 5, "additionalContext": "rotina homegrown de ofuscação (sem especificação pública)" } ] } }, { "type": "cryptographic-asset", "name": "VendorCipherX", "bom-ref": "alg/proprietary-cipher", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "cipher", "executionEnvironment": "software-plain-ram", "implementationPlatform": "x86_64", "certificationLevel": [ "none" ] } }, "evidence": { "occurrences": [ { "location": "vendor/acme/cipherx.go", "line": 2, "additionalContext": "cifra proprietária de fornecedor, parâmetros não documentados" } ] } }, { "type": "cryptographic-asset", "name": "Meridiano Root CA G1", "bom-ref": "cert/root-ca", "cryptoProperties": { "assetType": "certificate", "certificateProperties": { "subjectName": "CN=Meridiano Root CA G1, O=Banco Meridiano S.A., C=BR", "issuerName": "CN=Meridiano Root CA G1, O=Banco Meridiano S.A., C=BR", "notValidBefore": "2018-01-01T00:00:00Z", "notValidAfter": "2038-01-01T00:00:00Z", "certificateFormat": "X.509", "certificateExtension": "crt", "relatedCryptographicAssets": [ { "type": "signature-algorithm", "ref": "alg/rsa-4096-enc" }, { "type": "subject-public-key", "ref": "alg/rsa-4096-enc" } ] } }, "evidence": { "occurrences": [ { "location": "config/pki/root-ca.crt", "line": 1, "additionalContext": "âncora de confiança raiz (offline)" } ] } }, { "type": "cryptographic-asset", "name": "Meridiano Issuing CA", "bom-ref": "cert/intermediate-ca", "cryptoProperties": { "assetType": "certificate", "certificateProperties": { "subjectName": "CN=Meridiano Issuing CA, O=Banco Meridiano S.A., C=BR", "issuerName": "CN=Meridiano Root CA G1, O=Banco Meridiano S.A., C=BR", "notValidBefore": "2023-01-01T00:00:00Z", "notValidAfter": "2033-01-01T00:00:00Z", "certificateFormat": "X.509", "certificateExtension": "crt", "relatedCryptographicAssets": [ { "type": "signature-algorithm", "ref": "alg/ecdsa-p384" }, { "type": "subject-public-key", "ref": "alg/ecdsa-p384" } ] } }, "evidence": { "occurrences": [ { "location": "config/pki/issuing-ca.crt", "line": 1, "additionalContext": "CA emissora de certificados de serviço" } ] } }, { "type": "cryptographic-asset", "name": "api.meridiano.com.br", "bom-ref": "cert/tls-leaf", "cryptoProperties": { "assetType": "certificate", "certificateProperties": { "subjectName": "CN=api.meridiano.com.br, O=Banco Meridiano S.A., C=BR", "issuerName": "CN=Meridiano Issuing CA, O=Banco Meridiano S.A., C=BR", "notValidBefore": "2026-01-01T00:00:00Z", "notValidAfter": "2027-01-01T00:00:00Z", "certificateFormat": "X.509", "certificateExtension": "crt", "relatedCryptographicAssets": [ { "type": "signature-algorithm", "ref": "alg/rsa-2048-sign" }, { "type": "subject-public-key", "ref": "alg/rsa-2048-sign" } ] } }, "evidence": { "occurrences": [ { "location": "config/tls/api.crt", "line": 1, "additionalContext": "certificado TLS do gateway de API" } ] } }, { "type": "cryptographic-asset", "name": "svc-ledger.internal", "bom-ref": "cert/mtls-client", "cryptoProperties": { "assetType": "certificate", "certificateProperties": { "subjectName": "CN=svc-ledger.internal, O=Banco Meridiano S.A., C=BR", "issuerName": "CN=Meridiano Issuing CA, O=Banco Meridiano S.A., C=BR", "notValidBefore": "2026-03-01T00:00:00Z", "notValidAfter": "2026-09-01T00:00:00Z", "certificateFormat": "X.509", "certificateExtension": "crt", "relatedCryptographicAssets": [ { "type": "signature-algorithm", "ref": "alg/ecdsa-p256" }, { "type": "subject-public-key", "ref": "alg/ecdsa-p256" } ] } }, "evidence": { "occurrences": [ { "location": "config/mtls/ledger.crt", "line": 1, "additionalContext": "certificado mTLS do serviço de ledger" } ] } }, { "type": "cryptographic-asset", "name": "partner-old.example.com", "bom-ref": "cert/expired-partner", "cryptoProperties": { "assetType": "certificate", "certificateProperties": { "subjectName": "CN=partner-old.example.com, O=Partner Ltda, C=BR", "issuerName": "CN=Meridiano Issuing CA, O=Banco Meridiano S.A., C=BR", "notValidBefore": "2020-01-01T00:00:00Z", "notValidAfter": "2022-01-01T00:00:00Z", "certificateFormat": "X.509", "certificateExtension": "crt", "relatedCryptographicAssets": [ { "type": "signature-algorithm", "ref": "alg/rsa-2048-sign" }, { "type": "subject-public-key", "ref": "alg/rsa-2048-sign" } ] } }, "evidence": { "occurrences": [ { "location": "config/legacy/partner.crt", "line": 1, "additionalContext": "certificado de parceiro EXPIRADO ainda em truststore" } ] } }, { "type": "cryptographic-asset", "name": "Meridiano Code Signing", "bom-ref": "cert/revoked-code", "cryptoProperties": { "assetType": "certificate", "certificateProperties": { "subjectName": "CN=Meridiano Code Signing, O=Banco Meridiano S.A., C=BR", "issuerName": "CN=Meridiano Issuing CA, O=Banco Meridiano S.A., C=BR", "notValidBefore": "2024-01-01T00:00:00Z", "notValidAfter": "2027-01-01T00:00:00Z", "certificateFormat": "X.509", "certificateExtension": "crt", "relatedCryptographicAssets": [ { "type": "signature-algorithm", "ref": "alg/ecdsa-p384" }, { "type": "subject-public-key", "ref": "alg/ecdsa-p384" } ], "certificateState": [ { "state": "revoked" } ] } }, "evidence": { "occurrences": [ { "location": "config/signing/code.crt", "line": 1, "additionalContext": "certificado de assinatura de código REVOGADO" } ] } }, { "type": "cryptographic-asset", "name": "pqc.meridiano.com.br", "bom-ref": "cert/pqc-pilot", "cryptoProperties": { "assetType": "certificate", "certificateProperties": { "subjectName": "CN=pqc.meridiano.com.br, O=Banco Meridiano S.A., C=BR", "issuerName": "CN=Meridiano Issuing CA, O=Banco Meridiano S.A., C=BR", "notValidBefore": "2026-05-01T00:00:00Z", "notValidAfter": "2027-05-01T00:00:00Z", "certificateFormat": "X.509", "certificateExtension": "crt", "relatedCryptographicAssets": [ { "type": "signature-algorithm", "ref": "alg/ml-dsa-65" }, { "type": "subject-public-key", "ref": "alg/ml-dsa-65" } ] } }, "evidence": { "occurrences": [ { "location": "config/tls/pqc.crt", "line": 1, "additionalContext": "certificado piloto com assinatura PQC (ML-DSA)" } ] } }, { "type": "cryptographic-asset", "name": "TLS 1.2 (gateway externo)", "bom-ref": "proto/tls12", "cryptoProperties": { "assetType": "protocol", "protocolProperties": { "type": "tls", "version": "1.2", "cipherSuites": [ { "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "algorithms": [ "alg/ecdh-p256", "alg/rsa-2048-sign", "alg/aes-128-gcm", "alg/sha-256" ], "identifiers": [ "0xC0,0x2F" ] }, { "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "algorithms": [ "alg/rsa-2048-sign", "alg/3des", "alg/sha-1" ], "identifiers": [ "0x00,0x0A" ] }, { "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "algorithms": [ "alg/ecdh-p256", "alg/rsa-2048-sign", "alg/rc4", "alg/sha-1" ], "identifiers": [ "0xC0,0x11" ] } ] } }, "evidence": { "occurrences": [ { "location": "config/tls/gateway.yaml", "line": 12, "additionalContext": "suítes legadas habilitadas no gateway" } ] } }, { "type": "cryptographic-asset", "name": "TLS 1.3 (interno)", "bom-ref": "proto/tls13", "cryptoProperties": { "assetType": "protocol", "protocolProperties": { "type": "tls", "version": "1.3", "cipherSuites": [ { "name": "TLS_AES_256_GCM_SHA384", "algorithms": [ "alg/aes-256-gcm", "alg/sha-384" ], "identifiers": [ "0x13,0x02" ] }, { "name": "TLS_CHACHA20_POLY1305_SHA256", "algorithms": [ "alg/chacha20-poly1305", "alg/sha-256" ], "identifiers": [ "0x13,0x03" ] } ] } }, "evidence": { "occurrences": [ { "location": "config/tls/internal.yaml", "line": 8, "additionalContext": "malha de serviços com TLS 1.3" } ] } }, { "type": "cryptographic-asset", "name": "TLS 1.3 híbrido PQC", "bom-ref": "proto/tls13-hybrid", "cryptoProperties": { "assetType": "protocol", "protocolProperties": { "type": "tls", "version": "1.3", "cipherSuites": [ { "name": "TLS_AES_256_GCM_SHA384_X25519MLKEM768", "algorithms": [ "alg/x25519", "alg/ml-kem-768", "alg/aes-256-gcm", "alg/sha-384" ], "identifiers": [ "0x11,0xEC" ] } ] } }, "evidence": { "occurrences": [ { "location": "config/tls/pqc.yaml", "line": 5, "additionalContext": "key-share híbrido X25519+ML-KEM-768 (piloto)" } ] } }, { "type": "cryptographic-asset", "name": "SSH-2 (bastion)", "bom-ref": "proto/ssh2", "cryptoProperties": { "assetType": "protocol", "protocolProperties": { "type": "ssh", "version": "2.0", "cipherSuites": [ { "name": "ecdh-sha2-nistp256+ssh-ed25519", "algorithms": [ "alg/ecdh-p256", "alg/ed25519", "alg/aes-256-gcm" ], "identifiers": [ "ecdh-sha2-nistp256" ] } ] } }, "evidence": { "occurrences": [ { "location": "config/ssh/sshd_config", "line": 20, "additionalContext": "acesso administrativo via bastion" } ] } }, { "type": "cryptographic-asset", "name": "IPsec/IKEv2 (VPN parceiros)", "bom-ref": "proto/ikev2", "cryptoProperties": { "assetType": "protocol", "protocolProperties": { "type": "ipsec", "version": "2.0", "cipherSuites": [ { "name": "AES128-SHA1-MODP2048", "algorithms": [ "alg/aes-128-gcm", "alg/sha-1", "alg/dh-2048" ], "identifiers": [ "modp2048" ] } ] } }, "evidence": { "occurrences": [ { "location": "config/ipsec/ikev2.conf", "line": 3, "additionalContext": "túnel de VPN com parceiros" } ] } }, { "type": "cryptographic-asset", "name": "Chave privada de assinatura JWT", "bom-ref": "material/rsa-signing-priv", "cryptoProperties": { "assetType": "related-crypto-material", "relatedCryptoMaterialProperties": { "type": "private-key", "state": "active", "size": 2048, "algorithmRef": "alg/rsa-2048-sign", "format": "PEM" } }, "evidence": { "occurrences": [ { "location": "hsm/slot-0", "line": 1, "additionalContext": "chave RSA de assinatura de sessão (em HSM)" } ] } }, { "type": "cryptographic-asset", "name": "Chave pública de assinatura JWT", "bom-ref": "material/rsa-signing-pub", "cryptoProperties": { "assetType": "related-crypto-material", "relatedCryptoMaterialProperties": { "type": "public-key", "state": "active", "size": 2048, "algorithmRef": "alg/rsa-2048-sign", "format": "PEM" } }, "evidence": { "occurrences": [ { "location": "config/jwks.json", "line": 1, "additionalContext": "publicada no JWKS" } ] } }, { "type": "cryptographic-asset", "name": "Chave mestra do cofre", "bom-ref": "material/aes-vault-key", "cryptoProperties": { "assetType": "related-crypto-material", "relatedCryptoMaterialProperties": { "type": "secret-key", "state": "active", "size": 256, "algorithmRef": "alg/aes-256-gcm", "format": "PEM" } }, "evidence": { "occurrences": [ { "location": "hsm/slot-1", "line": 1, "additionalContext": "DEK/KEK do cofre de dados" } ] } }, { "type": "cryptographic-asset", "name": "Chave de selo de cache", "bom-ref": "material/aes-cache-key", "cryptoProperties": { "assetType": "related-crypto-material", "relatedCryptoMaterialProperties": { "type": "secret-key", "state": "active", "size": 128, "algorithmRef": "alg/aes-128-gcm", "format": "PEM" } }, "evidence": { "occurrences": [ { "location": "kms/cache", "line": 1, "additionalContext": "chave AES-128 de cache (rotação curta)" } ] } }, { "type": "cryptographic-asset", "name": "Chave 3DES de PIN", "bom-ref": "material/legacy-3des-key", "cryptoProperties": { "assetType": "related-crypto-material", "relatedCryptoMaterialProperties": { "type": "secret-key", "state": "deactivated", "size": 168, "algorithmRef": "alg/3des", "format": "PEM" } }, "evidence": { "occurrences": [ { "location": "hsm/slot-9", "line": 1, "additionalContext": "chave 3DES de PIN — desativada, ainda presente" } ] } }, { "type": "cryptographic-asset", "name": "Chave suspeita (incidente 2026-04)", "bom-ref": "material/compromised-key", "cryptoProperties": { "assetType": "related-crypto-material", "relatedCryptoMaterialProperties": { "type": "secret-key", "state": "compromised", "size": 256, "algorithmRef": "alg/aes-256-gcm", "format": "PEM" } }, "evidence": { "occurrences": [ { "location": "kms/quarantine", "line": 1, "additionalContext": "chave marcada como comprometida após incidente" } ] } }, { "type": "cryptographic-asset", "name": "Chave antiga destruída", "bom-ref": "material/destroyed-key", "cryptoProperties": { "assetType": "related-crypto-material", "relatedCryptoMaterialProperties": { "type": "secret-key", "state": "destroyed", "size": 256, "algorithmRef": "alg/aes-256-cbc", "format": "PEM" } }, "evidence": { "occurrences": [ { "location": "kms/destroyed", "line": 1, "additionalContext": "chave destruída (crypto-shredding) — fora de exposição" } ] } }, { "type": "cryptographic-asset", "name": "Token de API de parceiro", "bom-ref": "material/api-token", "cryptoProperties": { "assetType": "related-crypto-material", "relatedCryptoMaterialProperties": { "type": "token", "state": "active", "algorithmRef": "alg/hmac-sha256" } }, "evidence": { "occurrences": [ { "location": "config/partners.yaml", "line": 14, "additionalContext": "token HMAC de webhook" } ] } } ], "dependencies": [ { "ref": "cert/tls-leaf", "provides": [ "proto/tls13" ], "dependsOn": [ "alg/rsa-2048-sign", "alg/sha-256" ] }, { "ref": "cert/intermediate-ca", "provides": [ "cert/tls-leaf", "cert/mtls-client", "cert/revoked-code" ], "dependsOn": [ "cert/root-ca", "alg/ecdsa-p384" ] }, { "ref": "cert/root-ca", "dependsOn": [ "alg/rsa-4096-enc", "alg/sha-384" ] }, { "ref": "proto/tls13", "dependsOn": [ "alg/aes-256-gcm", "alg/chacha20-poly1305", "alg/sha-384", "alg/x25519" ] }, { "ref": "proto/tls12", "dependsOn": [ "alg/ecdh-p256", "alg/rsa-2048-sign", "alg/aes-128-gcm", "alg/3des", "alg/rc4", "alg/sha-1" ] }, { "ref": "proto/tls13-hybrid", "dependsOn": [ "alg/x25519", "alg/ml-kem-768", "alg/aes-256-gcm" ] }, { "ref": "proto/ikev2", "dependsOn": [ "alg/dh-2048", "alg/aes-128-gcm", "alg/sha-1" ] }, { "ref": "material/rsa-signing-priv", "dependsOn": [ "alg/rsa-2048-sign" ] }, { "ref": "material/aes-vault-key", "dependsOn": [ "alg/aes-256-gcm" ] }, { "ref": "cert/pqc-pilot", "dependsOn": [ "alg/ml-dsa-65" ] } ] }