{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d621003b-b2a1-47fc-bc6c-37f52a0a8255", "version": 1, "metadata": { "timestamp": "2026-09-27T08:37:49Z", "lifecycles": [ { "phase": "pre-build" } ], "supplier": { "name": "StreamSec HB", "url": [ "https://www.streamsec.com/" ] }, "authors": [ { "name": "StreamSec HB" } ], "component": { "bom-ref": "streamsec-tools", "type": "library", "name": "StreamSec Tools", "version": "4.1.4.360", "description": "Security library for Embarcadero Delphi and Free Pascal: TLS 1.0-1.3, SSH and SFTP, X.509 / PKIX path validation, OCSP, CMS and S/MIME, PKCS#12, classical and post-quantum public-key cryptography, an HTTP/1.1 and HTTP/2 stack, a mail layer, PAdES PDF signing, and an SP 800-90B entropy source.", "publisher": "StreamSec HB", "supplier": { "name": "StreamSec HB", "url": [ "https://www.streamsec.com/" ] }, "copyright": "Copyright (C) 2000-2026 StreamSec Handelsbolag", "purl": "pkg:generic/streamsec/streamsec-tools@4.1.4.360?checksum=sha256%3A56958e03fdf66b5362ad9740a534c8b2b646424e677201fccff8687c304da65e", "licenses": [ { "license": { "name": "StreamSec No-Nonsense License", "acknowledgement": "declared", "url": "https://www.streamsec.com/" } } ], "externalReferences": [ { "type": "website", "url": "https://www.streamsec.com/" }, { "type": "license", "url": "https://www.streamsec.com/" }, { "type": "release-notes", "url": "https://www.streamsec.com/" } ], "properties": [ { "name": "streamsec:version-source", "value": "stVersion.pas, cStreamSecToolsVersion. A version string belongs to exactly one distribution archive and is never reused." }, { "name": "streamsec:distribution-form", "value": "source, plus four prebuilt object files. The archive carries the library units, packages, demos and documentation, and four x86-64 ELF relocatable objects - stAESNIFunc.o, stGHashFunc.o, stMLKEMAvx2Func.o and stPirAvx2Func.o - which a Delphi Linux64 build links because that compiler has no inline assembler. They are not opaque: each is assembled by Free Pascal 3.2.2 or later from the .pas of the same name, which ships beside it, on an x86-64 Linux host with the shipped .inc files on the include path - fpc -Px86_64 -O2 -g- stAESNIFunc.pas - and each must come out with zero undefined symbols, which nm -u confirms, or the Delphi link fails. A consumer who would rather build them than trust the shipped copies can reproduce them from what is in the archive. No shared library is distributed, and compiled runtime packages are not redistributed except in the trial." }, { "name": "streamsec:linkage", "value": "static. Delphi links the compiled units directly into the consumer's executable, so the consumer's binary contains no separate StreamSec artifact for a scanner to detect. This component must be declared, not discovered." }, { "name": "streamsec:cpe-status", "value": "none. There is no CPE dictionary entry for this product, so vulnerability matching against the NVD will not resolve this component. Absence is deliberate: a fabricated CPE would match nothing while appearing to provide coverage." }, { "name": "streamsec:purl-type-rationale", "value": "pkg:generic is used because purl-spec defines no package type for Delphi or Object Pascal. There is no registry for the purl to resolve against." }, { "name": "streamsec:consumer-must-declare", "value": "zlib. Reached through the Delphi RTL unit System.ZLib (FPC: zstream) from StreamSec.Pdf.Model, and therefore linked into any application that reads a compressed PDF stream. The SSH transport offers zlib as a negotiable compression name but the unit that implemented it is not in this distribution, so the SSH side reaches no zlib code. The zlib sources are Embarcadero's, bundled with the consumer's RAD Studio installation - StreamSec ships no copy and cannot state the version. A consumer's SBOM should carry zlib at the version their compiler bundles." }, { "name": "streamsec:license-variant", "value": "This document describes the no-nonsense license in LICENSE.txt as shipped. A holder of a StreamSec deployment license should substitute their own license reference." }, { "name": "streamsec:released", "value": "2026-09-27" } ], "hashes": [ { "alg": "SHA-256", "content": "56958e03fdf66b5362ad9740a534c8b2b646424e677201fccff8687c304da65e" } ] } }, "components": [ { "bom-ref": "gladman-aes-assembler", "type": "library", "name": "Brian Gladman AES/Rijndael assembler", "version": "2008", "description": "Brian Gladman's x86 and x64 AES table assembler, carried by the unit stAESBG.pas. Its licence is the most demanding of the library's third-party licences: it is the only one that obliges a binary distribution to reproduce the notice in its documentation, in as many words.", "scope": "optional", "supplier": { "name": "Brian Gladman, Worcester, UK" }, "copyright": "Copyright (c) 1998-2008, Brian Gladman, Worcester, UK. All rights reserved.", "licenses": [ { "license": { "name": "Brian Gladman AES License (three-clause BSD-style)", "acknowledgement": "declared" } } ], "properties": [ { "name": "streamsec:vendored-files", "value": "stAESBG.pas, which reproduces the notice in full at its head, and the four assembler bodies it includes - AESEnc.inc, AESDec.inc, AESEnc_x64.inc and AESDec_x64.inc. Those four carry no notice of their own and are reachable only through stAESBG, which is what carries the obligation with them." }, { "name": "streamsec:reachability", "value": "OPTIONAL, AND USUALLY ABSENT. Since 4.1.3.357, which removed the legacy unit families, this assembler lives in stAESBG.pas and the four .inc files it includes, and nowhere else. An application that compiles the units directly does not link it unless it names that unit, and that is the normal case: compiled packages are not redistributable and there is no official StreamSec BPL to place on the global path, so almost every application compiles the library into its own executable. It IS in the shipped runtime packages, so an application built against one does link it - but building against runtime packages is itself a deliberate step, taken to reduce the total footprint of an installation that ships several executables all leaning on the library, and a customer doing that is expected to compose a package containing just the units they need. The obligation therefore stays something a consumer opts into: by naming stAESBG, or by including it in a package of their own. Before 4.1.2.355 the same assembler was inside stAES.pas and every application using AES linked it." }, { "name": "streamsec:attribution-obligation", "value": "ACTION REQUIRED BY THE CONSUMER, BUT ONLY IF stAESBG IS LINKED. Condition 2 of the license requires that binary distributions reproduce the copyright notice, the list of conditions and the disclaimer IN THEIR DOCUMENTATION. If your application does not link stAESBG, it does not incur this obligation. The full notice is at the top of Source/stAESBG.pas." }, { "name": "streamsec:compile-time-opt-out", "value": "PUREPASCAL (or ST4_NO_ASM, which implies it) removes this component. The assembler in stAESBG is gated on that define, so a PUREPASCAL build compiles every routine here to its `inherited` arm, registers nothing, and contains no Gladman-copyrighted code - the attribution obligation does not arise. The cost is stAES's Pascal in its place on Win32/Win64, about 340 MB/s against 610, and it applies to the rest of the library's assembler too." }, { "name": "streamsec:should-you-link-it", "value": "Almost certainly not. It differs from stAES only on Win32 and Win64 x86/x86-64 - on every other target it compiles to nothing - and on that platform AES-NI has been near-universal since 2010, where stAESNI is both faster and constant time. stAES and stAESCT between them cover every machine with an implementation robust for the threat model at hand, and stAESNI adds hardware speed where the CPU has it. Note that stAESCT is the SLOWEST of the four, not a fast alternative - it trades roughly 8x of throughput for its constant-time property." }, { "name": "streamsec:version-basis", "value": "Upstream carries no version number. The value above is the closing year of the copyright range in the incorporated notice, and is a marker only - do not treat it as an upstream release identifier." }, { "name": "streamsec:license-basis", "value": "declared. The notice is reproduced verbatim in the shipped source. It is close to BSD-3-Clause but is not identical to it, so it is named rather than given an SPDX identifier." } ] }, { "bom-ref": "bearssl-ct-primitives", "type": "library", "name": "BearSSL constant-time primitives (aes_ct, ghash_ctmul64)", "version": "2016", "description": "Two Pascal translations of BearSSL constant-time code. stAESCT.pas carries the bitsliced AES core translated from aes_ct (32-bit); the S-box circuit within it is the one published by Boyar and Peralta (eprint.iacr.org/2009/191), a published construction rather than a licensed work. stGHash.pas carries the carry-less multiply BMul64 and the 64-bit reversal Rev64 that feeds it, translated from ghash_ctmul64.", "scope": "optional", "supplier": { "name": "Thomas Pornin", "url": [ "https://bearssl.org/" ] }, "copyright": "Copyright (c) 2016 Thomas Pornin ", "licenses": [ { "license": { "id": "MIT", "acknowledgement": "declared" } } ], "externalReferences": [ { "type": "website", "url": "https://bearssl.org/" } ], "properties": [ { "name": "streamsec:vendored-files", "value": "stAESCT.pas (aes_ct: the bitsliced cipher core); stGHash.pas (ghash_ctmul64: BMul64 and Rev64, used by tGhashCT). The MIT notice is reproduced verbatim at the top of each of those units." }, { "name": "streamsec:compile-time-opt-out", "value": "BOTH HALVES CAN BE REMOVED, AND WITH THEM THIS COMPONENT. ST4_NO_GHASH_CT compiles out tGhashCT and its carry-less multiply helpers; ST4_NO_AES_CT compiles out stAESCT entirely. Each define also removes the BearSSL notice from its unit, and the library's own uses clauses honour ST4_NO_AES_CT - they name stAES in stAESCT's place - so the TLS, SSH and snip stacks still build. Set both and the build contains no BearSSL-derived code at all and carries no BearSSL notice, so this component does not apply to it. Verified by build: stAESCT.dcu falls from 54621 bytes to 402 (an empty unit) and stGHash.dcu from 19326 to 11611. THE PRICE, in both cases, is that the constant-time implementation is what gets removed: on a CPU without AES-NI, AES falls back to stAES's tables, and without PCLMULQDQ or PMULL, GHASH falls back to the Shoup 8-bit table (64 KiB per instance). Both are indexed by secret bytes and therefore cache-timing variable, which is the exposure these units exist to remove. Where the CPU has the instructions, nothing changes." }, { "name": "streamsec:attribution-notice", "value": "MIT requires the copyright notice and permission notice to be included in \"all copies or substantial portions of the Software\". The licence does not distinguish source from binary form, unlike the Gladman and BSD licences which enumerate both; the common reading is therefore that the notice accompanies a binary distribution too, and that is the prevailing industry practice. A narrower reading confining it to source redistribution is arguable. StreamSec discharges its own obligation by reproducing the notice verbatim in stAESCT.pas, which is the form in which consumers receive it. Whether the notice must also travel into a consumer's compiled executable is a question for the consumer's own counsel; the cost of carrying it is one line in a third-party notices file." }, { "name": "streamsec:reachability", "value": "Both units are in the contains clause of every StrSecIV runtime package. stAESCT reaches an application that names it, and it is the AES implementation that registers on machines without AES-NI, so an application linking it for that reason is shipping it. stGHash reaches any application that uses AES-GCM - which includes TLS - so its BearSSL-derived half is the more widely linked of the two unless ST4_NO_GHASH_CT is set." }, { "name": "streamsec:version-basis", "value": "BearSSL releases are versioned (0.6 at the time of writing) but the translated file carries only the 2016 copyright year, so that year is used as the marker. It is not an upstream release identifier." } ] }, { "bom-ref": "ccadb-mozilla-root-set", "type": "data", "name": "CCADB root set (Mozilla root program, websites trust bit)", "version": "2026-08-11", "description": "The Common CA Database export of the Mozilla root program, filtered to the websites trust bit, compiled into the library as PEM in StreamSec.Mobile.CCADBRoots.pas and surfaced by TsmCCADBTrustAnchors.", "scope": "optional", "supplier": { "name": "Mozilla Foundation / Common CA Database" }, "licenses": [ { "license": { "name": "MPL-2.0", "acknowledgement": "concluded" } } ], "externalReferences": [ { "type": "distribution", "url": "https://ccadb.my.salesforce-sites.com/mozilla/IncludedRootsPEMTxt?TrustBitsInclude=Websites" } ], "properties": [ { "name": "streamsec:snapshot-date", "value": "2026-08-11, taken unmodified from the URL above. The constant cCCADBEstablished in StreamSec.Mobile.CCADBRoots reports it at runtime." }, { "name": "streamsec:last-verified", "value": "2026-09-26. On that date the embedded set was compared against the current CCADB export and found unchanged - no additions, no removals. Reported at runtime by the constant cCCADBVerified in StreamSec.Mobile.CCADBRoots, alongside cCCADBEstablished above. The snapshot date is when the list was taken; this is when it was last confirmed still current, and it is the figure that answers the staleness question below." }, { "name": "streamsec:root-count", "value": "121, each checked at generation time to be self-signed, to carry basicConstraints CA:TRUE, and to be unexpired on that date." }, { "name": "streamsec:staleness", "value": "This is a point-in-time copy of a list that changes. Its age relative to the current CCADB export is the question an auditor will ask, and is why the date is carried here rather than left implicit." }, { "name": "streamsec:license-basis", "value": "concluded. The individual certificates are the issuing CAs' own; MPL-2.0 covers Mozilla's compilation of the list, following the NSS certdata.txt licensing. Confirm against the current CCADB terms before relying on this entry." }, { "name": "streamsec:reachability", "value": "Linked only when an application uses TsmCCADBTrustAnchors or otherwise references the unit. An application that supplies its own trust anchors does not carry it." } ] }, { "bom-ref": "nist-sp800-90b-entropyassessment-port", "type": "library", "name": "NIST SP 800-90B non-IID min-entropy estimators (Delphi port)", "version": "1.1.8", "description": "stEntropyEstimators.pas is a Delphi port of the section 6.3 non-IID min-entropy estimators from the NIST SP800-90B_EntropyAssessment reference implementation. Every estimator was verified against ea_non_iid output on the same data.", "scope": "optional", "supplier": { "name": "National Institute of Standards and Technology" }, "licenses": [ { "license": { "name": "NIST SP800-90B_EntropyAssessment license (see upstream repository)", "acknowledgement": "concluded" } } ], "pedigree": { "ancestors": [ { "type": "library", "name": "SP800-90B_EntropyAssessment", "version": "1.1.8", "supplier": { "name": "National Institute of Standards and Technology" }, "externalReferences": [ { "type": "vcs", "url": "https://github.com/usnistgov/SP800-90B_EntropyAssessment" } ] } ], "notes": "Reimplementation, not a copy. The upstream is C++ and depends on bz2, divsufsort, OpenSSL, GMP, MPFR and jsoncpp; none of those enter a StreamSec build. The port is algorithmic only and carries no upstream source." }, "properties": [ { "name": "streamsec:vendored-files", "value": "stEntropyEstimators.pas" }, { "name": "streamsec:license-basis", "value": "concluded. Confirm the current upstream license text before relying on this entry; NIST-authored software is commonly a U.S. Government work under 17 U.S.C. 105, but the repository's own terms govern." }, { "name": "streamsec:reachability", "value": "Linked only when an application uses the entropy-assessment path. It is not on the TLS, SSH or PKIX code paths." } ] } ], "dependencies": [ { "ref": "streamsec-tools", "dependsOn": [ "gladman-aes-assembler", "bearssl-ct-primitives", "ccadb-mozilla-root-set", "nist-sp800-90b-entropyassessment-port" ] }, { "ref": "bearssl-ct-primitives", "dependsOn": [] }, { "ref": "gladman-aes-assembler", "dependsOn": [] }, { "ref": "ccadb-mozilla-root-set", "dependsOn": [] }, { "ref": "nist-sp800-90b-entropyassessment-port", "dependsOn": [] } ] }