Confidentiality

A CBOM says where a product's cryptography is and what it is made of, which is useful to an operator for the same reasons it is useful to an attacker, and is commercially sensitive besides. Most producers will therefore end up with two documents about one product: one they will publish, and one they will release under an agreement. This section is about what those two documents are to each other, how the difference is reflected in a profile, and what a consumer can tell from the document in its hand.

Two documents, one product

Two variants of a CBOM are meant throughout, distinguished by who may hold them rather than by what they contain.

Nothing limits this to two. In principle it is a spectrum, and in practice it is a small number of tiers, because every additional tier is another document that has to stay consistent with the others. Both variants are extracts, in the sense Inventory uses: the inventory is the asset, and a CBOM is a scoped, filtered, redacted snapshot taken from it for a particular consumer. The variants are the same extraction run at two redaction settings, which is where the difference belongs — a public variant produced by editing a restricted one by hand is a third document with no source.

What this section does not mean by confidentiality

The word is already in use in this documentation for something else, and the two are easy to conflate because both are about secrecy and both bear on disclosure.

The words used normatively below are variant, for one of the documents, and audience, for who may hold it. "Confidentiality" is kept as the title of the section because it is what a reader arrives looking for.

Redaction is declared, never performed silently

This is settled and is the foundation the rest rests on. Decision 0003 established that an attribute with no value carries a marker saying why it has none, and Profile sets out the four outcomes. Applied to a variant pair, it has one consequence worth stating on its own: a public variant is not a smaller document. It is the same document with values replaced by markers.

The cost is real and is accepted deliberately: a marker confirms existence. A producer withholding implementationPurl has confirmed that it knows which library implements the interface. The methodology treats that as information the consumer is entitled to — it is what tells a buyer there is a conversation to open rather than a gap to write off — and the alternative, silence, does not conform.

A profile sets a floor and cannot set a ceiling

No rule form in this methodology is failed by a document containing more: more attributes, more interfaces, more detail than the rule asked for. Every count in the constraint vocabulary is a minimum — minCount, minInterfaces, minInterfacesOfType, minProviders — and there is no maximum of any kind. There is therefore no way to write "do not disclose X" into a profile, and that is deliberate for three reasons.

• It would break monotonicity. Extension adds and tightens and never relaxes, which is what makes conformance to a derived profile carry conformance to its base. A ceiling rule could not be tightened by a deeper profile, and a document could satisfy the derived profile while failing the base by containing something extra. Conformance would stop being monotone in the document as well as in the profile.
• It is not the methodology's business. A profile is a minimum reporting requirement. What a producer may not say is a matter for its own policy and for the contract it is disclosing under, and a reporting standard that told producers what to conceal would be a different instrument.
• It would be unenforceable by the party that wants it. The consumer holds the document and runs the evaluation. A producer cannot rely on a consumer's validator to protect the producer's secrets.

So the confidentiality control is applied where the document is produced — the select · filter · redact step in Inventory — and the profile is the acceptance test applied at release. What the profile expresses is the other side of the same decision: not "this must not be disclosed", but "this rule may be satisfied by a marker".

Reflecting the difference in a profile

That per-rule permission is withholdable, and it is where the confidentiality negotiation actually lands. Decision 0003 says so in as many words: deciding withholdability for each rule is a substantive negotiation between producers and consumers rather than a formatting detail. Two profiles follow from one rule set:

• a profile whose sensitive rules are withholdable is one that a lawfully redacted public variant can clear;
• a profile that permits no withholding on those rules is one that only a restricted variant can clear.

Removing withholdability is a tightening, and the validator already treats it as one: an override that makes a non-withholdable attribute withholdable is refused as relaxing, and the reverse is accepted and recorded. So the restricted profile is a derived profile of the public one, and the pair needs no new machinery at all. Conformance to the restricted profile carries conformance to the public one, which is the property a consumer wants: a supplier's restricted disclosure is never less acceptable than its public one, and a consumer holding a restricted claim does not have to re-evaluate against the public profile to know where it stands.

The shape already exists in this documentation. The migration profile tightens the baseline's implementationPurl rule in exactly this way:

{
  "id": "interface-disclosure#I9",
  "level": "MUST",
  "withholdable": false,
  "note": "Tightened by removing withholdability. The base already requires
           implementationPurl at MUST and accepts a 'withheld' marker in place
           of a value. Migration sequencing depends on knowing which library
           implements an interface, so this profile removes that option and
           requires the value itself. Level is restated as MUST for readability
           and is unchanged from the base."
}

That is the block as it stands in profile-pqc-migration.rules.json, with the note wrapped to fit.

It does it for a migration reason rather than an audience reason. The mechanism does not know the difference, which is convenient here and is the subject of the next two headings.

The direction surprises people

The public profile is the base and the restricted profile derives from it. Documents get smaller as the audience widens; profiles get larger as the audience narrows. A reader who expects the confidential profile to be the complete one, with the public profile as a cut-down of it, has the arrow the wrong way round — and would write an extension that adds withholdability, which is a relaxation and which the validator refuses before it evaluates any document.

Audience is a third relation, beside depth and branch

Maturity gives a practical test for what a derived profile is: if its objective states the same decision and its scope.orientation is the same, it is a greater depth; if either differs, it is a branch. A restricted variant profile passes that test — same consumer, same decision, same orientation — and is not a depth.

Keeping the third apart from the first matters for a reason the methodology has already decided elsewhere. Cannot tell you and will not tell you are different findings, and at the grain of a single rule the disclosure states keep them apart: unknown and withheld are reported separately and listed separately in a conformance claim, because an unknown value points at the producing process and a withheld one points at a policy. A family that presents an audience step as the next rung merges them again at the grain of a whole profile. It would rank a supplier contractually barred from naming a library below one whose scanner cannot see hardware cryptography, or the reverse, depending only on how the rungs were ordered — and both may be true of the same supplier, for different rules, in the same document.

The practical consequence is in how the pair is published and asked for. An audience step is published as a pair at one depth, not as the rung above it, and a consumer's requirement names the two separately: which profile, and on what terms it will be received.

What a profile cannot yet say

Nothing in a rules file records which audience its withholding permissions were set for. Two profiles with an identical rule set — one drafted as a public floor, one as a restricted floor — are indistinguishable as artifacts, and the pair described above are told apart today only by their titles and their prose.

The obvious fix is to declare it, and there is one trap worth recording before anyone tries. It cannot live in the disclosure block. C7 requires that an inherited block be identical along a chain, on the explicit reasoning that disclosure and conformanceKeywords carry no requirement of their own, so a divergence between a base and a derived profile can only be a mistake — there is a fixture for it. A derived restricted profile declaring a different audience in that block would fail C7, correctly by the letter of the check and wrongly by its intent. scope is the plausible home instead: it already narrows down a chain, C11 already checks it, and who a profile is written to be read by is part of the boundary it draws.

What the document says about itself

A recipient should not have to infer which variant it is holding, and today it may have no way to. A public variant whose producer happened to redact nothing looks exactly like a restricted one; two documents with the same subject and different digests give no account of why they differ. A declared variant on the product would close it — a fact about the document, in the same family as P3's subject identity and P4's completeness statement, and expressible with the product-rule machinery that already exists.

There is an adjacent defect that should be separated from it rather than folded in. P4 requires a completeness statement from a three-value vocabulary: all-external, all, partial. partial is doing two jobs. It says "we did not enumerate everything", and it says "we are not telling you about everything". Those are ignorance and policy — precisely the collapse the four disclosure states exist to prevent, reappearing one level up at the structural grain, inside a vocabulary. A buyer reading partial cannot tell whether to press the supplier on its tooling or to open a commercial conversation, which is the same loss decision 0003 was taken to avoid. Recorded as Q55.

Withholding structure

The marker model covers attributes. An interface omitted for confidentiality has no attribute on which to carry a marker, and structure is where a variant pair most often differs: it is easier to argue that a management interface should not be advertised than that a protocol version should not be.

A producer has two honest moves today and one position with none.

The last row is the disclosure model's own argument left unapplied. P2 was revised in baseline v0.6 exactly so that a subject with nothing to hide could say so rather than fail, on the reasoning that a rule which cannot be satisfied honestly by a legitimate subject is not strict but wrong. The same argument reaches a subject that has something it may not say. Whether a structural rule may be satisfied by a declared withholding is not a free change — it would make minInterfaces and minInterfacesOfType lower bounds on the declared set rather than on the product, which is a weaker statement than they make today, and it hands a producer a way to satisfy a structural rule without declaring anything. Recorded as Q56.

What the two variants owe each other

These are obligations on the producer. None of them is checkable by any artifact in this repository, and a consumer holding only one variant cannot test any of them, which is why they are written down.

What a claim already reveals

A conformance claim binds to one document by digest and lists, for each profile evaluated, the rules whose values were withheld, unknown and undeclared. Two claims for the same subject with different digests and different withheld lists therefore are the two variants, told apart with no new field and no new vocabulary: the difference between the lists is the redaction, named rule by rule.

What a claim does not carry is the audience the document was prepared for, or any indication that a fuller variant exists. A buyer comparing two suppliers on the verdict alone compares a public document with a restricted one and finds them equal. Conformance already warns that a consumer acting on the verdict alone discards the part of the result most likely to matter commercially; the variant pair is that warning's sharpest case, because both documents conform, neither producer has done anything wrong, and only one of them has answered the question.

What confidentiality is not a reason for

Dropping the marker. Silent redaction is undeclared, which fails, and which tells the recipient the document was not built against the profile. A producer that will not disclose a value and will not admit to holding it has chosen the one option that costs it conformance.

Publishing nothing. "We cannot publish our library versions" is an argument about one rule, not about the document. The entry profile in Maturity exists so that there is a bar low enough to be reachable, and the interfaces a product exposes, the protocols they speak and the versions of those protocols are not usually the sensitive part.

A floor set to nothing. If every contested rule in the public profile is withholdable, a conforming public variant answers no question and the family has a public profile in name only. The test is the one every profile already has to pass: state the consumer's decision and the options it chooses between, and check that a conforming document — exercising every withholding the profile permits — still discriminates between them.

Keeping secrets out. Key material, private keys and seeds are outside every profile at every depth and in every variant. That is a permanent exclusion, not a confidentiality decision, and it is not what a restricted variant is for: a restricted variant is the one with the library versions in it, not the one with the keys in it.

One document is not the exposure

The argument against publishing a CBOM is rarely about one CBOM. A single product's document describes what its datasheet and its release notes largely describe already. The exposure is in the join: an estate's worth of documents, correlated on the identifier schemes a profile exists to make correlatable, is a target list ordered by weakness. That joined artifact is the inventory, which is why Inventory treats the inventory as the asset and the CBOM as an extract from it, and why a distributed inventory is a confidentiality arrangement as much as an organisational one.

The second effect is in time rather than in breadth. Two public variants of consecutive releases disclose what changed between them. A producer publishing a CBOM on every release is operating, incidentally, a channel that announces its own cryptographic fixes — including ones it has not announced, and before its customers have deployed them.

Neither is a profile problem and a profile cannot help with either: it cannot make a disclosed fact less true, and the facts involved are individually innocuous. Both are distribution and retention questions, and they belong with the registry access control and the immutable-revision arrangement in Governance. They are recorded here because they are the reason a producer gives for refusing to publish at all, and a methodology that only ever argues for more disclosure will not be believed on the point.

What is not settled