From 555294fd5523bf62e529d3ffeef9137c04687fdd Mon Sep 17 00:00:00 2001 From: Basil Hess Date: Thu, 25 Jun 2026 14:23:31 +0200 Subject: [PATCH] Add protocol registry to cryptography-defs Defines protocols by family and version, alongside the existing algorithm families and elliptic curves. Each version carries a composition: a list of functional slots that all apply. A slot holds an algorithm set; "selection" states whether all, one or more, or exactly one of the set are used at runtime, and "selectedBy" how that choice is made (negotiation, configuration, ...). Set members are algorithm names that resolve against the variant patterns of the algorithm registry, or named bundles of such names (cipher suites, hybrid key exchange groups). The TLS 1.3 entry is illustrative for now; the list will be populated further. Signed-off-by: Basil Hess --- schema/cryptography-defs.json | 112 +++++++++++++- schema/cryptography-defs.schema.json | 222 ++++++++++++++++++++++++++- 2 files changed, 329 insertions(+), 5 deletions(-) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index 5e0d20480..77b01b0b7 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -1,6 +1,6 @@ { "$schema": "http://cyclonedx.org/schema/cryptography-defs.schema.json", - "lastUpdated": "2026-02-24T00:00:00Z", + "lastUpdated": "2026-08-06T00:00:00Z", "algorithms": [ { "family": "RSASSA-PKCS1", @@ -4224,5 +4224,113 @@ } ] } + ], + "protocols": [ + { + "family": "tls", + "description": "Transport Layer Security (TLS) provides confidentiality, integrity, and authentication for communication over a network.", + "standard": [ + { + "name": "IANA TLS Parameters", + "url": "https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml" + } + ], + "version": [ + { + "version": "1.3", + "standard": [ + { + "name": "RFC8446", + "url": "https://doi.org/10.17487/RFC8446" + } + ], + "composition": [ + { + "role": "key-exchange", + "selection": "one-of", + "selectedBy": "negotiation", + "algorithmSet": [ + "x25519", + "x448", + "ECDHE-secp256r1", + "ECDHE-secp384r1", + { + "name": "X25519MLKEM768", + "algorithms": [ + "x25519", + "ML-KEM-768" + ] + }, + { + "name": "SecP256r1MLKEM768", + "algorithms": [ + "ECDHE-secp256r1", + "ML-KEM-768" + ] + }, + { + "name": "SecP384r1MLKEM1024", + "algorithms": [ + "ECDHE-secp384r1", + "ML-KEM-1024" + ] + } + ] + }, + { + "role": "signature", + "selection": "one-of", + "selectedBy": "negotiation", + "algorithmSet": [ + "ECDSA-secp256r1-SHA-256", + "ECDSA-secp384r1-SHA-384", + "RSA-PSS-SHA-256", + "Ed25519", + "ML-DSA-65" + ] + }, + { + "role": "cert-chain-signature", + "selection": "any-of", + "selectedBy": "server-selected", + "algorithmSet": [ + "ECDSA-secp256r1-SHA-256", + "RSA-PKCS1-1.5-SHA-256", + "RSA-PSS-SHA-256", + "ML-DSA-65" + ] + }, + { + "role": "encryption", + "selection": "one-of", + "selectedBy": "negotiation", + "algorithmSet": [ + { + "name": "TLS_AES_128_GCM_SHA256", + "algorithms": [ + "AES-128-GCM", + "HKDF-SHA-256" + ] + }, + { + "name": "TLS_AES_256_GCM_SHA384", + "algorithms": [ + "AES-256-GCM", + "HKDF-SHA-384" + ] + }, + { + "name": "TLS_CHACHA20_POLY1305_SHA256", + "algorithms": [ + "ChaCha20-Poly1305", + "HKDF-SHA-256" + ] + } + ] + } + ] + } + ] + } ] -} +} \ No newline at end of file diff --git a/schema/cryptography-defs.schema.json b/schema/cryptography-defs.schema.json index e17815057..74eadf8f1 100644 --- a/schema/cryptography-defs.schema.json +++ b/schema/cryptography-defs.schema.json @@ -1,9 +1,9 @@ { "$schema": "http://json-schema.org/draft-07/schema#", "$id": "http://cyclonedx.org/schema/cryptography-defs.schema.json", - "$comment": "2026-03-05T14:27:50Z", - "title": "Cryptographic Algorithm Family Definitions", - "description": "Enumerates cryptographic algorithm families and their specific metadata.", + "$comment": "2026-08-07T13:10:42Z", + "title": "Cryptographic Definitions", + "description": "Enumerates cryptographic algorithm families, elliptic curves, and protocols with their specific metadata.", "type": "object", "additionalProperties": false, "properties": { @@ -229,6 +229,76 @@ "curves" ] } + }, + "protocols": { + "type": "array", + "title": "Protocol Families", + "description": "An array of cryptographic protocol family definitions.", + "items": { + "type": "object", + "title": "Protocol Family", + "description": "Defines a cryptographic protocol family and its metadata.", + "additionalProperties": false, + "properties": { + "family": { + "$ref": "#/definitions/protocolFamiliesEnum", + "title": "Protocol Family", + "description": "The name of the cryptographic protocol family." + }, + "description": { + "type": [ + "string", + "null" + ], + "title": "Description", + "description": "A description of the protocol family." + }, + "standard": { + "$ref": "#/definitions/standardRefs", + "title": "Standards", + "description": "List of standards defining or relating to the protocol family." + }, + "version": { + "type": "array", + "title": "Versions", + "description": "List of versions of the protocol family, each with its algorithm composition.", + "items": { + "type": "object", + "title": "Protocol Version", + "description": "Defines a specific protocol version and its algorithm composition.", + "additionalProperties": false, + "properties": { + "version": { + "type": "string", + "title": "Version", + "description": "The version identifier of the protocol." + }, + "standard": { + "$ref": "#/definitions/standardRefs", + "title": "Standards", + "description": "List of standards defining or relating to this protocol version." + }, + "composition": { + "type": "array", + "title": "Composition", + "description": "The algorithm composition of this protocol version, as a list of functional slots that all apply together.", + "items": { + "$ref": "#/definitions/compositionSlot" + } + } + }, + "required": [ + "version", + "composition" + ] + } + } + }, + "required": [ + "family", + "version" + ] + } } }, "required": [ @@ -587,6 +657,152 @@ "x963/ansit571k1", "x963/ansit571r1" ] + }, + "protocolFamiliesEnum": { + "type": "string", + "title": "Protocol Families", + "description": "An enum for the protocol families.", + "enum": [ + "5g-aka", + "dtls", + "eap-aka", + "eap-aka-prime", + "ike", + "ipsec", + "prins", + "quic", + "ssh", + "sstp", + "tls", + "wpa" + ] + }, + "standardRefs": { + "type": "array", + "title": "Standards", + "description": "List of references to standards or registries.", + "items": { + "type": "object", + "title": "Standard Reference", + "description": "Reference to a standard or registry, including its name and URL.", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "title": "Standard Name", + "description": "The name or identifier of the standard." + }, + "url": { + "type": "string", + "format": "iri-reference", + "title": "Standard URL", + "description": "A URL pointing to the standard's official documentation." + } + }, + "required": [ + "name", + "url" + ] + } + }, + "compositionSlot": { + "type": "object", + "title": "Composition Slot", + "description": "A functional slot of a protocol, holding the set of algorithms that can fill it. All slots of a composition apply together; within a slot, the selection states how many algorithms of the set are used at runtime.", + "additionalProperties": false, + "properties": { + "role": { + "type": "string", + "title": "Role", + "description": "The functional role this slot fills within the protocol.", + "examples": [ + "authentication", + "cert-chain-signature", + "encryption", + "integrity", + "kdf", + "key-exchange", + "prf", + "signature" + ] + }, + "selection": { + "type": "string", + "title": "Selection", + "description": "Specifies how many algorithms of the set are used at runtime: all of them together (all-of), one or more, possibly simultaneously (any-of), or exactly one (one-of).", + "enum": [ + "all-of", + "any-of", + "one-of" + ] + }, + "selectedBy": { + "type": "string", + "title": "Selected By", + "description": "Specifies the mechanism by which the algorithms used at runtime are selected from the set.", + "enum": [ + "build-time", + "configuration", + "hardware", + "negotiation", + "server-selected", + "unknown" + ] + }, + "algorithmSet": { + "$ref": "#/definitions/algorithmSet", + "title": "Algorithm Set", + "description": "The set of algorithms that can fill this slot." + } + }, + "required": [ + "role", + "selection", + "algorithmSet" + ] + }, + "algorithmSet": { + "type": "array", + "title": "Algorithm Set", + "description": "The set of algorithms that can fill a composition slot. How many of them are used at runtime is stated by the slot's selection. Each member is either the concrete name of an algorithm, matching a variant pattern of an algorithm family defined in this document, or a named bundle of such algorithms.", + "items": { + "title": "Algorithm Set Member", + "description": "A member of an algorithm set: an algorithm name, or a named bundle.", + "oneOf": [ + { + "type": "string", + "title": "Algorithm Name", + "description": "The concrete algorithm name, matching a variant pattern of an algorithm family defined in this document." + }, + { + "type": "object", + "title": "Named Bundle", + "description": "A named bundle of algorithms, such as a cipher suite or a hybrid key exchange group: it is selected as one unit, and all bundled algorithms are used together.", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "title": "Bundle Name", + "description": "The common name of the bundle." + }, + "algorithms": { + "type": "array", + "title": "Bundled Algorithms", + "description": "The concrete names of the algorithms composing this bundle, each matching a variant pattern of an algorithm family defined in this document.", + "items": { + "type": "string", + "title": "Algorithm Name", + "description": "The concrete algorithm name, matching a variant pattern of an algorithm family defined in this document." + } + } + }, + "required": [ + "name", + "algorithms" + ] + } + ] + } } } } \ No newline at end of file