Skip to content

CBOM: add protocol registry schema #1010

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bhess wants to merge 10 commits into
base: 2.0-dev
Choose a base branch
from
Open

CBOM: add protocol registry schema #1010

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
555294f
Add protocol registry to cryptography-defs
bhess Jun 25, 2026
57c5985
Add sub-protocol references to the protocol registry
bhess Aug 20, 2026
0e18e51
Reference the protocol registry from protocolProperties.type
bhess Aug 20, 2026
f578871
Merge branch '2.0-dev' into bhe-protocol-registry
jkowalleck Aug 24, 2026
ea34c2d
Merge branch '2.0-dev' into bhe-protocol-registry
jkowalleck Sep 1, 2026
2e8b48a
Split selectedBy into mechanism and selecting party
bhess Sep 9, 2026
0f67c4a
Document the registry join and add protocol type tests
bhess Sep 9, 2026
c77c986
add some clarification
bhess Sep 10, 2026
ffc4845
Merge branch '2.0-dev' into bhe-protocol-registry
jkowalleck Sep 10, 2026
dcd8f24
Merge branch '2.0-dev' into bhe-protocol-registry
jkowalleck Sep 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 5 additions & 37 deletions schema/2.0/model/cyclonedx-cryptography-2.0.schema.json
View file
Open in desktop

@jkowalleck jkowalleck Aug 24, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could you add new valid/invalid test cases, if needed?

@bhess bhess Sep 9, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added.. one simple positive and a negative test case.

Original file line number Diff line number Diff line change
Expand Up @@ -754,46 +754,14 @@
"additionalProperties": false,
"properties": {
"type": {
"type": "string",
"$ref": "../../cryptography-defs.schema.json#/definitions/protocolFamiliesEnum",
"title": "Type",

@bhess bhess Sep 10, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rename: "Protocol type"

"description": "The concrete protocol type.",
"enum": [
"tls",
"ssh",
"ipsec",
"ike",
"sstp",
"wpa",
"dtls",
"quic",
"eap-aka",
"eap-aka-prime",
"prins",
"5g-aka",
"other",
"unknown"
],
"meta:enum": {
"tls": "Transport Layer Security",
"ssh": "Secure Shell",
"ipsec": "Internet Protocol Security",
"ike": "Internet Key Exchange",
"sstp": "Secure Socket Tunneling Protocol",
"wpa": "Wi-Fi Protected Access",
"dtls": "Datagram Transport Layer Security",
"quic": "Quick UDP Internet Connections",
"eap-aka": "Extensible Authentication Protocol variant",
"eap-aka-prime": "Enhanced version of EAP-AKA",
"prins": "Protection of Inter-Network Signaling",
"5g-aka": "Authentication and Key Agreement for 5G",
"other": "Another protocol type",
"unknown": "The protocol type is not known"
}
"description": "The concrete protocol type. If specified, this value shall be one of the enumeration of valid protocol families defined in the `cryptography-defs.schema.json` subschema."
},
"version": {
"type": "string",
"title": "Protocol Version",
"description": "The version of the protocol.",
"description": "The version of the protocol. Together with the type, it identifies the corresponding protocol entry, by exact match, in the `cryptography-defs.schema.json` subschema.",
"examples": [
"1.0",
"1.2",
Expand All @@ -803,7 +771,7 @@
"cipherSuites": {
"type": "array",
"title": "Cipher Suites",
"description": "A list of cipher suites related to the protocol.",
"description": "A list of cipher suites related to the protocol, as configured or observed for the subject of this BOM. The protocol entry in the `cryptography-defs.schema.json` subschema describes what the protocol version itself can support or negotiate.",
"items": {
"$ref": "#/$defs/cipherSuite",
"title": "Cipher Suite"
Expand All @@ -812,7 +780,7 @@
"ikev2TransformTypes": {
"type": "object",
"title": "IKEv2 Transform Types",
"description": "The IKEv2 transform types supported (types 1-4), defined in [RFC 7296 section 3.3.2](https://www.ietf.org/rfc/rfc7296.html#section-3.3.2), and additional properties.",
"description": "The IKEv2 transform types supported (types 1-4), defined in [RFC 7296 section 3.3.2](https://www.ietf.org/rfc/rfc7296.html#section-3.3.2), and additional properties, as configured or observed for the subject of this BOM. The protocol entry in the `cryptography-defs.schema.json` subschema describes what the protocol version itself can support or negotiate.",
"additionalProperties": false,
"properties": {
"encr": {
Expand Down
235 changes: 233 additions & 2 deletions schema/cryptography-defs.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"$schema": "http://cyclonedx.org/schema/cryptography-defs.schema.json",
"lastUpdated": "2026-02-24T00:00:00Z",
"lastUpdated": "2026-08-06T00:00:00Z",
"algorithms": [
{
"family": "RSASSA-PKCS1",
Expand Down Expand Up @@ -4224,5 +4224,236 @@
}
]
}
],
"protocols": [
{
"family": "tls",
"description": "Transport Layer Security (TLS) provides confidentiality, integrity, and authentication for communication over a network.",
"standard": [
{
"name": "IANA TLS Parameters",
"url": "https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml"
}
],
"version": [
{
"version": "1.3",
"standard": [
{
"name": "RFC8446",
"url": "https://doi.org/10.17487/RFC8446"
}
],
"composition": [
{
"role": "key-exchange",
"selection": "one-of",
"selectedBy": "negotiation",
"selectingParty": "server",
"algorithmSet": [
"x25519",
"x448",
"ECDHE-secp256r1",
"ECDHE-secp384r1",
{
"name": "X25519MLKEM768",
"algorithms": [
"x25519",
"ML-KEM-768"
]
},
{
"name": "SecP256r1MLKEM768",
"algorithms": [
"ECDHE-secp256r1",
"ML-KEM-768"
]
},
{
"name": "SecP384r1MLKEM1024",
"algorithms": [
"ECDHE-secp384r1",
"ML-KEM-1024"
]
}
]
},
{
"role": "signature",
"selection": "one-of",
"selectedBy": "negotiation",
"selectingParty": "server",
"algorithmSet": [
"ECDSA-secp256r1-SHA-256",
"ECDSA-secp384r1-SHA-384",
"RSA-PSS-SHA-256",
"Ed25519",
"ML-DSA-65"
]
},
{
"role": "cert-chain-signature",
"selection": "any-of",
"selectedBy": "configuration",
"selectingParty": "server",
"algorithmSet": [
"ECDSA-secp256r1-SHA-256",
"RSA-PKCS1-1.5-SHA-256",
"RSA-PSS-SHA-256",
"ML-DSA-65"
]
},
{
"role": "encryption",
"selection": "one-of",
"selectedBy": "negotiation",
"selectingParty": "server",
"algorithmSet": [
{
"name": "TLS_AES_128_GCM_SHA256",
"algorithms": [
"AES-128-GCM",
"HKDF-SHA-256"
]
},
{
"name": "TLS_AES_256_GCM_SHA384",
"algorithms": [
"AES-256-GCM",
"HKDF-SHA-384"
]
},
{
"name": "TLS_CHACHA20_POLY1305_SHA256",
"algorithms": [
"ChaCha20-Poly1305",
"HKDF-SHA-256"
]
}
]
}
]
}
]
},
{
"family": "ike",
"description": "Internet Key Exchange (IKE) negotiates security associations and keying material for IPsec.",
"standard": [
{
"name": "RFC7296",
"url": "https://doi.org/10.17487/RFC7296"
}
],
"version": [
{
"version": "2",
"standard": [
{
"name": "RFC7296",
"url": "https://doi.org/10.17487/RFC7296"
}
],
"composition": [
{
"role": "encryption",
"selection": "one-of",
"selectedBy": "negotiation",
"selectingParty": "responder",
"algorithmSet": [
"AES-128-GCM",
"AES-256-GCM",
"AES-256-CBC",
"ChaCha20-Poly1305"
]
},
{
"role": "prf",
"selection": "one-of",
"selectedBy": "negotiation",
"selectingParty": "responder",
"algorithmSet": [
"HMAC-SHA-256",
"HMAC-SHA-384",
"AES-CMAC-PRF-128"
]
},
{
"role": "integrity",
"selection": "one-of",
"selectedBy": "negotiation",
"selectingParty": "responder",
"algorithmSet": [
"HMAC-SHA-256-128",
"HMAC-SHA-384-192"
]
},
{
"role": "key-exchange",
"selection": "any-of",
"selectedBy": "negotiation",
"selectingParty": "responder",
"algorithmSet": [
"ECDH-secp256r1",
"ECDH-secp384r1",
"x25519",
"ML-KEM-768"
]
}
]
}
]
},
{
"family": "ipsec",
"description": "Internet Protocol Security (IPsec) secures IP traffic using a key management protocol and packet protection protocols.",
"standard": [
{
"name": "RFC4301",
"url": "https://doi.org/10.17487/RFC4301"
}
],
"version": [
{
"version": "3",
"standard": [
{
"name": "RFC4301",
"url": "https://doi.org/10.17487/RFC4301"
}
],
"composition": [
{
"role": "key-management",
"selection": "one-of",
"selectedBy": "configuration",
"algorithmSet": [
{
"protocol": "ike",
"version": "1"
},
{
"protocol": "ike",
"version": "2"
}
]
},
{
"role": "packet-protection",
"selection": "any-of",
"selectedBy": "configuration",
"algorithmSet": [
{
"protocol": "esp"
},
{
"protocol": "ah"
}
]
}
]
}
]
}
]
}
}
Loading
Loading