Skip to content

CBOM: add protocol registry schema #1010

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
bhess wants to merge 3 commits into
base: 2.0-dev
Choose a base branch
from
+490 −39
Draft

CBOM: add protocol registry schema #1010

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
555294f
Add protocol registry to cryptography-defs
bhess Jun 25, 2026
57c5985
Add sub-protocol references to the protocol registry
bhess Aug 20, 2026
0e18e51
Reference the protocol registry from protocolProperties.type
bhess Aug 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 2 additions & 34 deletions schema/2.0/model/cyclonedx-cryptography-2.0.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -742,41 +742,9 @@
"additionalProperties": false,
"properties": {
"type": {
"type": "string",
"$ref": "../../cryptography-defs.schema.json#/definitions/protocolFamiliesEnum",
"title": "Type",
"description": "The concrete protocol type.",
"enum": [
"tls",
"ssh",
"ipsec",
"ike",
"sstp",
"wpa",
"dtls",
"quic",
"eap-aka",
"eap-aka-prime",
"prins",
"5g-aka",
"other",
"unknown"
],
"meta:enum": {
"tls": "Transport Layer Security",
"ssh": "Secure Shell",
"ipsec": "Internet Protocol Security",
"ike": "Internet Key Exchange",
"sstp": "Secure Socket Tunneling Protocol",
"wpa": "Wi-Fi Protected Access",
"dtls": "Datagram Transport Layer Security",
"quic": "Quick UDP Internet Connections",
"eap-aka": "Extensible Authentication Protocol variant",
"eap-aka-prime": "Enhanced version of EAP-AKA",
"prins": "Protection of Inter-Network Signaling",
"5g-aka": "Authentication and Key Agreement for 5G",
"other": "Another protocol type",
"unknown": "The protocol type is not known"
}
"description": "The concrete protocol type. If specified, this value shall be one of the enumeration of valid protocol families defined in the `cryptography-defs.schema.json` subschema."
},
"version": {
"type": "string",
Expand Down
227 changes: 225 additions & 2 deletions schema/cryptography-defs.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"$schema": "http://cyclonedx.org/schema/cryptography-defs.schema.json",
"lastUpdated": "2026-02-24T00:00:00Z",
"lastUpdated": "2026-08-06T00:00:00Z",
"algorithms": [
{
"family": "RSASSA-PKCS1",
Expand Down Expand Up @@ -4224,5 +4224,228 @@
}
]
}
],
"protocols": [
{
"family": "tls",
"description": "Transport Layer Security (TLS) provides confidentiality, integrity, and authentication for communication over a network.",
"standard": [
{
"name": "IANA TLS Parameters",
"url": "https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml"
}
],
"version": [
{
"version": "1.3",
"standard": [
{
"name": "RFC8446",
"url": "https://doi.org/10.17487/RFC8446"
}
],
"composition": [
{
"role": "key-exchange",
"selection": "one-of",
"selectedBy": "negotiation",
"algorithmSet": [
"x25519",
"x448",
"ECDHE-secp256r1",
"ECDHE-secp384r1",
{
"name": "X25519MLKEM768",
"algorithms": [
"x25519",
"ML-KEM-768"
]
},
{
"name": "SecP256r1MLKEM768",
"algorithms": [
"ECDHE-secp256r1",
"ML-KEM-768"
]
},
{
"name": "SecP384r1MLKEM1024",
"algorithms": [
"ECDHE-secp384r1",
"ML-KEM-1024"
]
}
]
},
{
"role": "signature",
"selection": "one-of",
"selectedBy": "negotiation",
"algorithmSet": [
"ECDSA-secp256r1-SHA-256",
"ECDSA-secp384r1-SHA-384",
"RSA-PSS-SHA-256",
"Ed25519",
"ML-DSA-65"
]
},
{
"role": "cert-chain-signature",
"selection": "any-of",
"selectedBy": "server-selected",
"algorithmSet": [
"ECDSA-secp256r1-SHA-256",
"RSA-PKCS1-1.5-SHA-256",
"RSA-PSS-SHA-256",
"ML-DSA-65"
]
},
{
"role": "encryption",
"selection": "one-of",
"selectedBy": "negotiation",
"algorithmSet": [
{
"name": "TLS_AES_128_GCM_SHA256",
"algorithms": [
"AES-128-GCM",
"HKDF-SHA-256"
]
},
{
"name": "TLS_AES_256_GCM_SHA384",
"algorithms": [
"AES-256-GCM",
"HKDF-SHA-384"
]
},
{
"name": "TLS_CHACHA20_POLY1305_SHA256",
"algorithms": [
"ChaCha20-Poly1305",
"HKDF-SHA-256"
]
}
]
}
]
}
]
},
{
"family": "ike",
"description": "Internet Key Exchange (IKE) negotiates security associations and keying material for IPsec.",
"standard": [
{
"name": "RFC7296",
"url": "https://doi.org/10.17487/RFC7296"
}
],
"version": [
{
"version": "2",
"standard": [
{
"name": "RFC7296",
"url": "https://doi.org/10.17487/RFC7296"
}
],
"composition": [
{
"role": "encryption",
"selection": "one-of",
"selectedBy": "negotiation",
"algorithmSet": [
"AES-128-GCM",
"AES-256-GCM",
"AES-256-CBC",
"ChaCha20-Poly1305"
]
},
{
"role": "prf",
"selection": "one-of",
"selectedBy": "negotiation",
"algorithmSet": [
"HMAC-SHA-256",
"HMAC-SHA-384",
"AES-CMAC-PRF-128"
]
},
{
"role": "integrity",
"selection": "one-of",
"selectedBy": "negotiation",
"algorithmSet": [
"HMAC-SHA-256-128",
"HMAC-SHA-384-192"
]
},
{
"role": "key-exchange",
"selection": "any-of",
"selectedBy": "negotiation",
"algorithmSet": [
"ECDH-secp256r1",
"ECDH-secp384r1",
"x25519",
"ML-KEM-768"
]
}
]
}
]
},
{
"family": "ipsec",
"description": "Internet Protocol Security (IPsec) secures IP traffic using a key management protocol and packet protection protocols.",
"standard": [
{
"name": "RFC4301",
"url": "https://doi.org/10.17487/RFC4301"
}
],
"version": [
{
"version": "3",
"standard": [
{
"name": "RFC4301",
"url": "https://doi.org/10.17487/RFC4301"
}
],
"composition": [
{
"role": "key-management",
"selection": "one-of",
"selectedBy": "configuration",
"algorithmSet": [
{
"protocol": "ike",
"version": "1"
},
{
"protocol": "ike",
"version": "2"
}
]
},
{
"role": "packet-protection",
"selection": "any-of",
"selectedBy": "configuration",
"algorithmSet": [
{
"protocol": "esp"
},
{
"protocol": "ah"
}
]
}
]
}
]
}
]
}
}
Loading
Loading