Skip to content

Commit 5ed95f6

Browse files
bhessbhess
committed
- Schema fix: Avoid name collision in 'oneOf' of certificateExtensions
- Schema fix: Define items in ikeV2 arrays - Schema extension: in protocolProperties/cipherSuites, adds explicit tlsGroups and tlsSignatureSchemes properties - Updates valid-cryptography-full-1.7 and valid-cryptography-implementation.1.7 test cases Signed-off-by: Basil Hess <[email protected]>
1 parent 6f93579 commit 5ed95f6

File tree

4 files changed

+331
-54
lines changed

4 files changed

+331
-54
lines changed

‎schema/bom-1.7.schema.json‎

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5802,8 +5802,7 @@
58025802
"additionalProperties": false,
58035803
"properties": {
58045804
"encr": {
5805-
"type": "array",
5806-
"$ref": "#/definitions/ikeV2Enc",
5805+
"type": "string",
58075806
"title": "Encryption Algorithms (ENCR)",
58085807
"description": "Transform Type 1: encryption algorithms"
58095808
},
@@ -5895,6 +5894,35 @@
58955894
"0x9E"
58965895
]
58975896
}
5897+
},
5898+
"tlsGroups": {
5899+
"type": "array",
5900+
"title": "TLS Groups",
5901+
"description": "A list of TLS named groups (formerly known as curves) for this cipher suite. These groups define the parameters for key exchange algorithms like ECDHE.",
5902+
"items": {
5903+
"type": "string",
5904+
"title": "Group Name",
5905+
"description": "The name of the TLS group",
5906+
"examples": [
5907+
"x25519",
5908+
"ffdhe2048"
5909+
]
5910+
}
5911+
},
5912+
"tlsSignatureSchemes": {
5913+
"type": "array",
5914+
"title": "TLS Signature Schemes",
5915+
"description": "A list of signature schemes supported for cipher suite. These schemes specify the algorithms used for digital signatures in TLS handshakes and certificate verification.",
5916+
"items": {
5917+
"type": "string",
5918+
"title": "Signature Scheme",
5919+
"description": "The name of the TLS signature scheme",
5920+
"examples": [
5921+
"ecdsa_secp256r1_sha256",
5922+
"rsa_pss_rsae_sha256",
5923+
"ed25519"
5924+
]
5925+
}
58985926
}
58995927
}
59005928
},

‎schema/cryptography-defs.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,10 @@
100100
{
101101
"pattern": "ECDH[E][-{ellipticCurve}]",
102102
"primitive": "key-agree"
103+
},
104+
{
105+
"pattern": "x25519|x448",
106+
"primitive": "key-agree"
103107
}
104108
]
105109
},

‎tools/src/test/resources/1.7/valid-cryptography-full-1.7.json‎

Lines changed: 219 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -12,88 +12,279 @@
1212
"cryptoProperties": {
1313
"assetType": "algorithm",
1414
"algorithmProperties": {
15-
"primitive": "ae",
15+
"primitive": "key-agree",
16+
"algorithmFamily": "ECDH",
1617
"parameterSetIdentifier": "128",
17-
"curve": "brainpoolP160r1",
18+
"curve": "brainpool/brainpoolP160r1",
19+
"ellipticCurve": "brainpool/brainpoolP160r1",
1820
"executionEnvironment": "software-plain-ram",
1921
"implementationPlatform": "x86_64",
20-
"certificationLevel": [ "fips140-1-l4" ],
22+
"certificationLevel": [ "fips140-3-l4" ],
2123
"mode": "gcm",
2224
"padding": "pkcs5",
23-
"cryptoFunctions": ["keygen", "encrypt", "decrypt", "tag"],
24-
"classicalSecurityLevel": 128,
25-
"nistQuantumSecurityLevel": 1
25+
"cryptoFunctions": ["keygen", "keyderive"],
26+
"classicalSecurityLevel": 96,
27+
"nistQuantumSecurityLevel": 0
2628
},
2729
"oid": "oid:1.2.3.4.5.6.7.8.9"
2830
}
2931
},
3032
{
3133
"type": "cryptographic-asset",
3234
"bom-ref": "asset-2",
33-
"name": "Name here",
35+
"name": "Example Certificate with All Properties",
3436
"cryptoProperties": {
3537
"assetType": "certificate",
3638
"certificateProperties": {
37-
"subjectName": "Subject name here",
38-
"issuerName": "Issuer name here",
39+
"serialNumber": "0B:35:82:6D:F5:7A:02:0A:0A:21:8F:BD:F3:91:43:C3",
40+
"subjectName": "CN=example.com, O=Example Corp, C=US",
41+
"issuerName": "CN=Example CA, O=Example Trust Services, C=US",
3942
"notValidBefore": "2022-01-01T00:00:00.000Z",
4043
"notValidAfter": "2024-01-01T00:00:00.000Z",
4144
"signatureAlgorithmRef": "bom-ref-to-algorithm",
4245
"subjectPublicKeyRef": "bom-ref-to-public-key",
4346
"certificateFormat": "X.509",
44-
"certificateExtension": "crt"
47+
"certificateExtension": "crt",
48+
"certificateFileExtension": "crt",
49+
"fingerprint": {
50+
"alg": "SHA-256",
51+
"content": "3942447fac867ae5cdb3229b658f4d48"
52+
},
53+
"certificateState": [
54+
{
55+
"state": "pre-activation",
56+
"reason": "Certificate created but not yet active"
57+
},
58+
{
59+
"state": "active",
60+
"reason": "Certificate in active use for TLS connections"
61+
},
62+
{
63+
"state": "suspended",
64+
"reason": "Temporary suspension due to security audit"
65+
},
66+
{
67+
"state": "deactivated",
68+
"reason": "Replaced by new certificate"
69+
},
70+
{
71+
"state": "revoked",
72+
"reason": "Private key compromise suspected"
73+
},
74+
{
75+
"state": "destroyed",
76+
"reason": "Certificate and associated keys securely destroyed"
77+
}
78+
],
79+
"creationDate": "2022-01-01T00:00:00.000Z",
80+
"activationDate": "2022-01-02T00:00:00.000Z",
81+
"deactivationDate": "2023-12-31T23:59:59.000Z",
82+
"revocationDate": "2024-01-01T00:00:00.000Z",
83+
"destructionDate": "2024-01-02T00:00:00.000Z",
84+
"certificateExtensions": [
85+
{
86+
"commonExtensionName": "basicConstraints",
87+
"commonExtensionValue": "CA:FALSE, pathlen:0"
88+
},
89+
{
90+
"commonExtensionName": "keyUsage",
91+
"commonExtensionValue": "digitalSignature, keyEncipherment"
92+
},
93+
{
94+
"commonExtensionName": "extendedKeyUsage",
95+
"commonExtensionValue": "serverAuth, clientAuth"
96+
},
97+
{
98+
"commonExtensionName": "subjectAlternativeName",
99+
"commonExtensionValue": "DNS:example.com, DNS:www.example.com"
100+
},
101+
{
102+
"commonExtensionName": "authorityKeyIdentifier",
103+
"commonExtensionValue": "keyid:12:34:56:78:90:AB:CD:EF"
104+
},
105+
{
106+
"commonExtensionName": "subjectKeyIdentifier",
107+
"commonExtensionValue": "AA:BB:CC:DD:EE:FF:00:11"
108+
},
109+
{
110+
"commonExtensionName": "authorityInformationAccess",
111+
"commonExtensionValue": "OCSP - URI:http://ocsp.example.com"
112+
},
113+
{
114+
"commonExtensionName": "certificatePolicies",
115+
"commonExtensionValue": "Policy: 2.23.140.1.2.1"
116+
},
117+
{
118+
"commonExtensionName": "crlDistributionPoints",
119+
"commonExtensionValue": "URI:http://crl.example.com/root.crl"
120+
},
121+
{
122+
"commonExtensionName": "signedCertificateTimestamp",
123+
"commonExtensionValue": "Signed by Example CT log at 2022-01-01T00:00:00Z"
124+
},
125+
{
126+
"customExtensionName": "someCustomExtension",
127+
"customExtensionValue": "Custom value for this extension"
128+
}
129+
130+
],
131+
"relatedCryptographicAssets": [
132+
{
133+
"type": "publicKey",
134+
"ref": "public-key-ref"
135+
},
136+
{
137+
"type": "privateKey",
138+
"ref": "private-key-ref"
139+
},
140+
{
141+
"type": "algorithm",
142+
"ref": "signing-algorithm-ref"
143+
}
144+
]
45145
},
46-
"oid": "oid:1.2.3.4.5.6.7.8.9"
146+
"oid": "oid:2.5.4.3"
47147
}
48148
},
49149
{
50150
"type": "cryptographic-asset",
51151
"bom-ref": "asset-3",
52-
"name": "Name here",
152+
"name": "Example Protocol with All Properties",
53153
"cryptoProperties": {
54154
"assetType": "protocol",
55155
"protocolProperties": {
56156
"type": "tls",
57157
"version": "1.3",
58158
"cipherSuites": [
59159
{
60-
"name": "TLS_DHE_RSA_WITH_AES_128_CCM",
160+
"name": "TLS_AES_128_GCM_SHA256",
61161
"algorithms": [
62-
"bom-ref-to-algorithm"
162+
"aes-128-gcm-ref",
163+
"sha256-ref"
63164
],
64165
"identifiers": [
65-
"0xC0"
166+
"0x1301"
167+
],
168+
"tlsGroups": [
169+
"x25519",
170+
"secp256r1",
171+
"secp384r1",
172+
"secp521r1",
173+
"ffdhe2048",
174+
"ffdhe3072"
175+
],
176+
"tlsSignatureSchemes": [
177+
"ecdsa_secp256r1_sha256",
178+
"ecdsa_secp384r1_sha384",
179+
"ecdsa_secp521r1_sha512",
180+
"rsa_pss_rsae_sha256",
181+
"rsa_pss_rsae_sha384",
182+
"rsa_pss_rsae_sha512",
183+
"ed25519",
184+
"ed448"
185+
]
186+
},
187+
{
188+
"name": "TLS_AES_256_GCM_SHA384",
189+
"algorithms": [
190+
"aes-256-gcm-ref",
191+
"sha384-ref"
192+
],
193+
"identifiers": [
194+
"0x1302"
195+
]
196+
},
197+
{
198+
"name": "TLS_CHACHA20_POLY1305_SHA256",
199+
"algorithms": [
200+
"chacha20-poly1305-ref",
201+
"sha256-ref"
202+
],
203+
"identifiers": [
204+
"0x1303"
66205
]
67206
}
68-
]
207+
],
208+
"ikev2TransformTypes": {
209+
"encr": [
210+
{
211+
"name": "AES-128-GCM",
212+
"keyLength": 128,
213+
"algorithm": "aes-128-gcm-ref"
214+
}
215+
],
216+
"prf": [
217+
{
218+
"name": "SHA-256",
219+
"algorithm": "sha256-ref"
220+
}
221+
],
222+
"integ": [
223+
{
224+
"name": "SHA-256",
225+
"algorithm": "sha256-ref"
226+
}
227+
],
228+
"ke": [
229+
{
230+
"group": 14,
231+
"algorithm": "diffie-hellman-group14-sha256-ref"
232+
}
233+
],
234+
"esn": true,
235+
"auth": [
236+
{
237+
"name": "ECDSA",
238+
"algorithm": "ecdsa_secp256r1_sha256"
239+
}
240+
]
241+
}
69242
},
70-
"oid": "oid:1.2.3.4.5.6.7.8.9"
243+
"oid": "oid:1.3.6.1.5.5.7.3.1"
71244
}
72245
},
73246
{
74247
"type": "cryptographic-asset",
75248
"bom-ref": "asset-4",
76-
"name": "Name here",
249+
"name": "Example Related Crypto Material with All Properties",
77250
"cryptoProperties": {
78251
"assetType": "related-crypto-material",
79252
"relatedCryptoMaterialProperties": {
80-
"type": "private-key",
81-
"id": "12345",
253+
"type": "public-key",
254+
"id": "key-12345-67890",
82255
"state": "active",
83-
"algorithmRef": "bom-ref-to-algorithm",
256+
"algorithmRef": "rsa-4096-ref",
84257
"creationDate": "2024-01-01T00:00:00.000Z",
85258
"activationDate": "2024-01-02T00:00:00.000Z",
86259
"updateDate": "2024-01-03T00:00:00.000Z",
87-
"expirationDate": "2024-01-04T00:00:00.000Z",
88-
"value": "Value here",
89-
"size": 1024,
90-
"format": "PEM",
260+
"expirationDate": "2026-01-01T00:00:00.000Z",
261+
"value": "-----BEGIN PUBLIC KEY-----",
262+
"size": 4096,
263+
"format": "PKCS#8",
91264
"securedBy": {
92265
"mechanism": "HSM",
93-
"algorithmRef": "bom-ref-to-algorithm"
94-
}
266+
"algorithmRef": "aes-256-gcm-ref"
267+
},
268+
"fingerprint": {
269+
"alg": "SHA-256",
270+
"content": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
271+
},
272+
"relatedCryptographicAssets": [
273+
{
274+
"type": "publicKey",
275+
"ref": "corresponding-public-key-ref"
276+
},
277+
{
278+
"type": "certificate",
279+
"ref": "certificate-using-this-key-ref"
280+
},
281+
{
282+
"type": "algorithm",
283+
"ref": "rsa-4096-ref"
284+
}
285+
]
95286
},
96-
"oid": "oid:1.2.3.4.5.6.7.8.9"
287+
"oid": "oid:1.2.840.113549.1.1.1"
97288
}
98289
}
99290
]

0 commit comments

Comments
 (0)