Skip to content

Commit b213b8d

Browse files
stevespringettstevespringett
authored
CBOM 1.7: Update test cases & a few schema fixes/extensions (#661)
Update schema test cases and fix validation issues for 1.7 CBOM. This PR addresses two schema validation issues discovered while running ajv on the test cases: - ikev2TransformTypes: The array items were missing type definitions. This has been corrected. - certificateExtensions: The oneOf clause defined two objects (commonExtensions and customExtensions) with overlapping property names, which caused validation errors. The property names have been made unique within each object to resolve this. Additionally, two new properties have been added to cryptoProperties.cipherSuites to support more precise TLS configurations: tlsGroups and tlsSignatureSchemes. <!-- Thank you for taking the time to develop and contribute a core enhancement or fix for a defect! We kindly request that you create pull requests only for things that have been discussed in a ticket first; exceptions may be made for spelling or grammar fixes. Read more about the process here: https://cyclonedx.org/participate/standardization-process/#working-model Please have the related ticket/issue ID ready. If there is none, feel free to create a new ticket: https://github.com/CycloneDX/specification/issues/new/choose --> <!-- Please provide a brief description of what this pull request intends to do and which ticket it fixes/closes. Example: > As discussed in ticket #485, this PR adds Streebog to the hash algorithm enum. > > fixes #485 In case this is for a spelling or grammar improvement, please provide a brief description. Example: > Fixe typo: color(AE) -> colour(BE) -->
2 parents 6f93579 + e4de276 commit b213b8d

File tree

6 files changed

+894
-71
lines changed

6 files changed

+894
-71
lines changed

‎schema/bom-1.7.schema.json‎

Lines changed: 73 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -5474,7 +5474,7 @@
54745474
],
54755475
"additionalProperties": false,
54765476
"properties": {
5477-
"state": {
5477+
"name": {
54785478
"type": "string",
54795479
"title": "State",
54805480
"description": "The name of the certificate lifecycle state."
@@ -5536,12 +5536,12 @@
55365536
{
55375537
"title": "Common Extensions",
55385538
"required": [
5539-
"name",
5540-
"value"
5539+
"commonExtensionName",
5540+
"commonExtensionValue"
55415541
],
55425542
"additionalProperties": false,
55435543
"properties": {
5544-
"name": {
5544+
"commonExtensionName": {
55455545
"type": "string",
55465546
"title": "name",
55475547
"description": "The name of the extension.",
@@ -5570,7 +5570,7 @@
55705570
"signedCertificateTimestamp": "Shows that the certificate has been publicly logged, which helps prevent the issuance of rogue certificates by a CA. Log ID, timestamp and signature as proof."
55715571
}
55725572
},
5573-
"value": {
5573+
"commonExtensionValue": {
55745574
"type": "string",
55755575
"title": "Value",
55765576
"description": "The value of the certificate extension."
@@ -5581,16 +5581,16 @@
55815581
"title": "Custom Extensions",
55825582
"description": "Custom extensions may convey application-specific or vendor-specific data not covered by standard extensions. The structure and semantics of custom extensions are typically defined outside of public standards. CycloneDX leverages properties to support this capability.",
55835583
"required": [
5584-
"name"
5584+
"customExtensionName"
55855585
],
55865586
"additionalProperties": false,
55875587
"properties": {
5588-
"name": {
5588+
"customExtensionName": {
55895589
"type": "string",
55905590
"title": "Name",
55915591
"description": "The name for the custom certificate extension."
55925592
},
5593-
"value": {
5593+
"customExtensionValue": {
55945594
"type": "string",
55955595
"title": "Value",
55965596
"description": "The description of the custom certificate extension."
@@ -5760,6 +5760,11 @@
57605760
"wpa",
57615761
"dtls",
57625762
"quic",
5763+
"eap-aka",
5764+
"eap-aka-prime",
5765+
"prins",
5766+
"5g-aka",
5767+
"jose",
57635768
"other",
57645769
"unknown"
57655770
],
@@ -5772,6 +5777,11 @@
57725777
"wpa": "Wi-Fi Protected Access",
57735778
"dtls": "Datagram Transport Layer Security",
57745779
"quic": "Quick UDP Internet Connections",
5780+
"eap-aka": "Extensible Authentication Protocol variant",
5781+
"eap-aka-prime": "Enhanced version of EAP-AKA",
5782+
"prins": "Protection of Inter-Network Signaling",
5783+
"5g-aka": "Authentication and Key Agreement for 5G",
5784+
"jose": "JSON Object Signing and Encryption",
57755785
"other": "Another protocol type",
57765786
"unknown": "The protocol type is not known"
57775787
}
@@ -5803,27 +5813,39 @@
58035813
"properties": {
58045814
"encr": {
58055815
"type": "array",
5806-
"$ref": "#/definitions/ikeV2Enc",
58075816
"title": "Encryption Algorithms (ENCR)",
5808-
"description": "Transform Type 1: encryption algorithms"
5809-
},
5817+
"description": "Transform Type 1: encryption algorithms",
5818+
"items": {
5819+
"$ref": "#/definitions/ikeV2Enc",
5820+
"title": "Encryption Algorithm (ENCR)"
5821+
}
5822+
},
58105823
"prf": {
58115824
"type": "array",
5812-
"$ref": "#/definitions/ikeV2Prf",
58135825
"title": "Pseudorandom Functions (PRF)",
5814-
"description": "Transform Type 2: pseudorandom functions"
5826+
"description": "Transform Type 2: pseudorandom functions",
5827+
"items": {
5828+
"$ref": "#/definitions/ikeV2Prf",
5829+
"title": "Pseudorandom Function (PRF)"
5830+
}
58155831
},
58165832
"integ": {
58175833
"type": "array",
5818-
"$ref": "#/definitions/ikeV2Integ",
58195834
"title": "Integrity Algorithms (INTEG)",
5820-
"description": "Transform Type 3: integrity algorithms"
5835+
"description": "Transform Type 3: integrity algorithms",
5836+
"items": {
5837+
"$ref": "#/definitions/ikeV2Integ",
5838+
"title": "Integrity Algorithm (INTEG)"
5839+
}
58215840
},
58225841
"ke": {
58235842
"type": "array",
5824-
"$ref": "#/definitions/ikeV2Ke",
58255843
"title": "Key Exchange Methods (KE)",
5826-
"description": "Transform Type 4: Key Exchange Method (KE) per [RFC 9370](https://www.ietf.org/rfc/rfc9370.html), formerly called Diffie-Hellman Group (D-H)."
5844+
"description": "Transform Type 4: Key Exchange Method (KE) per [RFC 9370](https://www.ietf.org/rfc/rfc9370.html), formerly called Diffie-Hellman Group (D-H).",
5845+
"items": {
5846+
"$ref": "#/definitions/ikeV2Ke",
5847+
"title": "Key Exchange Method (KE)"
5848+
}
58275849
},
58285850
"esn": {
58295851
"type": "boolean",
@@ -5832,9 +5854,12 @@
58325854
},
58335855
"auth": {
58345856
"type": "array",
5835-
"$ref": "#/definitions/ikeV2Auth",
58365857
"title": "IKEv2 Authentication methods",
5837-
"description": "IKEv2 Authentication method per [RFC9593](https://www.ietf.org/rfc/rfc9593.html)."
5858+
"description": "IKEv2 Authentication method per [RFC9593](https://www.ietf.org/rfc/rfc9593.html).",
5859+
"items": {
5860+
"$ref": "#/definitions/ikeV2Auth",
5861+
"title": "IKEv2 Authentication Method"
5862+
}
58385863
}
58395864
}
58405865
},
@@ -5895,6 +5920,35 @@
58955920
"0x9E"
58965921
]
58975922
}
5923+
},
5924+
"tlsGroups": {
5925+
"type": "array",
5926+
"title": "TLS Groups",
5927+
"description": "A list of TLS named groups (formerly known as curves) for this cipher suite. These groups define the parameters for key exchange algorithms like ECDHE.",
5928+
"items": {
5929+
"type": "string",
5930+
"title": "Group Name",
5931+
"description": "The name of the TLS group",
5932+
"examples": [
5933+
"x25519",
5934+
"ffdhe2048"
5935+
]
5936+
}
5937+
},
5938+
"tlsSignatureSchemes": {
5939+
"type": "array",
5940+
"title": "TLS Signature Schemes",
5941+
"description": "A list of signature schemes supported for cipher suite. These schemes specify the algorithms used for digital signatures in TLS handshakes and certificate verification.",
5942+
"items": {
5943+
"type": "string",
5944+
"title": "Signature Scheme",
5945+
"description": "The name of the TLS signature scheme",
5946+
"examples": [
5947+
"ecdsa_secp256r1_sha256",
5948+
"rsa_pss_rsae_sha256",
5949+
"ed25519"
5950+
]
5951+
}
58985952
}
58995953
}
59005954
},

‎schema/cryptography-defs.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,10 @@
100100
{
101101
"pattern": "ECDH[E][-{ellipticCurve}]",
102102
"primitive": "key-agree"
103+
},
104+
{
105+
"pattern": "x25519|x448",
106+
"primitive": "key-agree"
103107
}
104108
]
105109
},
@@ -726,6 +730,86 @@
726730
"primitive": "signature"
727731
}
728732
]
733+
},
734+
{
735+
"family": "MILENAGE",
736+
"standard": [
737+
{"name": "3GPP TS 35.206", "url": "https://www.3gpp.org/ftp/Specs/archive/35_series/35.206/35206-i00.zip"}
738+
],
739+
"variant": [
740+
{
741+
"pattern": "MILENAGE[-MAC]",
742+
"primitive": "mac"
743+
},
744+
{
745+
"pattern": "MILENAGE[-KDF]",
746+
"primitive": "kdf"
747+
}
748+
]
749+
},
750+
{
751+
"family": "TUAK",
752+
"standard": [
753+
{"name": "SHA-3 based authentication algorithm (3GPP TS 35.231)", "url": "https://www.3gpp.org/ftp/Specs/archive/35_series/35.231/35231-i00.zip"}
754+
],
755+
"variant": [
756+
{
757+
"pattern": "TUAC[-MAC]",
758+
"primitive": "mac"
759+
},
760+
{
761+
"pattern": "TUAC[-KDF]",
762+
"primitive": "kdf"
763+
}
764+
]
765+
},
766+
{
767+
"family": "ZUC",
768+
"standard": [
769+
{"name": "3GPP TS 35.221", "url": "https://www.3gpp.org/ftp/Specs/archive/35_series/35.221/35221-i00.zip"}
770+
],
771+
"variant": [
772+
{
773+
"pattern": "128-EEA3",
774+
"primitive": "stream-cipher"
775+
},
776+
{
777+
"pattern": "128-EIA3",
778+
"primitive": "mac"
779+
}
780+
]
781+
},
782+
{
783+
"family": "SNOW3G",
784+
"standard": [
785+
{"name": "3GPP TS 35.216", "url": "https://www.3gpp.org/ftp/Specs/archive/35_series/35.216/35216-i00.zip"}
786+
],
787+
"variant": [
788+
{
789+
"pattern": "128-EEA1",
790+
"primitive": "stream-cipher"
791+
},
792+
{
793+
"pattern": "128-EIA1",
794+
"primitive": "mac"
795+
}
796+
]
797+
},
798+
{
799+
"family": "3GPP-XOR",
800+
"standard": [
801+
{"name": "Legacy XOR-based AV generation algorithm (3GPP TS 35.201)", "url": "https://www.3gpp.org/ftp/Specs/archive/35_series/35.201/35201-i00.zip"}
802+
],
803+
"variant": [
804+
{
805+
"pattern": "3GPP-XOR[-MAC]",
806+
"primitive": "mac"
807+
},
808+
{
809+
"pattern": "3GPP-XOR[-KDF]",
810+
"primitive": "kdf"
811+
}
812+
]
729813
}
730814
],
731815
"ellipticCurves": [

0 commit comments

Comments
 (0)