Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CBOM: adds 'parameterSetIdentifier' property, replacing 'variant' #339

Merged
merged 1 commit into from
Nov 16, 2023

Conversation

bhess
Copy link
Contributor

@bhess bhess commented Nov 16, 2023

The new property 'parameterSetIdentifier' replaces 'variant' and contains information about the parameter set identifying an algorithm. This can be, for example, the key length (in AES), the digest length (in SHA2), or the hash algorithm used internally (in SLH-DSA / FIPS205). The "description" field contains some examples.

This PR is motivated by IBM/CBOM#37 and intends to address its use case.

Tagging @stevespringett, @n1ckl0sk0rtge, @mrutkows, @GeroDittmann

Signed-off-by: Basil Hess <bhe@zurich.ibm.com>
@bhess bhess requested a review from a team as a code owner November 16, 2023 10:11
@stevespringett stevespringett merged commit 779121c into CycloneDX:1.6-dev-cbom Nov 16, 2023
5 checks passed
@GeroDittmann
Copy link

Thanks for the tag, @bhess . Could you elaborate a little how this would be used?

In cases where a user or policy might care for a key length, would they typically find it in the title field? Without parsing a string?

Does the title field identify a parameter set, as parameterSetIdentifier suggests? Are these identifiers formally defined somewhere?

If I understand the examples in the description correctly, the interpretation of the title field depends on the algorithm it belongs to?

@bhess
Copy link
Contributor Author

bhess commented Dec 7, 2023

Hi @GeroDittmann,

In cases where a user or policy might care for a key length, would they typically find it in the title field? Without parsing a string?

The 'title' field is just for the schema definition, for informational purposes. The user would just set the field 'parameterSetIdentifier'. In the AES case this will be the key length, see the "description" part for some examples.

If I understand the examples in the description correctly, the interpretation of the title field depends on the algorithm it belongs to?

The 'parameterSetIdentifier' field depends on the algorithm it belongs to.

We don't formally define them (e.g. in terms of an exhaustive enum). There would need to be an authoritative source for such a list, which I think is outside the scope of the CBOM.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants