New property: OID #20
Description
Background
An OID uniquely identifies a cryptographic algorithm by serving as a standardized, globally unique numeric reference that distinguishes one algorithm from all others across systems and organizations. By using OIDs, cryptographic systems achieve consistency, security, and universality in identifying algorithms, a necessity for secure communications and interoperable standards in PKI and related systems.
- An OID is a sequence of integers separated by dots, such as 1.2.840.113549.1.11.2.840.113549.1.1, forming a managed hierarchy assigned by authorities like ISO, ITU, or IANA.
- In cryptographic standards, OIDs are used to unambiguously identify algorithms (like RSA, SHA, AES) or object classes, ensuring that software and systems recognize and process the same algorithm regardless of vendor or platform.
- OIDs are encoded in data structures (such as ASN.1) within certificates, signed messages, and protocol exchanges, enabling consistent identification and parameterization of cryptographic operations.
OIDs are assigned through a managed, hierarchical tree structure governed by international standards bodies (like ISO and ITU), which delegate ranges to organizations, ensuring that every OID is globally unique and cannot clash with identifiers from another source.
The OID for RSA encryption is 1.2.840.113549.1.1.11.2.840.113549.1.1.1, and for AES encryption it’s 2.16.840.1.101.3.4.12.16.840.1.101.3.4.1. These numbers are unique identifiers that directly reference their corresponding algorithms in global databases and protocol specifications, preventing any possibility of misinterpretation or collision between algorithms.
References
- NIST Cryptographic Algorithm Object Registration list
- CSOR at NIST algorithms registration
- Web pages with descriptions/explanations
Rationale
SPDX Crytographic Algorithms List should include a property where the OID number could be included when it does exist. Given that many does not have it, it cannot be considered the identifier
Description
The goal is to include OID as optional property for any crypto algorithms of the list
Actions
- Discussion and agreement on including OID as property
- Define the property name and description
- Define where it should be placed on the list and how
- Create a ticket with the list of algorithms that has an OID assigned, together with the OID
- Include the references where such OID could be consulted
- Add all the OID from that list to the SPDX Crypto Algorithms List
- Add the property description to the Properties Description document
DoD
- OID included in the Properties Description document
- Link to the corresponding PR oid as new SPDX Cryptographic Algorithms List property #35
- Link to the corresponding version of the Properties Description document, after the PR is merged
- All the algorithms present in the corresponding ticket list have been included in the SPDX List.
- Link to the corresponding PR oid as new SPDX Cryptographic Algorithms List property #35
- Link to the corresponding version of the list, once the PR is merged.