Description of properties

[zvr]

There should be a (more or less) formal description of the different properties used in the YAML files.

[toscalix]

Is it something like this what you are referring to?

Id

• Description: univocal identifier for every cryptographic algorithm. This list provides an identifier per algorithm.
• Values: alphanumeric, where the usage of lower or upper case characters depend on each algorithm

Name

• Description: widely accepted name provided by the author of the algorithm or a standardization body
• Values: string

keySize

• Description: key size is a measure of the difficulty of subverting the cryptographic protection (with classical computers) that is provided by the algorithm and key
• Values: bbbb, where bbbb is an integer, provided in bits. One or more values are possible

cryptoClass

• Description: cryptographic algorithms are categorised in classes. The classes are defined by the number of cryptographic keys that are used in conjunction with the algorithm.
  • Cryptographic hash functions do not require keys for their basic operation.
  • Symmetric-key algorithms transform data in a way that is fundamentally difficult to undo without knowledge of a secret key. The key is “symmetric” because the same key is used for a cryptographic operation and its inverse
  • Asymmetric-key algorithms, commonly known as public-key algorithms, use two related keys (i.e., a key pair) to perform their functions: a public key and a private key. The public key may be known by anyone; the private key should be under the sole control of the entity that “owns” the key pair. Even though the public and private keys of a key pair are related, knowledge of the public key cannot be used to determine the private key.
• Values: "Cryptographic-Hash-Function" , "Symetric-Key-Algorithm" or "Asymmetric-Key-Algorithm"

[toscalix]

SPDX Cryptographic Algorithms List properties description

Id

• Description: univocal identifier for every cryptographic algorithm. This list provides an identifier per algorithm.
• Values: alphanumeric, where the usage of lower or upper case characters depend on each algorithm

Name

• Description: widely accepted name provided by the author of the algorithm or a standardization body
• Values: string

commonkeySize

• Description: the detected key size
• Values: bbbb, where bbbb is an integer, provided in bits. One or more values are possible

specifiedkeySize

• Description: the default key size or range determined by the authors, standardization or compliance bodies/agencies
• Values: any of these options are valid
  • bbbb, where bbbb is an integer, provided in bits. If more than one value is possible, the operator AND will be used
  • bbbb TO cccc, where bbbb and cccc are integers, provided in bits, to express a range

cryptoClass

• Description: cryptographic algorithms are categorised in classes. The classes are defined by the number of cryptographic keys that are used in conjunction with the algorithm.
  • Cryptographic hash functions do not require keys for their basic operation.
  • Symmetric-key algorithms transform data in a way that is fundamentally difficult to undo without knowledge of a secret key. The key is “symmetric” because the same key is used for a cryptographic operation and its inverse
  • Asymmetric-key algorithms, commonly known as public-key algorithms, use two related keys (i.e., a key pair) to perform their functions: a public key and a private key. The public key may be known by anyone; the private key should be under the sole control of the entity that “owns” the key pair. Even though the public and private keys of a key pair are related, knowledge of the public key cannot be used to determine the private key.
• Values: "Cryptographic-Hash-Function" , "Symetric-Key-Algorithm" or "Asymmetric-Key-Algorithm"

Note: the subclasses has been added to the cryptoClass property, separated by a "/" character from the class. This specific way to structure the subclasses is WIP.

[toscalix]

CycloneDX overview of the cryptographic asset types and their specific categories

These tables provide a structured overview of the cryptographic asset types and their specific categories as defined in the CycloneDX CBOM specification.

Structure and Cryptographic Asset Types

Asset Type	Description
algorithm	Mathematical function commonly used for data encryption, authentication, and digital signatures.
certificate	An electronic document that is used to provide the identity or validate a public key.
protocol	A set of rules and guidelines that govern the behavior and communication with each other.
related-crypto-material	Other cryptographic assets related to algorithms, certificates, and protocols such as keys and tokens.	(cyclonedx.org, GitHub)

---

related-crypto-material properties

Material Type	Description
private-key	A private asymmetric key used for decryption or signing.
public-key	A public asymmetric key used for encryption or signature verification.
secret-key	A symmetric key used for both encryption and decryption.
key	General term for any cryptographic key, either symmetric or asymmetric.
ciphertext	Encrypted data output from applying an encryption algorithm.
signature	Digital signature proving authenticity and integrity.
digest	Fixed-length hash output from applying a hash function.
initialization-vector	A unique value used to initialize block cipher modes.
nonce	A one-time-use value to prevent replay attacks.
seed	A value used to initialize pseudo-random number generators.
salt	Random value added to data before hashing, often for passwords.
shared-secret	Confidential data shared between parties in secure communication.
tag	Authentication tag used to verify the integrity of encrypted data.
additional-data	Arbitrary metadata related to cryptographic processes.
password	A human-memorable secret used for authentication.
credential	Data that proves identity, often a combination of username and password or key material.
token	A digitally encoded identity or permission artifact (e.g., OAuth token).
other	Any other material relevant to cryptographic processing not covered by above types.
unknown	Used when the type of material is unclear or not disclosed.

---

Types of Cryptographic Assets

Type	Description
private-key	The confidential key of a key pair used in asymmetric cryptography.
public-key	The non-confidential key of a key pair used in asymmetric cryptography.
secret-key	A key used to encrypt and decrypt messages in symmetric cryptography.
key	A piece of information, usually an octet string, which, when processed through a cryptographic algorithm, processes cryptographic data.
ciphertext	The result of encryption performed on plaintext using an algorithm (or cipher).
signature	A cryptographic value that is calculated from the data and a key known only by the signer.
digest	The output of the hash function.
initialization-vector	A fixed-size random or pseudo-random value used as an input parameter for cryptographic algorithms.
nonce	A random or pseudo-random number that can only be used once in a cryptographic communication.
seed	The input to a pseudo-random number generator. Different seeds generate different pseudo-random sequences.
salt	A value used in a cryptographic process, usually to ensure that the results of computations for one instance cannot be reused by an attacker.
shared-secret	A piece of data known only to the parties involved, in a secure communication.
tag	A message authentication code (MAC), sometimes known as an authentication tag, is a short piece of information used for authenticating and integrity-checking a message.
additional-data	An unspecified collection of data with relevance to cryptographic activity.
password	A secret word, phrase, or sequence of characters used during authentication or authorization.
credential	Establishes the identity of a party to communication, usually in the form of cryptographic keys or passwords.
token	An object encapsulating a security identity.
other	Another type of cryptographic asset.
unknown	The type of cryptographic asset is not known.	(cyclonedx.org)

---

[toscalix]

OID as property. It was discuss it at a meeting to add it.

[toscalix]

This PR would close this ticket #15