Update algorithm names to match CycloneDX schema #362
Conversation
Updates algorithm naming conventions in mapper model to align with the CycloneDX cryptography-defs.json specification: - SHA1 → SHA-1, SHA256 → SHA-256, SHA384 → SHA-384, SHA512 → SHA-512 - SHA3-* → SHA-3-* (e.g., SHA3-256 → SHA-3-256) - ChaCha20Poly1305 → ChaCha20-Poly1305 - RSASSA-PSS → RSA-PSS - DH → FFDH (Finite Field Diffie-Hellman) - KDF in Counter Mode → SP800-108-CounterKDF - KDF in Feedback Mode → SP800-108-FeedbackKDF - SPHINCS+ → SLH-DSA Also adds CycloneDX schema JavaDoc references to algorithm classes and updates test assertions across all language modules (Java, Python, Go). Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
bhess
left a comment
bhess
left a comment
There was a problem hiding this comment.
Excellent!
Did you run an automatic check to verify that the patterns match?
I noticed a few that don’t, see the inline comments.
| PasswordBasedEncryption pbe = pbeOpt.get(); | ||
| assertThat(pbe.getName()).isEqualTo("PBES1"); | ||
| assertThat(pbe.asString()).isEqualTo("pbeWithHmacSHA256AndAES"); | ||
| assertThat(pbe.asString()).isEqualTo("pbeWithHmacSHA-256AndAES"); |
There was a problem hiding this comment.
See the pattern here: https://github.com/CycloneDX/specification/blob/8c16b5c89503657e14d618bd6851c416707a244b/schema/cryptography-defs.json#L1404
Should be
PBES1-AES-HMAC-SHA-256
|
|
||
| // Initialize RSADigestSigner | ||
| RSADigestSigner signer = new RSADigestSigner(digest, new ASN1ObjectIdentifier("1234")); | ||
| // Noncompliant@-1 {{(Signature) SHA256withRSA}} |
There was a problem hiding this comment.
This maps to RSA RSA-PKCS1-1.5-SHA-256, see
https://github.com/CycloneDX/specification/blob/8c16b5c89503657e14d618bd6851c416707a244b/schema/cryptography-defs.json#L19C23-L19C56
Similarly, all other patterns in the PR using "XYZwithRSA" or "XYZwithDSA" should be adapted.
|
This mapping isn't strictly true: |
Summary
Naming changes:
Test plan
mvn spotless:apply🤖 Generated with Claude Code