Use correct digest character lengths. Fixes usnistgov#2053

david-waltermire · Nov 14, 2024 · 728af69 · 728af69
1 parent db9dfc4
commit 728af69
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/src/metaschema/oscal_metadata_metaschema.xml b/src/metaschema/oscal_metadata_metaschema.xml
@@ -940,10 +940,10 @@
             </remarks>
         </define-flag>
         <constraint>
-            <matches target=".[@algorithm=('SHA-224','SHA3-224')]" regex="^[0-9a-fA-F]{28}$"/>
-            <matches target=".[@algorithm=('SHA-256','SHA3-256')]" regex="^[0-9a-fA-F]{32}$"/>
-            <matches target=".[@algorithm=('SHA-384','SHA3-384')]" regex="^[0-9a-fA-F]{48}$"/>
-            <matches target=".[@algorithm=('SHA-512','SHA3-512')]" regex="^[0-9a-fA-F]{64}$"/>
+            <matches id="oscal-check-hash-length-SHA2-3-224" target=".[@algorithm=('SHA-224','SHA3-224')]" regex="^[0-9a-fA-F]{56}$"/>
+            <matches id="oscal-check-hash-length-SHA2-3-256" target=".[@algorithm=('SHA-256','SHA3-256')]" regex="^[0-9a-fA-F]{64}$"/>
+            <matches id="oscal-check-hash-length-SHA2-3-384" target=".[@algorithm=('SHA-384','SHA3-384')]" regex="^[0-9a-fA-F]{96}$"/>
+            <matches id="oscal-check-hash-length-SHA2-3-512" target=".[@algorithm=('SHA-512','SHA3-512')]" regex="^[0-9a-fA-F]{128}$"/>
         </constraint>
     </define-field>