CycloneDX / CycloneDX/specification

[Defect]: Missing GOST 2012/2015 algorithms and curve OIDs

Open
#1,025 0 comments 0 reactions 0 assignees View on GitHub
cap: cryptography-registry defect
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

## Describe the defect

The GOST family in cryptography-defs.json only covers the RFC 4357 legacy suite (2001/94-era). Missing: GOST R 34.10-2012 signature, GOST R 34.11-2012 (Streebog) hash/HMAC, and GOST R 34.12-2015 block ciphers (Magma, Kuznyechik). Two TC26 curve entries also cite the wrong RFC, and several curves are missing their OIDs.

## Proposed changes:

Add variants: GOSTR3410-2012-(256|512) (RFC7091), GOSTR3411-2012-(256|512) (RFC6986), HMAC-GOSTR3411-2012-(256|512) (RFC7836), Magma[...] (RFC8891), Kuznyechik[...] (RFC7801)
Fix id-tc26-gost-3410-2012-256-paramSetA / -512-paramSetC: description RFC5832 → RFC7836
Add OIDs for CryptoPro-A/B/C and TC26 param sets (RFC4357 / RFC7836)

Contributor guide

Open the contributing guide

Research direction

Open cryptography-defs.json and review the existing RFC 4357 GOST entries alongside the proposed RFC 7091, RFC 6986, RFC 7836, RFC 8891, and RFC 7801 variants. Done means the listed signature, hash/HMAC, cipher, corrected curve descriptions, and CryptoPro/TC26 curve OIDs are represented accurately in the file.

Written by the indexing model from the issue text.

Assessment

Domain
cryptography
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
66/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.