CycloneDX / CycloneDX/specification

[FEATURE]: Add Argon2 to Cryptography Registry

Open
#756 3 comments 0 reactions 0 assignees View on GitHub
cap: cryptography proposed core enhancement
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

## Problem Statement
Argon2 (RFC 9106 standard, winner of 2015 Password Hashing Competition)
is not currently in the CycloneDX Cryptography Registry despite widespread
adoption and OWASP recommendation.

## Proposed Pattern
Argon2(id|i|d)[-{memoryMiB}][-{iterations}][-{parallelism}]

Valid examples:
- Argon2id (variant only)
- Argon2id-15-1-4 (RFC 9106 interactive defaults)
- Argon2id-64-2-1 (medium security)
- Argon2id-256-4-2 (high security)

## Illustration of Compatibility (json)

{
"type": "cryptographic-asset",
"name": "Argon2id-64-2-1",
"cryptoProperties": {
"assetType": "algorithm",
"algorithmProperties": {
"primitive": "password-hashing",
"algorithmFamily": "Argon2",
"parameterSetIdentifier": "id-64-2-1"
}
}
}

## Justification
1. Parametric algorithms are already in registry
2. Parameter variation critically impacts security
3. Enables policy enforcement and CBOM risk assessment
4. RFC 9106 is authoritative standard

## Standards Reference
RFC 9106: Argon2 Memory-Hard Function for Password Hashing

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.