Proposal of a new property: reference

Background

Every algorithms on the list has a reference, an origin. Usually it is a paper or an article where the cryptographic algorithm is described, including the rationale behind it, the target use case, the mathematical description and some other aspects.
The proposal is to include this origin, in the form of a link to every crypto algorithm

origin

• Description: link pointing at the description of the corresponding algorithm
• Values: URL

examples

For AES (Advanced Encryption Standard)

• origin: https://doi.org/10.6028/NIST.FIPS.197-upd1

The origin is a newer version of https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf
Reference: FIPS PUB 197 – Specification for the Advanced Encryption Standard (AES)

For Ed25519

• origin: https://ed25519.cr.yp.to/ed25519-20110926.pdf

Reference: Daniel J. Bernstein et al. – High-speed high-security signatures

Rationale

Each algorithms definition should include in the SPDX C.A. List links pointing to the publication that originally describes the algorithm or to the URL that points to where the algorithm is described technically.

In the detection use case, as well as in the auditing use case, such link is relevant to understand in detail the characteristices of the algorithm, what is used for, how it should be implemented and used, etc...

Description

This new property requires:

• A property name
• A property description
• A values description
• Some origins as example

Points for discussion

• Some of the algorithms has gone through revisions and even standardization processes. origin might refer to the current version of the algorithm.
• If the algorithm is deprecated by another algorithm but still present in the list, origin refers again to the latest version or revision before it was deprecated
• In an original exploration, it might be difficult or controversial to find the origin. What do we do in such cases?
• Is origin the right term, given that there might be revisions and standardizations processes for some cases?
• In some cases, the origin is a well known portal for papers and the origin comes in different formats, like LaTeX, pdf.... Which link should we take?

Actions

• Agreement on a name for the property
• Draft of the property description
  • Agreement on the values prioritization
• Agreement on the description of the property
• Provide the entry for the example algorithm
• List of at least 30 references to include on the list: draft
• Create and confirm
  • A first batch of references
  • A second batch of references
  • A third batch of references
• Created a PR for each batch of references. The first batch includes:
  • Name, description and values (property description)
  • Addition of at at list of at least 10 references to the list
  • Addition of the example algorithm
• PR for the second batch
• PR for the third batch

DoD

• Property name: reference
• Link to the property description draft
• Link to the list of references
• Link to the example algorithm entry
• Agreement on the property name, description and values
• Link to PR
  • Batch 1: #48
  • Batch 2: #64
  • Batch 3:
• PR merged

Start with the property description draft linked in issue #9 and review the reference batches represented by PRs #48 and #64. Check the remaining third batch, the example algorithm entry, the reference list, and the DoD; done means the required PRs are created and the feature is merged.