Skip to content

Cryptography: add unwrap, gmac, cmac#845

Open
bhess wants to merge 1 commit intoCycloneDX:2.0-devfrom
bhess:bhe-20dev-tweaks
Open

Cryptography: add unwrap, gmac, cmac#845
bhess wants to merge 1 commit intoCycloneDX:2.0-devfrom
bhess:bhe-20dev-tweaks

Conversation

@bhess
Copy link
Contributor

@bhess bhess commented Feb 24, 2026

Adds GMAC/CMAC to modes
Fixes #780

Adds unwrap to cryptoFunctions
Fixes #794

Signed-off-by: Basil Hess <bhe@zurich.ibm.com>
@bhess bhess requested a review from a team as a code owner February 24, 2026 16:19
@jkowalleck jkowalleck added this to the 2.0 milestone Feb 25, 2026
"cts": "Ciphertext Stealing mode.",
"xts": "XEX Tweaked-codebook with Stealing (disk encryption).",
"gmac": "Galois message authentication code",
"cmac": "Cipher-based message authentication code",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tiny change but maybe capitalize it to be consistent with the other descriptions?

"cts": "Ciphertext Stealing mode.",
"xts": "XEX Tweaked-codebook with Stealing (disk encryption).",
"gmac": "Galois message authentication code",
"cmac": "Cipher-based message authentication code",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just want to make sure I’m interpreting the modeling correctly.
algorithmProperties.mode is described as a block-cipher mode of operation, whereas gmac and cmac are typically treated as MAC constructions.

Are we intentionally allowing them here as AES variant suffixes (i.e., registry-aligned usage)? If so, would it make sense to slightly broaden the mode description to reflect that?

Alternatively, should these be modeled under primitive: mac (with cryptoFunctions: tag) and keep mode strictly for block-cipher modes?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the meta:enum descriptions for gmac and cmac don’t currently end with a period, while most other entries do. Would you like to align those for consistency?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just want to make sure I’m interpreting the modeling correctly. algorithmProperties.mode is described as a block-cipher mode of operation, whereas gmac and cmac are typically treated as MAC constructions.

Are we intentionally allowing them here as AES variant suffixes (i.e., registry-aligned usage)? If so, would it make sense to slightly broaden the mode description to reflect that?

Alternatively, should these be modeled under primitive: mac (with cryptoFunctions: tag) and keep mode strictly for block-cipher modes?

I initially hesitated to categorize CMAC and GMAC as 'modes of operation' in the traditional sense. However, NIST SP 800-38D gave me an argument since it states: GCM and GMAC are modes of operation for an underlying approved symmetric key block cipher.

The mode property has become slightly redundant with the naming patterns in 1.7, so I would recommend to give the patterns the priority when creating CBOMs to express the algorithm details.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That makes sense — thanks.

@stevespringett stevespringett added the cap: cryptography Capability: Cryptography (CBOM) label Feb 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cap: cryptography Capability: Cryptography (CBOM)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants