Cryptography Registry

Algorithm patterns in CycloneDX provide a standardized method for naming and identifying cryptographic algorithm implementations along with their specific parameters.

Pattern Format

The general format for algorithm patterns is:

AlgorithmFamily: Pattern[-{optionalParameter}]

Pattern Elements

• AlgorithmFamily: The base algorithm family identifier
• Pattern: Shows how the algorithm should be referenced
• []: Denotes optional parameters
• (): Denotes choices between alternatives
• |: Indicates alternative choices (OR operator)
• {}: Indicates placeholders for variable values

Pattern Examples

Using Patterns in CycloneDX

When creating a cryptographic asset component in a CycloneDX BOM, use the pattern to construct the component name that matches your specific implementation:

{
  "type": "cryptographic-asset",
  "name": "RSA-PKCS1-1.5-SHA-256-2048",
  "cryptoProperties": {
    "assetType": "algorithm",
    "algorithmProperties": {
      "primitive": "signature",
      "algorithmFamily": "RSASSA-PKCS1",
      "parameterSetIdentifier": "2048"
    }
  }
}

Organizations and individuals may contribute new cryptographic algorithm families or elliptic curves to the registry by submitting a request to the CycloneDX project. To register a new entry, open an issue or pull request in the CycloneDX specification repository with the following information:

For Algorithm Families:

• Algorithm family name
• Standardization references (RFC, NIST, ISO, etc.) with URLs
• Variant patterns showing naming conventions
• Cryptographic primitive type (e.g., signature, block-cipher, hash)
• Usage examples demonstrating the pattern

For Elliptic Curves:

• Curve name and standardization body
• Object Identifier (OID)
• Curve form (Weierstrass, TwistedEdwards, Montgomery, etc.)
• Known aliases and their categories
• Reference to authoritative specification

All submissions undergo community review to ensure accuracy, consistency with existing entries, and adherence to established naming conventions. Once approved, new entries are added to the registry and become immediately available to all tools and organizations utilizing the Cryptography Registry.