Skip to content

Comments

Add ShangMi (SM2/SM3/SM4/SM9) algorithm families#812

Merged
stevespringett merged 5 commits intoCycloneDX:masterfrom
Mehrn0ush:feat/crypto-registry-shangmi-sm2-sm3-sm4-sm9
Feb 19, 2026
Merged

Add ShangMi (SM2/SM3/SM4/SM9) algorithm families#812
stevespringett merged 5 commits intoCycloneDX:masterfrom
Mehrn0ush:feat/crypto-registry-shangmi-sm2-sm3-sm4-sm9

Conversation

@Mehrn0ush
Copy link
Contributor

Fixes #811

Adds SM2/SM3/SM4/SM9 algorithm families to the CycloneDX cryptography registry and updates algorithmFamiliesEnum accordingly.

Note: some official ShangMi specification mirrors appear region-blocked or unreliable from multiple locations.
To avoid fragile links in the registry, this PR relies on globally accessible references (RFC Editor + ISO)

Signed-off-by: Mehrn0ush <mehrnoush.vaseghi@gmail.com>
@Mehrn0ush Mehrn0ush requested a review from a team as a code owner February 5, 2026 11:08
@Mehrn0ush
Copy link
Contributor Author

Hi @bhess — if you have time, would you mind taking a look at this one as well?

This adds ShangMi (SM2/SM3/SM4/SM9) families and updates the schema enum.
I used RFC/ISO references where the official mirrors weren’t reliably accessible.

Thanks a lot — always appreciate your feedback.

@stevespringett
Copy link
Member

cc: @bhess

@stevespringett stevespringett added cap: cryptography Capability: Cryptography (CBOM) cap: cryptography-registry Capability: Cryptography Registry labels Feb 5, 2026
Copy link
Contributor

@bhess bhess left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @Mehrn0ush for the additions! See the comments inline.

Signed-off-by: Mehrn0ush <mehrnoush.vaseghi@gmail.com>
@Mehrn0ush
Copy link
Contributor Author

One question on SM2 naming conventions for the registry: I currently model SM2 as SM2-256 (and ...-256 for ENC/KEX) to be explicit about the common curve size. Would you prefer making the suffix optional (SM2[-256]) to align with the registry’s broader matching style, or keeping it strict as SM2-256? I can adjust either way — just want to follow the convention you think is best for downstream matching.
And,
Related detail: for SM4 placeholders I followed the existing conventions in cryptography-defs.json, where block cipher modes use {ivlen}, while ae modes use {ivLength} together with {tagLength} (consistent with how AES-GCM/CCM are expressed in the registry). If you’d rather normalize these placeholders to a single naming form across the file, I’m happy to align SM4 accordingly.

Thanks again @bhess

Signed-off-by: Mehrn0ush <mehrnoush.vaseghi@gmail.com>
@Mehrn0ush
Copy link
Contributor Author

Made SM2’s -256 suffix optional to accept both SM2 and SM2-256, following the registry’s [] convention. Updated patterns accordingly.

Copy link
Contributor

@bhess bhess left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the updates, LGTM!

@stevespringett stevespringett merged commit 62d453c into CycloneDX:master Feb 19, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cap: cryptography Capability: Cryptography (CBOM) cap: cryptography-registry Capability: Cryptography Registry

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[FEATURE]: Add ShangMi (SM2/SM3/SM4/SM9) algorithm families to cryptography definitions

3 participants