Skip to content

Conversation

@Mehrn0ush
Copy link
Contributor

As discussed in ticket #765, this PR adds HPKE (RFC 9180) to the Cryptography Registry.

Fixes #765

Details

  • Adds the HPKE algorithm family with pattern HPKE[-{mode}]-{kem}-{kdf}-{aead} (primitive: pke).
  • Adds RFC 9180 as the authoritative reference.
  • Updates the registry schema enum to allow HPKE.

Scope

  • Registry-only (schema/cryptography-defs.json) plus corresponding registry schema update (schema/cryptography-defs.schema.json).
  • No CycloneDX specification behavior changes.

@Mehrn0ush Mehrn0ush requested a review from a team as a code owner January 6, 2026 14:38
@stevespringett stevespringett added cap: cryptography Capability: Cryptography (CBOM) cap: cryptography-registry Capability: Cryptography Registry labels Jan 8, 2026
@stevespringett
Copy link
Member

@bhess

Copy link
Contributor

@bhess bhess left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this addition of HPKE. Please see the one comment inline. Other than that, LGTM!

],
"variant": [
{
"pattern": "HPKE[-{mode}]-{kem}-{kdf}-{aead}",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since the modes are well-defined by the RFC, I'd suggest the following pattern:
HPKE[-(mode_base|mode_psk|mode_auth|mode_auth_psk)]-{kem}-{kdf}-{aead}

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds HPKE (Hybrid Public Key Encryption from RFC 9180) to the Cryptography Registry. The addition follows the existing pattern for algorithm families and adds HPKE between ECIES and MQV in alphabetical order.

Changes:

  • Adds HPKE algorithm family entry with RFC 9180 as the authoritative reference
  • Defines the pattern HPKE[-{mode}]-{kem}-{kdf}-{aead} with primitive type pke
  • Maintains alphabetical ordering of algorithm families

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

"primitive": "pke"
}
]
},
Copy link

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is trailing whitespace after the closing brace and comma. This should be removed to maintain consistent formatting.

Suggested change
},
},

Copilot uses AI. Check for mistakes.
"family": "HPKE",
"standard": [
{
"name": "RFC 9180",
Copy link

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The RFC name should be "RFC9180" without a space to maintain consistency with the predominant naming pattern used in this file. Most RFC entries use the format "RFCnnnn" without a space, such as "RFC8017", "RFC8032", "RFC7919", "RFC5869", etc.

Suggested change
"name": "RFC 9180",
"name": "RFC9180",

Copilot uses AI. Check for mistakes.
Copy link
Member

@stevespringett stevespringett left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Update the pattern to match what @bhess had suggested

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cap: cryptography Capability: Cryptography (CBOM) cap: cryptography-registry Capability: Cryptography Registry

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[FEATURE]: Add HPKE (RFC 9180) to Cryptography Registry

3 participants