Add external catalog traceability to cryptographic algorithm approval - #53
Merged
3keyroman merged 1 commit intoSep 25, 2026
Merged
Conversation
3keyroman
force-pushed
the
crypto-external-catalog-references
branch
from
August 26, 2026 06:56
1a54bdc to
8b71085
Compare
Add ETSI TS 119 312 and the ECCG Agreed Cryptographic Mechanisms to the shared references catalog and cite them, together with CNSA 2.0, from the algorithm approval requirement. Note in guidance that where a regulatory regime or trust scheme mandates a cryptographic catalog, approved algorithms and parameters should be traceable to it, and add the matching assessment cue. Cite ETSI TS 119 312 from the cryptographic lifecycle requirement, whose deprecation rules follow the same catalog. Mark the SOG-IS agreed cryptographic mechanisms as deprecated and superseded by the ECCG ACM, which is maintained under the EUCC scheme. Rename eucc-crypto-inventory to eucc-crypto-guidelines and correct its title. The document covers cryptographic mechanism approval rather than inventory, so cite it from the algorithm approval requirement instead of cryptographic visibility. Ignore local coverage output.
3keyroman
force-pushed
the
crypto-external-catalog-references
branch
from
September 25, 2026 05:58
8b71085 to
a97bdb5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Approved cryptographic algorithms are not always freely chosen. Where an organization operates under a regulatory regime or trust scheme, the approval set is bounded by an external cryptographic catalog. The
crypto-algorithmsrequirement did not reflect that, and the catalog entries describing those external catalogs were not cited from the Cryptography category.Changes
crypto-algorithmsstating that where a regulatory regime or trust scheme mandates a cryptographic catalog, approved algorithms and parameters should be traceable to that catalog rather than determined independently, and that the applicable catalog should be identified. Add the matching assessment cue.etsi-119-312(ETSI TS 119 312 - Cryptographic Suites) andeccg-acm(ECCG Agreed Cryptographic Mechanisms) to the shared references catalog.etsi-119-312,eccg-acm,eucc-crypto-guidelinesandcnsa-2-0fromcrypto-algorithms, which previously cited onlynist-sp-800-131a.etsi-119-312fromcrypto-lifecycle, whose deprecation rules follow the same catalog.sogis-cryptoasdeprecatedwithsupersededBy: eccg-acm. SOG-IS ceased issuing certificates on 27 February 2026 and the ECCG ACM, maintained under the EUCC scheme, is its successor.eucc-crypto-inventorytoeucc-crypto-guidelinesand correct its title toEUCC Guidelines on Cryptography. The document covers cryptographic mechanism approval and contains no inventory guidance, so it is cited fromcrypto-algorithmsrather thancrypto-visibility.categories/cryptography/_index.mdandmodel/references/_index.mdfrom the model YAML.The guidance names no specific standard, keeping requirement text technology- and framework-neutral. The concrete catalogs are carried by the references, where the
regionsmetadata expresses jurisdictional scope.Reference URLs for ETSI TS 119 312 and the ECCG ACM point at the publisher landing page rather than a pinned revision, so they remain valid as new versions are published.
Resolves #49