TLS appears as duplicate entries: correctly as protocol (TRANSITIONAL) and incorrectly as algorithm (UNSAFE)

[marcoeg]

Problem

TLS-1.3 and TLS-1.2 appear twice in CBOM output:

1. Correctly as protocol:tls-1-3 with status TRANSITIONAL (from service scanner)
2. Incorrectly as algo:tls-1-3 with status UNSAFE (from library import detection)

The second entry is wrong - TLS is a protocol, not an algorithm, and should not be created from library import detection.

Observed Behavior

The CBOM contains duplicate TLS entries:

// Entry 1: CORRECT (from service scanner)
{
"name": "TLS-1.3",
"bom-ref": "protocol:tls-1-3",
"cryptoProperties": { "assetType": "protocol" },
"properties": [
{ "name": "cbom:pqc:status", "value": "TRANSITIONAL" }
]
}

// Entry 2: INCORRECT (from library detection)
{
"name": "TLS-1.3",
"bom-ref": "algo:tls-1-3",
"cryptoProperties": { "assetType": "algorithm" },
"properties": [
{ "name": "cbom:pqc:status", "value": "UNSAFE" },
{ "name": "cbom:pqc:migration_urgency", "value": "CRITICAL" }
]
}

Expected Behavior

TLS should only appear once as a protocol. The spurious algorithm entry should not be created.

Impact

• PQC Reports: TLS incorrectly listed in UNSAFE/CRITICAL section due to the algorithm entry
• Duplicate entries: Same TLS version counted twice with conflicting classifications
• Assessment accuracy: Overall PQC readiness score artificially lowered
• User confusion: Contradictory information about the same protocol

Steps to Reproduce

1. Scan a directory containing Go or Rust binaries that use TLS:
   ./cbom-generator --discover-services --format cyclonedx --cyclonedx-spec 1.7 -o output.json /usr/bin
2. Check for both TLS entries:
   cat output.json | jq '.components[] | select(.name | test("TLS-1")) | {name, "bom-ref", status: .properties[] | select(.name ==
   "cbom:pqc:status") | .value}'
3. Observe TLS appearing twice with different bom-refs and conflicting PQC status

Environment

• cbom-generator version: 1.9.x
• OS: Linux (Ubuntu 22.04)
• Affected binaries: Any Go binary using crypto/tls, any Rust binary using rustls

Additional Context

The spurious algorithm entry is created because normalization maps in pqc_classifier.c map library imports (crypto/tls, rustls::)
to "TLS-1.2" and "TLS-1.3" as algorithm names. These mappings should be removed since protocol detection is already handled
correctly by the service scanner.