Missing CycloneDX cryptographic primitives: pke, xof, drbg, combiner

[marcoeg]

The cbom-generator is missing 4 of the 15 cryptographic primitive types defined in CycloneDX 1.6/1.7. Adding these will ensure full c
ompliance with the CycloneDX cryptography specification.

Missing Primitives

Primitive	Description	Example Algorithms
pke	Public Key Encryption	RSA-OAEP, ECIES, ElGamal
xof	Extendable Output Function	SHAKE128, SHAKE256, BLAKE2X
drbg	Deterministic Random Bit Generator	HMAC-DRBG, CTR-DRBG
combiner	Cryptographic Combiner	XOR, KDF-based combiners

Current Behavior

Algorithms like SHAKE256 are incorrectly classified as hash when they should be xof:

  {
    "name": "SHAKE256",
    "cryptoProperties": {
      "algorithmProperties": {
        "primitive": "hash"  // Wrong - should be "xof"
      }
    }
  }

Expected Behavior

 {
   "name": "SHAKE256",
   "cryptoProperties": {
     "algorithmProperties": {
       "primitive": "xof"  // Correct
     }
   }
 }

Implementation Plan

1. Add 4 new values to crypto_primitive_t enum in algorithm_metadata.h
2. Update primitive_type_to_string() in algorithm_metadata.c
3. Add OID mappings for XOF algorithms (SHAKE128/256)
4. Update primitive derivation logic in main.c
5. Update PQC classifier to handle new primitives
6. Add unit tests

Files to Modify

• include/algorithm_metadata.h - Add enum values
• src/algorithm_metadata.c - Add mappings and conversion
• src/main.c - Update derivation logic
• src/pqc_classifier.c - Handle new primitives
• tests/test_algorithm_metadata.c - Add tests

Acceptance Criteria

• All 4 new primitives added to enum
• SHAKE128/SHAKE256 classified as xof
• HMAC-DRBG/CTR-DRBG classified as drbg
• RSA-OAEP classified as pke
• PQC classifier handles new primitives
• Unit tests pass
• CycloneDX 1.7 schema validation passes

References

• https://cyclonedx-python-library.readthedocs.io/en/v10.0.0/autoapi/cyclonedx/model/crypto/
• https://csrc.nist.gov/publications/detail/fips/202/final
• https://csrc.nist.gov/publications/detail/sp/800-90a/rev-1/final