@cdxgen/cdxgen 13.1.0 → 13.3.0

package/bin/sign.js

@@ -11,7 +11,11 @@ import {
   retrieveCdxgenVersion,
   safeExistsSync,
 } from "../lib/ecosystems/utils.js";
-import { signBom } from "../lib/helpers/bomSigner.js";
+import {
+  checkSignatureEntries,
+  displayValue,
+  signBom,
+} from "../lib/helpers/bomSigner.js";
 import {
   getNonCycloneDxErrorMessage,
   isCycloneDxBom,
@@ -31,12 +35,14 @@ const args = _yargs
   })
   .option("private-key", {
     alias: "k",
-    description: "Private key in PEM format.",
+    description:
+      "Private key in PEM format, or the shared secret file for HS256, HS384, and HS512.",
   })
   .option("algorithm", {
     alias: "a",
     default: readEnvironmentVariable("SBOM_SIGN_ALGORITHM") || "RS512",
-    description: "JSF Signature Algorithm (e.g., RS512, ES256, Ed25519).",
+    description:
+      "JSF Signature Algorithm (e.g., RS512, ES256, Ed25519). It must match the key type.",
   })
   .option("mode", {
     alias: "m",
@@ -45,27 +51,36 @@ const args = _yargs
     description:
       "Signature mode. Use 'signers' for multi-signing, 'chain' for sequential chaining.",
   })
+  .option("verify-existing-with", {
+    type: "array",
+    string: true,
+    description:
+      "Public key (PEM) of an earlier signer. With --mode chain, every existing chain entry must verify with one of these keys before a new entry is appended.",
+  })
+  .option("allow-unverified-history", {
+    type: "boolean",
+    default: false,
+    description:
+      "With --mode chain, append even when existing chain entries cannot be verified with --verify-existing-with.",
+  })
   .option("key-id", {
     description:
       "Optional identifier for the key (keyId) to embed in the signature block.",
   })
   .option("sign-components", {
     type: "boolean",
-    default: true,
     description:
-      "Sign granular components. Disable (--no-sign-components) when appending multi-signatures.",
+      "Sign granular components. Defaults to true, or false when appending a signers or chain signature to a signed BOM.",
   })
   .option("sign-services", {
     type: "boolean",
-    default: true,
     description:
-      "Sign granular services. Disable (--no-sign-services) when appending multi-signatures.",
+      "Sign granular services. Defaults to true, or false when appending a signers or chain signature to a signed BOM.",
   })
   .option("sign-annotations", {
     type: "boolean",
-    default: true,
     description:
-      "Sign granular annotations. Disable (--no-sign-annotations) when appending multi-signatures.",
+      "Sign granular annotations. Defaults to true, or false when appending a signers or chain signature to a signed BOM.",
   })
   .option("attach", {
     type: "string",
@@ -97,7 +112,7 @@ const envPrivateKeyBase64 = readEnvironmentVariable(
 
 if (args.privateKey) {
   if (safeExistsSync(args.privateKey)) {
-    privateKeyContent = fs.readFileSync(args.privateKey, "utf8");
+    privateKeyContent = fs.readFileSync(args.privateKey);
     hasPrivateKey = true;
   } else {
     console.error(`Private key file '${args.privateKey}' not found.`);
@@ -105,7 +120,7 @@ if (args.privateKey) {
   }
 } else if (envPrivateKeyFile) {
   if (safeExistsSync(envPrivateKeyFile)) {
-    privateKeyContent = fs.readFileSync(envPrivateKeyFile, "utf8");
+    privateKeyContent = fs.readFileSync(envPrivateKeyFile);
     hasPrivateKey = true;
   } else {
     console.error(
@@ -115,9 +130,7 @@ if (args.privateKey) {
   }
 } else if (envPrivateKeyBase64) {
   try {
-    privateKeyContent = Buffer.from(envPrivateKeyBase64, "base64").toString(
-      "utf8",
-    );
+    privateKeyContent = Buffer.from(envPrivateKeyBase64, "base64");
     hasPrivateKey = true;
   } catch {
     console.error(
@@ -147,6 +160,66 @@ function hasAnySignature(bomJson) {
   return false;
 }
 
+function describeEntry(result) {
+  const parts = [];
+  if (result.algorithm !== undefined) {
+    parts.push(displayValue(result.algorithm));
+  }
+  if (result.keyId !== undefined) {
+    parts.push(`keyId '${displayValue(result.keyId)}'`);
+  }
+  return parts.length
+    ? `entry ${result.index} (${parts.join(", ")})`
+    : `entry ${result.index}`;
+}
+
+// A new chain entry covers every earlier entry, so the signer vouches for
+// that history. Check it with the earlier signers' keys before appending.
+function checkChainHistory(bomJson) {
+  const existing = bomJson.signature;
+  if (
+    args.mode !== "chain" ||
+    existing === undefined ||
+    (existing !== null &&
+      typeof existing === "object" &&
+      Object.hasOwn(existing, "signers"))
+  ) {
+    return;
+  }
+  const keys = (args.verifyExistingWith || []).map((keyFile) => {
+    if (!safeExistsSync(keyFile)) {
+      throw new Error(`Public key file '${keyFile}' not found.`);
+    }
+    return fs.readFileSync(keyFile, "utf8");
+  });
+  const unverified = checkSignatureEntries(bomJson, keys).filter(
+    (result) => !result.verified,
+  );
+  if (!unverified.length) {
+    return;
+  }
+  const details = unverified.map(
+    (result) =>
+      `  - ${describeEntry(result)}: ${result.reasons[0] || "no --verify-existing-with key was given"}`,
+  );
+  if (args.allowUnverifiedHistory) {
+    console.warn(
+      [
+        `Warning: appending to a chain with ${unverified.length} unverified entry(s):`,
+        ...details,
+      ].join("\n"),
+    );
+    return;
+  }
+  throw new Error(
+    [
+      `the new chain entry would vouch for ${unverified.length} existing entry(s) that could not be verified:`,
+      ...details,
+      "Pass --verify-existing-with <public key> for each earlier signer, or --allow-unverified-history to sign anyway.",
+    ].join("\n"),
+  );
+}
+
 try {
   const bomJson = JSON.parse(fs.readFileSync(args.input, "utf8"));
   if (!isCycloneDxBom(bomJson)) {
@@ -156,6 +229,7 @@ try {
 
   let signedBom = bomJson;
   if (hasPrivateKey && privateKeyContent) {
+    checkChainHistory(bomJson);
     signedBom = signBom(bomJson, {
       privateKey: privateKeyContent,
       algorithm: args.algorithm,

package/bin/tracebom.js

@@ -79,7 +79,7 @@ const args = _yargs
   })
   .option("disable-network", {
     description:
-      "Disable network inside sandbox. Automatically disabled when --trace-http-urls is set.",
+      "Disable network inside sandbox. Automatically disabled when --trace-http-urls or --proxy-egress is set.",
     default: true,
     type: "boolean",
   })
@@ -170,6 +170,56 @@ const args = _yargs
     default: true,
     type: "boolean",
   })
+  .option("proxy-egress", {
+    description:
+      "Route all outbound traffic through safer-exec's hostname-pinning egress proxy. Only --allow-host (and --allow-url) hosts are reachable; allowed and denied targets are recorded as services. Enables the network.",
+    default: false,
+    type: "boolean",
+  })
+  .option("allow-loopback", {
+    description: "Allow the traced process to connect to loopback addresses.",
+    default: false,
+    type: "boolean",
+  })
+  .option("sandbox-dry-run", {
+    description:
+      "Deny every filesystem write and network connection and record the attempted operations as counts in the BOM metadata.",
+    default: false,
+    type: "boolean",
+  })
+  .option("policy", {
+    description:
+      "Apply a named safer-exec ecosystem policy (for example npm, pnpm, pypi, uv, maven, cargo, gomod, nuget) before the other sandbox options.",
+    type: "string",
+  })
+  .option("policy-file", {
+    description: "Apply a safer-exec JSON policy file.",
+    type: "string",
+  })
+  .option("block-interpreters", {
+    description:
+      "Block interpreters that carry sandbox or task-port exemptions (macOS only).",
+    default: false,
+    type: "boolean",
+  })
+  .option("deny-persistence-writes", {
+    description:
+      "Deny writes to auto-execution and persistence locations such as LaunchAgents, shell rc files and cron directories. Paths in --write-paths stay writable.",
+    default: false,
+    type: "boolean",
+  })
+  .option("private-tmp", {
+    description:
+      "Give the traced process private /tmp and /var/tmp mounts (Linux only).",
+    default: false,
+    type: "boolean",
+  })
+  .option("protect-home", {
+    description: "Isolate $HOME inside the sandbox (Linux only).",
+    choices: ["off", "read-only", "tmpfs"],
+    default: "off",
+    type: "string",
+  })
   .option("print", {
     description: "Print BOM to stdout.",
     default: false,
@@ -230,9 +280,10 @@ const options = {
   traceMaxMemoryMB: args.maxMemory,
   traceMaxProcesses: args.maxProcesses,
   traceTimeoutMs: args.timeout,
-  traceDisableNetwork: args.traceHttpUrls
-    ? false
-    : (args.disableNetwork ?? true),
+  traceDisableNetwork:
+    args.traceHttpUrls || args.proxyEgress
+      ? false
+      : (args.disableNetwork ?? true),
   traceHTTPURLs: args.traceHttpUrls ?? false,
   tracePeriod: args.tracePeriod,
   traceMaxCPUCores: args.maxCpu,
@@ -265,6 +316,15 @@ const options = {
     ? args.blockExec.split(",").filter(Boolean)
     : [],
   traceCrypto: args.traceCrypto ?? true,
+  traceProxyEgress: args.proxyEgress ?? false,
+  traceAllowLoopback: args.allowLoopback ?? false,
+  traceDryRun: args.sandboxDryRun ?? false,
+  tracePolicy: args.policy,
+  tracePolicyFile: args.policyFile ? resolve(args.policyFile) : undefined,
+  traceBlockInterpreters: args.blockInterpreters ?? false,
+  traceDenyPersistenceWrites: args.denyPersistenceWrites ?? false,
+  tracePrivateTmp: args.privateTmp ?? false,
+  traceProtectHome: args.protectHome,
   cbom: undefined,
   projectType: ["dynamic"],
   output: resolve(args.output),

package/bin/validate.js

@@ -114,11 +114,21 @@ const args = _yargs
     description:
       "Path to a PEM public key. When set, cdx-validate also verifies the BOM signature.",
   })
+  .option("secret-key", {
+    description:
+      "Path to the shared secret for HMAC (HS256, HS384, HS512) signatures. HMAC signatures are only accepted with this option.",
+  })
+  .option("nested-signatures", {
+    type: "boolean",
+    default: true,
+    description:
+      "Also verify component, service, and annotation signatures, as cdx-verify does. Pass --no-nested-signatures to verify only the root signature.",
+  })
   .option("require-signature", {
     type: "boolean",
     default: false,
     description:
-      "Exit non-zero (4) when --public-key is provided but signature verification fails.",
+      "Exit non-zero (4) when --public-key or --secret-key is provided but signature verification fails.",
   })
   .option("strict", {
     type: "boolean",
@@ -162,13 +172,13 @@ async function loadBom(input, platform) {
   return undefined;
 }
 
-function loadPublicKey(path) {
+function loadKeyFile(path, label, encoding) {
   if (!path) return null;
   if (!safeExistsSync(path)) {
-    console.error(`Public key '${path}' not found.`);
+    console.error(`${label} '${path}' not found.`);
     process.exit(1);
   }
-  return fs.readFileSync(path, "utf8");
+  return fs.readFileSync(path, encoding);
 }
 
 function splitCsv(value) {
@@ -199,14 +209,20 @@ function isLocalProtoBomInput(input) {
 }
 
 const bomJson = await loadBom(args.input, args.platform);
-const publicKeyStr = loadPublicKey(args.publicKey);
+if (args.publicKey && args.secretKey) {
+  console.error("cdx-validate: use either --public-key or --secret-key.");
+  process.exit(1);
+}
+const publicKeyStr = loadKeyFile(args.publicKey, "Public key", "utf8");
+const secretKey = loadKeyFile(args.secretKey, "Shared secret");
+const verificationRequested = Boolean(publicKeyStr || secretKey);
 const inputIsLocalProtoBom = isLocalProtoBomInput(args.input);
 if (!isCycloneDxBom(bomJson)) {
   console.error(getNonCycloneDxErrorMessage(bomJson, "cdx-validate"));
   process.exit(1);
 }
 
-if (inputIsLocalProtoBom && publicKeyStr) {
+if (inputIsLocalProtoBom && verificationRequested) {
   console.error(
     "cdx-validate: protobuf BOM input does not currently preserve JSF signature blocks. Verify signatures against the source JSON BOM instead.",
   );
@@ -222,6 +238,8 @@ const report = await validateBomAdvanced(bomJson, {
   includeManual: args.includeManual,
   includePass: args.includePass,
   publicKey: publicKeyStr || undefined,
+  secretKey: secretKey || undefined,
+  nestedSignatures: args.nestedSignatures,
 });
 
 let output;
@@ -242,10 +260,14 @@ try {
 
 writeOrPrint(output, args.reportFile);
 
+for (const e of report.validationErrors || []) {
+  console.error(`cdx-validate: ${e.stage} validation threw: ${e.message}`);
+}
+
 const { shouldFail: fail, reason } = shouldFail(report, {
   failSeverity: args.failSeverity,
   strict: args.strict,
-  requireSignature: Boolean(args.requireSignature && publicKeyStr),
+  requireSignature: Boolean(args.requireSignature && verificationRequested),
 });
 
 if (report.signatureVerified === false && args.requireSignature) {

package/bin/verify.js

@@ -13,7 +13,12 @@ import {
   retrieveCdxgenVersion,
   safeExistsSync,
 } from "../lib/ecosystems/utils.js";
-import { verifyNode } from "../lib/helpers/bomSigner.js";
+import {
+  displayValue,
+  loadSharedSecret,
+  loadVerificationKey,
+  verifyNode,
+} from "../lib/helpers/bomSigner.js";
 import {
   getNonCycloneDxErrorMessage,
   isCycloneDxBom,
@@ -36,8 +41,12 @@ const args = _yargs
     description: "The platform to validate. No default",
   })
   .option("public-key", {
-    default: "public.key",
-    description: "Public key in PEM format. Default public.key",
+    description:
+      "Public key in PEM format. Default public.key unless --secret-key is used",
+  })
+  .option("secret-key", {
+    description:
+      "File holding the shared secret for HMAC (HS256, HS384, HS512) signatures. HMAC signatures are only accepted with this option.",
   })
   .option("deep", {
     type: "boolean",
@@ -114,16 +123,50 @@ if (!isCycloneDxBom(bomJson)) {
   process.exit(1);
 }
 
-if (bomJson && !safeExistsSync(args.publicKey)) {
-  console.log("Public key for signature verification is missing!");
+if (args.publicKey && args.secretKey) {
+  console.log("Use either --public-key or --secret-key, not both.");
+  process.exit(1);
+}
+const keyFile = args.secretKey || args.publicKey || "public.key";
+if (!args.secretKey && !args.publicKey) {
+  console.log(
+    `No --public-key given; using '${keyFile}' from the current directory. Pass --public-key to name the trusted key explicitly.`,
+  );
+}
+if (!safeExistsSync(keyFile)) {
+  console.log(
+    args.secretKey
+      ? "Shared secret for signature verification is missing!"
+      : "Public key for signature verification is missing!",
+  );
   process.exit(1);
 }
 
-const publicKeyStr = fs.readFileSync(args.publicKey, "utf8");
+let verificationKey;
+try {
+  verificationKey = args.secretKey
+    ? loadSharedSecret(fs.readFileSync(keyFile))
+    : loadVerificationKey(fs.readFileSync(keyFile, "utf8"));
+} catch (error) {
+  console.log(`Unable to use '${keyFile}': ${error.message}`);
+  process.exit(1);
+}
 
-let rootMatch = null;
+function verify(node) {
+  const reasons = [];
+  const match = verifyNode(node, verificationKey, { reasons });
+  return { match, reasons };
+}
+
+function printReasons(reasons) {
+  for (const reason of new Set(reasons)) {
+    console.log(`  - ${reason}`);
+  }
+}
+
+let rootResult = null;
 if (bomJson.signature) {
-  rootMatch = verifyNode(bomJson, publicKeyStr);
+  rootResult = verify(bomJson);
 }
 
 const verifyNested = args.deep || !bomJson.signature;
@@ -131,36 +174,23 @@ let hasInvalidNested = false;
 let checkedNested = 0;
 
 if (verifyNested) {
-  for (const comp of bomJson.components || []) {
-    if (comp.signature) {
-      checkedNested++;
-      if (!verifyNode(comp, publicKeyStr)) {
-        console.log(
-          `Component '${comp["bom-ref"] || comp.name}' signature is invalid!`,
-        );
-        hasInvalidNested = true;
-      }
-    }
-  }
-  for (const svc of bomJson.services || []) {
-    if (svc.signature) {
-      checkedNested++;
-      if (!verifyNode(svc, publicKeyStr)) {
-        console.log(
-          `Service '${svc["bom-ref"] || svc.name}' signature is invalid!`,
-        );
-        hasInvalidNested = true;
-      }
-    }
-  }
-  for (const ann of bomJson.annotations || []) {
-    if (ann.signature) {
-      checkedNested++;
-      if (!verifyNode(ann, publicKeyStr)) {
-        console.log(
-          `Annotation '${ann["bom-ref"] || ann.subject}' signature is invalid!`,
-        );
-        hasInvalidNested = true;
+  const nestedTargets = [
+    ["components", "Component", (c) => c["bom-ref"] || c.name],
+    ["services", "Service", (s) => s["bom-ref"] || s.name],
+    ["annotations", "Annotation", (a) => a["bom-ref"] || a.subject],
+  ];
+  for (const [field, label, nameOf] of nestedTargets) {
+    for (const node of bomJson[field] || []) {
+      if (node?.signature) {
+        checkedNested++;
+        const result = verify(node);
+        if (!result.match) {
+          console.log(
+            `${label} '${displayValue(nameOf(node))}' signature is invalid!`,
+          );
+          printReasons(result.reasons);
+          hasInvalidNested = true;
+        }
       }
     }
   }
@@ -168,17 +198,27 @@ if (verifyNested) {
 
 if (hasInvalidNested) {
   console.log("One or more nested signatures are invalid!");
+  if (rootResult?.match) {
+    console.log(
+      "The root signature verifies with this key. Nested signatures belong to the party that created them, so pass --no-deep to verify only the root signature with this key.",
+    );
+  }
   process.exit(1);
 }
 
 if (bomJson.signature) {
+  const rootMatch = rootResult?.match;
   if (rootMatch) {
     const identifier = rootMatch.keyId
-      ? `KeyId: '${rootMatch.keyId}'`
+      ? `KeyId: '${displayValue(rootMatch.keyId)}'`
       : `Algorithm: '${rootMatch.algorithm}'`;
     console.log(`✓ Signature is valid! (Matched ${identifier})`);
   } else {
     console.log("BOM signature is invalid!");
+    printReasons(rootResult?.reasons || []);
+    console.log(
+      "If this BOM was signed with cdxgen 13.2.0 or earlier, re-sign it with this version of cdx-sign.",
+    );
     process.exit(1);
   }
 } else if (checkedNested > 0 && !hasInvalidNested) {

package/data/crypto-oid.json

@@ -40,11 +40,11 @@
     "description": "Korean SEED algorithm, CBC mode"
   },
   "seedOFB": {
-    "oid": "1.2.410.200004.1.5",
+    "oid": "1.2.410.200004.1.6",
     "description": "Korean SEED algorithm, OFB mode"
   },
   "seedCFB": {
-    "oid": "1.2.410.200004.1.6",
+    "oid": "1.2.410.200004.1.5",
     "description": "Korean SEED algorithm, CFB mode"
   },
   "seedMAC": {
@@ -233,11 +233,11 @@
   },
   "cryptoProECDH256": {
     "oid": "1.2.643.7.1.1.6.1",
-    "description": "CryptoPro ECC DH algorithm for GOST R 34.10-2012 256 bit key"
+    "description": "TC26 GOST R 34.10-2012 256-bit key agreement"
   },
   "cryptoProECDH512": {
     "oid": "1.2.643.7.1.1.6.2",
-    "description": "CryptoPro ECC DH algorithm for GOST R 34.10-2012 512 bit key"
+    "description": "TC26 GOST R 34.10-2012 512-bit key agreement"
   },
   "dsa": {
     "oid": "1.2.840.10040.4.1",
@@ -932,8 +932,8 @@
     "description": "Teletrust algorithm"
   },
   "rsaSignature": {
-    "oid": "1.3.36.3.3.1",
-    "description": "Teletrust signature algorithm"
+    "oid": "1.3.14.3.2.11",
+    "description": "RSA signature (OIW secsig)"
   },
   "rsaSignatureWithsha1": {
     "oid": "1.3.36.3.3.1.1",
@@ -1412,8 +1412,8 @@
     "description": "Novell encryption algorithm"
   },
   "sha-1": {
-    "oid": "2.16.840.1.113719.1.2.8.82",
-    "description": "Novell digest algorithm"
+    "oid": "1.3.14.3.2.26",
+    "description": "SHA-1 secure hash standard (OIW)"
   },
   "rc2BSafe1Cbc": {
     "oid": "2.16.840.1.113719.1.2.8.92",
@@ -1959,10 +1959,6 @@
     "oid": "1.2.156.10197.1.301.3",
     "description": "Chinese Cryptography Standardization Technology Committee (CCSTC)"
   },
-  "sm2sign_with_": {
-    "oid": "1.2.156.10197.1.501",
-    "description": "Chinese Cryptography Standardization Technology Committee (CCSTC)"
-  },
   "PBKDF2": {
     "oid": "1.2.840.113549.1.5.12",
     "description": "PBKDF2 key derivation algorithm"
@@ -1994,5 +1990,85 @@
   "pbeWithSHA1AndRC2-CBC": {
     "oid": "1.2.840.113549.1.5.11",
     "description": "Password Based Encryption Algorithm. Uses RC2 in Cipher Block Chaining Mode (RC2-CBC)."
+  },
+  "ml-dsa-44": {
+    "oid": "2.16.840.1.101.3.4.3.17",
+    "description": "ML-DSA-44 post-quantum signature (FIPS 204)"
+  },
+  "ml-dsa-65": {
+    "oid": "2.16.840.1.101.3.4.3.18",
+    "description": "ML-DSA-65 post-quantum signature (FIPS 204)"
+  },
+  "ml-dsa-87": {
+    "oid": "2.16.840.1.101.3.4.3.19",
+    "description": "ML-DSA-87 post-quantum signature (FIPS 204)"
+  },
+  "ml-kem-512": {
+    "oid": "2.16.840.1.101.3.4.4.1",
+    "description": "ML-KEM-512 post-quantum key encapsulation (FIPS 203)"
+  },
+  "ml-kem-768": {
+    "oid": "2.16.840.1.101.3.4.4.2",
+    "description": "ML-KEM-768 post-quantum key encapsulation (FIPS 203)"
+  },
+  "ml-kem-1024": {
+    "oid": "2.16.840.1.101.3.4.4.3",
+    "description": "ML-KEM-1024 post-quantum key encapsulation (FIPS 203)"
+  },
+  "x25519": {
+    "oid": "1.3.101.110",
+    "description": "X25519 Diffie-Hellman key agreement (RFC 7748)"
+  },
+  "slh-dsa-sha2-128s": {
+    "oid": "2.16.840.1.101.3.4.3.20",
+    "description": "SLH-DSA-SHA2-128s hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-sha2-128f": {
+    "oid": "2.16.840.1.101.3.4.3.21",
+    "description": "SLH-DSA-SHA2-128f hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-sha2-192s": {
+    "oid": "2.16.840.1.101.3.4.3.22",
+    "description": "SLH-DSA-SHA2-192s hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-sha2-192f": {
+    "oid": "2.16.840.1.101.3.4.3.23",
+    "description": "SLH-DSA-SHA2-192f hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-sha2-256s": {
+    "oid": "2.16.840.1.101.3.4.3.24",
+    "description": "SLH-DSA-SHA2-256s hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-sha2-256f": {
+    "oid": "2.16.840.1.101.3.4.3.25",
+    "description": "SLH-DSA-SHA2-256f hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-shake-128s": {
+    "oid": "2.16.840.1.101.3.4.3.26",
+    "description": "SLH-DSA-SHAKE-128s hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-shake-128f": {
+    "oid": "2.16.840.1.101.3.4.3.27",
+    "description": "SLH-DSA-SHAKE-128f hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-shake-192s": {
+    "oid": "2.16.840.1.101.3.4.3.28",
+    "description": "SLH-DSA-SHAKE-192s hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-shake-192f": {
+    "oid": "2.16.840.1.101.3.4.3.29",
+    "description": "SLH-DSA-SHAKE-192f hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-shake-256s": {
+    "oid": "2.16.840.1.101.3.4.3.30",
+    "description": "SLH-DSA-SHAKE-256s hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-shake-256f": {
+    "oid": "2.16.840.1.101.3.4.3.31",
+    "description": "SLH-DSA-SHAKE-256f hash-based signature (FIPS 205)"
+  },
+  "sm2sign_with_sm3": {
+    "oid": "1.2.156.10197.1.501",
+    "description": "Chinese Cryptography Standardization Technology Committee (CCSTC)"
   }
 }