CBOM 1.7: protocolProperties JSON schema and XSD diverge (relatedCryptographicAssets, cryptoRefArray, tlsGroups, tlsSignatureSchemes)

[stondo]

Summary

In CycloneDX 1.7, the JSON schema and the XSD disagree on the content model of
cryptoProperties.protocolProperties. A CBOM that is valid against the official JSON
schema cannot be serialized to XML that validates against the official XSD, and vice
versa.

Details

JSON schema (bom-1.7.schema.json, definitions.cryptoProperties.properties.protocolProperties.properties)
lists:

type, version, cipherSuites, cryptoRefArray, ikev2TransformTypes, relatedCryptographicAssets

XSD (bom-1.7.xsd, the protocolProperties element's complexType sequence) lists:

type, version, cipherSuites, algorithms, identifiers, tlsGroups,
tlsSignatureSchemes, ikev2TransformTypes, cryptoRef

Concretely:

1. relatedCryptographicAssets is JSON-only. It is present in the JSON schema for
   protocolProperties but has no counterpart element in the XSD. The sibling
   properties certificateProperties and relatedCryptoMaterialProperties do have
   relatedCryptographicAssets in both serializations (XSD elements at the
   certificateProperties and relatedCryptoMaterialProperties complexTypes), which
   suggests the omission under protocolProperties is an oversight rather than a
   deliberate serialization difference.
   -- see [Defect]: 1.7 XML schema omits protocol relatedCryptographicAssets #1018
2. tlsGroups and tlsSignatureSchemes are XSD-only. They have no JSON-schema
   counterpart under protocolProperties (the JSON schema has no TLS parameter
   object at all beyond cipherSuites).
3. cryptoRefArray (JSON) vs cryptoRef (XSD) and algorithms/identifiers
   (XSD-only) — these may be intentional JSON↔XML representation differences, but
   it would be useful to confirm and document the intended mapping.

Impact

Any JSON→XML (or XML→JSON) conversion of a 1.7 CBOM that uses
protocolProperties.relatedCryptographicAssets (or the XSD-only TLS fields) cannot
produce output that validates against the other serialization's official schema.
Tooling must either emit schema-invalid documents or silently drop conformant data.

Environment

• Schemas fetched from the CycloneDX/specification repository (master, schema/
  directory), also published at https://cyclonedx.org/schema/bom-1.7.schema.json
  and bom-1.7.xsd.
• Observed while implementing bidirectional JSON↔XML conversion for CycloneDX 1.7
  in an SBOM conversion tool.

Suggested fix

Align the two serializations for protocolProperties: add relatedCryptographicAssets
to the XSD (mirroring certificateProperties/relatedCryptoMaterialProperties), and
either add tlsGroups/tlsSignatureSchemes to the JSON schema or remove them from
the XSD. A documented JSON↔XML field mapping for cryptoRefArray/cryptoRef and
algorithms/identifiers would also help implementers.