Evaluate and decide over the following discrepancies between SPDX and Cyclone DX algorithms IDs

[toscalix]

Rationale

In order to keep as much compatibility as possibl;e between SPDX Cryptographic Algorithm List and the CycloneDX algorithms family, SPDX should revisit the following algorithms IDs and decide if:

• we keep them as they are
• we change them using the same ID that CycloneDX does
• look for a way to include a second way to name the algorithm

Request

Evaluate the following IDs:

Some algorithms in CycloneDX are mapped to slightly different SPDX filenames:

• CAST5/CAST6 → SPDX: cast.yaml
• ChaCha/ChaCha20 → SPDX: chacha(salsa).yaml
• FFDH → SPDX: diffiehellman.yaml
• SHA-1 → SPDX: shs.yaml
• SHA-2 → SPDX: shax.yaml
• SHA-3 → SPDX: keccak.yaml Confirm this one!
• SNOW3G → SPDX: snow.yaml

DoD

• Discussion and decision about the IDs has been carried out:
  • cast
  • chacha(salsa)
  • diffiehellman
  • shs
  • shax
  • keccak
  • snow
• List the PR that solve the discrepancies if changes need to be introduced to the algorithms IDs
• Link to the rationale and the decisions taken if no changes are needed.