From e7e77cee0e6a8d489f9ec0cd97f1406d5b7b4ed3 Mon Sep 17 00:00:00 2001
From: Mehrn0ush <mehrnoush.vaseghi@gmail.com>
Date: Thu, 29 Oct 2026 23:42:45 +0400
Subject: [PATCH] fix(2.0): restrict NIST quantum security level -- addres
 #1185

Signed-off-by: Mehrn0ush <mehrnoush.vaseghi@gmail.com>
---
 .../cyclonedx-cryptography-2.0.schema.json    |  4 +-
 ...phy-nist-quantum-security-level-6-2.0.json | 20 +++++++++
 ...ist-quantum-security-level-bounds-2.0.json | 45 +++++++++++++++++++
 3 files changed, 67 insertions(+), 2 deletions(-)
 create mode 100644 tools/src/test/resources/2.0/invalid-cryptography-nist-quantum-security-level-6-2.0.json
 create mode 100644 tools/src/test/resources/2.0/valid-cryptography-nist-quantum-security-level-bounds-2.0.json

diff --git a/schema/2.0/modules/cyclonedx-cryptography-2.0.schema.json b/schema/2.0/modules/cyclonedx-cryptography-2.0.schema.json
index 88dfe3941..56e5d91cd 100644
--- a/schema/2.0/modules/cyclonedx-cryptography-2.0.schema.json
+++ b/schema/2.0/modules/cyclonedx-cryptography-2.0.schema.json
@@ -256,9 +256,9 @@
             "nistQuantumSecurityLevel": {
               "type": "integer",
               "title": "NIST security strength category",
-              "description": "The NIST security strength category as defined in https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria). A value of 0 indicates that none of the categories are met.",
+              "description": "The NIST security strength category as defined in https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria). NIST defines categories 1 through 5. CycloneDX uses 0 to indicate that none of these categories are met. Omission makes no category assertion and does not establish whether an assessment was performed.",
               "minimum": 0,
-              "maximum": 6
+              "maximum": 5
             },
             "secProperties": {
               "type": "array",
diff --git a/tools/src/test/resources/2.0/invalid-cryptography-nist-quantum-security-level-6-2.0.json b/tools/src/test/resources/2.0/invalid-cryptography-nist-quantum-security-level-6-2.0.json
new file mode 100644
index 000000000..66197bc2c
--- /dev/null
+++ b/tools/src/test/resources/2.0/invalid-cryptography-nist-quantum-security-level-6-2.0.json
@@ -0,0 +1,20 @@
+{
+  "$schema": "https://cyclonedx.org/schema/2.0/cyclonedx-2.0.schema.json",
+  "specFormat": "CycloneDX",
+  "specVersion": "2.0",
+  "definitions": {
+    "components": [
+      {
+        "type": "cryptographic-asset",
+        "name": "algorithm",
+        "cryptoProperties": {
+          "assetType": "algorithm",
+          "algorithmProperties": {
+            "primitive": "hash",
+            "nistQuantumSecurityLevel": 6
+          }
+        }
+      }
+    ]
+  }
+}
diff --git a/tools/src/test/resources/2.0/valid-cryptography-nist-quantum-security-level-bounds-2.0.json b/tools/src/test/resources/2.0/valid-cryptography-nist-quantum-security-level-bounds-2.0.json
new file mode 100644
index 000000000..016a018f6
--- /dev/null
+++ b/tools/src/test/resources/2.0/valid-cryptography-nist-quantum-security-level-bounds-2.0.json
@@ -0,0 +1,45 @@
+{
+  "$schema": "https://cyclonedx.org/schema/2.0/cyclonedx-2.0.schema.json",
+  "specFormat": "CycloneDX",
+  "specVersion": "2.0",
+  "definitions": {
+    "components": [
+      {
+        "type": "cryptographic-asset",
+        "name": "SHA-256",
+        "cryptoProperties": {
+          "assetType": "algorithm",
+          "algorithmProperties": {
+            "primitive": "hash",
+            "algorithmFamily": "SHA-2"
+          }
+        }
+      },
+      {
+        "type": "cryptographic-asset",
+        "name": "MD5",
+        "cryptoProperties": {
+          "assetType": "algorithm",
+          "algorithmProperties": {
+            "primitive": "hash",
+            "algorithmFamily": "MD5",
+            "nistQuantumSecurityLevel": 0
+          }
+        }
+      },
+      {
+        "type": "cryptographic-asset",
+        "name": "ML-KEM-1024",
+        "cryptoProperties": {
+          "assetType": "algorithm",
+          "algorithmProperties": {
+            "primitive": "kem",
+            "algorithmFamily": "ML-KEM",
+            "parameterSetIdentifier": "1024",
+            "nistQuantumSecurityLevel": 5
+          }
+        }
+      }
+    ]
+  }
+}