Add outputLength property to schema

[jvdsn]

Fixes #799

Adds the outputLength property that indicates the output length of the cryptographic algorithm. This is not restricted to key derivation functions, but could also be used for MAC tags, XOF output lengths, and more.

[jvdsn]

@meghsaha-ibm

[bhess]

Thanks for the addition @jvdsn, that's useful! I had two questions regarding edge cases:

• For some algorithms, there are multiple outputs with different lengths. For example, KEM operations: encaps produces a ciphertext and shared secret, decaps produces a shared secret, and key generation produces a public/private key pair. Would it make sense to model outputs as a list of named values (e.g., { name: "public-key", length: X }) to avoid ambiguity when multiple outputs exist?
• Some algorithms have variable-length outputs (e.g., XOFs). Should this field support a range or otherwise indicate variable/unbounded length instead of a fixed value?

[stevespringett]

Perhaps use oneOf to account for either an integer which would represent a single output length, or an object which would have min and max properties.

Refer to: https://json-schema.org/understanding-json-schema/reference/combining#oneOf

This would look something like:

"oneOf": [
    { "type": "integer" },
    { 
      "type": "object", 
      "properties": {
        "min": { ... }
        "max": { ... }
      }
    }
  ]

[jvdsn]

@stevespringett apologies for the delay. I have updated the PR now. Let me know what you think. One open question: do we want to enforce that both min and max are required (as they are currently)? Or should we allow one of them to be omitted?

[jvdsn]

@stevespringett I fixed the DCO

[jkowalleck]

RFC notice sent on July 23, 2026

• https://groups.io/g/CycloneDX/topic/120410973
• https://cyclonedx.slack.com/archives/CVA0G10FN/p1784815784761599

Public RFC period ends August 20, 2026

[jkowalleck]

are both required, always?
not have a atleast one of them required?

[jvdsn]

Currently both are required for simplicity. If there's any strong opinions one way or another, I can change it.