From ac12a330a3b57edcc3c2257dded515771e21b148 Mon Sep 17 00:00:00 2001
From: aaronormerod <137795541+aaronormerod@users.noreply.github.com>
Date: Mon, 12 Oct 2026 11:16:47 +0100
Subject: [PATCH] fix: use hashAlgorithm in PBES1 pattern

RFC 8018 section 6.1 builds PBES1 on PBKDF1, which takes a hash
algorithm, not a KDF.

Fixes #906

Signed-off-by: aaronormerod <137795541+aaronormerod@users.noreply.github.com>
---
 schema/cryptography-defs.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json
index b2435f1fc..ebc8d7cb7 100644
--- a/schema/cryptography-defs.json
+++ b/schema/cryptography-defs.json
@@ -1772,7 +1772,7 @@
       ],
       "variant": [
         {
-          "pattern": "PBES1[-{encryptionAlgorithm}][-{kdf}][-{dkLen}][-{iterations}]",
+          "pattern": "PBES1[-{encryptionAlgorithm}][-{hashAlgorithm}][-{dkLen}][-{iterations}]",
           "primitive": "other"
         }
       ]