Operation Groups

operation-groups.json groups related crypto functions into logical operations so reviewers see an asset lifecycle instead of isolated calls.

Examples include:

• key generator creation, initialization, and key generation;
• cipher creation, initialization, update, and final encrypt/decrypt;
• signer creation, update, and sign/verify;
• digest or MAC creation, input updates, and final output.

Grouping evidence

Grouping uses available method scope, object identity, asset type, lifecycle stage, and function metadata. Same-named local variables in different methods should not be treated as one operation. When object or lifecycle evidence is incomplete, review the group boundary manually.

What a group contains

• operation intent, category, and source context;
• ordered crypto-function steps;
• step-level parameter and FIPS evidence;
• quantum, CWE, anti-pattern, confidence, and manual-review summaries;
• missing context and review questions;
• remediation direction, developer checks, code improvement, and migration dependencies when available.

Group-level assessment summarizes existing scanner facts. It does not create new parameter values.

Typical developer action

Review all steps before changing one call. A secure final cipher mode can still depend on weak key generation, an unresolved provider, or a noncompliant initialization parameter earlier in the lifecycle.