feature: added new metrics:

metrics/TransportEncryption/BlockCipher/BlockCipher.yaml

@@ -0,0 +1,12 @@
+# ====== Metadata ======
+id: BlockCipher
+description: This rule assesses whether a [Resource] has all its [TransportEncryption] [p1:cipherSuites] configured so that each cipher suite’s sessionCipher is correctly set to the AES block cipher family.
+category: Cryptography
+version: "1.0"
+comments: Aligned with BSI TR-02102-2, which recommends AES-based suites."
+
+# ====== Configuration ======
+configuration:
+  p1:
+    operator: "regex.match"
+    targetValue: "^AES([_-]|$)"

metrics/TransportEncryption/BlockCipher/data.json

@@ -0,0 +1,4 @@
+{
+    "operator": "regex.match",
+    "target_value": "^AES([_-]|$)"
+}

metrics/TransportEncryption/BlockCipher/metric.rego

@@ -0,0 +1,22 @@
+package cch.metrics.block_cipher
+
+import rego.v1
+import input as document
+
+default applicable := false
+
+default compliant := false
+
+applicable if {
+  document.TransportEncryption
+  document.TransportEncryption.cipherSuites
+  count(document.TransportEncryption.cipherSuites) > 0
+}
+
+compliant if {
+  applicable
+  every cs in document.TransportEncryption.cipherSuites {
+      cs.sessionCipher
+      regex.match(data.target_value, cs.sessionCipher)
+  }
+}

metrics/TransportEncryption/BlockCipherMode/BlockCipherMode.yaml

@@ -0,0 +1,12 @@
+# ====== Metadata ======
+id: BlockCipherMode
+description: This rule assesses whether a [Resource] has all its [TransportEncryption] [p1:cipherSuites] configured so that each cipher suite’s sessionCipher mode is correctly configured.
+category: Cryptography
+version: "1.0"
+comments: Aligned with BSI TR-02102-2, which recommends using either CCM mode, or GCM mode, or CBC mode.
+
+# ====== Configuration ======
+configuration:
+  p1:
+    operator: "regex.match"
+    targetValue: "(?:^|[_-])(GCM|CCM|CBC)$"

metrics/TransportEncryption/BlockCipherMode/data.json

@@ -0,0 +1,4 @@
+{
+    "operator": "regex.match",
+    "target_value": "(?:^|[_-])(GCM|CCM|CBC)$"
+}

metrics/TransportEncryption/BlockCipherMode/metric.rego

@@ -0,0 +1,21 @@
+package cch.metrics.block_cipher_mode
+
+import rego.v1
+import input as document
+
+default applicable := false
+default compliant := false
+
+applicable if {
+  document.TransportEncryption
+  document.TransportEncryption.cipherSuites
+  count(document.TransportEncryption.cipherSuites) > 0
+}
+
+compliant if {
+  applicable
+  every cs in document.TransportEncryption.cipherSuites {
+    cs.sessionCipher
+    regex.match(data.target_value, cs.sessionCipher)
+  }
+}