134 lines
4.3 KiB
YAML
134 lines
4.3 KiB
YAML
# StellaOps Cryptography Configuration - EU Profile (eIDAS)
|
|
# This configuration aligns with eIDAS (electronic IDentification, Authentication and trust Services)
|
|
# regulation (EU) No 910/2014 for European Union deployments.
|
|
|
|
StellaOps:
|
|
Crypto:
|
|
Plugins:
|
|
# Path to the plugin manifest JSON file
|
|
ManifestPath: "/app/etc/crypto-plugins-manifest.json"
|
|
|
|
# Discovery mode: "explicit" (only load configured plugins) or "auto" (load all compatible)
|
|
# Production deployments should use "explicit" for security
|
|
DiscoveryMode: "explicit"
|
|
|
|
# List of enabled plugins with optional priority and configuration overrides
|
|
Enabled:
|
|
# Offline Verification Provider - temporary fallback until eIDAS plugin available
|
|
# Uses NIST-approved algorithms (ECDSA P-256/384/521, RSA, SHA-2)
|
|
# TODO: Replace with eidas.soft plugin when available
|
|
- Id: "offline-verification"
|
|
Priority: 100
|
|
Options: {}
|
|
|
|
# Disable non-eIDAS compliant providers
|
|
Disabled:
|
|
- "sm.*" # Chinese SM algorithms
|
|
- "openssl.gost" # Russian GOST
|
|
- "pkcs11.gost"
|
|
- "cryptopro.gost"
|
|
- "wine.csp"
|
|
- "pq.*" # Post-quantum (not yet eIDAS-qualified)
|
|
|
|
# Fail application startup if a configured plugin cannot be loaded
|
|
FailOnMissingPlugin: true
|
|
|
|
# Require at least one crypto provider to be successfully loaded
|
|
RequireAtLeastOne: true
|
|
|
|
Compliance:
|
|
# eIDAS compliance profile
|
|
ProfileId: "eidas"
|
|
|
|
# Enable strict validation (reject algorithms not approved by eIDAS)
|
|
# TODO: Re-enable when eIDAS plugin is available
|
|
StrictValidation: false
|
|
|
|
# Enforce jurisdiction filtering (only EU-compliant plugins)
|
|
# TODO: Re-enable when eIDAS plugin is available
|
|
EnforceJurisdiction: false
|
|
|
|
# Allowed jurisdictions
|
|
AllowedJurisdictions:
|
|
- "eu"
|
|
- "world"
|
|
|
|
# Canonical algorithm preferences (ETSI TS 119 312)
|
|
HashAlgorithm: "SHA-256"
|
|
SignatureAlgorithm: "ES256"
|
|
|
|
# Enable algorithm downgrade warnings
|
|
WarnOnWeakAlgorithms: true
|
|
|
|
# eIDAS Qualified Timestamping Configuration (QTS-001, QTS-004)
|
|
Timestamping:
|
|
# Default timestamp mode
|
|
DefaultMode: Standard # Standard | Qualified | QualifiedLtv
|
|
|
|
# Qualified TSA Providers (EU Trust List validated)
|
|
Providers:
|
|
- Name: d-trust-qts
|
|
Url: https://qts.d-trust.net/tsp
|
|
Qualified: true
|
|
TrustListRef: eu-lotl
|
|
SignatureFormat: CadesT
|
|
HashAlgorithm: SHA256
|
|
|
|
- Name: a-trust-qts
|
|
Url: https://tsp.a-trust.at/tsp/tsp
|
|
Qualified: true
|
|
TrustListRef: eu-lotl
|
|
SignatureFormat: CadesT
|
|
|
|
- Name: infocert-qts
|
|
Url: https://timestamp.infocert.it/tsa
|
|
Qualified: true
|
|
TrustListRef: eu-lotl
|
|
|
|
# Non-qualified fallback (for non-EU deployments)
|
|
- Name: digicert
|
|
Url: http://timestamp.digicert.com
|
|
Qualified: false
|
|
|
|
# EU Trust List Configuration
|
|
TrustList:
|
|
# Online URL for EU List of Trusted Lists (LOTL)
|
|
LotlUrl: https://ec.europa.eu/tools/lotl/eu-lotl.xml
|
|
|
|
# Offline path for air-gapped environments (QTS-004 requirement)
|
|
OfflinePath: /app/data/trustlists/eu-lotl.xml
|
|
|
|
# Cache TTL in hours (refresh interval)
|
|
CacheTtlHours: 24
|
|
|
|
# Verify signature on trust list updates
|
|
VerifySignature: true
|
|
|
|
# Fallback to offline if online fetch fails
|
|
FallbackToOffline: true
|
|
|
|
# Policy Overrides - require qualified timestamps per environment/tag
|
|
Overrides:
|
|
- Match:
|
|
Environments:
|
|
- production
|
|
- staging
|
|
Mode: Qualified
|
|
TsaProvider: d-trust-qts
|
|
SignatureFormat: CadesT
|
|
|
|
- Match:
|
|
Tags:
|
|
- regulated
|
|
- eidas-required
|
|
- financial
|
|
Mode: QualifiedLtv
|
|
TsaProvider: d-trust-qts
|
|
SignatureFormat: CadesLT
|
|
|
|
# eIDAS certificate requirements (for reference):
|
|
# - Certificates must comply with ETSI EN 319 412-1 and 319 412-2
|
|
# - Minimum key lengths: RSA 2048-bit, ECDSA P-256
|
|
# - Qualified certificates require QSCD (e.g., smart card, HSM)
|
|
# - Advanced Electronic Signatures (AdES): XAdES, PAdES, CAdES formats
|