stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity
Files
7ac70ece71b17634d157952d203a4e552e19285b
git.stella-ops.org/etc/crypto-plugins-manifest.json
master dac8e10e36 feat(crypto): Complete Phase 2 - Configuration-driven crypto architecture with 100% compliance 
## Summary

This commit completes Phase 2 of the configuration-driven crypto architecture, achieving
100% crypto compliance by eliminating all hardcoded cryptographic implementations.

## Key Changes

### Phase 1: Plugin Loader Infrastructure
- **Plugin Discovery System**: Created StellaOps.Cryptography.PluginLoader with manifest-based loading
- **Configuration Model**: Added CryptoPluginConfiguration with regional profiles support
- **Dependency Injection**: Extended DI to support plugin-based crypto provider registration
- **Regional Configs**: Created appsettings.crypto.{international,russia,eu,china}.yaml
- **CI Workflow**: Added .gitea/workflows/crypto-compliance.yml for audit enforcement

### Phase 2: Code Refactoring
- **API Extension**: Added ICryptoProvider.CreateEphemeralVerifier for verification-only scenarios
- **Plugin Implementation**: Created OfflineVerificationCryptoProvider with ephemeral verifier support
  - Supports ES256/384/512, RS256/384/512, PS256/384/512
  - SubjectPublicKeyInfo (SPKI) public key format
- **100% Compliance**: Refactored DsseVerifier to remove all BouncyCastle cryptographic usage
- **Unit Tests**: Created OfflineVerificationProviderTests with 39 passing tests
- **Documentation**: Created comprehensive security guide at docs/security/offline-verification-crypto-provider.md
- **Audit Infrastructure**: Created scripts/audit-crypto-usage.ps1 for static analysis

### Testing Infrastructure (TestKit)
- **Determinism Gate**: Created DeterminismGate for reproducibility validation
- **Test Fixtures**: Added PostgresFixture and ValkeyFixture using Testcontainers
- **Traits System**: Implemented test lane attributes for parallel CI execution
- **JSON Assertions**: Added CanonicalJsonAssert for deterministic JSON comparisons
- **Test Lanes**: Created test-lanes.yml workflow for parallel test execution

### Documentation
- **Architecture**: Created CRYPTO_CONFIGURATION_DRIVEN_ARCHITECTURE.md master plan
- **Sprint Tracking**: Created SPRINT_1000_0007_0002_crypto_refactoring.md (COMPLETE)
- **API Documentation**: Updated docs2/cli/crypto-plugins.md and crypto.md
- **Testing Strategy**: Created testing strategy documents in docs/implplan/SPRINT_5100_0007_*

## Compliance & Testing

- ✅ Zero direct System.Security.Cryptography usage in production code
- ✅ All crypto operations go through ICryptoProvider abstraction
- ✅ 39/39 unit tests passing for OfflineVerificationCryptoProvider
- ✅ Build successful (AirGap, Crypto plugin, DI infrastructure)
- ✅ Audit script validates crypto boundaries

## Files Modified

**Core Crypto Infrastructure:**
- src/__Libraries/StellaOps.Cryptography/CryptoProvider.cs (API extension)
- src/__Libraries/StellaOps.Cryptography/CryptoSigningKey.cs (verification-only constructor)
- src/__Libraries/StellaOps.Cryptography/EcdsaSigner.cs (fixed ephemeral verifier)

**Plugin Implementation:**
- src/__Libraries/StellaOps.Cryptography.Plugin.OfflineVerification/ (new)
- src/__Libraries/StellaOps.Cryptography.PluginLoader/ (new)

**Production Code Refactoring:**
- src/AirGap/StellaOps.AirGap.Importer/Validation/DsseVerifier.cs (100% compliant)

**Tests:**
- src/__Libraries/__Tests/StellaOps.Cryptography.Plugin.OfflineVerification.Tests/ (new, 39 tests)
- src/__Libraries/__Tests/StellaOps.Cryptography.PluginLoader.Tests/ (new)

**Configuration:**
- etc/crypto-plugins-manifest.json (plugin registry)
- etc/appsettings.crypto.*.yaml (regional profiles)

**Documentation:**
- docs/security/offline-verification-crypto-provider.md (600+ lines)
- docs/implplan/CRYPTO_CONFIGURATION_DRIVEN_ARCHITECTURE.md (master plan)
- docs/implplan/SPRINT_1000_0007_0002_crypto_refactoring.md (Phase 2 complete)

## Next Steps

Phase 3: Docker & CI/CD Integration
- Create multi-stage Dockerfiles with all plugins
- Build regional Docker Compose files
- Implement runtime configuration selection
- Add deployment validation scripts

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2025-12-23 18:20:00 +02:00

287 lines
8.6 KiB
JSON
Raw Blame History

{
"$schema": "https://schema.stella-ops.org/crypto-plugins-manifest/v1.json",
"version": "1.0",
"plugins": [
{
"id": "default",
"name": "DefaultCryptoProvider",
"assembly": "StellaOps.Cryptography.dll",
"type": "StellaOps.Cryptography.DefaultCryptoProvider",
"capabilities": [
"signing:ES256",
"signing:ES384",
"signing:ES512",
"signing:RS256",
"signing:RS384",
"signing:RS512",
"signing:PS256",
"signing:PS384",
"signing:PS512",
"hashing:SHA256",
"hashing:SHA384",
"hashing:SHA512",
"password:PBKDF2",
"password:Argon2id"
],
"jurisdiction": "world",
"compliance": ["NIST", "FIPS-140-3-candidate"],
"platforms": ["linux", "windows", "osx"],
"priority": 50
},
{
"id": "libsodium",
"name": "LibsodiumCryptoProvider",
"assembly": "StellaOps.Cryptography.dll",
"type": "StellaOps.Cryptography.LibsodiumCryptoProvider",
"capabilities": [
"signing:Ed25519",
"hashing:Blake2b",
"symmetric:XSalsa20-Poly1305",
"password:Argon2id"
],
"jurisdiction": "world",
"compliance": ["NIST"],
"platforms": ["linux", "windows", "osx"],
"priority": 60,
"conditionalCompilation": "STELLAOPS_CRYPTO_SODIUM"
},
{
"id": "openssl.gost",
"name": "OpenSslGostProvider",
"assembly": "StellaOps.Cryptography.Plugin.OpenSslGost.dll",
"type": "StellaOps.Cryptography.Plugin.OpenSslGost.OpenSslGostProvider",
"capabilities": [
"signing:GOST-R-34.10-2012-256",
"signing:GOST-R-34.10-2012-512",
"hashing:GOST-R-34.11-2012-256",
"hashing:GOST-R-34.11-2012-512"
],
"jurisdiction": "russia",
"compliance": ["GOST", "FSB"],
"platforms": ["linux", "osx"],
"priority": 100,
"options": {
"enginePath": "/usr/lib/x86_64-linux-gnu/engines-3/gost.so"
}
},
{
"id": "cryptopro.gost",
"name": "CryptoProGostCryptoProvider",
"assembly": "StellaOps.Cryptography.Plugin.CryptoPro.dll",
"type": "StellaOps.Cryptography.Plugin.CryptoPro.CryptoProGostCryptoProvider",
"capabilities": [
"signing:GOST-R-34.10-2001",
"signing:GOST-R-34.10-2012-256",
"signing:GOST-R-34.10-2012-512",
"hashing:GOST-R-34.11-94",
"hashing:GOST-R-34.11-2012-256",
"hashing:GOST-R-34.11-2012-512"
],
"jurisdiction": "russia",
"compliance": ["GOST", "FSB", "ГосСОПКА"],
"platforms": ["windows"],
"priority": 110,
"conditionalCompilation": "STELLAOPS_CRYPTO_PRO"
},
{
"id": "pkcs11.gost",
"name": "Pkcs11GostCryptoProvider",
"assembly": "StellaOps.Cryptography.Plugin.Pkcs11Gost.dll",
"type": "StellaOps.Cryptography.Plugin.Pkcs11Gost.Pkcs11GostCryptoProvider",
"capabilities": [
"signing:GOST-R-34.10-2012-256",
"signing:GOST-R-34.10-2012-512",
"hashing:GOST-R-34.11-2012-256",
"hashing:GOST-R-34.11-2012-512"
],
"jurisdiction": "russia",
"compliance": ["GOST", "FSB", "PKCS#11"],
"platforms": ["linux", "windows"],
"priority": 105,
"options": {
"libraryPath": "/usr/lib/x86_64-linux-gnu/pkcs11/librtpkcs11ecp.so"
}
},
{
"id": "wine.csp",
"name": "WineCspProvider",
"assembly": "StellaOps.Cryptography.Plugin.WineCsp.dll",
"type": "StellaOps.Cryptography.Plugin.WineCsp.WineCspProvider",
"capabilities": [
"signing:GOST-R-34.10-2012-256",
"signing:GOST-R-34.10-2012-512",
"hashing:GOST-R-34.11-2012-256",
"hashing:GOST-R-34.11-2012-512"
],
"jurisdiction": "russia",
"compliance": ["GOST"],
"platforms": ["linux"],
"priority": 95,
"options": {
"winePrefix": "/opt/stellaops/wine"
}
},
{
"id": "sm.soft",
"name": "SmSoftCryptoProvider",
"assembly": "StellaOps.Cryptography.Plugin.SmSoft.dll",
"type": "StellaOps.Cryptography.Plugin.SmSoft.SmSoftCryptoProvider",
"capabilities": [
"signing:SM2",
"hashing:SM3",
"symmetric:SM4"
],
"jurisdiction": "china",
"compliance": ["GM/T", "OSCCA"],
"platforms": ["linux", "windows", "osx"],
"priority": 100
},
{
"id": "sm.remote",
"name": "SmRemoteHttpProvider",
"assembly": "StellaOps.Cryptography.Plugin.SmRemote.dll",
"type": "StellaOps.Cryptography.Plugin.SmRemote.SmRemoteHttpProvider",
"capabilities": [
"signing:SM2",
"hashing:SM3"
],
"jurisdiction": "china",
"compliance": ["GM/T", "OSCCA"],
"platforms": ["linux", "windows", "osx"],
"priority": 90,
"options": {
"baseAddress": "http://localhost:8900"
}
},
{
"id": "pq.soft",
"name": "PqSoftCryptoProvider",
"assembly": "StellaOps.Cryptography.Plugin.PqSoft.dll",
"type": "StellaOps.Cryptography.Plugin.PqSoft.PqSoftCryptoProvider",
"capabilities": [
"signing:ML-DSA-44",
"signing:ML-DSA-65",
"signing:ML-DSA-87",
"signing:SLH-DSA-SHA2-128s",
"signing:SLH-DSA-SHA2-128f",
"signing:SLH-DSA-SHAKE-128s",
"signing:SLH-DSA-SHAKE-128f",
"hashing:SHA3-256",
"hashing:SHA3-512",
"hashing:SHAKE256"
],
"jurisdiction": "world",
"compliance": ["NIST-PQC", "FIPS-203", "FIPS-205"],
"platforms": ["linux", "windows", "osx"],
"priority": 70
},
{
"id": "fips.soft",
"name": "FipsSoftCryptoProvider",
"assembly": "StellaOps.Cryptography.dll",
"type": "StellaOps.Cryptography.FipsSoftCryptoProvider",
"capabilities": [
"signing:ES256",
"signing:ES384",
"signing:ES512",
"signing:RS256",
"signing:RS384",
"signing:RS512",
"hashing:SHA256",
"hashing:SHA384",
"hashing:SHA512"
],
"jurisdiction": "world",
"compliance": ["FIPS-140-3"],
"platforms": ["linux", "windows"],
"priority": 80
},
{
"id": "eidas.soft",
"name": "EidasSoftCryptoProvider",
"assembly": "StellaOps.Cryptography.dll",
"type": "StellaOps.Cryptography.EidasSoftCryptoProvider",
"capabilities": [
"signing:ES256",
"signing:ES384",
"signing:ES512",
"signing:RS256",
"signing:RS384",
"signing:RS512",
"hashing:SHA256",
"hashing:SHA384",
"hashing:SHA512"
],
"jurisdiction": "eu",
"compliance": ["eIDAS", "ETSI-TS-119-312"],
"platforms": ["linux", "windows", "osx"],
"priority": 85
},
{
"id": "kcmvp.hash",
"name": "KcmvpHashOnlyProvider",
"assembly": "StellaOps.Cryptography.dll",
"type": "StellaOps.Cryptography.KcmvpHashOnlyProvider",
"capabilities": [
"hashing:SHA256",
"hashing:SHA384",
"hashing:SHA512"
],
"jurisdiction": "korea",
"compliance": ["KCMVP"],
"platforms": ["linux", "windows"],
"priority": 75
},
{
"id": "offline-verification",
"name": "OfflineVerificationCryptoProvider",
"assembly": "StellaOps.Cryptography.Plugin.OfflineVerification.dll",
"type": "StellaOps.Cryptography.Plugin.OfflineVerification.OfflineVerificationCryptoProvider",
"capabilities": [
"signing:ES256",
"signing:ES384",
"signing:ES512",
"signing:RS256",
"signing:RS384",
"signing:RS512",
"signing:PS256",
"signing:PS384",
"signing:PS512",
"hashing:SHA-256",
"hashing:SHA-384",
"hashing:SHA-512",
"verification:ES256",
"verification:ES384",
"verification:ES512",
"verification:RS256",
"verification:RS384",
"verification:RS512"
],
"jurisdiction": "world",
"compliance": ["NIST", "offline-airgap"],
"platforms": ["linux", "windows", "osx"],
"priority": 45,
"enabledByDefault": true
},
{
"id": "sim.crypto.remote",
"name": "SimRemoteProvider",
"assembly": "StellaOps.Cryptography.Plugin.SimRemote.dll",
"type": "StellaOps.Cryptography.Plugin.SimRemote.SimRemoteProvider",
"capabilities": [
"signing:*",
"hashing:*",
"verification:*"
],
"jurisdiction": "world",
"compliance": ["test-only"],
"platforms": ["linux", "windows", "osx"],
"priority": 10,
"options": {
"baseAddress": "http://localhost:8901"
},
"enabledByDefault": false
}
]
}
Reference in New Issue View Git Blame Copy Permalink