49922dff5a
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
Notify Smoke Test / Notifier Service Tests (push) Has been cancelled
Notify Smoke Test / Notification Smoke Test (push) Has been cancelled
Notify Smoke Test / Notify Unit Tests (push) Has been cancelled
AOC Guard CI / aoc-guard (push) Has been cancelled
AOC Guard CI / aoc-verify (push) Has been cancelled
Export Center CI / export-ci (push) Has been cancelled
Manifest Integrity / Validate Schema Integrity (push) Has been cancelled
Manifest Integrity / Validate Contract Documents (push) Has been cancelled
Manifest Integrity / Validate Pack Fixtures (push) Has been cancelled
Manifest Integrity / Audit SHA256SUMS Files (push) Has been cancelled
Manifest Integrity / Verify Merkle Roots (push) Has been cancelled
Policy Lint & Smoke / policy-lint (push) Has been cancelled
Risk Bundle CI / risk-bundle-build (push) Has been cancelled
Scanner Analyzers / Discover Analyzers (push) Has been cancelled
Scanner Analyzers / Validate Test Fixtures (push) Has been cancelled
Risk Bundle CI / risk-bundle-offline-kit (push) Has been cancelled
Risk Bundle CI / publish-checksums (push) Has been cancelled
Scanner Analyzers / Build Analyzers (push) Has been cancelled
Scanner Analyzers / Test Language Analyzers (push) Has been cancelled
Scanner Analyzers / Verify Deterministic Output (push) Has been cancelled
devportal-offline / build-offline (push) Has been cancelled
Mirror Thin Bundle Sign & Verify / mirror-sign (push) Has been cancelled
289 lines
11 KiB
Markdown
289 lines
11 KiB
Markdown
# Crypto Compliance Review · License & Export Analysis
|
|
|
|
**Status:** IN REVIEW (legal sign-off pending)
|
|
**Date:** 2025-12-07
|
|
**Owners:** Security Guild, Legal
|
|
**Unblocks:** RU-CRYPTO-VAL-05, RU-CRYPTO-VAL-06
|
|
|
|
## Overview
|
|
|
|
This document captures the licensing, export controls, and distribution guidance for cryptographic components in StellaOps, specifically:
|
|
|
|
1. **GostCryptography Fork** (`third_party/forks/AlexMAS.GostCryptography`)
|
|
2. **CryptoPro Plugin** (`StellaOps.Cryptography.Plugin.CryptoPro`)
|
|
3. **Regional Crypto Providers** (GOST, SM2/SM3, eIDAS)
|
|
|
|
## 1. GostCryptography Fork
|
|
|
|
### 1.1 License
|
|
|
|
| Attribute | Value |
|
|
|-----------|-------|
|
|
| Upstream | https://github.com/AlexMAS/GostCryptography |
|
|
| License | MIT |
|
|
| StellaOps Usage | Source-vendored in `third_party/forks/` |
|
|
| Compatibility | MIT is compatible with AGPL-3.0-or-later |
|
|
|
|
### 1.2 Attribution Requirements
|
|
|
|
The MIT license requires attribution in distributed software:
|
|
|
|
```
|
|
Copyright (c) 2014-2024 AlexMAS
|
|
See third_party/forks/AlexMAS.GostCryptography/LICENSE
|
|
```
|
|
|
|
**Required Actions:**
|
|
- [x] Keep `LICENSE` file in fork directory
|
|
- [ ] Add attribution to `NOTICE.md` in repository root
|
|
- [ ] Include attribution in RootPack_RU bundle documentation
|
|
|
|
### 1.3 Distribution Guidance
|
|
|
|
| Distribution Channel | Allowed | Notes |
|
|
|---------------------|---------|-------|
|
|
| StellaOps Source | Yes | Fork stays vendored |
|
|
| RootPack_RU Bundle | Yes | Source + binaries allowed |
|
|
| Public NuGet | **No** | Do not publish as standalone package |
|
|
| Container Images | Yes | With source attribution |
|
|
|
|
## 2. CryptoPro CSP Plugin
|
|
|
|
### 2.1 License
|
|
|
|
| Attribute | Value |
|
|
|-----------|-------|
|
|
| Vendor | CryptoPro LLC (crypto-pro.ru) |
|
|
| Product | CryptoPro CSP 5.0 |
|
|
| License Type | Commercial (per-deployment) |
|
|
| Cost | Varies by tier (~$50-200 USD per instance) |
|
|
|
|
### 2.2 Distribution Model
|
|
|
|
CryptoPro CSP is **not redistributable** by StellaOps. The distribution model is:
|
|
|
|
```
|
|
┌─────────────────────────────────────────────────────────────────┐
|
|
│ Distribution Model │
|
|
├─────────────────────────────────────────────────────────────────┤
|
|
│ │
|
|
│ StellaOps ships: │
|
|
│ ├── Plugin source code (AGPL-3.0-or-later) │
|
|
│ ├── Interface bindings to CryptoPro CSP │
|
|
│ └── Documentation for customer-provided CSP installation │
|
|
│ │
|
|
│ Customer provides: │
|
|
│ ├── CryptoPro CSP license │
|
|
│ ├── CSP binaries installed on target system │
|
|
│ └── PKCS#11 module path configuration │
|
|
│ │
|
|
└─────────────────────────────────────────────────────────────────┘
|
|
```
|
|
|
|
### 2.3 Configuration for Customer-Provided CSP
|
|
|
|
```yaml
|
|
# etc/authority.yaml - Customer configures CSP path
|
|
crypto:
|
|
pkcs11:
|
|
library_path: /opt/cprocsp/lib/amd64/libcapi20.so # Customer-provided
|
|
slot_id: 0
|
|
pin_env: AUTHORITY_HSM_PIN
|
|
```
|
|
|
|
### 2.4 Documentation Requirements
|
|
|
|
- [x] Document that CSP is "customer-provided" in installation guide
|
|
- [x] Add EULA notice that CSP licensing is customer responsibility
|
|
- [x] Include CSP version compatibility matrix (CSP 4.0/5.0)
|
|
- [x] Provide license acceptance/test procedure for Linux CSP service and Windows runners
|
|
|
|
### 2.5 License Acceptance & Validation (customer-provided CSP)
|
|
|
|
**Linux (native CSP, headless)**
|
|
|
|
1. Place vendor `.tgz`/`.deb` bundles under `<repo>/opt/cryptopro/downloads` (mounted read-only into `/opt/cryptopro/downloads`).
|
|
2. Set `CRYPTOPRO_ACCEPT_EULA=1` only if you hold a valid license and agree to the vendor terms.
|
|
3. Install CSP packages with `ops/cryptopro/install-linux-csp.sh` (offline by default; respects arch filtering).
|
|
4. Build the HTTP wrapper with the same EULA flag:
|
|
```bash
|
|
docker build -t cryptopro-linux-csp \
|
|
--build-arg CRYPTOPRO_ACCEPT_EULA=1 \
|
|
-f ops/cryptopro/linux-csp-service/Dockerfile .
|
|
docker run --rm -p 18080:8080 cryptopro-linux-csp
|
|
```
|
|
5. Validate license/keyset with the wrapper endpoints (fail closed if unlicensed):
|
|
- `GET /health` (binary present)
|
|
- `GET /license` (mirrors `csptest -keyset -info`; surfaces license/keyset errors)
|
|
- `POST /keyset/init` (optional: creates empty keyset to silence container warnings)
|
|
|
|
**Windows (native CSP)**
|
|
|
|
1. Install licensed CryptoPro CSP on the runner/host.
|
|
2. Accept the EULA during installation; ensure the license is activated per vendor tooling (`csptest -license -view`).
|
|
3. Set `STELLAOPS_CRYPTO_PRO_ENABLED=1` and configure `StellaOps:Crypto:CryptoPro:Keys` with certificate handle/thumbprint.
|
|
4. Run the guarded tests: `./scripts/crypto/run-cryptopro-tests.ps1` (skips when the env flag or CSP is missing). **No Windows HTTP wrapper/Wine path is shipped; only native CSP on Windows, and the Linux CSP service uses customer-provided `.deb` binaries.**
|
|
5. Capture test output + `csptest -keyset -info` in sprint evidence for RU-CRYPTO-VAL-04/06 closure.
|
|
|
|
**EULA reminder:** StellaOps never distributes CSP binaries or license keys; operators must provide and accept the vendor EULA explicitly via the flags above. If licensing review is deferred, note explicitly in sprint records that licensing remains customer responsibility.
|
|
|
|
## 3. Export Control Analysis
|
|
|
|
### 3.1 Applicable Regulations
|
|
|
|
| Regulation | Jurisdiction | Relevance |
|
|
|------------|--------------|-----------|
|
|
| EAR (Export Administration Regulations) | USA | Crypto export controls |
|
|
| Wassenaar Arrangement | 42 countries | Dual-use goods |
|
|
| EU Dual-Use Regulation | EU | Crypto controls |
|
|
| Russian Export Controls | Russia | GOST algorithm distribution |
|
|
|
|
### 3.2 Algorithm Classification
|
|
|
|
| Algorithm | Classification | Notes |
|
|
|-----------|---------------|-------|
|
|
| ECDSA P-256/P-384 | Mass-market exempt | Widely available |
|
|
| RSA 2048+ | Mass-market exempt | Widely available |
|
|
| EdDSA (Ed25519) | Mass-market exempt | Widely available |
|
|
| GOST R 34.10-2012 | Regional use | See Section 3.3 |
|
|
| SM2/SM3 | Regional use | Chinese national standard |
|
|
|
|
### 3.3 GOST Algorithm Guidance
|
|
|
|
GOST algorithms (GOST R 34.10-2012, GOST R 34.11-2012) are:
|
|
|
|
- **Not export-controlled** from Russia when used in commercial software
|
|
- **May be restricted** for import into certain jurisdictions
|
|
- **Recommended** for use only in RootPack_RU deployments targeting Russian customers
|
|
|
|
**Guidance:**
|
|
1. Default StellaOps distribution does NOT include GOST algorithms enabled
|
|
2. RootPack_RU is a separate distribution with GOST opt-in
|
|
3. Document that customers are responsible for compliance with local crypto regulations
|
|
|
|
### 3.4 Distribution Matrix
|
|
|
|
| Component | Global | RootPack_RU | RootPack_CN | Notes |
|
|
|-----------|--------|-------------|-------------|-------|
|
|
| Core StellaOps | Yes | Yes | Yes | ECDSA/RSA/EdDSA |
|
|
| GostCryptography Fork | Source only | Source + Binary | No | MIT license |
|
|
| CryptoPro Plugin | Interface only | Interface + docs | No | Customer-provided CSP |
|
|
| SM2/SM3 Plugin | No | No | Interface + docs | Customer-provided HSM |
|
|
|
|
## 4. EULA and Notice Requirements
|
|
|
|
### 4.1 NOTICE.md Addition
|
|
|
|
Add to repository `NOTICE.md`:
|
|
|
|
```markdown
|
|
## Third-Party Cryptographic Components
|
|
|
|
### GostCryptography (MIT License)
|
|
Copyright (c) 2014-2024 AlexMAS
|
|
https://github.com/AlexMAS/GostCryptography
|
|
|
|
This software includes a forked version of the GostCryptography library
|
|
for GOST algorithm support. The fork is located at:
|
|
third_party/forks/AlexMAS.GostCryptography/
|
|
|
|
### CryptoPro CSP Integration
|
|
The CryptoPro CSP plugin provides integration with CryptoPro CSP software.
|
|
CryptoPro CSP is commercial software and must be licensed separately by
|
|
the end user. StellaOps does not distribute CryptoPro CSP binaries.
|
|
```
|
|
|
|
### 4.2 Installation Guide Addition
|
|
|
|
Add to installation documentation:
|
|
|
|
```markdown
|
|
## Regional Crypto Support (Optional)
|
|
|
|
### Russian Federation (RootPack_RU)
|
|
|
|
StellaOps supports GOST R 34.10-2012 signing through integration with
|
|
CryptoPro CSP. This integration requires:
|
|
|
|
1. A valid CryptoPro CSP license (obtained separately from crypto-pro.ru)
|
|
2. CryptoPro CSP 4.0 or 5.0 installed on the target system
|
|
3. Configuration of the PKCS#11 module path
|
|
|
|
**Note:** CryptoPro CSP is commercial software. StellaOps provides only
|
|
the integration plugin; the CSP runtime must be licensed and installed
|
|
by the customer.
|
|
```
|
|
|
|
## 5. CI/Testing Implications
|
|
|
|
### 5.1 Test Environment Requirements
|
|
|
|
| Environment | CSP Required | Legal Status |
|
|
|-------------|--------------|--------------|
|
|
| Development (Linux) | No | OpenSSL GOST engine fallback |
|
|
| CI (Linux) | No | Mock/skip CSP tests |
|
|
| CI (Windows opt-in) | Yes | Customer/StellaOps license |
|
|
| Production | Customer | Customer license |
|
|
|
|
### 5.2 CI Guard Implementation
|
|
|
|
Tests are guarded by environment variable:
|
|
|
|
```csharp
|
|
[Fact]
|
|
[SkipUnless("STELLAOPS_CRYPTO_PRO_ENABLED", "1")]
|
|
public async Task CryptoProSigner_SignsWithGost()
|
|
{
|
|
// Test only runs when CSP is available and licensed
|
|
}
|
|
```
|
|
|
|
### 5.3 Wine Loader Experiment (RU-CRYPTO-VAL-05)
|
|
|
|
**Status:** BLOCKED pending legal review
|
|
|
|
Running CryptoPro CSP DLLs under Wine for cross-platform testing:
|
|
|
|
| Consideration | Assessment |
|
|
|---------------|------------|
|
|
| Technical Feasibility | Uncertain - CSP uses Windows APIs |
|
|
| Legal Permissibility | Requires CryptoPro EULA review |
|
|
| Recommendation | Defer to Windows-only testing |
|
|
|
|
**Decision:** Do not pursue Wine loader approach until/unless CryptoPro explicitly permits this use case in their EULA.
|
|
|
|
## 6. Action Items
|
|
|
|
### Immediate (unblocks RU-CRYPTO-VAL-06)
|
|
|
|
- [x] Document fork licensing (MIT) ← This document
|
|
- [x] Document CryptoPro distribution model ← This document
|
|
- [x] Add attribution to NOTICE.md
|
|
- [x] Update installation guide with CSP requirements and license acceptance steps
|
|
- [x] Document CSP license validation flow (Linux wrapper + Windows runner)
|
|
|
|
### Short-term
|
|
|
|
- [ ] Review CryptoPro EULA for Wine usage (if needed)
|
|
- [ ] Create regional distribution manifests for RootPack_RU
|
|
- [ ] Add compliance checkboxes to RootPack_RU installation
|
|
|
|
### For Legal Sign-off
|
|
|
|
- [ ] Confirm MIT + AGPL-3.0 compatibility statement
|
|
- [ ] Confirm customer-provided model for CSP is acceptable
|
|
- [ ] Review export control applicability for GOST distribution
|
|
|
|
## 7. Sign-off Log
|
|
|
|
| Role | Name | Date | Notes |
|
|
|------|------|------|-------|
|
|
| Security Guild | | | |
|
|
| Legal | | | |
|
|
| Product | | | |
|
|
|
|
---
|
|
|
|
*Document Version: 1.0.0*
|
|
*Last Updated: 2025-12-07*
|