17 lines
1.0 KiB
Markdown
17 lines
1.0 KiB
Markdown
# Evidence Locker Crypto Registry Prep — PREP-EVID-CRYPTO-90-001
|
||
|
||
Status: **Ready for implementation** (2025-11-20)
|
||
Owners: Evidence Locker Guild · Security Guild
|
||
Scope: Document ICryptoProviderRegistry expectations for Evidence Locker hashing/signing (manifest digests, DSSE, bundle encryption) including sovereign profiles.
|
||
|
||
## Requirements
|
||
- Registry entries must expose: `ProviderId`, `Algorithms` (signing/hash), `KeyUri`, `IsFips`, `IsPQReady`, `SupportsTimestamping`.
|
||
- Evidence Locker must select provider via config `EvidenceLocker:Crypto:ProviderId` with default `stella-default`.
|
||
- DSSE signing for bundles uses provider’s signing key; hashing uses provider hash list in order (sha256 first, optional gost for RU profile).
|
||
- JWKS/keys: provider responsible for exporting JWKS; Evidence Locker caches JWKS via configured `KeyUri`; cache TTL configurable.
|
||
|
||
## Acceptance criteria
|
||
- Prep doc published here; sprint task marked DONE.
|
||
- Provider selection/config rules recorded; hashing/signing responsibilities clarified.
|
||
|