stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity
Files
cf5b72974f923126944f4dcd47e85864ebb31a3b
git.stella-ops.org/docs/features/checked/cryptography/crypto-provider-plugin-architecture.md
master cf5b72974f save checkpoint
2026-02-11 01:32:14 +02:00

7.9 KiB
Raw Blame History

Crypto Provider Plugin Architecture (GOST, SM, FIPS, eIDAS)

Module

Cryptography

Status

VERIFIED

Description

Full plugin-based crypto architecture with dedicated plugins for GOST, SM (Chinese), FIPS, and eIDAS regional crypto profiles. MultiProfileSigner supports runtime profile selection.

Implementation Details

  • CryptoPluginBase: src/Cryptography/StellaOps.Cryptography.Plugin/CryptoPluginBase.cs -- abstract base class for all crypto plugins implementing IPlugin + ICryptoCapability; provides lifecycle management, SignAsync/VerifyAsync/EncryptAsync/DecryptAsync/HashAsync abstract methods, CanHandle for algorithm routing
  • GostPlugin: src/Cryptography/StellaOps.Cryptography.Plugin.Gost/GostPlugin.cs -- GOST R 34.10-2012 / GOST R 34.11-2012 (Streebog) crypto provider for Russian Federation compliance
  • SmPlugin: src/Cryptography/StellaOps.Cryptography.Plugin.Sm/SmPlugin.cs -- SM2/SM3/SM4 crypto provider for Chinese national standards compliance
  • FipsPlugin: src/Cryptography/StellaOps.Cryptography.Plugin.Fips/FipsPlugin.cs -- FIPS 140-2/3 compliant crypto provider restricting operations to FIPS-approved algorithms
  • EidasPlugin: src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/EidasPlugin.cs -- EU eIDAS regulation crypto provider with qualified timestamping and CAdES signature support
  • HsmPlugin: src/Cryptography/StellaOps.Cryptography.Plugin.Hsm/HsmPlugin.cs -- Hardware Security Module plugin with PKCS#11 integration
  • MultiProfileSigner: src/Cryptography/StellaOps.Cryptography/MultiProfileSigner.cs -- orchestrates concurrent signing with multiple IContentSigner profiles (e.g., EdDSA + GOST dual-stack); SignAllAsync runs all profiles via Task.WhenAll; returns MultiSignatureResult with all signatures + timestamp
  • IContentSigner: src/Cryptography/StellaOps.Cryptography/IContentSigner.cs -- signer interface: SignAsync, Profile, Algorithm, KeyId; extends IDisposable
  • IContentVerifier: src/Cryptography/StellaOps.Cryptography/IContentVerifier.cs -- verifier interface
  • SignatureProfile: src/Cryptography/StellaOps.Cryptography/SignatureProfile.cs -- enum/model for crypto profiles
  • Models: src/Cryptography/StellaOps.Cryptography/Models/ -- MultiSignatureResult, SignatureResult, Signature, VerificationResult
  • Tests: src/Cryptography/__Tests/StellaOps.Cryptography.Tests/CryptographyModelTests.cs
  • Source: Feature matrix scan

E2E Test Plan

  • Verify each crypto plugin (GOST, SM, FIPS, eIDAS, HSM) can be loaded and initialized through the plugin system
  • Verify CryptoPluginBase lifecycle: initialization, health check, and disposal
  • Test CanHandle routes signing requests to the correct plugin based on algorithm prefix
  • Verify MultiProfileSigner signs with all configured profiles concurrently and returns combined result
  • Test dual-stack signing (e.g., EdDSA + GOST) produces two independent signatures
  • Verify plugin health checks report connected/disconnected status
  • Verify FIPS plugin rejects non-FIPS-approved algorithms

Verification

Run ID: run-001 Date: 2026-02-10 Method: Tier 1 code review + Tier 2d test verification

Build: PASS (0 errors, 0 warnings) Tests: PASS (101/101 cryptography tests pass)

CryptoPluginBase provides complete abstract base with lifecycle management. All 5 plugins extend it properly. MultiProfileSigner orchestrates concurrent signing via Task.WhenAll. Tests validate model layer.

Verdict: PASS

Recheck (Run-002)

  • Verified: 2026-02-10
  • Method: Tier 2d deterministic integration replay.
  • Tests: PASS (src/Cryptography/__Tests/StellaOps.Cryptography.Tests: 101/101).
  • Tier 2 Evidence: docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-002/tier2-integration-check.json
  • Outcome: Plugin architecture and multi-profile signer behavior remain verified.

Recheck (Run-003)

  • Verified: 2026-02-10
  • Method: Tier 2 follow-up deterministic integration replay.
  • Tests: PASS (src/Cryptography/__Tests/StellaOps.Cryptography.Tests: 101/101).
  • Tier 2 Evidence: docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-003/tier2-integration-check.json
  • Outcome: Crypto provider plugin architecture remains stable in follow-up replay.

Recheck (Run-004)

  • Verified: 2026-02-10
  • Method: Tier 2 deterministic integration replay + full cryptography suite replay.
  • Tests: PASS (src/Cryptography/__Tests/StellaOps.Cryptography.Tests: 101/101).
  • Tier 2 Evidence: docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-004/tier2-integration-check.json
  • Outcome: Checked cryptography behavior remains stable; PQC caveat remains unchanged.

Recheck (Run-005)

  • Verified: 2026-02-10
  • Method: Tier 2d deterministic integration replay.
  • Tests: PASS (src/Cryptography/__Tests/StellaOps.Cryptography.Tests: 101/101).
  • Tier 2 Evidence: docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-005/tier2-integration-check.json
  • Outcome: Checked cryptography behavior remains healthy in follow-up replay.

Recheck (Run-006)

  • Verified: 2026-02-10
  • Method: Tier 2d deterministic integration replay.
  • Tests: PASS (src/Cryptography/__Tests/StellaOps.Cryptography.Tests: 101/101).
  • Tier 2 Evidence: docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-006/tier2-integration-check.json
  • Outcome: Checked cryptography behavior remains healthy in continued replay.

Recheck (Run-007)

  • Verified: 2026-02-10
  • Method: Tier 2d deterministic integration replay.
  • Tests: PASS (src/Cryptography/__Tests/StellaOps.Cryptography.Tests: 101/101).
  • Tier 2 Evidence: docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-007/tier2-integration-check.json
  • Outcome: Checked cryptography behavior remains healthy in continued replay.

Recheck (Run-008)

  • Verified: 2026-02-10
  • Method: Tier 2d deterministic integration replay.
  • Tests: PASS (src/Cryptography/__Tests/StellaOps.Cryptography.Tests: 101/101).
  • Tier 2 Evidence: docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-008/tier2-integration-check.json
  • Outcome: Checked cryptography behavior remains healthy in continued replay.

Recheck (Run-009)

  • Verified: 2026-02-10
  • Method: Tier 2d deterministic integration replay.
  • Tests: PASS (src/Cryptography/__Tests/StellaOps.Cryptography.Tests: 101/101).
  • Tier 2 Evidence: docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-009/tier2-integration-check.json
  • Outcome: Checked cryptography behavior remains healthy in continued replay.

Recheck (Run-010)

  • Verified: 2026-02-10
  • Method: Tier 2d deterministic integration replay.
  • Tests: PASS (src/Cryptography/__Tests/StellaOps.Cryptography.Tests: 101/101).
  • Tier 2 Evidence: docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-010/tier2-integration-check.json
  • Outcome: Checked cryptography behavior remains healthy in continued replay.

Recheck (Run-011)

  • Verified: 2026-02-10
  • Method: Tier 2d deterministic integration replay.
  • Tests: PASS (src/Cryptography/__Tests/StellaOps.Cryptography.Tests: 101/101).
  • Tier 2 Evidence: docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-011/tier2-integration-check.json
  • Outcome: Checked cryptography behavior remains healthy in continued replay.

Recheck (Run-012)

  • Verified: 2026-02-10
  • Method: Tier 2d deterministic cryptography suite replay.
  • Tests: PASS (src/Cryptography/__Tests/StellaOps.Cryptography.Tests: 101/101).
  • Tier 2 Evidence: docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-012/tier2-integration-check.json
  • Outcome: Checked cryptography behavior remains healthy in continued replay.