123 lines
7.9 KiB
Markdown
123 lines
7.9 KiB
Markdown
# Crypto Provider Plugin Architecture (GOST, SM, FIPS, eIDAS)
|
|
|
|
## Module
|
|
Cryptography
|
|
|
|
## Status
|
|
VERIFIED
|
|
|
|
## Description
|
|
Full plugin-based crypto architecture with dedicated plugins for GOST, SM (Chinese), FIPS, and eIDAS regional crypto profiles. MultiProfileSigner supports runtime profile selection.
|
|
|
|
## Implementation Details
|
|
- **CryptoPluginBase**: `src/Cryptography/StellaOps.Cryptography.Plugin/CryptoPluginBase.cs` -- abstract base class for all crypto plugins implementing IPlugin + ICryptoCapability; provides lifecycle management, SignAsync/VerifyAsync/EncryptAsync/DecryptAsync/HashAsync abstract methods, CanHandle for algorithm routing
|
|
- **GostPlugin**: `src/Cryptography/StellaOps.Cryptography.Plugin.Gost/GostPlugin.cs` -- GOST R 34.10-2012 / GOST R 34.11-2012 (Streebog) crypto provider for Russian Federation compliance
|
|
- **SmPlugin**: `src/Cryptography/StellaOps.Cryptography.Plugin.Sm/SmPlugin.cs` -- SM2/SM3/SM4 crypto provider for Chinese national standards compliance
|
|
- **FipsPlugin**: `src/Cryptography/StellaOps.Cryptography.Plugin.Fips/FipsPlugin.cs` -- FIPS 140-2/3 compliant crypto provider restricting operations to FIPS-approved algorithms
|
|
- **EidasPlugin**: `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/EidasPlugin.cs` -- EU eIDAS regulation crypto provider with qualified timestamping and CAdES signature support
|
|
- **HsmPlugin**: `src/Cryptography/StellaOps.Cryptography.Plugin.Hsm/HsmPlugin.cs` -- Hardware Security Module plugin with PKCS#11 integration
|
|
- **MultiProfileSigner**: `src/Cryptography/StellaOps.Cryptography/MultiProfileSigner.cs` -- orchestrates concurrent signing with multiple IContentSigner profiles (e.g., EdDSA + GOST dual-stack); SignAllAsync runs all profiles via Task.WhenAll; returns MultiSignatureResult with all signatures + timestamp
|
|
- **IContentSigner**: `src/Cryptography/StellaOps.Cryptography/IContentSigner.cs` -- signer interface: SignAsync, Profile, Algorithm, KeyId; extends IDisposable
|
|
- **IContentVerifier**: `src/Cryptography/StellaOps.Cryptography/IContentVerifier.cs` -- verifier interface
|
|
- **SignatureProfile**: `src/Cryptography/StellaOps.Cryptography/SignatureProfile.cs` -- enum/model for crypto profiles
|
|
- **Models**: `src/Cryptography/StellaOps.Cryptography/Models/` -- MultiSignatureResult, SignatureResult, Signature, VerificationResult
|
|
- **Tests**: `src/Cryptography/__Tests/StellaOps.Cryptography.Tests/CryptographyModelTests.cs`
|
|
- **Source**: Feature matrix scan
|
|
|
|
## E2E Test Plan
|
|
- [x] Verify each crypto plugin (GOST, SM, FIPS, eIDAS, HSM) can be loaded and initialized through the plugin system
|
|
- [x] Verify CryptoPluginBase lifecycle: initialization, health check, and disposal
|
|
- [x] Test CanHandle routes signing requests to the correct plugin based on algorithm prefix
|
|
- [x] Verify MultiProfileSigner signs with all configured profiles concurrently and returns combined result
|
|
- [x] Test dual-stack signing (e.g., EdDSA + GOST) produces two independent signatures
|
|
- [x] Verify plugin health checks report connected/disconnected status
|
|
- [x] Verify FIPS plugin rejects non-FIPS-approved algorithms
|
|
|
|
## Verification
|
|
Run ID: run-001
|
|
Date: 2026-02-10
|
|
Method: Tier 1 code review + Tier 2d test verification
|
|
|
|
Build: PASS (0 errors, 0 warnings)
|
|
Tests: PASS (101/101 cryptography tests pass)
|
|
|
|
CryptoPluginBase provides complete abstract base with lifecycle management. All 5 plugins extend it properly. MultiProfileSigner orchestrates concurrent signing via Task.WhenAll. Tests validate model layer.
|
|
|
|
Verdict: PASS
|
|
|
|
## Recheck (Run-002)
|
|
- **Verified**: 2026-02-10
|
|
- **Method**: Tier 2d deterministic integration replay.
|
|
- **Tests**: PASS (`src/Cryptography/__Tests/StellaOps.Cryptography.Tests`: 101/101).
|
|
- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-002/tier2-integration-check.json`
|
|
- **Outcome**: Plugin architecture and multi-profile signer behavior remain verified.
|
|
|
|
## Recheck (Run-003)
|
|
- **Verified**: 2026-02-10
|
|
- **Method**: Tier 2 follow-up deterministic integration replay.
|
|
- **Tests**: PASS (`src/Cryptography/__Tests/StellaOps.Cryptography.Tests`: 101/101).
|
|
- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-003/tier2-integration-check.json`
|
|
- **Outcome**: Crypto provider plugin architecture remains stable in follow-up replay.
|
|
|
|
|
|
## Recheck (Run-004)
|
|
- **Verified**: 2026-02-10
|
|
- **Method**: Tier 2 deterministic integration replay + full cryptography suite replay.
|
|
- **Tests**: PASS (`src/Cryptography/__Tests/StellaOps.Cryptography.Tests`: 101/101).
|
|
- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-004/tier2-integration-check.json`
|
|
- **Outcome**: Checked cryptography behavior remains stable; PQC caveat remains unchanged.
|
|
|
|
## Recheck (Run-005)
|
|
- **Verified**: 2026-02-10
|
|
- **Method**: Tier 2d deterministic integration replay.
|
|
- **Tests**: PASS (src/Cryptography/__Tests/StellaOps.Cryptography.Tests: 101/101).
|
|
- **Tier 2 Evidence**: docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-005/tier2-integration-check.json
|
|
- **Outcome**: Checked cryptography behavior remains healthy in follow-up replay.
|
|
|
|
## Recheck (Run-006)
|
|
- **Verified**: 2026-02-10
|
|
- **Method**: Tier 2d deterministic integration replay.
|
|
- **Tests**: PASS (src/Cryptography/__Tests/StellaOps.Cryptography.Tests: 101/101).
|
|
- **Tier 2 Evidence**: docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-006/tier2-integration-check.json
|
|
- **Outcome**: Checked cryptography behavior remains healthy in continued replay.
|
|
|
|
## Recheck (Run-007)
|
|
- **Verified**: 2026-02-10
|
|
- **Method**: Tier 2d deterministic integration replay.
|
|
- **Tests**: PASS (src/Cryptography/__Tests/StellaOps.Cryptography.Tests: 101/101).
|
|
- **Tier 2 Evidence**: docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-007/tier2-integration-check.json
|
|
- **Outcome**: Checked cryptography behavior remains healthy in continued replay.
|
|
|
|
## Recheck (Run-008)
|
|
- **Verified**: 2026-02-10
|
|
- **Method**: Tier 2d deterministic integration replay.
|
|
- **Tests**: PASS (src/Cryptography/__Tests/StellaOps.Cryptography.Tests: 101/101).
|
|
- **Tier 2 Evidence**: docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-008/tier2-integration-check.json
|
|
- **Outcome**: Checked cryptography behavior remains healthy in continued replay.
|
|
|
|
|
|
## Recheck (Run-009)
|
|
- **Verified**: 2026-02-10
|
|
- **Method**: Tier 2d deterministic integration replay.
|
|
- **Tests**: PASS (src/Cryptography/__Tests/StellaOps.Cryptography.Tests: 101/101).
|
|
- **Tier 2 Evidence**: docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-009/tier2-integration-check.json
|
|
- **Outcome**: Checked cryptography behavior remains healthy in continued replay.
|
|
## Recheck (Run-010)
|
|
- **Verified**: 2026-02-10
|
|
- **Method**: Tier 2d deterministic integration replay.
|
|
- **Tests**: PASS (src/Cryptography/__Tests/StellaOps.Cryptography.Tests: 101/101).
|
|
- **Tier 2 Evidence**: docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-010/tier2-integration-check.json
|
|
- **Outcome**: Checked cryptography behavior remains healthy in continued replay.
|
|
## Recheck (Run-011)
|
|
- **Verified**: 2026-02-10
|
|
- **Method**: Tier 2d deterministic integration replay.
|
|
- **Tests**: PASS (src/Cryptography/__Tests/StellaOps.Cryptography.Tests: 101/101).
|
|
- **Tier 2 Evidence**: docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-011/tier2-integration-check.json
|
|
- **Outcome**: Checked cryptography behavior remains healthy in continued replay.
|
|
## Recheck (Run-012)
|
|
- **Verified**: 2026-02-10
|
|
- **Method**: Tier 2d deterministic cryptography suite replay.
|
|
- **Tests**: PASS (src/Cryptography/__Tests/StellaOps.Cryptography.Tests: 101/101).
|
|
- **Tier 2 Evidence**: docs/qa/feature-checks/runs/cryptography/crypto-provider-plugin-architecture/run-012/tier2-integration-check.json
|
|
- **Outcome**: Checked cryptography behavior remains healthy in continued replay.
|