Enum CipherSuite 

#[repr(u8)]
pub enum CipherSuite {
    Standard2025 = 1,
    PostQuantum2030 = 2,
    Hybrid2028 = 3,
    GovHighAssurance = 4,
    LegacyRSA = 255,
}

Supported cipher suites for cryptographic agility.

Allows rotation from classical to post-quantum algorithms without breaking existing files.

Design Rationale (Poka-yoke)

Hardcoding Ed25519 creates long-term risk. Post-quantum computers could break classical signatures by 2030-2040. This enum allows graceful migration without breaking existing files.

Security Recommendations

• Standard2025: Use for current deployments (fast, small keys)
• Hybrid2028: Use for long-term sensitive data (transition period)
• PostQuantum2030: Use when NIST PQC is fully standardized
• GovHighAssurance: Use for government/defense applications
• LegacyRSA: DEPRECATED - load-only for migration

Variants

Standard2025 = 1

Current standard (2025): Fast, small keys

• Sign: Ed25519 (ed25519-dalek)
• Encrypt: XChaCha20-Poly1305
• Hash: BLAKE3
• KDF: Argon2id

PostQuantum2030 = 2

NIST PQC Standard (2030+): Post-Quantum resistant

• Sign: ML-DSA-65 (Dilithium3)
• KEM: ML-KEM-768 (Kyber768)
• Hash: SHA3-256
• KDF: HKDF-SHA3

Hybrid2028 = 3

Hybrid mode: Classical + Post-Quantum (transition period)

• Sign: Ed25519 + ML-DSA-65 (both required)
• KEM: X25519 + ML-KEM-768

Provides security against both classical and quantum adversaries

GovHighAssurance = 4

Government/High-Assurance (NSA Suite B compatible)

• Sign: ECDSA P-384
• Encrypt: AES-256-GCM
• Hash: SHA-384

Required for some government/defense applications

LegacyRSA = 255

Legacy support (deprecated, load-only)

• Sign: RSA-2048
• Encrypt: AES-128-CBC

WARNING: Do not create new files with this suite

Implementations

impl CipherSuite

pub fn from_u8(value: u8) -> Option<Self>

Convert from u8 value with validation

pub const fn to_u8(self) -> u8

Convert to u8 value

pub const fn is_secure(&self) -> bool

Check if this suite is considered secure (not deprecated)

pub const fn is_post_quantum(&self) -> bool

Check if this suite provides post-quantum resistance

pub const fn is_government_approved(&self) -> bool

Check if this suite is government-approved

pub const fn is_deprecated(&self) -> bool

Check if this suite is deprecated

pub const fn signature_size(&self) -> usize

Get signature size in bytes

pub const fn public_key_size(&self) -> usize

Get public key size in bytes

pub const fn encryption_key_size(&self) -> usize

Get encryption key size in bytes

pub const fn hash_size(&self) -> usize

Get hash output size in bytes

pub const fn name(&self) -> &'static str

Get human-readable name

pub const fn signature_algorithm(&self) -> &'static str

Get signature algorithm name

pub const fn encryption_algorithm(&self) -> &'static str

Get encryption algorithm name

pub const fn hash_algorithm(&self) -> &'static str

Get hash algorithm name

pub const fn kdf_algorithm(&self) -> &'static str

Get KDF algorithm name

pub const fn migration_target(&self) -> Option<Self>

Get recommended migration target

pub const fn security_level_bits(&self) -> u32

Get security level in bits (classical equivalent)

pub const fn meets_security_level(&self, min_bits: u32) -> bool

Check if suite meets minimum security level

pub const fn all() -> &'static [Self]

Get all available suites

pub const fn recommended() -> &'static [Self]

Get recommended suites for new deployments

Trait Implementations

impl Clone for CipherSuite

fn clone(&self) -> CipherSuite

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CipherSuite

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CipherSuite

fn default() -> CipherSuite

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for CipherSuite

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for CipherSuite

fn eq(&self, other: &CipherSuite) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for CipherSuite

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Copy for CipherSuite

impl Eq for CipherSuite

impl StructuralPartialEq for CipherSuite