lit/crypto/
mod.rs

1pub mod agent;
2pub mod encryption;
3pub mod fips;
4/// Cryptographic primitives module
5/// Implements NIST-approved post-quantum cryptography standards
6/// Cryptographic operations for Lit version control
7///
8/// FIPS 140-3 compliant cryptographic operations
9/// All algorithms are approved for use in validated modules
10pub mod signatures;
11
12use serde::{Deserialize, Serialize};
13
14/// Cryptographic configuration for FIPS 140-3 compliance
15#[derive(Debug, Clone, Serialize, Deserialize)]
16pub struct CryptoConfig {
17    /// Enable post-quantum signatures (ML-DSA/Dilithium)
18    pub enable_pq_signatures: bool,
19    /// Hash algorithm version
20    pub hash_version: HashVersion,
21    /// FIPS 140-3 mode (uses only approved algorithms)
22    pub fips_mode: bool,
23    /// Enable power-on self-tests
24    pub enable_self_tests: bool,
25}
26
27#[derive(Debug, Clone, Serialize, Deserialize)]
28pub enum HashVersion {
29    /// SHA3-512 + BLAKE3 composite (quantum-resistant)
30    CompositeV1,
31    /// SHA-512 only (FIPS 140-3 approved, FIPS 180-4)
32    Sha512Fips,
33}
34
35impl Default for CryptoConfig {
36    fn default() -> Self {
37        CryptoConfig {
38            enable_pq_signatures: true,
39            hash_version: HashVersion::CompositeV1,
40            fips_mode: true, // FIPS mode enabled by default
41            enable_self_tests: true,
42        }
43    }
44}
45
46impl CryptoConfig {
47    /// Load from repository or use defaults
48    pub fn load() -> Self {
49        // For now, use defaults. Future: load from .lit/crypto_config
50        Self::default()
51    }
52
53    /// Create FIPS 140-3 strict mode configuration
54    pub fn fips_strict() -> Self {
55        CryptoConfig {
56            enable_pq_signatures: false, // PQ not yet FIPS 140-3 approved
57            hash_version: HashVersion::Sha512Fips,
58            fips_mode: true,
59            enable_self_tests: true,
60        }
61    }
62}
63
64/// FIPS 140-2 operational state
65#[derive(Debug, Clone, PartialEq)]
66pub enum FipsState {
67    /// Power-on state, self-tests not run
68    PowerOn,
69    /// Self-tests passed, ready for cryptographic operations
70    Approved,
71    /// Self-test failed, cryptographic operations disabled
72    Error,
73}
lit/crypto/mod.rs

lit/crypto/
mod.rs
