Enum AlgorithmProfile 

#[repr(u8)]
pub enum AlgorithmProfile {
    Unrestricted = 0,
    Cnsa2 = 1,
    Cnsa1 = 2,
    Migration = 3,
}

Algorithm restriction profile selected at module initialization.

A single binary can serve general FIPS 140-3 consumers (Unrestricted) and CNSA-restricted deployments (Cnsa2, Cnsa1) by choosing the appropriate profile at init time.

The profile is immutable once set: it is stored when the module becomes Operational and cannot be changed without restarting the process (which resets the state machine). A module that fails initialisation reports the default, Unrestricted.

Variants

Unrestricted = 0

All FIPS-approved algorithms are available. This is the default and preserves backward compatibility with callers that use initialize_with_tests.

Cnsa2 = 1

CNSA 2.0 — CNSSP-15 (March 2025) Annex B: AES-256, ML-KEM-1024, ML-DSA-87, SHA-384 or SHA-512, and the SP 800-208 stateful hash-based signatures for software and firmware signing, with the supporting services those need at matching strength. The suite names no Keccak-family algorithm for a software module, so none is permitted here. Everything else returns Error::AlgorithmRestricted.

Cnsa1 = 2

CNSA 1.0 — CNSSP-15 (October 2016) Annex B: AES-256, ECDH and ECDSA on P-384, SHA-384, and Diffie-Hellman and RSA at a minimum 3072-bit modulus, with the supporting services those need at matching strength. SHA-256 and its variants are refused: the suite admits them only under a near-term condition scoped to UNCLASSIFIED data, which a module cannot evaluate.

Migration = 3

Both suites at once — not a CNSA profile and not defined by any standard. This is oxicrypt’s own union of CNSA 1.0 and CNSA 2.0, for a deployment migrating between them that must run classical and post-quantum algorithms side by side.

It is narrower than Unrestricted, which refuses nothing: SHA-1, AES-128, RSA-2048 and P-256 are all refused here. It admits no Keccak-family algorithm, because neither suite does.

Trait Implementations

impl Clone for AlgorithmProfile

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for AlgorithmProfile

impl Debug for AlgorithmProfile

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for AlgorithmProfile

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for AlgorithmProfile

impl PartialEq for AlgorithmProfile

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for AlgorithmProfile