Crate ic_ontology

Expand description

§ic-ontology — the machine-readable cryptographic ontology

This crate is what makes IronCrypto agentic-first. A conventional crypto library documents itself for humans: prose, examples, a changelog. An agent has to guess which primitive fits its task, guess whether its deployment allows it, and guess what will go wrong. Each guess is a chance to ship something broken.

The ontology replaces those guesses with data:

registry — every algorithm, described in closed vocabulary terms: class, purpose, strength against classical and quantum adversaries, FIPS standing, standards, parameter bounds, usage constraints with severities, relations to other algorithms, and the exact Rust path to call.
Query — filter by what the task needs, not by name.
select — go straight from an Intent and a Policy to a Recommendation carrying the choice, the reasoning, the rejected alternatives, and the rules the caller must honour.
export — emit the whole thing as JSON, JSON-LD, Turtle, or JSON Schema for tools that do not speak Rust.

§The property that matters most

The registry describes algorithms this library does not implement, and declines rather than substituting something weaker. Asked for a policy nothing here satisfies, an agent gets a refusal instead of the nearest plausible answer:

use ic_ontology::select::{recommend, Intent, NoRecommendation, Policy};

// No hash offers this much quantum resistance, so the answer is "nothing",
// not "the strongest one available".
let outcome = recommend(
    Intent::HashData,
    Policy { require_fips: false, min_classical_bits: 0,
             min_quantum_bits: 512, aes_hardware: false },
);
assert_eq!(outcome.unwrap_err(), NoRecommendation::NothingSatisfiesPolicy);

An honest “no” is worth more to an autonomous caller than a plausible “yes”.

This example used to be post-quantum key agreement, which returned select::NoRecommendation::KnownButUnavailable because ML-KEM-768 was implemented but not checked against anyone else’s values. It is checked against NIST’s ACVP vectors now, so that call succeeds and the example had to move to a policy that still has no answer.

Re-exports§

pub use query::all;
pub use query::get;
pub use query::related;
pub use query::Query;
pub use registry::REGISTRY;
pub use rules::Rule;
pub use rules::RULES;
pub use select::recommend;
pub use select::Intent;
pub use select::NoRecommendation;
pub use select::Policy;
pub use select::Recommendation;
pub use types::Class;
pub use types::Constraint;
pub use types::Edge;
pub use types::Entry;
pub use types::FipsStatus;
pub use types::ImplStatus;
pub use types::Param;
pub use types::Performance;
pub use types::Purpose;
pub use types::Relation;
pub use types::Severity;
pub use types::Strength;
pub use types::Unit;

Modules§

errors: The error catalog, mirroring ic_core::ErrorKind.
export: Serializing the ontology for consumption outside Rust.
frameworks: Security frameworks: weaknesses, adversary techniques, CMMC practices and SP 800-53 controls.
profile: Named algorithm suites: what a profile permits, and nothing else.
query: Querying the registry.
registry: The algorithm registry: every entry the ontology knows about.
rules: The rules that hold for every algorithm, as data.
runtime: What this particular build can actually do.
select: Intent-driven algorithm selection.
standards: The standards knowledgebase: documents, and the obligations they impose.
types: The ontology vocabulary: the types every registry entry is built from.

Constants§

ONTOLOGY_VERSION: The ontology’s schema version.