lit/crypto/
mod.rs

1pub mod encryption;
2pub mod fips;
3/// Cryptographic primitives module
4/// Implements NIST-approved post-quantum cryptography standards
5/// Cryptographic operations for Lit version control
6///
7/// FIPS 140-3 compliant cryptographic operations
8/// All algorithms are approved for use in validated modules
9pub mod signatures;
10
11use serde::{Deserialize, Serialize};
12
13/// Cryptographic configuration for FIPS 140-3 compliance
14#[derive(Debug, Clone, Serialize, Deserialize)]
15pub struct CryptoConfig {
16    /// Enable post-quantum signatures (ML-DSA/Dilithium)
17    pub enable_pq_signatures: bool,
18    /// Hash algorithm version
19    pub hash_version: HashVersion,
20    /// FIPS 140-3 mode (uses only approved algorithms)
21    pub fips_mode: bool,
22    /// Enable power-on self-tests
23    pub enable_self_tests: bool,
24}
25
26#[derive(Debug, Clone, Serialize, Deserialize)]
27pub enum HashVersion {
28    /// SHA3-512 + BLAKE3 composite (quantum-resistant)
29    CompositeV1,
30    /// SHA-512 only (FIPS 140-3 approved, FIPS 180-4)
31    Sha512Fips,
32}
33
34impl Default for CryptoConfig {
35    fn default() -> Self {
36        CryptoConfig {
37            enable_pq_signatures: true,
38            hash_version: HashVersion::CompositeV1,
39            fips_mode: true, // FIPS mode enabled by default
40            enable_self_tests: true,
41        }
42    }
43}
44
45impl CryptoConfig {
46    /// Load from repository or use defaults
47    pub fn load() -> Self {
48        // For now, use defaults. Future: load from .lit/crypto_config
49        Self::default()
50    }
51
52    /// Create FIPS 140-3 strict mode configuration
53    pub fn fips_strict() -> Self {
54        CryptoConfig {
55            enable_pq_signatures: false, // PQ not yet FIPS 140-3 approved
56            hash_version: HashVersion::Sha512Fips,
57            fips_mode: true,
58            enable_self_tests: true,
59        }
60    }
61}
62
63/// FIPS 140-2 operational state
64#[derive(Debug, Clone, PartialEq)]
65pub enum FipsState {
66    /// Power-on state, self-tests not run
67    PowerOn,
68    /// Self-tests passed, ready for cryptographic operations
69    Approved,
70    /// Self-test failed, cryptographic operations disabled
71    Error,
72}
lit/crypto/mod.rs

lit/crypto/
mod.rs
