blitz_traits/
tls_policy.rs

1//! Typed reasons for refusing TLS under the house algorithm policy.
2
3/// Only ECDSA/Ed25519 authentication and ChaCha20-Poly1305 encryption are allowed.
4#[non_exhaustive]
5#[derive(Clone, Copy, Debug, Eq, PartialEq)]
6pub enum TlsPolicyError {
7    /// An RSA key appeared in the leaf, intermediates, or required trust anchor.
8    RsaCertificateChain,
9    /// A certificate key was neither ECDSA nor Ed25519.
10    CertificateKey,
11    /// A certificate signature was outside the permitted verification algorithms.
12    CertificateSignature,
13    /// A TLS handshake signature was outside the advertised signature schemes.
14    HandshakeSignature,
15    /// The peer selected a cipher suite outside the ChaCha20-Poly1305 offer.
16    CipherSuite,
17    /// The peer rejected the permitted profile with a TLS alert.
18    ///
19    /// The alert does not distinguish RSA-only from AES-only servers.
20    PeerRejectedAlgorithms { alert: u8 },
21}
22
23impl std::fmt::Display for TlsPolicyError {
24    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
25        match self {
26            Self::RsaCertificateChain => f.write_str(
27                "RSA certificate chain forbidden; ECDSA/Ed25519 keys required throughout the chain (alert 43 unsupported_certificate)",
28            ),
29            Self::CertificateKey => f.write_str(
30                "certificate key forbidden; only ECDSA/Ed25519 keys allowed (alert 43 unsupported_certificate)",
31            ),
32            Self::CertificateSignature => f.write_str(
33                "certificate signature forbidden; only ECDSA/Ed25519 verification allowed, RSA signatures forbidden",
34            ),
35            Self::HandshakeSignature => f.write_str(
36                "TLS handshake signature forbidden; only ECDSA/Ed25519 schemes allowed, RSA signatures forbidden",
37            ),
38            Self::CipherSuite => f.write_str(
39                "peer selected a forbidden cipher suite; only ChaCha20-Poly1305 allowed, AES forbidden",
40            ),
41            Self::PeerRejectedAlgorithms { alert } => write!(
42                f,
43                "peer rejected ECDSA/Ed25519 with ChaCha20-Poly1305 (TLS alert {alert}); RSA and AES forbidden; no fallback",
44            ),
45        }
46    }
47}
48
49impl std::error::Error for TlsPolicyError {}
blitz_traits/tls_policy.rs

blitz_traits/
tls_policy.rs
