45 lines
1.5 KiB
TypeScript
45 lines
1.5 KiB
TypeScript
/**
|
||
* Repo-wide crypto primitive selector.
|
||
*
|
||
* For every registered `PrimitiveId`, choose the impl flavour that builds
|
||
* will route to. Values MUST be one of `'noble'` (vendor-reviewed JS
|
||
* reference), `'native'` (our in-house JS re-implementation), or a future
|
||
* `'wasm'` / `'webcrypto'` flavour as they land.
|
||
*
|
||
* Flipping a value here triggers the codegen (`scripts/gen-crypto-selects.ts`)
|
||
* to overwrite the corresponding `<id>.select.ts` file. The CI guard
|
||
* `scripts/check-crypto-selects.ts` fails the build if the generated
|
||
* selects are out of date or have been hand-edited.
|
||
*
|
||
* Policy for flipping to `'native'`:
|
||
* - Tier-safe primitives (hmac / hkdf / pbkdf2): after gates 1–3
|
||
* (KAT + fuzz + timing) only.
|
||
* - Hash compressions (sha256 / sha384 / sha512): after gates 1–3 and a
|
||
* benchmark within 2× of noble.
|
||
* - Dangerous tier (curves, AEADs, argon2id): audit required per primitive.
|
||
* Staying on `'noble'` indefinitely is a legitimate terminal state.
|
||
*/
|
||
import type { PrimitiveId } from "@suaveplan/crypto-utils/primitive-id";
|
||
|
||
export type PrimitiveFlavour = "noble" | "native";
|
||
|
||
export const cryptoConfig: Readonly<Record<PrimitiveId, PrimitiveFlavour>> = {
|
||
// hash
|
||
sha256: "noble",
|
||
sha384: "noble",
|
||
sha512: "noble",
|
||
hmac: "noble",
|
||
hkdf: "noble",
|
||
pbkdf2: "noble",
|
||
argon2id: "noble",
|
||
// curve
|
||
secp256k1: "noble",
|
||
ed25519: "noble",
|
||
x25519: "noble",
|
||
p256: "noble",
|
||
// cipher
|
||
"aes-256-gcm": "noble",
|
||
"chacha20-poly1305": "noble",
|
||
"xchacha20-poly1305": "noble",
|
||
};
|