config

Documentation

Overview

Package config manages the cryptographic mode and algorithm registry for krypton. Mode determines which algorithms are permitted. Once set, mode is immutable.

Index

• func AlgorithmPermitted(algorithm string) error
• func Init(mode Mode, enablePQC bool) error
• func IsFIPSOnly() bool
• func IsInitialized() bool
• func IsPQCEnabled() bool
• func RequireHybrid() bool
• func ResetForTesting()
• type Config
• type Mode
  • func GetMode() Mode

Functions

func AlgorithmPermitted

func AlgorithmPermitted(algorithm string) error

AlgorithmPermitted checks if an algorithm is permitted in the current mode. Returns ErrAlgorithmNotPermitted if not allowed.

func Init

func Init(mode Mode, enablePQC bool) error

Init initializes the global configuration. Can only be called once. Returns ErrModeImmutable if called after initialization.

func IsFIPSOnly

func IsFIPSOnly() bool

IsFIPSOnly returns whether we're in fips_only mode.

func IsInitialized

func IsInitialized() bool

IsInitialized returns whether config has been initialized.

func IsPQCEnabled

func IsPQCEnabled() bool

IsPQCEnabled returns whether PQC algorithms are enabled.

func RequireHybrid

func RequireHybrid() bool

RequireHybrid returns true if the current mode requires hybrid classical+PQC operations.

func ResetForTesting

func ResetForTesting()

ResetForTesting resets the global config (only for testing).

Types

type Config

type Config struct {
	// contains filtered or unexported fields
}

Config holds the global cryptographic configuration. Once initialized, mode and EnablePQC are immutable.

type Mode

type Mode string

Mode represents the cryptographic operating mode.

const (
	// ModeFIPSOnly allows only FIPS-approved algorithms (no ChaCha, no X25519, no Argon2id).
	ModeFIPSOnly Mode = "fips_only"

	// ModeStandard allows standard algorithms; PQC optional via EnablePQC.
	ModeStandard Mode = "standard"

	// ModePQCHybrid requires PQC and uses hybrid classical+PQC for sign/kem.
	ModePQCHybrid Mode = "pqc_hybrid"

	// ModePQCOnly allows only PQC algorithms (no classical ECDSA/ECDH/RSA/Ed25519/X25519).
	ModePQCOnly Mode = "pqc_only"
)

func GetMode

func GetMode() Mode

GetMode returns the current mode.