checkId: check.core.crypto.available plugin: stellaops.doctor.core severity: fail tags: [quick, security, crypto]

Cryptography Providers

Doctor check check.core.crypto.available — for operators confirming that the host provides the cryptographic primitives Stella Ops needs for signing, hashing, and encryption before those operations fail at runtime.

What It Checks

Verifies that required cryptographic algorithms are available on the host system. The check tests six algorithms by actually executing them:

Algorithm	Test
SHA-256	Hashes a 4-byte test payload
SHA-384	Hashes a 4-byte test payload
SHA-512	Hashes a 4-byte test payload
RSA	Creates an RSA key pair and reads the key size
ECDSA	Creates an ECDSA key pair and reads the key size
AES	Creates an AES cipher and reads the key size

The check also detects whether FIPS mode is enforced on the system via CryptoConfig.AllowOnlyFipsAlgorithms and reports the OS platform.

If any algorithm fails to execute, the check reports fail with the list of unavailable algorithms.

Why It Matters

Stella Ops relies on these cryptographic primitives for:

SHA-256/384/512: SBOM digests, evidence hashing, content-addressable storage, DSSE payloads.
RSA/ECDSA: JWT signing, TLS certificates, code signing, attestation signatures.
AES: Data-at-rest encryption, data protection keys.

If any algorithm is unavailable, core features like evidence signing, token validation, and encrypted storage will fail at runtime.

Common Causes

Operating system does not support required algorithms (minimal or stripped-down containers)
FIPS mode restrictions preventing non-FIPS algorithms
Missing cryptographic libraries (e.g., OpenSSL not installed in Alpine images)
Running on a platform with limited crypto support

How to Fix

Docker Compose

If using Alpine-based images, ensure OpenSSL is installed:

RUN apk add --no-cache openssl

Or switch to a Debian/Ubuntu-based image that includes full crypto support:

FROM mcr.microsoft.com/dotnet/aspnet:8.0

Bare Metal / systemd

Install required crypto libraries:

# Debian/Ubuntu
sudo apt-get install -y openssl libssl-dev

# RHEL/CentOS
sudo yum install -y openssl openssl-devel

If FIPS mode is required, ensure all algorithms used are FIPS-compliant:

# Check FIPS status
cat /proc/sys/crypto/fips_enabled

Kubernetes / Helm

Use a base image with full cryptographic support. In your Helm values:

image:
  repository: stellaops/platform
  tag: latest  # Uses Debian-based runtime with full crypto

Verification

stella doctor run --check check.core.crypto.available

check.security.encryption — validates encryption key configuration and algorithms
check.security.tls.certificate — validates TLS certificate availability and validity

See the Doctor reference for the full check catalog, CLI usage, and export bundles.