Crypto Profile Configuration

Audience: Operators and DevOps owners deploying into regulated regions; crypto/platform engineers. Scope: How to pick a regional crypto profile, choose between free/OSS and paid/licensed providers, and enable simulations while hardware or licenses are pending.

Related: Cryptographic compliance profiles (the purpose-based algorithm model and certification status) · FIPS/eIDAS/KCMVP validation · OpenSSL GOST remote signer · SM hardware simulation.

Use this guide to take a deployment from “which region am I in?” to a working, evidence-producing crypto profile — including the OSS, licensed, and simulated provider paths.

Quick selectors

Step-by-step: pick a region

  1. Choose the compliance profile ID and set STELLAOPS_CRYPTO_COMPLIANCE_PROFILE.
  2. Set StellaOps:Crypto:Registry:ActiveProfile to the region (see table below) and order the PreferredProviders.
  3. Decide on provider type:
    • Free/OSS: OpenSSL GOST (RU), SM soft, PQ soft, FIPS/eIDAS/KCMVP soft baselines.
    • Paid/licensed: CryptoPro (RU), QSCD (eIDAS), certified FIPS/KCMVP modules when available. See docs/legal/crypto-compliance-review.md for licensing/export notes.
    • Simulation: enable STELLAOPS_CRYPTO_ENABLE_SIM=1 and point STELLAOPS_CRYPTO_SIM_URL to sim-crypto-service.
  4. Apply any provider-specific env (e.g., CRYPTOPRO_ACCEPT_EULA=1, SM_SOFT_ALLOWED=1, PQ_SOFT_ALLOWED=1, PKCS#11 PINs).
  5. Capture evidence: JWKS export + CryptoProviderMetrics + fixed-message sign/verify logs.
  6. If you only need a smoke check without full tests, run dotnet run --project devops/services/crypto/sim-crypto-smoke/SimCryptoSmoke.csproj against a running simulator (see SIM_PROFILE/SIM_ALGORITHMS below).

Operator selection via CLI / admin API

You do not have to hand-edit appsettings*.json to change profiles. The CLI exposes the regional-crypto surface under stella crypto (CryptoCommandGroup):

Persistence is hybrid (CryptoProfilePreferenceStore): when a backend URL is configured the CLI calls the platform admin endpoint PUT /api/v1/admin/crypto-providers/preferences (tenant-scoped); otherwise it falls back to a local YAML file at ~/.stellaops/appsettings.crypto.yaml that sets StellaOps:Crypto:Registry:ActiveProfile. This keeps the offline/air-gap bootstrap path working while converging on platform-managed state for connected deployments.

Choosing a region

RegionCompliance profileRegistry profile / providersFree vs paidSimulation
RU (OSS)gostActiveProfile: ru-offline; providers: ru.openssl.gost, ru.pkcs11Free (OpenSSL) path on Linux — ru.openssl.gost is auto-required when STELLAOPS_CRYPTO_ENABLE_RU_OPENSSL is set (default on Linux); ru.pkcs11 via STELLAOPS_CRYPTO_ENABLE_RU_PKCS11 (default on). Optional remote signer: see docs/security/openssl-gost-remote.md. (NOT a StellaOps-wired env var — STELLAOPS_RU_OPENSSL_REMOTE_URL is a deployment-level routing toggle described in that runbook; OpenSslGostProvider has no remote-URL option, so the host/gateway, not the provider, consumes it.)STELLAOPS_CRYPTO_ENABLE_SIM=1; sim covers GOST12 + Magma/Kuznyechik when hardware/licensing is unavailable.
RU (CryptoPro paid)gostSame profile; ensure ru.cryptopro.csp registered.Linux-only CSP service: bind customer .deb packages to /opt/cryptopro/downloads, set CRYPTOPRO_ACCEPT_EULA=1, run devops/services/cryptopro/linux-csp-service. Licensing model documented in docs/legal/crypto-compliance-review.md.Use simulator until licenses are supplied.
CN (SM)smActiveProfile: sm; providers: cn.sm.soft (env SM_SOFT_ALLOWED=1), optional PKCS#11.Hardware/PKCS#11 wiring in docs/security/sm-hardware-simulation.md.sim-crypto-service handles SM2 (sim.crypto.remote).
FIPS (US)fipsProviders: fips.ecdsa.soft (software-only, non-certified; signs ES256/384/512, hashes SHA-256/384/512; gate FIPS_SOFT_ALLOWED must be set to 1/true — defaults off), KMS/OpenSSL FIPS when available.Certified module runbook: docs/security/fips-eidas-kcmvp-validation.md.Simulator covers ES256/384/512 (sim.crypto.remote).
eIDAS (EU)eidasProviders: eu.eidas.soft (software-only, non-certified, QSCD not enforced; signs ES256/384, hashes SHA-256/384; gate EIDAS_SOFT_ALLOWED must be set to 1/true — defaults off).QSCD bring-up in docs/security/fips-eidas-kcmvp-validation.md.Simulator (sim.crypto.remote) until QSCD arrives.
KCMVP (KR)kcmvpProviders: kr.kcmvp.hash (SHA-256 hash-only baseline; gate KCMVP_HASH_ALLOWED — note this gate defaults to enabled when unset, unlike the FIPS/eIDAS gates which default off), future KCDSA/ARIA/SEED module.Hardware flow in docs/security/fips-eidas-kcmvp-validation.md.Simulator (sim.crypto.remote) while awaiting certified module.
PQ addenda(overlay)Enable via PQ_SOFT_ALLOWED=1; provider pq.soft.Uses liboqs/BouncyCastle soft providers.Simulator available via sim.crypto.remote if you want a remote signer.

Sample config (appsettings.json)

Binding note: the registry/sim options bind under StellaOps:Crypto:* (StellaOps:Crypto:Registry → CryptoProviderRegistryOptions, StellaOps:Crypto:Sim → SimRemoteProviderOptions), but the compliance options bind from the root-level Crypto:Compliance section (CryptoComplianceOptions.SectionKey = "Crypto:Compliance", bound by CryptoComplianceOptionsConfiguration). Compliance is therefore a sibling of StellaOps, not a child of it — putting it under StellaOps:Compliance would not be read.

{
  "StellaOps": {
    "Crypto": {
      "Registry": {
        "ActiveProfile": "ru-offline",
        "PreferredProviders": [ "ru.openssl.gost", "ru.pkcs11", "sim.crypto.remote" ]
      },
      "Sim": {
        "BaseAddress": "http://localhost:8080"
      }
    }
  },
  "Crypto": {
    "Compliance": {
      "ProfileId": "gost",
      "StrictValidation": true
    }
  }
}

Licensing and hardware notes

Simulation guidance

Use simulation paths when licensed hardware or certified modules are unavailable. They keep the registry/profile contracts stable while waiting for customer licenses (CryptoPro), QSCD devices (eIDAS), KCMVP modules, or SM PKCS#11 tokens.

Unified simulator (sim-crypto-service)

Quick simulation steps

  1. Build and run:

    docker build -t sim-crypto -f devops/services/crypto/sim-crypto-service/Dockerfile devops/services/crypto/sim-crypto-service
docker run --rm -p 8080:8080 sim-crypto

  2. Configure environment:

    • Set STELLAOPS_CRYPTO_ENABLE_SIM=1 to append sim.crypto.remote to registry ordering.
    • Point the client: STELLAOPS_CRYPTO_SIM_URL=http://localhost:8080 or bind StellaOps:Crypto:Sim:BaseAddress.
    • Keep sim.crypto.remote first in PreferredProviders for the target profile.

  3. Quick check (curl):

    MESSAGE_BASE64=$(printf "stellaops-sim-check" | base64)
curl -s -X POST http://localhost:8080/sign \
  -H 'content-type: application/json' \
  -d "{\"messageBase64\":\"${MESSAGE_BASE64}\",\"algorithm\":\"SM2\"}"

  4. Smoke harnesses (no VSTest):

    • PowerShell: devops/tools/run-sim-smoke.ps1 (args: -BaseUrl http://localhost:5000 -SimProfile sm|ru-free|ru-paid|eidas|fips|kcmvp|pq)
    • Headless: dotnet run --project devops/services/crypto/sim-crypto-smoke/SimCryptoSmoke.csproj -c Release with SIM_PROFILE and optional SIM_MESSAGE/SIM_ALGORITHMS=SM2,pq.sim,ES256. SIM_PROFILE defaults to regional (an alias for all), which exercises the full regional set (SM2, sm.sim, sm2.sim, GOST12-256, GOST12-512, ru.magma.sim, ru.kuznyechik.sim, eidas.sim, fips.sim, pq.sim, DILITHIUM3, FALCON512). Single-region values map to one algorithm each (Program.cs::ResolveAlgorithm): sm/china/sm2→SM2; gost/russia/ru/ru-free/ru-paid→GOST12-256; eidas/eu→eidas.sim; fips→fips.sim; pq/post-quantum→pq.sim; kcmvp/kr→kcmvp.sim. An unrecognised value is passed through verbatim as the algorithm ID. The harness reads STELLAOPS_CRYPTO_SIM_URL (default http://localhost:5000, not 8080).

Use the simulator to close sprints until certified evidence is available; keep “non-certified” labels in RootPack manifests.

Evidence expectations

Last updated: 2025-12-11.