Crypto Registry Decision · 2025-11-18

What this is: a dated decision record for the Stella Ops cryptographic provider registry (ICryptoProviderRegistry). It captures the agreed defaults, the reasoning, and the follow-up work needed to make sovereign-aware crypto selectable through configuration rather than code changes.

Audience: crypto/platform engineers and module owners (EvidenceLocker, ExportCenter, TimelineIndexer, CLI) wiring the registry into their hosts.

Related: Crypto routing audit · 2025-11-07 (the inventory that motivated this decision) · Crypto profile configuration (how operators select a profile at deploy time).

Outcome

• Ship ICryptoProviderRegistry with the following defaults:
  • PreferredProviders (global default): default, ru.openssl.gost, ru.pkcs11.
  • ActiveProfile for RU/sovereign deployments: ru-offline, with preferred order ru.cryptopro.csp, ru.openssl.gost, ru.pkcs11.
  • For non-RU deployments, ActiveProfile remains default.
• Publish the registry contract via the shared library (the StellaOps.Cryptography stack) and reference it from EvidenceLocker, ExportCenter, TimelineIndexer, and downstream services.
• Bind configuration deterministically: keep profile names and provider IDs lowercase ASCII, and enforce ISO-8601 UTC timestamps for any audit material generated by registry actions.

Rationale

• Aligns with the crypto routing audit · 2025-11-07 so that sovereign-ready providers are selectable without code changes.
• Keeps the default provider chain intact for non-sovereign deployments while enabling RU-specific stacks where they are mandated.

Required follow-ups

• Publish the NuGet/package update exposing the approved registry contract and provider IDs.
• Update module hosts (EvidenceLocker, ExportCenter, TimelineIndexer, CLI) to bind StellaOps:Crypto:Registry using the defaults above.
• Add a CI smoke test asserting that the registry resolves the chosen ActiveProfile on both Linux and Windows.
• Mirror this decision into the sprint docs for the affected modules.