(
alg: CryptographicAlgorithm,
whitelist: Option<&HashSet<CryptographicAlgorithm>>,
)
| 651 | } |
| 652 | |
| 653 | fn validate_algorithm( |
| 654 | alg: CryptographicAlgorithm, |
| 655 | whitelist: Option<&HashSet<CryptographicAlgorithm>>, |
| 656 | ) -> KResult<()> { |
| 657 | // Default blacklist (deprecated/broken or not in requested scope) |
| 658 | match alg { |
| 659 | CryptographicAlgorithm::DES |
| 660 | | CryptographicAlgorithm::THREE_DES |
| 661 | | CryptographicAlgorithm::RC2 |
| 662 | | CryptographicAlgorithm::RC4 |
| 663 | | CryptographicAlgorithm::RC5 |
| 664 | | CryptographicAlgorithm::IDEA |
| 665 | | CryptographicAlgorithm::CAST5 |
| 666 | | CryptographicAlgorithm::Blowfish |
| 667 | | CryptographicAlgorithm::SKIPJACK |
| 668 | | CryptographicAlgorithm::MARS |
| 669 | | CryptographicAlgorithm::OneTimePad |
| 670 | | CryptographicAlgorithm::HMACMD5 |
| 671 | | CryptographicAlgorithm::DSA |
| 672 | | CryptographicAlgorithm::ECMQV => { |
| 673 | return deny( |
| 674 | ErrorReason::Constraint_Violation, |
| 675 | format!("Deprecated algorithm: {alg}"), |
| 676 | ); |
| 677 | } |
| 678 | _ => {} |
| 679 | } |
| 680 | |
| 681 | // In-scope + still allowed (note: non-fips feature may add more algorithms) |
| 682 | match alg { |
| 683 | CryptographicAlgorithm::AES |
| 684 | | CryptographicAlgorithm::RSA |
| 685 | | CryptographicAlgorithm::ECDSA |
| 686 | | CryptographicAlgorithm::ECDH |
| 687 | | CryptographicAlgorithm::EC |
| 688 | | CryptographicAlgorithm::HMACSHA1 |
| 689 | | CryptographicAlgorithm::HMACSHA224 |
| 690 | | CryptographicAlgorithm::HMACSHA256 |
| 691 | | CryptographicAlgorithm::HMACSHA384 |
| 692 | | CryptographicAlgorithm::HMACSHA512 |
| 693 | | CryptographicAlgorithm::ChaCha20 |
| 694 | | CryptographicAlgorithm::Poly1305 |
| 695 | | CryptographicAlgorithm::ChaCha20Poly1305 |
| 696 | | CryptographicAlgorithm::SHA3224 |
| 697 | | CryptographicAlgorithm::SHA3256 |
| 698 | | CryptographicAlgorithm::SHA3384 |
| 699 | | CryptographicAlgorithm::SHA3512 |
| 700 | | CryptographicAlgorithm::HMACSHA3224 |
| 701 | | CryptographicAlgorithm::HMACSHA3256 |
| 702 | | CryptographicAlgorithm::HMACSHA3384 |
| 703 | | CryptographicAlgorithm::HMACSHA3512 |
| 704 | | CryptographicAlgorithm::Ed448 |
| 705 | | CryptographicAlgorithm::CoverCrypt |
| 706 | | CryptographicAlgorithm::CoverCryptBulk => {} |
| 707 | #[cfg(feature = "non-fips")] |
| 708 | CryptographicAlgorithm::Ed25519 => {} |
| 709 | #[cfg(feature = "non-fips")] |
| 710 | CryptographicAlgorithm::ConfigurableKEM |
no test coverage detected