Module: Confium::Policy

Defined in:
lib/confium/policy.rb

Constant Summary collapse

JURISDICTIONS =

Built-in jurisdictional policies. Each is a Hash mapping algorithm name to minimum key bits.

{
  # EU: eIDAS + GDPR alignment. RSA >= 2048, ECDSA P-256+.
  eu: {
    rsa:       2048,
    ecdsa_p256: 256,
    ecdsa_p384: 384,
    ed25519:   256,
    name:      "European Union (eIDAS)",
  },
  # US: NIST SP 800-131A. RSA >= 2048, ECDSA P-256+, SHA-1 legacy.
  us: {
    rsa:       2048,
    ecdsa_p256: 256,
    ecdsa_p384: 384,
    ed25519:   256,
    sha1_legacy: true,
    name:      "United States (NIST SP 800-131A)",
  },
  # OIML CNML: international, follows BIPM recommendations.
  cnml: {
    rsa:       2048,
    ecdsa_p256: 256,
    ecdsa_p384: 384,
    ed25519:   256,
    name:      "OIML CNML (BIPM)",
  },
}.freeze

Class Attribute Summary collapse

Class Method Summary collapse

Class Attribute Details

.fips_mode ⇒ Boolean

Returns whether FIPS 140 mode is enabled.

Returns:

  • (Boolean) —

    whether FIPS 140 mode is enabled



57
58
59
 
# File 'lib/confium/policy.rb', line 57

def fips_mode
  @fips_mode
end

.jurisdiction ⇒ Symbol?

Returns the active jurisdiction (:eu, :us, :cnml).

Returns:

  • (Symbol, nil) —

    the active jurisdiction (:eu, :us, :cnml)



54
55
56
 
# File 'lib/confium/policy.rb', line 54

def jurisdiction
  @jurisdiction
end

Class Method Details

.check!(algorithm, key_bits:) ⇒ Boolean

Check whether an algorithm + key size is allowed under the active policy.

Parameters:

  • algorithm (String, Symbol) —

    e.g. "rsa", "ecdsa_p256"

  • key_bits (Integer) —

    the key size in bits

Returns:

  • (Boolean)

Raises:



91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
 
# File 'lib/confium/policy.rb', line 91

def check!(algorithm, key_bits:)
  alg = algorithm.to_sym

  if @fips_mode
    # FIPS mode: only FIPS-approved algorithms.
    fips_approved = %i[ecdsa_p256 ecdsa_p384 rsa]
    unless fips_approved.include?(alg)
      raise Confium::PolicyViolationError.new(
        "algorithm #{alg} is not FIPS-approved",
        policy: :fips,
        violation: :unapproved_algorithm,
      )
    end
  end

  return true unless @jurisdiction

  policy = JURISDICTIONS[@jurisdiction]
  return true unless policy

  min_bits = policy[alg]
  return true if min_bits.nil?

  if key_bits < min_bits
    raise Confium::PolicyViolationError.new(
      "#{alg} key size #{key_bits} below #{min_bits} for #{@jurisdiction}",
      policy: @jurisdiction,
      violation: :key_too_small,
    )
  end

  true
end

.known_jurisdictions ⇒ Array<Symbol>

The list of known jurisdiction identifiers.

Returns:

  • (Array<Symbol>) 


127
128
129
 
# File 'lib/confium/policy.rb', line 127

def known_jurisdictions
  JURISDICTIONS.keys
end

.reset! ⇒ Object

Reset all policies to defaults (no jurisdiction, no FIPS).



132
133
134
135
 
# File 'lib/confium/policy.rb', line 132

def reset!
  @jurisdiction = nil
  @fips_mode = false
end