Executable cryptography support
Publication status: released. This artifact describes one build; it does not report an installed fleet or authorize activation.
Build applicability
- Release version:
v0.5.5 - Build ID:
a0e48c24f7ab385584ef7587d5c430810c172713d5e438ea5192897606e7caa4 - Target:
aarch64-unknown-linux-gnu - Source revision:
4beaefff33e9775bbecf8d59654586195bf1cd10 - Cargo features:
default,pcap,pcap_capture - Exact JSON SHA-256:
d3168c8008e38b688af3bbfc129d2195dab5d541a91e7efc8bc7c9eefd346f8c
Machine-readable catalog. New implementations require a new release. Policy changes select installed, available options for new TLS handshakes; existing sessions keep their configuration.
The catalog JSON is public. Installers, SBOMs, release signatures, and provenance are supplied through authorized customer onboarding; private repository links require granted access. Contact support for installation and verification materials. A catalog download alone does not verify an installer.
Linux AMD64 alternate
The options and profiles below describe the primary ARM64 build. This alternate has its own build identity and runtime applicability.
- Target:
x86_64-unknown-linux-gnu - Build ID:
330fbc04ac6ff9d7136cf7954d7c82e73389a4da1203230d6ba02e0f0c31f80e - Source revision:
4beaefff33e9775bbecf8d59654586195bf1cd10 - Exact JSON SHA-256:
7f7ef11cd5ffea461b70c95efd5e6365dbf8abf4be5949774de6990b3047c792
Download the exact Linux AMD64 catalog. Select the matching target artifact; the two digests are not interchangeable.
Options
| Context | Option | Operations | Encoding | Status |
|---|---|---|---|---|
| primitive | primitive:aes256gcm |
encrypt, decrypt | aes256gcm-ciphertext-tag128-v1 |
complete; active |
| primitive | primitive:chacha20poly1305 |
encrypt, decrypt | chacha20poly1305-ciphertext-tag128-v1 |
complete; active |
| primitive | primitive:ed25519 |
generate-keypair, sign-detached, verify-detached | ed25519-detached-v1 |
complete; active |
| primitive | primitive:ml-dsa-65:signed-message |
generate-keypair, sign-signed-message, verify-signed-message | ml-dsa-65-fips204-signed-message-v1 |
complete; active |
| primitive | primitive:ml-kem-768 |
generate-keypair, encapsulate, decapsulate | ml-kem-768-fips203-raw-v1 |
complete; active |
| primitive | primitive:sha256 |
hash | sha256-raw-v1 |
complete; active |
| primitive | primitive:x25519 |
generate-keypair, derive-shared-secret | x25519-rfc7748-raw-v1 |
complete; active |
| transit-tls | tls:cipher:TLS_AES_128_GCM_SHA256 |
tls-negotiate | tls13-aead-record |
complete; active |
| transit-tls | tls:cipher:TLS_AES_256_GCM_SHA384 |
tls-negotiate | tls13-aead-record |
complete; active |
| transit-tls | tls:cipher:TLS_CHACHA20_POLY1305_SHA256 |
tls-negotiate | tls13-aead-record |
complete; active |
| transit-tls | tls:cipher:TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 |
tls-negotiate | tls12-aead-record |
complete; active |
| transit-tls | tls:cipher:TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 |
tls-negotiate | tls12-aead-record |
complete; active |
| transit-tls | tls:cipher:TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 |
tls-negotiate | tls12-aead-record |
complete; active |
| transit-tls | tls:cipher:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 |
tls-negotiate | tls12-aead-record |
complete; active |
| transit-tls | tls:cipher:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 |
tls-negotiate | tls12-aead-record |
complete; active |
| transit-tls | tls:cipher:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 |
tls-negotiate | tls12-aead-record |
complete; active |
| transit-tls | tls:client-auth:required |
authenticate-client | tls-client-certificate |
complete; active |
| transit-tls | tls:group:X25519 |
tls-negotiate | tls-x25519-raw32 |
complete; active |
| transit-tls | tls:group:X25519MLKEM768 |
tls-negotiate | tls-x25519mlkem768-client1216-server1120 |
complete; active |
| transit-tls | tls:group:secp256r1 |
tls-negotiate | tls-secp256r1-uncompressed65 |
complete; active |
| transit-tls | tls:group:secp384r1 |
tls-negotiate | tls-secp384r1-uncompressed97 |
complete; active |
TLS profiles
| Profile | TLS range | Cipher suites | Groups | Client authentication |
|---|---|---|---|---|
tls12-compatible-ecdsa@1 |
1.2–1.3 | TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 |
X25519, secp256r1, secp384r1 |
none |
tls12-compatible-rsa@1 |
1.2–1.3 | TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 |
X25519, secp256r1, secp384r1 |
none |
tls13-hybrid-required@1 |
1.3–1.3 | TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256 |
X25519MLKEM768 |
none |
tls13-modern@1 |
1.3–1.3 | TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256 |
X25519, secp256r1 |
none |
Prerequisites and limits
Before installation, verify the supplied package and run its bounded --check-crypto-runtime command on the target CPU. Primitive selftests do not establish configured TLS or deployment readiness. CPU compatibility and earlier release limits include the v0.5.1 ARM64 CPU limits, v0.5.3 service-startup limits, and unpublished v0.5.2/v0.5.4 releases.
A declaration is not runtime availability. Every selected agent must report a fresh matching catalog/build, available required options, a usable server identity, and configured trust roots when client authentication is required. The complete policy must prepare successfully. RSA and ECDSA TLS 1.2 profiles require matching server identities.
X25519MLKEM768 describes hybrid TLS 1.3 key establishment. It does not make certificate authentication post-quantum. Primitive ML-KEM and ML-DSA entries do not establish TLS or Messenger support. ML-DSA here uses signed-message encoding; it is not a detached signature API.
Native external plugin binaries and WebAssembly plugin loading are unsupported. This catalog does not establish QUIC, service-mesh, storage, SDK write-API, or native Messenger compatibility. Messenger has a separate protocol and client support boundary.
Standardized algorithms do not imply module certification or an independent product audit. Cryptographic disclosures describe verification and encoding limits. Policy management explains review, canary observations, and acknowledged rollback.