Executable cryptography support

Build applicability

• Release version: v0.5.5
• Build ID: a0e48c24f7ab385584ef7587d5c430810c172713d5e438ea5192897606e7caa4
• Target: aarch64-unknown-linux-gnu
• Source revision: 4beaefff33e9775bbecf8d59654586195bf1cd10
• Cargo features: default, pcap, pcap_capture
• Exact JSON SHA-256: d3168c8008e38b688af3bbfc129d2195dab5d541a91e7efc8bc7c9eefd346f8c

Download the exact machine-readable catalog. Read the public support reference.

The catalog JSON is public. Installers, SBOMs, release signatures, and provenance are supplied through authorized customer onboarding; private repository links require granted access. Contact support for installation and verification materials. A catalog download alone does not verify an installer.

Linux AMD64 alternate

The options and profiles below describe the primary ARM64 build. This alternate has its own build identity and runtime applicability.

• Target: x86_64-unknown-linux-gnu
• Build ID: 330fbc04ac6ff9d7136cf7954d7c82e73389a4da1203230d6ba02e0f0c31f80e
• Source revision: 4beaefff33e9775bbecf8d59654586195bf1cd10
• Exact JSON SHA-256: 7f7ef11cd5ffea461b70c95efd5e6365dbf8abf4be5949774de6990b3047c792

Download the exact Linux AMD64 catalog. Select the matching target artifact; the two digests are not interchangeable.

Executable options

Scroll the table horizontally on a narrow screen.

Bundled implementations

• primitive:aes-gcm: aes-gcm, version 0.10.3, provider aes-gcm
• primitive:chacha20poly1305: chacha20poly1305, version 0.10.1, provider chacha20poly1305
• primitive:ed25519-dalek: ed25519-dalek, version 2.2.0, provider ed25519-dalek
• primitive:pqcrypto-mldsa: pqcrypto-mldsa, version 0.1.2, provider pqcrypto-mldsa
• primitive:pqcrypto-mlkem: pqcrypto-mlkem, version 0.1.1, provider pqcrypto-mlkem
• primitive:sha2: sha2, version 0.10.9, provider sha2
• primitive:x25519-dalek: x25519-dalek, version 2.0.1, provider x25519-dalek
• tls:aws-lc-rs: rustls AWS-LC TLS provider, version rustls@0.23.31/aws-lc-rs@1.16.3, provider aws-lc-rs

TLS profiles

These schema-v1 profiles are templates. Every target must admit the complete policy before apply.

{
  "cipherSuites": [
    "TLS_AES_128_GCM_SHA256",
    "TLS_AES_256_GCM_SHA384",
    "TLS_CHACHA20_POLY1305_SHA256",
    "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
    "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
    "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
  ],
  "clientAuth": "none",
  "keyExchangeGroups": [
    "X25519",
    "secp256r1",
    "secp384r1"
  ],
  "maxTlsVersion": "1.3",
  "minTlsVersion": "1.2",
  "requirePostQuantum": false,
  "schemaVersion": 1
}

{
  "cipherSuites": [
    "TLS_AES_128_GCM_SHA256",
    "TLS_AES_256_GCM_SHA384",
    "TLS_CHACHA20_POLY1305_SHA256",
    "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
    "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
    "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
  ],
  "clientAuth": "none",
  "keyExchangeGroups": [
    "X25519",
    "secp256r1",
    "secp384r1"
  ],
  "maxTlsVersion": "1.3",
  "minTlsVersion": "1.2",
  "requirePostQuantum": false,
  "schemaVersion": 1
}

{
  "cipherSuites": [
    "TLS_AES_256_GCM_SHA384",
    "TLS_CHACHA20_POLY1305_SHA256"
  ],
  "clientAuth": "none",
  "keyExchangeGroups": [
    "X25519MLKEM768"
  ],
  "maxTlsVersion": "1.3",
  "minTlsVersion": "1.3",
  "requirePostQuantum": true,
  "schemaVersion": 1
}

{
  "cipherSuites": [
    "TLS_AES_128_GCM_SHA256",
    "TLS_AES_256_GCM_SHA384",
    "TLS_CHACHA20_POLY1305_SHA256"
  ],
  "clientAuth": "none",
  "keyExchangeGroups": [
    "X25519",
    "secp256r1"
  ],
  "maxTlsVersion": "1.3",
  "minTlsVersion": "1.3",
  "requirePostQuantum": false,
  "schemaVersion": 1
}

Runtime prerequisites

Before installation, verify the supplied package and run its bounded --check-crypto-runtime command on the target CPU. Primitive selftests do not establish configured TLS or deployment readiness. CPU compatibility and earlier release limits include the v0.5.1 ARM64 CPU limits, v0.5.3 service-startup limits, and unpublished v0.5.2/v0.5.4 releases.

Catalog declaration is separate from runtime availability. Each target must report a fresh matching catalog and build, available selected options, a usable server identity, and configured trust roots when client authentication is required. RSA and ECDSA TLS 1.2 profiles need matching identities.

Installed implementations can prepare a new immutable TLS configuration. Existing connections retain their configuration; new handshakes use the selected policy. New implementations require a new signed release. External native and WebAssembly plugin loading are unsupported.

X25519MLKEM768 provides hybrid TLS 1.3 key establishment. It does not make certificate authentication post-quantum. A hybrid-required policy rejects classical-only peers.

Separate protocol boundaries

Primitive ML-KEM uses key generation, encapsulation, and decapsulation. ML-DSA-65 uses signed-message encoding, not detached signatures. Algorithm, exact version, and encoding must accompany persisted material.

Native Messenger has separate provider, peer, protocol, and retained-key requirements. Its current reviewed message path uses Ed25519 signed prekeys and single AES-GCM ratchet messages; this catalog does not activate composite signatures or nested AEAD there. Inbound decrypt/verify support and outbound initiation are separate decisions.

This artifact does not establish QUIC, every service-mesh adapter, storage, SDK write-API, or installed native-client compatibility. Standardized algorithms do not imply FIPS module certification or an independent product audit.

Messenger compatibility • Cryptographic disclosures

Review, observe, and recover

Save a versioned draft, preview its exact environment and agent cohort, review the immutable baseline and capability checks, then explicitly apply. Phase health requires fresh attributed observations after required acknowledgments; zero traffic is not success.

Rollback is pending until affected agents acknowledge restoration, including removal of an inactive baseline. A successful source environment must still run its promoted version before a destination promotion is admitted. Binary downgrade is a separate compatibility check.

Policy authoring • Rollout and rollback • Docs index