Cryptography
Every cryptographic primitive in Omitly, drawn directly from our cryptographic bill of materials (CBOM v1). We publish this so a reviewer can evaluate exactly what we use and how — not take our word for it.
On FIPS: where an algorithm is FIPS-approved, our implementation is nota CMVP-validated module. We state this as "approved algorithm, non-validated implementation" throughout — never "FIPS compliant."
Tamper-evidence seal — signing & verification
| Primitive | signature · Ed25519 |
|---|
| Implementation | ed25519-dalek 2 |
|---|
| Purpose | Signs the entire delivered PDF (trailing %%OMITLY-SEAL appendix); verify_strict rejects non-canonical/malleable signatures. Per-install key — integrity, not identity (see CLAUDE.md invariant #2). |
|---|
| FIPS posture | FIPS 186-5 approved algorithm; ed25519-dalek is NOT a CMVP-validated module. State "approved algorithm, non-validated implementation" — never "FIPS compliant". |
|---|
| Source | src-tauri/src/seal.rs |
|---|
Offline license verification
| Primitive | signature · Ed25519 |
|---|
| Implementation | ed25519-dalek 2 |
|---|
| Purpose | Verifies Omitly Pro license signatures fully offline, no network, no PII. |
|---|
| FIPS posture | Same posture as the seal above — FIPS 186-5 approved algorithm, non-validated implementation. |
|---|
| Source | crates/licensing/src/lib.rs |
|---|
Document / report hashing
| Primitive | hash |
|---|
| Implementation | sha2 0.10 |
|---|
| Purpose | Audit-report and delivered-bytes hashing feeding the seal + license verification digests. |
|---|
| FIPS posture | FIPS 180-4 approved algorithm; sha2 is NOT a CMVP-validated module. |
|---|
| Source | src-tauri/src/seal.rs, crates/licensing/src/lib.rs |
|---|
PAdES signing — CMS SignedData
| Implementation | cryptographic-message-syntax 0.28 |
|---|
| Purpose | Builds RFC 5652 CMS SignedData over a BYOC (bring-your-own-certificate) RSA or ECDSA key for PAdES interop with real-world PDF viewers (Acrobat). The crate does not fix one algorithm — RSA vs ECDSA is determined by the imported certificate. Composes with, never precedes, the Ed25519 seal (CLAUDE.md invariant #6). Algorithm floors: SHA-1-issued certs and RSA <2048 bits are refused outright; RSA <3072 warns (NIST SP 800-131A / ASD ISM). Revocation (OCSP/CRL) is NOT checked in this milestone. |
|---|
| Source | src-tauri/src/sign.rs |
|---|
X.509 certificate parsing
| Implementation | x509-certificate 0.25 |
|---|
| Purpose | Parses/validates imported signing certificates for PAdES (algorithm floor + expiry re-checked at sign time, not just import — CLAUDE.md invariant #9). |
|---|
| Source | src-tauri/src/sign.rs |
|---|
Crypto backend for CMS/X.509
| Primitive | other |
|---|
| Implementation | ring 0.17 |
|---|
| Purpose | Direct dependency of both cryptographic-message-syntax and x509-certificate (confirmed via Cargo.lock reverse-dependency trace, not assumed) — the actual crypto backend behind their CMS/X.509 operations, not just a transitive pull-through. |
|---|
Bundled qpdf crypto provider
| Primitive | other |
|---|
| Purpose | qpdf sidecar crypto provider used for PDF encryption/decryption handling, including password-protected PDF open via --password-file=-. Since omitly#834, macOS builds qpdf from source with its `native` crypto provider (-DUSE_IMPLICIT_CRYPTO=OFF -DREQUIRE_CRYPTO_NATIVE=ON) — qpdf's own bundled implementation of the PDF standard security handler's RC4/AES, not OpenSSL — so the macOS bundle no longer ships libcrypto.3.dylib at all (previously Homebrew OpenSSL libcrypto.3.dylib v3.6.2; the switch was forced by libcrypto inheriting the CI runner's macOS version rather than the app's actual deployment target). Windows is unaffected and still bundles qpdf30.dll from the official qpdf v12.3.2 msvc64 zip, whose embedded strings and qpdf/external-libs release metadata identify statically linked OpenSSL v3.6.0. |
|---|
| FIPS posture | Neither qpdf's native crypto provider (macOS) nor the bundled qpdf30.dll OpenSSL (Windows) is a CMVP-validated module. State "approved algorithms, non-validated bundled implementation" — never "FIPS compliant" — for either platform. |
|---|
| Source | src-tauri/binaries/qpdf-aarch64-apple-darwin (native provider, macOS), src-tauri/binaries/qpdf30.dll (OpenSSL, Windows) |
|---|
Signing-key seed generation
| Primitive | drbg |
|---|
| Implementation | getrandom 0.2 |
|---|
| Purpose | Seeds the per-install Ed25519 seal signing key. |
|---|
| FIPS posture | OS-provided CSPRNG accessed via getrandom, not a crate-implemented DRBG construction — closest available CycloneDX primitive, noted here for precision. |
|---|
| Source | src-tauri/src/seal.rs |
|---|
Post-quantum
Omitly's shipped signatures (Ed25519) are classical. There is no harvest-now-decrypt-later exposure through Omitly — no document content is ever encrypted for transmission or stored by us — but sealed documents are long-lived, so the seal is where post-quantum matters. We now publish a dated, ISM-2073-aligned post-quantum transition plan: an algorithm-agile seal envelope, hybrid ECDSA P-384 + ML-DSA-87 signing with independent cross-verification at mint, default-on RFC 3161 timestamps, and a published policy cutover ahead of the ISM's 2030 line.