Standard primitives. Explicit agility.
OSDF never invents cryptography. It uses conservative, widely reviewed algorithms, identifies every algorithm explicitly, and is built to adopt stronger suites - including post-quantum - without redesigning the package.
# Every algorithm is identified explicitly and versionedcontent_digest = SHA-256(JCS(content_security_object))object_digest = SHA-256(domain || object_type || canonical_bytes)revision_hash = SHA-256(domain_rev || doc_id || n || parent || root)merkle_leaf = SHA-256(0x00 || canonical_event_bytes)merkle_node = SHA-256(0x01 || left_hash || right_hash) # Envelope encryption - random per-document DEK, wrapped under customer KEKDEK = CSPRNG(256)ciphertext, tag = AES-256-GCM(DEK, nonce, plaintext, AAD)wrapped_DEK = Wrap(customer_KEK, DEK, document_context)The baseline suite
Content & object digests
FIPS 180-4. Migration path to SHA-384/512 profiles.
Digital signatures
Open baseline; ECDSA P-256 for validated-module profiles.
Authenticated encryption
FIPS 197 + SP 800-38D. Unique nonces, authenticated AAD.
Key derivation
Separate contexts and labels for each derived value.
Pseudonymous aliases
Document-scoped; secret stays customer-controlled.
Trusted timestamps
Time-stamp tokens for higher-assurance workflows.
Crypto-agility, not crypto-gambling
Algorithm selection lives in versioned profiles. The format can migrate to stronger and post-quantum suites without breaking historical verification.
Conservative baseline
SHA-256, Ed25519, AES-256-GCM with explicit algorithm identifiers and versioned profiles.
Validated modules
ECDSA P-256 and FIPS 140-3 validated cryptographic modules where deployment requires them.
Hybrid post-quantum
Hybrid classical + ML-DSA signatures and ML-KEM key wrapping for new recipient slots.
High-assurance
Optional SLH-DSA archival countersignatures and RFC 3161 timestamps for long-lived records.
Cryptography you can inspect
The algorithms, schemas, and test vectors are public. Verify the math yourself with the open CLI and WASM core.