# This file is taken from following locations:
# https://src.fedoraproject.org/rpms/crypto-policies
# https://gitlab.com/redhat-crypto/fedora-crypto-policies
# Licensed under LGPL-2.1-or-later

[hash_algorithms]
ignore_invalid = [ "sha3-256", "sha3-512" ]
md5.collision_resistance = "never"
md5.second_preimage_resistance = "never"
sha1.collision_resistance = "always"
sha1.second_preimage_resistance = "always"
ripemd160.collision_resistance = "never"
ripemd160.second_preimage_resistance = "never"
sha224.collision_resistance = "always"
sha224.second_preimage_resistance = "always"
sha256.collision_resistance = "always"
sha256.second_preimage_resistance = "always"
sha384.collision_resistance = "always"
sha384.second_preimage_resistance = "always"
sha512.collision_resistance = "always"
sha512.second_preimage_resistance = "always"
sha3-256.collision_resistance = "always"
sha3-256.second_preimage_resistance = "always"
sha3-512.collision_resistance = "always"
sha3-512.second_preimage_resistance = "always"
default_disposition = "never"

[symmetric_algorithms]
idea = "never"
tripledes = "never"
cast5 = "never"
blowfish = "never"
aes128 = "always"
aes192 = "never"
aes256 = "always"
twofish = "never"
camellia128 = "always"
camellia192 = "never"
camellia256 = "always"
default_disposition = "never"

[asymmetric_algorithms]
ignore_invalid = [ "x25519", "x448", "mlkem768-x25519", "mlkem1024-x448", "ed25519", "ed448", "eddsa", "mldsa65-ed25519", "mldsa87-ed448" ]
# Photon uses a legacy 1024 gpg key, so allow rsa1024 imports
rsa1024 = "always"
rsa2048 = "always"
rsa3072 = "always"
rsa4096 = "always"
dsa1024 = "always"
dsa2048 = "always"
dsa3072 = "always"
dsa4096 = "always"
nistp256 = "always"
nistp384 = "always"
nistp521 = "always"
cv25519 = "always"
x25519 = "always"
x448 = "always"
mlkem768-x25519 = "always"
mlkem1024-x448 = "always"
ed25519 = "always"
eddsa = "always"
ed448 = "always"
mldsa65-ed25519 = "always"
mldsa87-ed448 = "always"
elgamal1024 = "never"
elgamal2048 = "never"
elgamal3072 = "never"
elgamal4096 = "never"
brainpoolp256 = "never"
brainpoolp512 = "never"
default_disposition = "never"

[aead_algorithms]
default_disposition = "never"
ignore_invalid = [ "gcm" ]
eax = "always"
ocb = "always"
gcm = "always"