Cryptography

Note

Project policy: draft. This page is the only home of Shiin’s cryptography rules (ADR-0031, ADR-0032).

Algorithms

Key management

Signing key generation, rotation, and public-key export use the OS keyring, following ADR-0032. Replay encryption keys are stored alongside the signing key in the keyring. Native key-store lifecycle checks pass on hosted Linux, macOS, and Windows runners, including persistence, rotation, retained-key replay, and corrupt-entry refusal. The testing strategy describes the isolated fixture and its limits. Live operator-environment qualification and independent review remain open.

Randomness

Shiin uses the operating system’s randomness source for ids and keys. The engine crates never use a custom randomness source.

Read next

• Receipts
• Signing key storage