@vorionsys/platform-core 0.1.0

package/dist/security/crypto/fips-mode.d.ts

@@ -0,0 +1,726 @@
+/**
+ * FIPS 140-2 Compliant Cryptography Mode
+ *
+ * Provides FIPS 140-2 Level 1 compliant cryptographic operations for FedRAMP
+ * compliance. Enforces the use of only FIPS-approved algorithms and key lengths.
+ *
+ * FIPS 140-2 Approved Algorithms:
+ * - Symmetric Encryption: AES-128, AES-256 (GCM, CBC, CTR modes)
+ * - Hash Functions: SHA-256, SHA-384, SHA-512 (NO SHA-1, MD5)
+ * - Asymmetric: RSA (2048+ bits), ECDSA (P-256, P-384, P-521)
+ * - MACs: HMAC-SHA256, HMAC-SHA384, HMAC-SHA512
+ * - Key Derivation: PBKDF2, HKDF with approved hash functions
+ * - Transport: TLS 1.2+ only
+ *
+ * Security Guarantees:
+ * - Algorithm validation before every operation
+ * - Key length enforcement per algorithm
+ * - Comprehensive audit logging
+ * - Runtime enforcement with configurable strict mode
+ *
+ * @packageDocumentation
+ * @module security/crypto/fips-mode
+ */
+import * as crypto from 'node:crypto';
+import { z } from 'zod';
+/**
+ * FIPS 140-2 approved symmetric encryption algorithms
+ */
+export declare const FIPS_SYMMETRIC_ALGORITHMS: {
+    readonly 'AES-128-GCM': "aes-128-gcm";
+    readonly 'AES-256-GCM': "aes-256-gcm";
+    readonly 'AES-128-CBC': "aes-128-cbc";
+    readonly 'AES-256-CBC': "aes-256-cbc";
+    readonly 'AES-128-CTR': "aes-128-ctr";
+    readonly 'AES-256-CTR': "aes-256-ctr";
+};
+export type FIPSSymmetricAlgorithm = (typeof FIPS_SYMMETRIC_ALGORITHMS)[keyof typeof FIPS_SYMMETRIC_ALGORITHMS];
+/**
+ * FIPS 140-2 approved hash algorithms
+ */
+export declare const FIPS_HASH_ALGORITHMS: {
+    readonly 'SHA-256': "sha256";
+    readonly 'SHA-384': "sha384";
+    readonly 'SHA-512': "sha512";
+};
+export type FIPSHashAlgorithm = (typeof FIPS_HASH_ALGORITHMS)[keyof typeof FIPS_HASH_ALGORITHMS];
+/**
+ * FIPS 140-2 approved HMAC algorithms
+ */
+export declare const FIPS_HMAC_ALGORITHMS: {
+    readonly 'HMAC-SHA256': "sha256";
+    readonly 'HMAC-SHA384': "sha384";
+    readonly 'HMAC-SHA512': "sha512";
+};
+export type FIPSHMACAlgorithm = (typeof FIPS_HMAC_ALGORITHMS)[keyof typeof FIPS_HMAC_ALGORITHMS];
+/**
+ * FIPS 140-2 approved asymmetric algorithms
+ */
+export declare const FIPS_ASYMMETRIC_ALGORITHMS: {
+    readonly 'RSA-2048': "rsa";
+    readonly 'RSA-3072': "rsa";
+    readonly 'RSA-4096': "rsa";
+    readonly 'ECDSA-P256': "ec";
+    readonly 'ECDSA-P384': "ec";
+    readonly 'ECDSA-P521': "ec";
+};
+export type FIPSAsymmetricAlgorithm = (typeof FIPS_ASYMMETRIC_ALGORITHMS)[keyof typeof FIPS_ASYMMETRIC_ALGORITHMS];
+/**
+ * FIPS 140-2 approved ECDSA curves
+ */
+export declare const FIPS_ECDSA_CURVES: {
+    readonly 'P-256': "prime256v1";
+    readonly 'P-384': "secp384r1";
+    readonly 'P-521': "secp521r1";
+};
+export type FIPSECDSACurve = (typeof FIPS_ECDSA_CURVES)[keyof typeof FIPS_ECDSA_CURVES];
+/**
+ * FIPS 140-2 minimum key lengths by algorithm type
+ */
+export declare const FIPS_MINIMUM_KEY_LENGTHS: Record<string, number>;
+/**
+ * Non-FIPS algorithms that should be rejected
+ */
+export declare const NON_FIPS_ALGORITHMS: readonly ["md5", "sha1", "sha-1", "des", "3des", "des-ede", "des-ede3", "rc2", "rc4", "blowfish", "bf", "idea", "cast", "cast5", "seed"];
+/**
+ * FIPS-approved TLS versions
+ */
+export declare const FIPS_TLS_VERSIONS: readonly ["TLSv1.2", "TLSv1.3"];
+/**
+ * Non-FIPS TLS versions that should be rejected
+ */
+export declare const NON_FIPS_TLS_VERSIONS: readonly ["SSLv2", "SSLv3", "TLSv1", "TLSv1.1"];
+/**
+ * FIPS mode configuration
+ */
+export interface FIPSModeConfig {
+    /** Whether FIPS mode is enabled */
+    enabled: boolean;
+    /** Strict mode: reject all non-FIPS operations (true) vs warn (false) */
+    strictMode: boolean;
+    /** List of allowed algorithms (defaults to all FIPS-approved) */
+    allowedAlgorithms: string[];
+    /** Minimum key lengths by algorithm type */
+    minimumKeyLengths: Record<string, number>;
+    /** Whether to audit log all crypto operations */
+    auditAllCryptoOperations: boolean;
+    /** Alert on non-compliant attempts */
+    alertOnViolations: boolean;
+    /** Custom alert callback for violations */
+    alertCallback?: (violation: FIPSViolation) => void | Promise<void>;
+}
+export declare const fipsModeConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    strictMode: z.ZodDefault<z.ZodBoolean>;
+    allowedAlgorithms: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    minimumKeyLengths: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+    auditAllCryptoOperations: z.ZodDefault<z.ZodBoolean>;
+    alertOnViolations: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    enabled?: boolean;
+    strictMode?: boolean;
+    allowedAlgorithms?: string[];
+    minimumKeyLengths?: Record<string, number>;
+    auditAllCryptoOperations?: boolean;
+    alertOnViolations?: boolean;
+}, {
+    enabled?: boolean;
+    strictMode?: boolean;
+    allowedAlgorithms?: string[];
+    minimumKeyLengths?: Record<string, number>;
+    auditAllCryptoOperations?: boolean;
+    alertOnViolations?: boolean;
+}>;
+/**
+ * Default FIPS mode configuration
+ */
+export declare const DEFAULT_FIPS_CONFIG: FIPSModeConfig;
+/**
+ * Crypto operation types for audit logging
+ */
+export declare const CryptoOperationType: {
+    readonly ENCRYPT: "encrypt";
+    readonly DECRYPT: "decrypt";
+    readonly HASH: "hash";
+    readonly HMAC: "hmac";
+    readonly SIGN: "sign";
+    readonly VERIFY: "verify";
+    readonly KEY_DERIVE: "key_derive";
+    readonly RANDOM: "random";
+    readonly KEY_GENERATE: "key_generate";
+};
+export type CryptoOperationType = (typeof CryptoOperationType)[keyof typeof CryptoOperationType];
+/**
+ * Crypto operation for validation
+ */
+export interface CryptoOperation {
+    /** Operation type */
+    type: CryptoOperationType;
+    /** Algorithm being used */
+    algorithm: string;
+    /** Key length in bits (if applicable) */
+    keyLength?: number;
+    /** Curve name (for ECDSA) */
+    curve?: string;
+    /** Hash function (for composite operations) */
+    hashFunction?: string;
+    /** Additional context */
+    context?: Record<string, unknown>;
+}
+export declare const cryptoOperationSchema: z.ZodObject<{
+    type: z.ZodNativeEnum<{
+        readonly ENCRYPT: "encrypt";
+        readonly DECRYPT: "decrypt";
+        readonly HASH: "hash";
+        readonly HMAC: "hmac";
+        readonly SIGN: "sign";
+        readonly VERIFY: "verify";
+        readonly KEY_DERIVE: "key_derive";
+        readonly RANDOM: "random";
+        readonly KEY_GENERATE: "key_generate";
+    }>;
+    algorithm: z.ZodString;
+    keyLength: z.ZodOptional<z.ZodNumber>;
+    curve: z.ZodOptional<z.ZodString>;
+    hashFunction: z.ZodOptional<z.ZodString>;
+    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    type?: "encrypt" | "decrypt" | "hash" | "sign" | "verify" | "random" | "hmac" | "key_derive" | "key_generate";
+    algorithm?: string;
+    keyLength?: number;
+    context?: Record<string, unknown>;
+    curve?: string;
+    hashFunction?: string;
+}, {
+    type?: "encrypt" | "decrypt" | "hash" | "sign" | "verify" | "random" | "hmac" | "key_derive" | "key_generate";
+    algorithm?: string;
+    keyLength?: number;
+    context?: Record<string, unknown>;
+    curve?: string;
+    hashFunction?: string;
+}>;
+/**
+ * FIPS compliance violation
+ */
+export interface FIPSViolation {
+    /** Unique violation ID */
+    id: string;
+    /** Timestamp of violation */
+    timestamp: Date;
+    /** Violation type */
+    type: 'algorithm' | 'key_length' | 'hash' | 'tls' | 'certificate';
+    /** The operation that was attempted */
+    operation: CryptoOperation;
+    /** Reason for violation */
+    reason: string;
+    /** Whether the operation was blocked */
+    blocked: boolean;
+    /** Stack trace (if available) */
+    stackTrace?: string;
+}
+export declare const fipsViolationSchema: z.ZodObject<{
+    id: z.ZodString;
+    timestamp: z.ZodDate;
+    type: z.ZodEnum<["algorithm", "key_length", "hash", "tls", "certificate"]>;
+    operation: z.ZodObject<{
+        type: z.ZodNativeEnum<{
+            readonly ENCRYPT: "encrypt";
+            readonly DECRYPT: "decrypt";
+            readonly HASH: "hash";
+            readonly HMAC: "hmac";
+            readonly SIGN: "sign";
+            readonly VERIFY: "verify";
+            readonly KEY_DERIVE: "key_derive";
+            readonly RANDOM: "random";
+            readonly KEY_GENERATE: "key_generate";
+        }>;
+        algorithm: z.ZodString;
+        keyLength: z.ZodOptional<z.ZodNumber>;
+        curve: z.ZodOptional<z.ZodString>;
+        hashFunction: z.ZodOptional<z.ZodString>;
+        context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        type?: "encrypt" | "decrypt" | "hash" | "sign" | "verify" | "random" | "hmac" | "key_derive" | "key_generate";
+        algorithm?: string;
+        keyLength?: number;
+        context?: Record<string, unknown>;
+        curve?: string;
+        hashFunction?: string;
+    }, {
+        type?: "encrypt" | "decrypt" | "hash" | "sign" | "verify" | "random" | "hmac" | "key_derive" | "key_generate";
+        algorithm?: string;
+        keyLength?: number;
+        context?: Record<string, unknown>;
+        curve?: string;
+        hashFunction?: string;
+    }>;
+    reason: z.ZodString;
+    blocked: z.ZodBoolean;
+    stackTrace: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    reason?: string;
+    id?: string;
+    type?: "algorithm" | "hash" | "tls" | "certificate" | "key_length";
+    operation?: {
+        type?: "encrypt" | "decrypt" | "hash" | "sign" | "verify" | "random" | "hmac" | "key_derive" | "key_generate";
+        algorithm?: string;
+        keyLength?: number;
+        context?: Record<string, unknown>;
+        curve?: string;
+        hashFunction?: string;
+    };
+    timestamp?: Date;
+    blocked?: boolean;
+    stackTrace?: string;
+}, {
+    reason?: string;
+    id?: string;
+    type?: "algorithm" | "hash" | "tls" | "certificate" | "key_length";
+    operation?: {
+        type?: "encrypt" | "decrypt" | "hash" | "sign" | "verify" | "random" | "hmac" | "key_derive" | "key_generate";
+        algorithm?: string;
+        keyLength?: number;
+        context?: Record<string, unknown>;
+        curve?: string;
+        hashFunction?: string;
+    };
+    timestamp?: Date;
+    blocked?: boolean;
+    stackTrace?: string;
+}>;
+/**
+ * FIPS audit log entry
+ */
+export interface FIPSAuditEntry {
+    /** Unique audit entry ID */
+    id: string;
+    /** Timestamp of the operation */
+    timestamp: Date;
+    /** Type of operation */
+    operationType: CryptoOperationType;
+    /** Algorithm used */
+    algorithm: string;
+    /** Key length (if applicable) */
+    keyLength?: number;
+    /** Whether the operation succeeded */
+    success: boolean;
+    /** Whether the operation was FIPS compliant */
+    fipsCompliant: boolean;
+    /** Duration in milliseconds */
+    durationMs: number;
+    /** Error message if failed */
+    error?: string;
+    /** Request ID for correlation */
+    requestId?: string;
+    /** User ID if available */
+    userId?: string;
+    /** Tenant ID if available */
+    tenantId?: string;
+}
+export declare const fipsAuditEntrySchema: z.ZodObject<{
+    id: z.ZodString;
+    timestamp: z.ZodDate;
+    operationType: z.ZodNativeEnum<{
+        readonly ENCRYPT: "encrypt";
+        readonly DECRYPT: "decrypt";
+        readonly HASH: "hash";
+        readonly HMAC: "hmac";
+        readonly SIGN: "sign";
+        readonly VERIFY: "verify";
+        readonly KEY_DERIVE: "key_derive";
+        readonly RANDOM: "random";
+        readonly KEY_GENERATE: "key_generate";
+    }>;
+    algorithm: z.ZodString;
+    keyLength: z.ZodOptional<z.ZodNumber>;
+    success: z.ZodBoolean;
+    fipsCompliant: z.ZodBoolean;
+    durationMs: z.ZodNumber;
+    error: z.ZodOptional<z.ZodString>;
+    requestId: z.ZodOptional<z.ZodString>;
+    userId: z.ZodOptional<z.ZodString>;
+    tenantId: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    error?: string;
+    durationMs?: number;
+    id?: string;
+    algorithm?: string;
+    tenantId?: string;
+    success?: boolean;
+    userId?: string;
+    requestId?: string;
+    keyLength?: number;
+    timestamp?: Date;
+    operationType?: "encrypt" | "decrypt" | "hash" | "sign" | "verify" | "random" | "hmac" | "key_derive" | "key_generate";
+    fipsCompliant?: boolean;
+}, {
+    error?: string;
+    durationMs?: number;
+    id?: string;
+    algorithm?: string;
+    tenantId?: string;
+    success?: boolean;
+    userId?: string;
+    requestId?: string;
+    keyLength?: number;
+    timestamp?: Date;
+    operationType?: "encrypt" | "decrypt" | "hash" | "sign" | "verify" | "random" | "hmac" | "key_derive" | "key_generate";
+    fipsCompliant?: boolean;
+}>;
+/**
+ * Certificate validation options
+ */
+export interface CertificateValidationOptions {
+    /** Minimum RSA key size */
+    minRSAKeySize: number;
+    /** Minimum ECDSA curve (P-256, P-384, P-521) */
+    minECDSACurve: string;
+    /** Require TLS 1.2+ */
+    requireTLS12: boolean;
+    /** Reject weak cipher suites */
+    rejectWeakCipherSuites: boolean;
+    /** Allowed cipher suites (if specified, only these are allowed) */
+    allowedCipherSuites?: string[];
+}
+export declare const DEFAULT_CERT_VALIDATION_OPTIONS: CertificateValidationOptions;
+/**
+ * Callback for FIPS audit logging
+ */
+export type FIPSAuditCallback = (entry: FIPSAuditEntry) => void | Promise<void>;
+/**
+ * Error codes for FIPS operations
+ */
+export declare const FIPSErrorCode: {
+    /** Non-FIPS algorithm attempted */
+    readonly NON_FIPS_ALGORITHM: "FIPS_NON_COMPLIANT_ALGORITHM";
+    /** Key length below minimum */
+    readonly INSUFFICIENT_KEY_LENGTH: "FIPS_INSUFFICIENT_KEY_LENGTH";
+    /** Non-FIPS hash function */
+    readonly NON_FIPS_HASH: "FIPS_NON_COMPLIANT_HASH";
+    /** Non-FIPS TLS version */
+    readonly NON_FIPS_TLS: "FIPS_NON_COMPLIANT_TLS";
+    /** Weak certificate */
+    readonly WEAK_CERTIFICATE: "FIPS_WEAK_CERTIFICATE";
+    /** Provider not initialized */
+    readonly NOT_INITIALIZED: "FIPS_NOT_INITIALIZED";
+    /** Operation failed */
+    readonly OPERATION_FAILED: "FIPS_OPERATION_FAILED";
+    /** Invalid configuration */
+    readonly INVALID_CONFIG: "FIPS_INVALID_CONFIG";
+};
+export type FIPSErrorCode = (typeof FIPSErrorCode)[keyof typeof FIPSErrorCode];
+/**
+ * Custom error class for FIPS operations
+ */
+export declare class FIPSError extends Error {
+    readonly code: FIPSErrorCode;
+    readonly details?: Record<string, unknown>;
+    constructor(message: string, code: FIPSErrorCode, details?: Record<string, unknown>);
+}
+/**
+ * Validate if an algorithm is FIPS 140-2 compliant
+ *
+ * @param algorithm - The algorithm name to validate
+ * @returns true if the algorithm is FIPS compliant
+ */
+export declare function validateAlgorithm(algorithm: string): boolean;
+/**
+ * Validate if a key length meets FIPS 140-2 requirements
+ *
+ * @param algorithm - The algorithm type
+ * @param keyLength - The key length in bits
+ * @returns true if the key length is FIPS compliant
+ */
+export declare function validateKeyLength(algorithm: string, keyLength: number): boolean;
+/**
+ * Validate if a hash function is FIPS 140-2 compliant
+ *
+ * @param hashFunction - The hash function name
+ * @returns true if the hash is FIPS compliant
+ */
+export declare function validateHash(hashFunction: string): boolean;
+/**
+ * Validate if a complete crypto operation is FIPS 140-2 compliant
+ *
+ * @param operation - The crypto operation to validate
+ * @returns true if the operation is FIPS compliant
+ */
+export declare function isFIPSCompliant(operation: CryptoOperation): boolean;
+/**
+ * Validate TLS version
+ *
+ * @param tlsVersion - The TLS version string
+ * @returns true if the TLS version is FIPS compliant
+ */
+export declare function validateTLSVersion(tlsVersion: string): boolean;
+/**
+ * Validate cipher suite
+ *
+ * @param cipherSuite - The cipher suite string
+ * @returns true if the cipher suite is FIPS compliant
+ */
+export declare function validateCipherSuite(cipherSuite: string): boolean;
+/**
+ * FIPS 140-2 Compliant Crypto Provider
+ *
+ * Provides cryptographic operations that enforce FIPS 140-2 compliance.
+ * All operations are validated and audited.
+ *
+ * @example
+ * ```typescript
+ * const provider = new FIPSCryptoProvider();
+ * await provider.initialize();
+ *
+ * // Encrypt data
+ * const encrypted = await provider.fipsEncrypt(
+ *   Buffer.from('sensitive data'),
+ *   key,
+ *   'aes-256-gcm'
+ * );
+ *
+ * // Hash data
+ * const hash = await provider.fipsHash(
+ *   Buffer.from('data'),
+ *   'sha256'
+ * );
+ * ```
+ */
+export declare class FIPSCryptoProvider {
+    private readonly config;
+    private readonly auditCallbacks;
+    private readonly violations;
+    private initialized;
+    constructor(config?: Partial<FIPSModeConfig>);
+    /**
+     * Initialize the FIPS crypto provider
+     */
+    initialize(): Promise<void>;
+    /**
+     * Ensure the provider is initialized
+     */
+    private ensureInitialized;
+    /**
+     * Get current configuration
+     */
+    getConfig(): Readonly<FIPSModeConfig>;
+    /**
+     * Check if FIPS mode is enabled
+     */
+    isFIPSModeEnabled(): boolean;
+    /**
+     * Register an audit callback
+     */
+    onAudit(callback: FIPSAuditCallback): void;
+    /**
+     * Get recorded violations
+     */
+    getViolations(): FIPSViolation[];
+    /**
+     * Clear recorded violations
+     */
+    clearViolations(): void;
+    /**
+     * Emit audit event
+     */
+    private emitAudit;
+    /**
+     * Record a FIPS violation
+     */
+    private recordViolation;
+    /**
+     * Validate and potentially block a crypto operation
+     */
+    private validateOperation;
+    /**
+     * Create audit entry helper
+     */
+    private createAuditEntry;
+    /**
+     * FIPS-compliant encryption
+     *
+     * Only allows FIPS 140-2 approved algorithms (AES-128, AES-256 in GCM, CBC, CTR modes)
+     *
+     * @param data - Data to encrypt
+     * @param key - Encryption key
+     * @param algorithm - FIPS-approved algorithm (default: aes-256-gcm)
+     * @returns Encrypted data with IV and auth tag
+     */
+    fipsEncrypt(data: Buffer, key: Buffer, algorithm?: FIPSSymmetricAlgorithm): Promise<{
+        ciphertext: Buffer;
+        iv: Buffer;
+        authTag?: Buffer;
+    }>;
+    /**
+     * FIPS-compliant decryption
+     *
+     * Only allows FIPS 140-2 approved algorithms
+     *
+     * @param ciphertext - Encrypted data
+     * @param key - Decryption key
+     * @param iv - Initialization vector
+     * @param algorithm - FIPS-approved algorithm (default: aes-256-gcm)
+     * @param authTag - Authentication tag (required for GCM mode)
+     * @returns Decrypted data
+     */
+    fipsDecrypt(ciphertext: Buffer, key: Buffer, iv: Buffer, algorithm?: FIPSSymmetricAlgorithm, authTag?: Buffer): Promise<Buffer>;
+    /**
+     * FIPS-compliant hashing
+     *
+     * Only allows SHA-2 family (SHA-256, SHA-384, SHA-512)
+     *
+     * @param data - Data to hash
+     * @param algorithm - FIPS-approved hash algorithm (default: sha256)
+     * @returns Hash digest
+     */
+    fipsHash(data: Buffer | string, algorithm?: FIPSHashAlgorithm): Promise<Buffer>;
+    /**
+     * FIPS-compliant HMAC
+     *
+     * Only allows HMAC-SHA256, HMAC-SHA384, HMAC-SHA512
+     *
+     * @param data - Data to authenticate
+     * @param key - HMAC key
+     * @param algorithm - Hash algorithm for HMAC (default: sha256)
+     * @returns HMAC digest
+     */
+    fipsHmac(data: Buffer | string, key: Buffer, algorithm?: FIPSHMACAlgorithm): Promise<Buffer>;
+    /**
+     * FIPS-compliant digital signature
+     *
+     * Only allows RSA (2048+ bits) and ECDSA (P-256, P-384, P-521)
+     *
+     * @param data - Data to sign
+     * @param privateKey - Private key for signing
+     * @param algorithm - Signing algorithm (default: sha256)
+     * @returns Digital signature
+     */
+    fipsSign(data: Buffer | string, privateKey: crypto.KeyObject | string, algorithm?: FIPSHashAlgorithm): Promise<Buffer>;
+    /**
+     * FIPS-compliant signature verification
+     *
+     * @param data - Data that was signed
+     * @param signature - Signature to verify
+     * @param publicKey - Public key for verification
+     * @param algorithm - Hash algorithm used for signing (default: sha256)
+     * @returns true if signature is valid
+     */
+    fipsVerify(data: Buffer | string, signature: Buffer, publicKey: crypto.KeyObject | string, algorithm?: FIPSHashAlgorithm): Promise<boolean>;
+    /**
+     * FIPS-compliant random bytes generation
+     *
+     * Uses DRBG (Deterministic Random Bit Generator) compliant with SP 800-90A
+     *
+     * @param length - Number of bytes to generate
+     * @returns Random bytes
+     */
+    fipsRandomBytes(length: number): Promise<Buffer>;
+    /**
+     * FIPS-compliant key derivation using PBKDF2
+     *
+     * @param password - Password to derive key from
+     * @param salt - Salt value
+     * @param iterations - Number of iterations (minimum 1000)
+     * @param keyLength - Desired key length in bytes
+     * @param digest - Hash algorithm (default: sha256)
+     * @returns Derived key
+     */
+    fipsPBKDF2(password: Buffer | string, salt: Buffer, iterations: number, keyLength: number, digest?: FIPSHashAlgorithm): Promise<Buffer>;
+    /**
+     * FIPS-compliant key derivation using HKDF
+     *
+     * @param ikm - Input keying material
+     * @param salt - Salt value
+     * @param info - Context and application specific information
+     * @param keyLength - Desired key length in bytes
+     * @param digest - Hash algorithm (default: sha256)
+     * @returns Derived key
+     */
+    fipsHKDF(ikm: Buffer, salt: Buffer, info: Buffer, keyLength: number, digest?: FIPSHashAlgorithm): Promise<Buffer>;
+    /**
+     * Generate FIPS-compliant key pair
+     *
+     * @param type - Key type ('rsa' or 'ec')
+     * @param options - Key generation options
+     * @returns Key pair
+     */
+    fipsGenerateKeyPair(type: 'rsa' | 'ec', options?: {
+        modulusLength?: number;
+        namedCurve?: string;
+    }): Promise<{
+        publicKey: crypto.KeyObject;
+        privateKey: crypto.KeyObject;
+    }>;
+    /**
+     * Validate certificate for FIPS compliance
+     *
+     * @param cert - X.509 certificate (PEM format or X509Certificate object)
+     * @param options - Validation options
+     * @returns Validation result
+     */
+    validateCertificate(cert: string | crypto.X509Certificate, options?: CertificateValidationOptions): {
+        valid: boolean;
+        errors: string[];
+        warnings: string[];
+    };
+    /**
+     * Shutdown the provider
+     */
+    shutdown(): Promise<void>;
+}
+/**
+ * Enable global FIPS mode
+ */
+export declare function enableFIPSMode(): void;
+/**
+ * Disable global FIPS mode
+ */
+export declare function disableFIPSMode(): void;
+/**
+ * Check if global FIPS mode is enabled
+ */
+export declare function isFIPSModeEnabled(): boolean;
+/**
+ * Get the default FIPS crypto provider
+ */
+export declare function getFIPSCryptoProvider(): FIPSCryptoProvider;
+/**
+ * Set a custom FIPS crypto provider as the default
+ */
+export declare function setFIPSCryptoProvider(provider: FIPSCryptoProvider): void;
+/**
+ * Reset the default FIPS crypto provider (for testing)
+ */
+export declare function resetFIPSCryptoProvider(): Promise<void>;
+/**
+ * FIPS-compliant encrypt using default provider
+ */
+export declare function fipsEncrypt(data: Buffer, key: Buffer, algorithm?: FIPSSymmetricAlgorithm): Promise<{
+    ciphertext: Buffer;
+    iv: Buffer;
+    authTag?: Buffer;
+}>;
+/**
+ * FIPS-compliant decrypt using default provider
+ */
+export declare function fipsDecrypt(ciphertext: Buffer, key: Buffer, iv: Buffer, algorithm?: FIPSSymmetricAlgorithm, authTag?: Buffer): Promise<Buffer>;
+/**
+ * FIPS-compliant hash using default provider
+ */
+export declare function fipsHash(data: Buffer | string, algorithm?: FIPSHashAlgorithm): Promise<Buffer>;
+/**
+ * FIPS-compliant sign using default provider
+ */
+export declare function fipsSign(data: Buffer | string, privateKey: crypto.KeyObject | string, algorithm?: FIPSHashAlgorithm): Promise<Buffer>;
+/**
+ * FIPS-compliant random bytes using default provider
+ */
+export declare function fipsRandomBytes(length: number): Promise<Buffer>;
+/**
+ * Create a new FIPSCryptoProvider instance
+ */
+export declare function createFIPSCryptoProvider(config?: Partial<FIPSModeConfig>): FIPSCryptoProvider;
+/**
+ * Create FIPSCryptoProvider from environment variables
+ */
+export declare function createFIPSCryptoProviderFromEnv(): FIPSCryptoProvider;
+//# sourceMappingURL=fips-mode.d.ts.map