Security
The register.
Every algorithm Senua AI uses: what it protects, its standard, its status in the Australian Government's Information Security Manual (September 2026), and what it moves to.
| Protects | Algorithm | Standard | ISM status | Moves to |
|---|---|---|---|---|
| Connections: key agreement | X25519, ECDH P-256 | RFC 8446, FIPS 186-5 | P-256 until 2030; X25519 not listed | X25519 with ML-KEM-768, then ML-KEM-1024 |
| Connections: server identity | RSA 2048 to 8192, ECDSA P-256 and P-384, Ed25519; SHA-2; a shipped revocation list | RFC 5280, RFC 8017 | RSA, ECDSA until 2030 | ML-DSA certificates |
| Connections: traffic | AES-128-GCM, ChaCha20-Poly1305 | SP 800-38D, RFC 8439 | AES-128 until 2030 | AES-256-GCM (implemented) |
| Learned state at rest | ChaCha20-Poly1305, 256-bit keys, HKDF-SHA-256 | RFC 8439, RFC 5869 | Not listed | AES-256-GCM |
| Product releases | ECDSA P-384, SHA-384; key in AWS KMS | FIPS 186-5 | Until 2030 | ML-DSA-87 beside it |
| Engine software | ChaCha20-Poly1305, a 256-bit key per release in AWS KMS | RFC 8439 | Not listed | AES-256-GCM |
| Passwords | PBKDF2-HMAC-SHA-256, 600,000 iterations | SP 800-132 | Until 2030 | HMAC-SHA-512 |
| Licences, engine links | Ed25519; X25519 with ChaCha20-Poly1305 | RFC 8032, RFC 7748 | Not listed | ML-DSA-87, ML-KEM-1024 |
| Hashing, key derivation | SHA-256, SHA-384, SHA-512; HMAC, HKDF | FIPS 180-4, RFC 5869 | SHA-256 until 2030 | SHA-384, SHA-512 |
| Sign-in codes | TOTP, HMAC-SHA-1 | RFC 6238 | Not approved | Kept for authenticators |