Summary

Add a registry for managing key types.

Review Request #15183 — Created July 21, 2026 and updated July 29, 2026, 8:16 p.m.

Information

Owner

chipx86

Repository

cryptozoology

Branch

master

Bugs

Depends On

Reviewers

Groups

beanbag-misc

People

Description

This introduces KeyTypesRegistry, which tracks all key types supported
by Cryptozoology. This provides access to keys by key type ID and by
encryption or keywrap algorithm.

While this only includes support for AES and EC keys right now, it would
allow callers to provide or override key types as needed.

The existing call sites that hard-code knowledge of key types now make
use of the registry to fetch keys by ID or algorithm, except where
appropriate (e.g., if explicitly an AES key needs to be created).

Testing Done

Unit tests pass.

Commits

Summary	ID
Add a registry for managing key types. This introduces `KeyTypesRegistry`, which tracks all key types supported by Cryptozoology. This provides access to keys by key type ID and by encryption or keywrap algorithm. While this only includes support for AES and EC keys right now, it would allow callers to provide or override key types as needed. The existing call sites that hard-code knowledge of key types now make use of the registry to fetch keys by ID or algorithm, except where appropriate (e.g., if explicitly an AES key needs to be created).	a23ed43afbc580db35b61914181269dfb0c49a85

Summary

Add a registry for managing key types.

This introduces `KeyTypesRegistry`, which tracks all key types supported by Cryptozoology. This provides access to keys by key type ID and by encryption or keywrap algorithm. While this only includes support for AES and EC keys right now, it would allow callers to provide or override key types as needed. The existing call sites that hard-code knowledge of key types now make use of the registry to fetch keys by ID or algorithm, except where appropriate (e.g., if explicitly an AES key needs to be created).

a23ed43afbc580db35b61914181269dfb0c49a85

Issues

Description	From	Last Updated
Do we want to document somewhere that get_key_type('ec') resolves only to the private key class? It feels a little confusing …	david	July 22, 2026, 2:12 p.m.
Do we not want to reexport KeyTypesRegistry as well?	david	July 22, 2026, 1:56 p.m.
We should protect this with the registry's lock so we don't end up with issues across threads: with self._lock: for …	david	July 22, 2026, 1:57 p.m.
This ends up caching None for invalid values, making it so a stream of Secret.decode() calls with random alg= values …	david	July 22, 2026, 5:19 p.m.
Same here regarding self._lock and not caching invalid values. Perhaps we could extract this into a helper?	david	July 22, 2026, 1:59 p.m.
Can we make this use the same typed signature as the base class?	david	July 22, 2026, 2:01 p.m.
This reads a little odd. How about just "This clears the algorithm caches whenever an item is registered"?	david	July 22, 2026, 2:02 p.m.
Can we make this use the same typed signature as the base class?	david	July 22, 2026, 2:02 p.m.
Same here re: "This will be used"	david	July 22, 2026, 2:02 p.m.
If we wrap the cache writes in with self._lock its less of an issue, but this is rebinding rather than …	david	July 22, 2026, 2:05 p.m.
The actual implementation is named "KeyTypesRegistry" (with an s). The name here (and in all the test methods/docstrings) is incorrect. …	david	July 22, 2026, 2:03 p.m.
Can we call registry.populate() here so that this matches more closely with test_get_for_keywrap_alg_uses_cache?	david	July 22, 2026, 2:11 p.m.
Inside _get_or_add_cached we iterate through the registry in the cache miss path. If the registry hasn't populated yet it will …	david	July 29, 2026, 8:13 p.m.
This isn't quite right, we're returning a key class, not an instance.	david	July 29, 2026, 8:13 p.m.

flake8 passed.

JSHint passed.

The issue has been dropped. Show all issues

Do we want to document somewhere that get_key_type('ec') resolves only to the private key class? It feels a little confusing that we have separate public and private classes but only the private one is registered.

chipx86

July 22, 2026, 2:12 p.m.

Let me think about that outside of this change. That's really more about the relationship between those classes, and probably should live there.

cryptozoology/keys/__init__.py (Diff revision 1)

The issue has been dropped. Show all issues

Do we not want to reexport KeyTypesRegistry as well?

chipx86

July 22, 2026, 2:12 p.m.

I don't see any reason to. It's not something a caller would use, just unit tests. We don't do this elsewhere.

cryptozoology/keys/registry.py (Diff revision 1)

The issue has been resolved. Show all issues

We should protect this with the registry's lock so we don't end up with issues across threads:

with self._lock:
    for key_cls in self:
        ...

    self._enc_key_cache_map[alg] = key_cls

cryptozoology/keys/registry.py (Diff revision 1)

The issue has been resolved. Show all issues

This ends up caching None for invalid values, making it so a stream of Secret.decode() calls with random alg= values grows memory without bound.

Can we only cache positive results?

Same for the keywrap algorithm.

chipx86

July 22, 2026, 2:12 p.m.

A None result is a valid result for this function and should be cached. If this is called 10 times for the same unsupported algorithm, we want that None result instead of looping 10 times and performing regex matches or string parsing on the same thing each time. I can address the unbound growth issue.

cryptozoology/keys/registry.py (Diff revision 1)

The issue has been resolved. Show all issues

Same here regarding self._lock and not caching invalid values. Perhaps we could extract this into a helper?

chipx86

July 22, 2026, 2:12 p.m.

I thought about that, but it's two simple tight loops. I don't want to over-engineer this.

chipx86

July 22, 2026, 2:45 p.m.

Alright, there's going to be more engineering required for the unbound growth issue, so I guess I will do this in some form.

cryptozoology/keys/registry.py (Diff revision 1)

The issue has been dropped. Show all issues

Can we make this use the same typed signature as the base class?

chipx86

July 22, 2026, 2:12 p.m.

It's a callback handler. It only needs to accept what it needs to deal with. We use this pattern plenty, ignoring the arguments if we don't need them, so we don't have to micromanage the signature.

cryptozoology/keys/registry.py (Diff revision 1)

The issue has been resolved. Show all issues

This reads a little odd. How about just "This clears the algorithm caches whenever an item is registered"?

cryptozoology/keys/registry.py (Diff revision 1)
The issue has been dropped. Show all issues
```
Can we make this use the same typed signature as the base class?
```
cryptozoology/keys/registry.py (Diff revision 1)
The issue has been resolved. Show all issues
```
Same here re: "This will be used"
```

cryptozoology/keys/registry.py (Diff revision 1)

The issue has been dropped. Show all issues

If we wrap the cache writes in with self._lock its less of an issue, but this is rebinding rather than clearing. I think it would be better to use self._*_map.clear() here.

chipx86

July 22, 2026, 2:12 p.m.

We also use this to set the state initially. I could separate that out but I'm not sure we gain anything from this. Absolute worst-case here (if we didn't lock on iterate) is that we cache a thing that then quickly falls out of cache, or we put a value in cache that was just put in cache from another thread. And I think that's the same as calling .clear(). Not sure it's worth worrying about.

cryptozoology/keys/tests/test_registry.py (Diff revision 1)

The issue has been resolved. Show all issues

The actual implementation is named "KeyTypesRegistry" (with an s). The name here (and in all the test methods/docstrings) is incorrect.

That said, all of our other registries are named in the singular, so KeyTypeRegistry is perhaps the better one to use.

chipx86

July 22, 2026, 2:12 p.m.

I renamed it at one point. I'll rename it back.

cryptozoology/keys/tests/test_registry.py (Diff revision 1)

The issue has been resolved. Show all issues

Can we call registry.populate() here so that this matches more closely with test_get_for_keywrap_alg_uses_cache?

Change Summary:


Renamed KeyTypesRegistry to KeyTypeRegistry (and same for the singleton).
The algorithm lookup caches now employ a LRU, and access is managed by a wrapper function.
Made it clear that the arguments going to the registry hooks are unused.

Commits:

	Summary	ID
	Add a registry for managing key types. This introduces `KeyTypesRegistry`, which tracks all key types supported by Cryptozoology. This provides access to keys by key type ID and by encryption or keywrap algorithm. While this only includes support for AES and EC keys right now, it would allow callers to provide or override key types as needed. The existing call sites that hard-code knowledge of key types now make use of the registry to fetch keys by ID or algorithm, except where appropriate (e.g., if explicitly an AES key needs to be created).	908e102286672e8dda1fcd967449e9c176c4e818
	Add a registry for managing key types. This introduces `KeyTypesRegistry`, which tracks all key types supported by Cryptozoology. This provides access to keys by key type ID and by encryption or keywrap algorithm. While this only includes support for AES and EC keys right now, it would allow callers to provide or override key types as needed. The existing call sites that hard-code knowledge of key types now make use of the registry to fetch keys by ID or algorithm, except where appropriate (e.g., if explicitly an AES key needs to be created).	5dfabcea925bf7710f2d5ee48fc40a167ed0f22f

Diff:

Revision 2 (+902 -30)

Show changes

	cryptozoology/keys/__init__.py
	cryptozoology/keys/registry.py
	cryptozoology/keys/tests/test_registry.py
	cryptozoology/operations/secrets.py

Checks run (2 succeeded)

flake8 passed.

JSHint passed.

cryptozoology/keys/registry.py (Diff revision 2)

The issue has been resolved. Show all issues

Inside _get_or_add_cached we iterate through the registry in the cache miss path. If the registry hasn't populated yet it will call populate(), which triggers a reset of the caches. This means the active cache would be different than the one bound inside the parameter here.
We should probably do:

self.populate()  # Ensure defaults have been added.

with self._lock:
    return self._get_or_add_cached(...)


Some for get_for_keywrap_alg

cryptozoology/keys/registry.py (Diff revision 2)
The issue has been resolved. Show all issues
```
This isn't quite right, we're returning a key class, not an instance.
```

Change Summary:


Registries are now populated before locking when fetching by algorithm.
Fixed a return type in the docstring.

Commits:

	Summary	ID
	Add a registry for managing key types. This introduces `KeyTypesRegistry`, which tracks all key types supported by Cryptozoology. This provides access to keys by key type ID and by encryption or keywrap algorithm. While this only includes support for AES and EC keys right now, it would allow callers to provide or override key types as needed. The existing call sites that hard-code knowledge of key types now make use of the registry to fetch keys by ID or algorithm, except where appropriate (e.g., if explicitly an AES key needs to be created).	5dfabcea925bf7710f2d5ee48fc40a167ed0f22f
	Add a registry for managing key types. This introduces `KeyTypesRegistry`, which tracks all key types supported by Cryptozoology. This provides access to keys by key type ID and by encryption or keywrap algorithm. While this only includes support for AES and EC keys right now, it would allow callers to provide or override key types as needed. The existing call sites that hard-code knowledge of key types now make use of the registry to fetch keys by ID or algorithm, except where appropriate (e.g., if explicitly an AES key needs to be created).	a23ed43afbc580db35b61914181269dfb0c49a85

Diff:

Revision 3 (+910 -30)

Show changes

	cryptozoology/keys/__init__.py
	cryptozoology/keys/registry.py
	cryptozoology/keys/tests/test_registry.py
	cryptozoology/operations/secrets.py

Checks run (2 succeeded)

flake8 passed.

JSHint passed.

Ship it!

```
Ship It!
```