Understanding GOST Cryptography Standards: A Practical Guide for Russian Developers
The article explains GOST cryptography standards in accessible language for developers who encounter requirements to implement electronic signatures through CryptoPro. It begins by clarifying that modern secure systems rely on three distinct cryptographic primitives rather than a single bundled technology.
Three Pillars of Cryptography
The first pillar is hashing, implemented in GOST R 34.11-2012 (Stribog), which produces a fixed-length digest from any input size while making reversal impossible. The second pillar is asymmetric digital signatures under GOST R 34.10-2012, which uses a private key on a hardware token to sign the hash and an X.509 certificate containing the public key for verification. The third pillar is symmetric block encryption via GOST R 34.12-2015 algorithms Magma and Kuznechik, which protect data confidentiality using the same key for both encryption and decryption.
Generations of Russian Standards
The text outlines three generations of domestic cryptography. The 1990s generation based on GOST R 34.10-94 and GOST 28147-89 is now obsolete. The 2000s generation introduced elliptic-curve signatures in GOST R 34.10-2001 but certificate issuance was discontinued in 2019. The current 2012+ generation combines strengthened elliptic curves, the Stribog hash function, and the Magma and Kuznechik ciphers that remain mandatory today.
Western Equivalents and Packaging Standards
Direct mappings are provided to international algorithms: Stribog corresponds to SHA-256, GOST R 34.10-2012 to ECDSA or RSA-2048, and Kuznechik to AES-256. Practical interoperability is achieved through the PKCS family and X.509 standards. PKCS#11 supplies the driver interface for accessing private keys stored on tokens such as Rutoken without exposing them to system memory. Certificate requests follow PKCS#10, while protected containers use PKCS#12. Final signatures are wrapped in PKCS#7 / CMS structures and enhanced with CAdES, XAdES, or PAdES profiles to include trusted timestamps and support different document formats.
The guide concludes that once the separate roles of each standard are understood, working with Russian cryptography becomes a predictable engineering task rather than an opaque process.
Related articles
Google to Back Unified robots.txt Standard for Blocking AI Training Data Use
Google has announced plans to support a common mechanism in robots.txt that allows website owners to opt out of having their content used for training generative AI models. The feature will be based on work by the AIPREF working group at IETF and is scheduled for rollout in 2027. Instead of issuing separate instructions to each AI provider, publishers will be able to set a single policy marker that participating companies are expected to respect. Google intends to treat an unspecified general marker the same way it currently handles its own Google-Extended directive. Existing per-company rules will continue to function, letting site owners combine a broad default with specific exceptions. The approach simplifies management as the number of AI crawlers grows, though compliance will remain voluntary and dependent on which organizations adopt the standard.
Who Pays When AI Agents Err: Insurance for AI Risks in Russia and the West
A typical 2026 scenario involves an AI agent connected to a CRM system that mistakenly deletes half of a company's customer database by misclassifying contacts as duplicates. The incident occurs without any cyber attack or malicious intent from developers, raising questions about liability among model developers, integrators, and the deploying company. Russian law places responsibility on humans or organizations under the National AI Strategy to 2030 and the AI Ethics Code, with harm assessed via general Civil Code provisions such as Article 1079 on sources of increased danger. Experimental legal regimes since January 2025 require mandatory insurance for AI-related harm in areas like autonomous vehicles and telemedicine, while Federal Law No. 243-FZ of July 2026 grants developers of sovereign AI models rights to insure liability and mandates technical documentation. A March 2026 draft law proposed detailed responsibility chains and exemptions but was significantly diluted in the final version. Internationally, no mandatory AI liability insurance exists in the US or EU, though specialized products from insurers like Armilla and Munich Re cover hallucinations, agent actions, and performance shortfalls, with real incidents already generating claims.
Russia's MinTsifry to Begin Issuing Official Code Signing Certificates in 2027
The Russian Ministry of Digital Development plans to start issuing state-backed code signing certificates for software developers in 2027, with corporate security certificates following in 2028. The initiative aims to help operating systems identify publishers and verify that code has not been altered after release. A draft government decree would grant MinTsifry the powers of a National Certification Authority, allowing it to set certificate requirements, issue and revoke certificates, define validity periods, and maintain a public registry. While the signature confirms origin and integrity, it does not guarantee the absence of vulnerabilities in the software. The law permits charging fees for certificates, but no decision on pricing has been made yet. Full recognition by operating systems, browsers, and app stores will be required, and foreign platforms are not obligated to trust the Russian certificates automatically.
Rostelecom Explores Underground Data Centers in Partnership With Norilsk Nickel for Stronger Physical Protection
Rostelecom is developing underground data centers as a third layer of protection against serious external threats. The first layer involves backup sites with data copies, while the second distributes computing power and services across geographically separated locations. The company is discussing the project with Norilsk Nickel, which could supply both underground facilities and its own power generation capacity. Experts from iKS-Consulting estimate that a buried data center would cost 30-40 percent more than a comparable surface facility due to requirements for waterproofing, ventilation, gas monitoring, specialized fire suppression, evacuation systems, and underground equipment transport. Sources indicate the plans were reported by Vedomosti citing a top Rostelecom executive and people familiar with the talks. No specific timelines, sites, or technical parameters have been disclosed yet.