ANKASecure© Documentation

ANKASecure© is a Cryptographic Control Plane: a layer that governs cryptographic behaviour across enterprise systems, so that algorithm choice, key lifecycle and policy stop being decisions baked into application code and become decisions the platform enforces at runtime.

This site is written for the person integrating with a deployment that already exists — an architect designing that integration, a developer writing the code, or a compliance function looking for the evidence behind a claim. It covers the model, the client surface (SDK, CLI, OpenAPI), the algorithms and the compliance mapping, and one page for every error the platform can return.

Start here

Understand the model

Why the platform is shaped the way it is. Read this before designing an integration — most integration mistakes are model mistakes.

• Foundational Concepts — the section index, and what each page answers
• The Cryptographic Control Plane — the central idea
• CAPA — Crypto Agility Posture Architecture — the five pillars, and the posture model built on them
• Cryptographic Maturity Model — where an organisation stands today, and what moves it
• Policy-Driven Crypto-Agility — how an algorithm changes without an application changing
• Cryptographic Sovereignty — sharing data with a third party without surrendering keys
• Multi-Tenant Isolation Model — what separates one tenant from another
• Envelope Encryption Pattern — the DEK/KEK structure every operation rests on
• Key Identifier (KID) System — how a ciphertext names the key that made it

Choose your cryptography

• Hybrid vs Composite Keys — the distinction, and when each applies
• Algorithm Catalog — 125 algorithms, classical and post-quantum
• Composite Algorithm Catalog — the 41 composite combinations
• Integrity Guarantee — what the platform promises about a payload it returns
• Random Number Generation — entropy sources and their qualification

Build against it

Java SDK

• SDK Overview and Prerequisites
• SDK Quick Start — first call, end to end
• Usage Guide and Integration
• Worked flows 1–21 — one runnable example per scenario, from a first encrypt to composite keys
• File Operation Patterns — streaming and large payloads
• Security Best Practices
• PQC Transport — quantum-safe session establishment

Command line

• CLI Overview and Installation
• Crypto CLI commands and Interactive Mode
• CLI Architecture and the generated OpenAPI client

Direct HTTP

• OpenAPI Specifications — the vendored core, auth and pqc documents to generate a client from
• JOSE Technical Reference — the wire formats the platform produces and consumes
• JWS Serialization and JAdES — choosing a signature serialization
• Detached Signatures
• Interoperability & Standards — what a third party can verify without our software

Migrate what you already have

The migration section is a sequence: assess, import, analyse, convert, integrate, validate.

It opens with import — bringing legacy keys and certificate chains in from a PKCS#12 or JKS keystore. That is a control-plane operation on the Admin API, POST /api/v3/admin/tenants/{tenantId}/keys/import-keystore; the step-by-step import guide is delivered with a licensed deployment rather than published here.

• Migration Overview — strategy, and the shape of the whole path
• Planning & Assessment
• Analyze · Convert · Utilities
• PKCS#7 to JOSE Conversion — the most common legacy case
• Integration and Monitoring & Validation
• API Reference — the migration endpoints, with their parameters, responses and error codes

When a call fails

Every failure the platform returns carries a type URI, and every one of those URIs has a page here explaining what it means and what to change.

• Error Reference — the index, with the quick-reference table and the response format

Show the evidence

For the reader who has to justify the choice to an auditor, a regulator or a security committee.

• Regulatory Compliance Matrix — the complete mapping
• Standards Alignment
• NIST CSWP 39 · GSA PQC · ETSI QSC · IETF Composite KEM
• FIPS 140-3 & Algorithms · OWASP · TSA / eIDAS
• The platform's PCI DSS v4.0 self-assessment is shared under a commercial agreement rather than published here — ask your ANKATech contact for it
• Policy Enforcement Guide and Template Selection Guide — how a compliance requirement becomes a policy the platform enforces
• Performance Benchmarks — measured cost of every operation, compact and streaming

Background reading

Longer-form explanations, for sharing with people who are not going to read a reference page.

• ANKASecure Explained
• Composite Keys Explained
• Hybrid Encryption with ML-KEM and Hybrid Encryption
• Data-Level Protection with Hybrid Keys
• PQC Risk Analysis: Financial Sector