AnkaSecure Crypto CLI — Interactive Mode

CLI Version: 3.4.0 Total subcommands: 26 (plus the interactive boxed menu described below)

The Crypto CLI ships with a guided interactive boxed menu designed for end-user crypto sessions. It is launched with the --interactive flag on the root binary and presents a numeric main menu plus context-aware submenus for each operation category. Administrative key write/lifecycle workflows are intentionally absent — see the Key Management CLI for those.

Launching the interactive menu

java -jar ankasecure-cli-crypto-3.4.0-fat.jar --interactive
# or, after install:
AnkaSecureCLI --interactive

The first call requires a valid configuration. If no config exists, the menu walks you through init automatically (option 1 — Authentication & Setup) before allowing any other action.

Main menu

┌─ AnkaSecure Crypto CLI ────────────────────────────────────┐
│ Post-Quantum Cryptography Command-Line Interface           │
│ Version 3.0.0                                              │
└────────────────────────────────────────────────────────────┘

  ┌─ GETTING STARTED ───────────────────────────────────────┐
  │  1. Authentication & Setup                              │
  │  2. View Supported Algorithms (Hybrid/PQC/Classical)    │
  └─────────────────────────────────────────────────────────┘

  ┌─ KEYS ──────────────────────────────────────────────────┐
  │  3. View Keys                                           │
  │     → List and inspect available keys                   │
  └─────────────────────────────────────────────────────────┘

  ┌─ CRYPTOGRAPHIC OPERATIONS (Small Files < 5MB) ──────────┐
  │  4. Encryption & Decryption                             │
  │  5. Digital Signatures                                  │
  │  6. Combined Operations (Sign+Encrypt)                  │
  └─────────────────────────────────────────────────────────┘

  ┌─ LARGE FILE OPERATIONS (Streaming, large inputs) ───────┐
  │  7. Streaming Operations                                │
  │     → Encryption, signatures, combined(memory-efficient)│
  └─────────────────────────────────────────────────────────┘

  ┌─ MIGRATION & INTEROPERABILITY ──────────────────────────┐
  │  8. PKCS#7/CMS Migration & Conversion                   │
  │     → Convert existing formats to PQC                   │
  └─────────────────────────────────────────────────────────┘

  ┌─ UTILITIES ─────────────────────────────────────────────┐
  │  9. Utilities & Information                             │
  └─────────────────────────────────────────────────────────┘

  0. Exit

Select option [0-9]:

Navigation rules (apply at every level):

• Press a digit then Enter to choose.
• Press Enter without a digit to apply the default action.
• Press 0 and Enter at any submenu to return to the parent.
• Submenus show a breadcrumb on the top line (e.g. Main Menu > Encryption & Decryption > Encrypt File).

1. Authentication & Setup

Wizard for first-time configuration of the CLI. Same workflow as the standalone init subcommand, with prompts for:

• Server URL
• OAuth2 client_id
• OAuth2 client_secret (typed via readPassword, never echoed)
• TLS verification policy (warns when disabled)
• Optional PQC transport layer

The resulting credentials are encrypted with AES-256-GCM + PBKDF2 (150 000 iterations) and written to ~/.ankasecure-crypto/config.properties.

After the first successful setup, option 1 lets you re-run init (overwriting the existing config), inspect the active session, or clear credentials.

2. View Supported Algorithms

Browses the algorithm catalog with three view modes:

• Quick presets — common scenarios (post-quantum-only, FIPS-approved, hybrid-ready, etc.).
• Custom filter builder — interactively combines family, category, NIST level and standard.
• Table / detailed / JSON output.

This wraps the get-supported-algorithms subcommand with a presentation layer.

3. View Keys

Read-only key browsing. The submenu offers exactly two options:

┌─ BROWSE ────────────────────────────────────────────────┐
│  1. List All Keys (with filters)                        │
│  2. View Key Details                                    │
└─────────────────────────────────────────────────────────┘

  0. Back to Main Menu

Select option [0-2]:

• List All Keys — the Key Inventory. Interactive prompts collect the server-side filters (origin, restriction, key type, lifecycle status) and ask for the output format (Table or Detailed) once; both apply to every page. The inventory then navigates lazily page-by-page: each page is one server request of 50 keys, fetched on demand. A header Page X/Y — N keys (rendered from the page-envelope totals, never by loading the full key set) precedes each page, and a [n]ext / [p]rev / [q]uit prompt fetches the next or previous page or returns to the View Keys menu.
• View Key Details — wraps get-key-metadata, with a key-picker that lets you select from the visible inventory.

Administrative key writes (generate, import, patch, rotate, revoke, archive, delete, export) are not part of this menu and are not exposed by the Crypto CLI at all. To run those workflows, switch to ankasecure-km or the Admin Console.

4. Encryption & Decryption

Submenu for the small-file crypto operations. Each of the three chooses streaming on its own: Encrypt File by size (unless PQC transport is enabled), Decrypt File and Re-encrypt File when the input is a streaming artifact.

1. Encrypt File
2. Decrypt File
3. Re-encrypt File (algorithm or key rotation, no plaintext exposure)
0. Back to Main Menu

Each option launches a wizard:

• Encrypt File — prompts for --kid, --input-file, --output-file, optional --force. If the input reaches the server's configured compact limit (crypto.max-plaintext-bytes, default 4 MB), the CLI announces it is switching to streaming mode automatically. With PQC transport enabled it does not switch: the wizard ends with a message naming encrypt-file-stream, because the streaming routes travel under TLS only and streaming is an explicit choice (the Streaming Operations menu offers it).
• Decrypt File — prompts for --input-file, --output-file. The key id is recovered from the envelope.
• Re-encrypt File — prompts for the new --kid, the input ciphertext, and the output. Used to migrate data from a legacy algorithm to a PQC algorithm without exposing plaintext to disk.

5. Digital Signatures

1. Sign File
2. Verify Signature
3. Re-sign File (sign with a different key)
0. Back to Main Menu

• Sign File — wraps sign-file; prompts for signing key id, input file and detached-signature output path. With PQC transport enabled, a file at or above the compact limit is not switched to streaming: the wizard ends with a message naming sign-file-stream.
• Verify Signature — wraps verify-signature; prompts for input file and signature file. Exit status reflects validity.
• Re-sign File — wraps resign-file; used after key rotation.

6. Combined Operations (Sign+Encrypt)

1. Sign and Encrypt File
2. Decrypt and Verify File
0. Back to Main Menu

• Sign and Encrypt File — wraps sign-encrypt-file; prompts for both the signing key id and the encryption key id.
• Decrypt and Verify File — wraps decrypt-verify-file; both keys are recovered from the envelope.

7. Streaming Operations

The streaming submenu exposes eight explicit streaming operations (Encrypt, Decrypt, Sign, Verify Signature, Re-encrypt, Re-sign, Encrypt with Public Key, Verify with Public Key) for callers who choose streaming explicitly. Its note states that, in the regular menus, Encrypt File and Sign File switch to streaming at the server's compact limit (not with PQC transport), and Decrypt File and Re-encrypt File follow the input's format. Two presentation tiers:

• Single-operation flows (Encrypt Stream, Decrypt Stream, Sign Stream, Verify Stream, etc.) — wraps the matching subcommand, prompts for buffer size and an optional progress bar.
• Combined flows (Sign-Encrypt Stream) — same as the small-file combined operation but with explicit streaming semantics.

Use this section when you need deterministic streaming behaviour regardless of input size, or when working with files in the GB / TB range.

8. PKCS#7 / CMS Migration & Conversion

1. Analyze PKCS#7 Envelope
2. Convert PKCS#7 to PQC
3. Analyze PKCS#7 (streaming)
4. Convert PKCS#7 to PQC (streaming)
0. Back to Main Menu

• Analyze — wraps analyze-pkcs7 / analyze-pkcs7-stream. Read-only inspection of legacy envelopes: detected algorithms, signers, certificates, content type.
• Convert — wraps convert-pkcs7 / convert-pkcs7-stream. Translates a legacy PKCS#7/CMS payload into a PQC-protected output, optionally re-signing or re-encrypting with new key ids. The screens state the Capability Grants a conversion needs (REENCRYPT from the decrypting recipient to every recipient, RESIGN from each signer to itself), and a conversion refused 403 by the grant gate prints the same hint as the batch commands.

9. Utilities & Information

Miscellaneous tools:

• View Current Session — wraps view-session.
• Reload Configuration — re-reads ~/.ankasecure-crypto/config.properties after manual edits.
• Clear Cached Algorithm Metadata — flushes the in-process algorithm catalog cache.
• About — prints version, build commit and license.

Cancellation and validation

• Every interactive prompt accepts the literal cancel (or pressing ESC if the terminal supports it) to abort the current wizard and return to the previous menu, except the key prompt.
• The key prompt accepts any Key ID the platform accepts (1 to 255 letters, digits, dots, hyphens and underscores, not dots alone), and every word is a valid Key ID, so its keywords start with a colon, which no Key ID contains: :cancel returns to the previous menu and :list browses the keys that have the capability the operation needs. A key named cancel or list is selected by typing its name.
• Input validation is performed inline: invalid paths, non-existent key ids, mismatched algorithm/capability pairings, and overwrite collisions are caught before any network call.
• Output paths are validated by FileOutputGuard: existing files prompt for explicit overwrite confirmation unless --force was acknowledged earlier in the session.

When to use which mode

Related documentation

• Commands Reference — flag-CLI subcommand catalogue
• Crypto CLI Architecture — internals, command-execution pipeline
• Internationalization — locale support
• Key Management CLI Overview — administrative key management

CLI Version: 3.4.0 Java Version: 25

© 2025 ANKATech Solutions Inc. All rights reserved.