Standards & Regulatory Alignment

ANKASecure implements post-quantum cryptographic algorithms aligned with guidance from leading international cybersecurity authorities. This document describes the platform's consistency with global cryptographic standards.

Coverage:

• 14 International/National Standards supported
• 15 Countries/Regions with dedicated policy templates
• $50+ Trillion GDP market coverage
• 4.5+ Billion People regulatory reach

Global Standards

NIST PQC (United States)

Aligned with: U.S. National Institute of Standards and Technology (NIST) Post-Quantum Cryptography standardization process

Algorithms:

• ML-KEM (FIPS 203) - Key Encapsulation Mechanism
• ML-DSA (FIPS 204) - Digital Signature Algorithm
• SLH-DSA (FIPS 205) - Stateless Hash-Based Signatures
• XMSS, XMSS^MT, LMS and HSS (SP 800-208 stateful hash-based signatures): XMSS-SHA2_10_256, XMSSMT-SHA2_20/2_256, LMS-SHA256-M32-H10-W4, LMS-SHA256-M24-H10-W4, LMS-HSS-L2-SHA256-M32-H10-W4

Policy Template: NIST_APPROVED

FALCON is deliberately absent. It was selected for standardization as FN-DSA but no FIPS document has been published, so no FALCON parameter set in the catalogue carries a NIST attribution. Under NIST_APPROVED's mandatoryStandards: ["NIST"] the family is unreachable, so the template does not declare it rather than inventing an attribution. For the same reason the template declares no CMCE, BIKE, SABER, NTRU or NTRU Prime.

ENISA (European Union)

Consistent with: European Union Agency for Cybersecurity's PQC migration guidelines and recommended approaches for quantum-resistant key establishment and digital signatures

Algorithms:

• ML-KEM, ML-DSA and SLH-DSA at Security Levels 3 and 5. XMSS and LMS are excluded by the template's level floor: every stateful row is Level 1. The single-tree SHA-256/256 rows XMSS-SHA2_10_256 and LMS-SHA256-M32-H10-W4 carry an ENISA attribution; LMS-SHA256-M24-H10-W4 does not, because ECCG ACM v2.0 agrees a hash-based scheme only with an agreed hash function (Note 46) and SHA-256/192 is not one
• No FALCON: no Falcon parameter set carries ENISA (FALCON-1024 carries ANSSI alone), so EU_COMPLIANT does not admit it; use ANSSI_COMPLIANT for FALCON-1024
• Security Levels 3 and 5

Policy Templates: EU_COMPLIANT, and all European regional templates

BSI TR-02102 (Germany)

Aligned with: Bundesamt für Sicherheit in der Informationstechnik (BSI) technical guideline TR-02102

Recommendations:

• ML-KEM, ML-DSA, SLH-DSA (FALCON is not declared by this template — use ANSSI_COMPLIANT)
• FrodoKEM (unique - LWE-based diversity)
• XMSS, XMSS^MT, LMS and HSS where the state can be managed, with every parameter set of SP 800-208 (TR-02102-1 §5.3.4.3, Table 5.8): every stateful row of the catalogue carries the BSI attribution, the SHA-256/192 set LMS-SHA256-M24-H10-W4 included
• Brainpool Curves (unique - German government standard ECC)
• Hybrid transitions (classical + PQC)

Policy Template: BSI_COMPLIANT

Unique Features:

• Only international standard recommending FrodoKEM for algorithm diversity (lattice-based vs learning-with-errors)
• Brainpool elliptic curves (brainpoolP256r1/384r1/512r1) - German government standard (RFC 5639, BSI TR-03111)
• Classical-only use of Brainpool deprecated after Dec 31, 2031 per BSI TR-02102-3

Brainpool Curves (Germany - BSI Standard)

Developed by: Bundesamt für Sicherheit in der Informationstechnik (BSI)

Standards:

• RFC 5639 (IETF) - Elliptic Curve Cryptography (ECC) Brainpool Standard Curves
• BSI TR-03111 - Elliptic Curve Cryptography (ECC)
• BSI TR-02102-1 - Cryptographic Mechanisms: Recommendations and Key Lengths
• ISO/IEC 15946-5:2017 - Elliptic curve generation

Curves:

• brainpoolP256r1 - 128-bit security (L1)
• brainpoolP384r1 - 192-bit security (L3)
• brainpoolP512r1 - 256-bit security (L5)

Use Cases:

• German federal government agencies
• European compliance (ENISA approved)
• ECDSA digital signatures
• ECDH key agreement

Policy Template: BSI_COMPLIANT (brainpoolP384r1 and brainpoolP512r1 only — brainpoolP256r1 is Level 1, below the template Level 3 floor)

Regulatory Context:

• BSI recommends Brainpool for German government operations
• Sunset Policy: Classical-only use deprecated after December 31, 2031 (BSI TR-02102-3)
• Hybrid Mandatory: Must be combined with PQC algorithms (ML-KEM, ML-DSA) after 2031

Unique Feature: Only ECC curves specifically designed by a national cybersecurity agency (BSI) as alternative to NIST P-curves for sovereignty reasons

ANSSI RGS (France)

Compatible with: Référentiel Général de Sécurité (RGS) and ANSSI guidance on post-quantum cryptography

Recommendations:

• NIST PQC algorithms (ML-KEM, ML-DSA), and SLH-DSA, usable as is (PG-083 §2.2.3)
• FrodoKEM as a conservative KEM for high-security applications (2023 follow-up §2)
• XMSS and LMS where the state can be managed (2023 follow-up §2): the single-tree rows XMSS-SHA2_10_256, LMS-SHA256-M32-H10-W4 and LMS-SHA256-M24-H10-W4 carry the ANSSI attribution, each with a hash output of at least 192 bits (PG-083 §2.1.4); no multi-tree row does
• FALCON preferred for compact signatures (eID cards, smartcards)
• Hybrid migration strategies
• Security Levels 3 and 5

Policy Template: ANSSI_COMPLIANT

Unique Feature: FALCON algorithm preference due to compact signature size (40% smaller than ML-DSA)

NCSC PQC Guidelines (United Kingdom)

Aligned with: UK National Cyber Security Centre recommendations for the transition to post-quantum cryptography

Recommendations:

• ML-KEM, ML-DSA (NIST algorithms)
• SLH-DSA (stateless signatures)

Policy Template: NCSC_UK_PQC

Note: NCSC adopts NIST and ENISA positioning (no unique algorithms)

CCN-CERT / ENS (Spain)

Consistent with: Spanish National Cryptologic Centre (CCN-CERT) guidance for critical systems under the Esquema Nacional de Seguridad (ENS)

Approach: Adopts ENISA and NIST PQC positioning

Policy Template: CCN_CERT_ENS

Note: Aligns with ENISA guidance (no unique algorithms)

ACN (Italy)

Aligned with: Agenzia per la Cybersicurezza Nazionale (ACN) recommendations for quantum-safe cryptography

Approach: Based on ENISA guidance and NIST PQC selected algorithms

Policy Template: ACN_ITALY_PQC

Note: Follows ENISA and NIST positioning (no unique algorithms)

ISO/IEC JTC 1 (Global)

Compatible with: ISO/IEC standardization efforts on quantum-resistant cryptography, including digital signatures and key establishment

Coverage:

• Global multinational operations
• 165+ countries recognize ISO standards
• Interoperability focus

Policy Template: GLOBAL_ISO_COMPLIANT

ETSI TR 103 619 (Telecommunications)

Aligned with: ETSI technical reports and guidance on post-quantum transitions for TLS, PKI and secure communications

Recommendations:

• HQC (diversified approach to ML-KEM; ETSI standardization is IN PROGRESS — draft expected 2026, finalization targeted 2027)
• ML-KEM (TS 103 744 restricts the post-quantum KEM to ML-KEM)
• XMSS, LMS (hash-based signatures; the single-tree XMSS-SHA2_10_256 and LMS-SHA256-M32-H10-W4)

Policy Template: ETSI_QSC

Unique Feature: HQC algorithm family, selected by NIST in March 2025 as the Round-4 backup KEM, for algorithm diversity

Signatures come from TS 119 312. TS 103 744 is a key-establishment deliverable and defines no signature scheme; ETSI TS 119 312 V2.1.1 recommends ML-DSA (Table 3.1), SLH-DSA at levels 3 and 5 (Table 3.2) and RSA-PSS (Table 2), so ETSI_QSC declares those families too and admits every catalogue algorithm attributed to ETSI.

Regional Standards

CRYPTREC (Japan)

e-Government Profile alignment with ML-KEM, ML-DSA, Camellia (national cipher), XMSS, LMS (the single-tree XMSS-SHA2_10_256 and LMS-SHA256-M32-H10-W4)

Policy Template: JAPAN_CRYPTREC

Unique Feature: Camellia cipher (CRYPTREC-listed, standardized in ISO/IEC 18033-3)

GMT (China)

Consistency with: State Cryptography Administration (Guó Mì) standards

Mandatory Algorithms:

• SM2 (digital signatures - GMT 0003.1-2012)
• SM4-GCM/CCM (block cipher - GMT 0002-2012)
• HMAC-SM3 (hash function - GMT 0004-2012)

Policy Template: CHINA_GMT_COMPLIANT

Regulatory Context: Cryptography Law of the People's Republic of China (2020) requires GM/T algorithms for critical systems

KISA (South Korea)

Alignment with: Korea Information Security Agency national cipher requirements

National Ciphers:

• SEED (1998) - First Korean national cipher (ISO/IEC 18033-3)
• ARIA (2004) - Second generation (IETF RFC 5794; not an ISO/IEC 18033-3 cipher, so the catalogue carries no ISO attribution on it)

Policy Template: KOREA_KCMVP

Regulatory Context: KCMVP certification requires national ciphers for government systems

Korean post-quantum (KpqC). Korea's post-quantum competition (KpqC), established by NSR and NIS in 2021, announced its final selection in January 2025 with SMAUG-T among its KEMs (kpqc.cryptolab.co.kr, accessed 2026-10-03). The catalogue offers SMAUG-T-MODE1, SMAUG-T-MODE3 and SMAUG-T-MODE5 (levels 1, 3 and 5 as the designers claim them in the SMAUG-T specification dated 2026-02-04) as EXPERIMENTAL, with no standards attribution: Korean Standard (KS) work on the selected schemes is in progress, so no published standard names SMAUG-T, and no body the catalogue carries recommends it. SMAUG-T-MODET (TiMER) is not offered. Consequences for policy:

• KOREA_KCMVP mandates the KISA and ISO attributions, so it does not admit SMAUG-T; the template is unchanged.
• A template that mandates no standard admits it, subject to its other dimensions.
• Under a policy with requireComposite, a stand-alone SMAUG-T key is refused like every other stand-alone post-quantum KEM; the catalogue has no composite pair with a SMAUG-T component.

GOST (Russia + CIS)

Compatible with: GOST R 34.10/34.11 cryptographic family

National Algorithms:

• GOST-EC (GOST R 34.10-2012) - Elliptic curve signatures
• Streebog (GOST R 34.11-2012) - Hash function (256/512-bit)
• Grasshopper (GOST R 34.12-2015) - Block cipher (not supported by the platform)

Policy Template: GOST_COMPLIANT

Regulatory Context: Federal Law 149-FZ requires GOST algorithms for state information systems

MySEAL 2.0 (Malaysia / ASEAN)

Consistent with: Malaysian Cybersecurity Agency MySEAL 2.0 framework for Southeast Asia

Coverage: Malaysia + ASEAN region (689M people, $3.6T GDP)

Policy Template: MALAYSIA_MYSEAL

NCA-NCS (Saudi Arabia / GCC)

Aligned with: Saudi National Cybersecurity Authority (NCA) standards NCA-NCS-1:2020

Algorithms: Classical only (RSA, EC, AES) - pre-PQC standard

Coverage: Saudi Arabia + GCC countries (57M people, $2.1T GDP)

Policy Template: SAUDI_NCA_COMPLIANT

Sector-Specific Templates

FINANCE_COMPLIANT

Standards: Dual NIST + ISO compliance

Use Cases:

• Banks (PCI DSS v4.0.1)
• Fintechs (SOC2)
• Payment processors (ISO 27001)

Requirements:

• Cryptographic inventory and annual review (PCI DSS v4.0.1 requirement 12.3.3)
• Security Levels 3 and 5 only
• NIST and ISO approved algorithms

Template Selection Guide

Business Value

• Instant Compliance: Deploy with pre-configured templates matching target market regulations
• Zero Lock-In: Switch between standards without code changes (configuration-only)
• Multi-Tenancy Support: Different tenants can use different national standards simultaneously
• Risk Mitigation: Prevent use of non-approved algorithms, block shadow crypto
• Capability: NIST, GMT, GOST, CRYPTREC, BSI and ANSSI algorithm sets supported simultaneously in one platform
• Future-Proof: Add new algorithm standards via configuration updates, not software upgrades

For detailed policy configuration examples, see: Policy Configuration Guide*

For complete algorithm catalog, see: Algorithm Catalog