Package co.ankatech.ankasecure.sdk.examples

Class ExampleScenario17

java.lang.Object

co.ankatech.ankasecure.sdk.examples.ExampleScenario17

public final class ExampleScenario17
extends Object

Scenario 17 — Sign-Then-Encrypt Nested Operations, Compact (data-plane).

Demonstrates the proper sequence for authenticated encryption: signing plaintext first (inner layer) then encrypting the signature (outer layer). This is the recommended pattern for secure messaging where both authenticity and confidentiality are required.

Why Sign-THEN-Encrypt?

• Authenticity + Confidentiality: Signature proves sender identity, encryption protects content
• Secure messaging pattern: Standard in protocols like S/MIME and PGP
• Order matters: Sign-then-encrypt prevents signature stripping attacks
• Nested JOSE tokens: Creates JWE(JWS) structure per RFC 7516

Steps:

1. Resolve a pre-provisioned ML-DSA-65 signing key (post-quantum digital signature)
2. Resolve a pre-provisioned ML-KEM-768 encryption key (post-quantum key encapsulation)
3. Create plaintext message file
4. Sign-then-encrypt: Sign with ML-DSA → Encrypt with ML-KEM (creates JWE(JWS))
5. Decrypt-then-verify: Decrypt with ML-KEM → Verify with ML-DSA (reverses process)
6. Validate: Original plaintext matches recovered plaintext
7. Validate: Signature is cryptographically valid

Key Algorithms:

• ML-DSA-65: NIST FIPS 204 post-quantum signature (192-bit security)
• ML-KEM-768: NIST FIPS 203 post-quantum encryption (192-bit security)

API Endpoints:

• POST /api/v3/crypto/sign-encrypt (compact sign-then-encrypt operation)
• POST /api/v3/crypto/decrypt-verify (compact decrypt-then-verify operation)

This scenario uses the compact nested-op endpoints. For the streaming (bounded-memory, large-file) counterpart with the end-of-stream integrity verdict, see ExampleScenario21.

Token Structure:

 JWE Header (ML-KEM-768 encrypted symmetric key)
   ↓
 Encrypted Payload:
   JWS Header (ML-DSA-65 signature metadata)
     ↓
   JWS Payload: Original plaintext
     ↓
   JWS Signature: ML-DSA-65 signature bytes
 

Prerequisite: a cli.properties for the cli-reference actor of the provisioned demo-cli playground, carrying the ankasecure.demo.kids catalogue (emitted by the demo-provisioning tool). The SDK is data-plane-only — key lifecycle (generate/rotate/export) lives in cli-admin, not the SDK.

Since:

3.0.0

Author:

ANKATech Solutions Inc.

See Also:

• ExampleUtil
• ExamplePlaygroundKeys
• AuthenticatedSdk

Method Summary

Modifier and Type	Method	Description
static void	main(String[] args)	Runs the sign-then-encrypt nested operations scenario on pre-provisioned keys.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

main

public static void main(String[] args)

Runs the sign-then-encrypt nested operations scenario on pre-provisioned keys.

Loads CLI properties, authenticates against ANKASecure©, resolves the pre-provisioned playground keys, and delegates to the scenario logic. On any unrecoverable error the JVM terminates via ExampleUtil.fatal(String, Throwable).

Parameters:

args - command-line arguments (ignored)