Package co.ankatech.ankasecure.sdk.examples

Class ExampleScenario18

java.lang.Object
co.ankatech.ankasecure.sdk.examples.ExampleScenario18
public final class ExampleScenario18 extends Object
Scenario 18 — Use Composite Hybrid Keys for Quantum-Resistant Security (data-plane).

Demonstrates the data-plane workflow for using composite cryptographic keys that combine classical and post-quantum algorithms. Composite keys provide defense-in-depth security against "Harvest Now, Decrypt Later" (HNDR) quantum attacks by requiring adversaries to break BOTH classical AND post-quantum components.

The SDK is data-plane-only: it does not create composite keys. This scenario operates on the two composite keys pre-provisioned in the demo-cli playground:

  • P-256+ML-KEM-768 (kty COMPOSITE_KEM_COMBINE) — used for encrypt/decrypt
  • brainpoolP384r1+ML-DSA-87 (kty COMPOSITE_SIGNATURE) — used for sign/verify

Real-World Scenarios:

  • Government agencies: NSM-10 compliance for HNDR protection of classified data
  • Financial institutions: Long-term protection of transaction records (10+ years)
  • Healthcare systems: HIPAA-compliant quantum-resistant encryption of patient records
  • Critical infrastructure: Defense-in-depth for SCADA systems and utilities
  • Cloud providers: Quantum-safe encryption tiers for enterprise customers

Composite Modes Demonstrated:

  • COMPOSITE_KEM_COMBINE: Hybrid Key Encapsulation Mechanism for encryption. Combines P-256 (classical) + ML-KEM-768 (PQC) outputs. Both secrets required for decryption (AND-decrypt model).
  • COMPOSITE_SIGNATURE: Dual digital signatures for document signing. Creates brainpoolP384r1 (classical) + ML-DSA-87 (PQC) signatures with ALL verification policy (both must verify).

Steps:

  1. Resolve the pre-provisioned COMPOSITE_KEM_COMBINE key (P-256+ML-KEM-768)
  2. Encrypt sensitive data using the composite KEM (transparent API usage)
  3. Decrypt data demonstrating AND-requirement (both components needed)
  4. Resolve the pre-provisioned COMPOSITE_SIGNATURE key (brainpoolP384r1+ML-DSA-87)
  5. Sign and verify a document with dual signatures (ALL policy enforcement)

Security Benefits:

  • HNDR Protection: Data remains secure even if quantum computers break classical algorithms
  • Defense in Depth: Both components must be broken to compromise data
  • Crypto-Agility: Component rotation supported without changing ciphertext format
  • Compliance: NIST CSWP 39, GSA PQC Buyer's Guide, NSM-10 aligned

API Endpoints:

  • POST /api/v3/crypto/stream/encrypt (composite KEM emits a multi-recipient General JSON JWE)
  • POST /api/v3/crypto/stream/decrypt (enforces the composite AND-decrypt)
  • POST /api/v3/crypto/stream/sign (transparent - works with composite KID)
  • POST /api/v3/crypto/stream/verify (verifies dual signatures according to policy)

Prerequisite: a cli.properties for the cli-reference actor of the provisioned demo-cli playground, carrying the ankasecure.demo.kids catalogue (emitted by the demo-provisioning tool). Key lifecycle (generate/rotate/export) lives in cli-admin, not the SDK.

Since:
3.0.0
Author:
ANKATech Solutions Inc.
See Also:

  • Method Details

    • main

      public static void main(String[] args)