Package co.ankatech.ankasecure.sdk.model

Enum Class NistSecurityLevel

java.lang.Object
java.lang.Enum<NistSecurityLevel>
co.ankatech.ankasecure.sdk.model.NistSecurityLevel
All Implemented Interfaces:
Serializable, Comparable<NistSecurityLevel>, Constable
public enum NistSecurityLevel extends Enum<NistSecurityLevel>
NIST security levels for post-quantum cryptographic algorithms.

Security levels categorize cryptographic algorithms based on their computational resistance to attacks, measured in equivalent symmetric key strength (AES). NIST uses these levels to classify post-quantum algorithms standardized in FIPS 203, 204, and 205.

Security Level Guidelines:

Level Equivalent Security Use Cases Data Lifetime
1 AES-128 (128-bit) Legacy compatibility, short-lived data < 1 year
3 AES-192 (192-bit) Standard production (RECOMMENDED) 1-10 years
5 AES-256 (256-bit) High-security, classified data, long-term archives 10+ years

Agency Guidance:

  • BSI (Germany): recommends ML-KEM, ML-DSA and SLH-DSA only with the parameter sets of NIST security categories 3 and 5, and recommends quantum-safe key agreement and signatures only in hybrid combination with a classical scheme; hash-based signatures may also be used alone (BSI TR-02102-1 version 2026-01, sections 2.2, 2.4, 2.4.3, 5.3.4, 5.3.4.1 and 5.3.4.2).
  • ANSSI (France): recommends the highest NIST security level possible for ML-KEM and ML-DSA, preferably level 5 or level 3, combined with a recognized classical algorithm in a hybrid mode; hybridation is optional only for hash-based signatures (ANSSI views on the post-quantum cryptography transition, 2023 follow-up, sections 1.1, 2 and 4).
  • NIST (USA): approves all three ML-KEM parameter sets and recommends ML-KEM-768 (level 3) as the default parameter set (FIPS 203, section 8).

Example Usage:


 // Recommended for most production scenarios
 NistSecurityLevel level = NistSecurityLevel.LEVEL_3;
 System.out.println(level.getBitSecurity()); // 192

 // Filter algorithms by security level
 AlgorithmFilter filter = AlgorithmFilter.builder()
     .withMinSecurityLevel(3)
     .withStatus(AlgorithmInfo.Status.RECOMMENDED)
     .build();
 List<AlgorithmInfo> algorithms = sdk.getSupportedAlgorithms(filter);
See Also:

  • Enum Constant Details

    • LEVEL_1

      public static final NistSecurityLevel LEVEL_1
      NIST Security Level 1 - Equivalent to AES-128 (128-bit security).

      Security: 128-bit symmetric key strength
      Quantum resistance: Adequate for short-term protection
      Use cases: Legacy compatibility, non-sensitive data, session tokens
      Recommendation: ⚠️ below the levels BSI and ANSSI recommend - prefer Level 3+
      Data lifetime: < 1 year

      Example Algorithms:
      Classical: RSA-3072, ECDSA-P256, X25519, Ed25519
      PQC: ML-KEM-512, ML-DSA-44

    • LEVEL_3

      public static final NistSecurityLevel LEVEL_3
      NIST Security Level 3 - Equivalent to AES-192 (192-bit security).

      Security: 192-bit symmetric key strength
      Quantum resistance: Strong protection for medium to long-term
      Use cases: ✅ RECOMMENDED for most production scenarios
      Guidance: lowest level BSI recommends for ML-KEM, ML-DSA and SLH-DSA; the level of NIST's default ML-KEM parameter set
      Data lifetime: 1-10 years

      Example Algorithms:
      Classical: ECDSA-P384
      PQC: ML-KEM-768, ML-DSA-65

    • LEVEL_5

      public static final NistSecurityLevel LEVEL_5
      NIST Security Level 5 - Equivalent to AES-256 (256-bit security).

      Security: 256-bit symmetric key strength
      Quantum resistance: Maximum protection for highly sensitive data
      Use cases: Government/defense, classified data, long-term archives (10+ years)
      Performance: ⚠️ Slower than Level 3 (larger keys/signatures)
      Data lifetime: 10+ years

      Example Algorithms:
      Classical: ECDSA-P521
      PQC: ML-KEM-1024, ML-DSA-87

      Trade-offs:
      ✅ Maximum security
      ⚠️ Larger key sizes (increased bandwidth/storage)
      ⚠️ Slower operations (encryption/signing/verification)

  • Method Details

    • values

      public static NistSecurityLevel[] values()
      Returns an array containing the constants of this enum class, in the order they are declared.
      Returns:
      an array containing the constants of this enum class, in the order they are declared

    • valueOf

      public static NistSecurityLevel valueOf(String name)
      Returns the enum constant of this class with the specified name. The string must match exactly an identifier used to declare an enum constant in this class. (Extraneous whitespace characters are not permitted.)
      Parameters:
      name - the name of the enum constant to be returned.
      Returns:
      the enum constant with the specified name
      Throws:
      IllegalArgumentException - if this enum class has no constant with the specified name
      NullPointerException - if the argument is null

    • getLevel

      public int getLevel()
      Returns the numeric security level.
      Returns:
      the level value (1, 3, or 5)

    • getBitSecurity

      public int getBitSecurity()
      Returns the equivalent symmetric key strength in bits.

      This value represents the computational effort required to break the cryptographic algorithm, measured in terms of AES key size.

      Returns:
      the bit security (128, 192, or 256)

    • getDescription

      public String getDescription()
      Returns a human-readable description of this security level.
      Returns:
      the description (e.g., "AES-192 equivalent (RECOMMENDED for production)")

    • fromLevel

      public static NistSecurityLevel fromLevel(int level)
      Parses a security level from its numeric value.

      Example: 

      
 NistSecurityLevel level = NistSecurityLevel.fromLevel(3); // Returns LEVEL_3

      Parameters:
      level - the numeric level (1, 3, or 5)
      Returns:
      the matching NistSecurityLevel enum value
      Throws:
      IllegalArgumentException - if the level is not 1, 3, or 5

    • meetsMinimum

      public boolean meetsMinimum(NistSecurityLevel minimumLevel)
      Checks if this security level meets or exceeds a minimum required level.

      Example: 

      
 NistSecurityLevel.LEVEL_5.meetsMinimum(NistSecurityLevel.LEVEL_3); // true
 NistSecurityLevel.LEVEL_1.meetsMinimum(NistSecurityLevel.LEVEL_3); // false

      Parameters:
      minimumLevel - the minimum required security level
      Returns:
      true if this level is greater than or equal to the minimum
      Throws:
      IllegalArgumentException - if minimumLevel is null

    • toString

      public String toString()
      Overrides:
      toString in class Enum<NistSecurityLevel>