Flow 30 --- Regulatory Compliance Templates for Composite Keys

package co.ankatech.ankasecure.sdk.examples;

import co.ankatech.ankasecure.sdk.AuthenticatedSdk;
import co.ankatech.ankasecure.sdk.model.*;
import co.ankatech.secure.client.model.KeyRequest;

import static co.ankatech.ankasecure.sdk.examples.ExampleUtil.*;

/**
 * Scenario 30 — Regulatory Compliance Templates for Composite Keys.
 *
 * <p>Demonstrates how to create composite cryptographic keys that comply with
 * specific regulatory frameworks using direct KeyRequest configuration.</p>
 *
 * <h3>What You'll Learn:</h3>
 * <ul>
 *   <li>How to configure composite keys for regulatory compliance</li>
 *   <li>Differences between BSI, ANSSI, ETSI, EU, NIST, and ENISA requirements</li>
 *   <li>Which KDFs and algorithms are required/allowed by each framework</li>
 *   <li>How to generate keys for different regulatory jurisdictions</li>
 * </ul>
 *
 * <h3>Regulatory Frameworks Covered:</h3>
 * <ol>
 *   <li><strong>BSI TR-02102-1</strong> (Germany) - P-384+ML-KEM-1024, HKDF-SHA384</li>
 *   <li><strong>ANSSI RGS v2.0</strong> (France) - P-256+ML-KEM-768, HKDF-SHA256</li>
 *   <li><strong>ETSI TS 103 744</strong> (EU Telecom) - X25519+ML-KEM-768, HKDF-SHA256</li>
 *   <li><strong>EU Unified</strong> (Multi-national) - X25519+ML-KEM-768, HKDF-SHA256</li>
 *   <li><strong>NIST SP 800-227</strong> (USA) - Flexible levels</li>
 *   <li><strong>ENISA Guidelines</strong> (EU) - Risk-based approach</li>
 * </ol>
 *
 * @author ANKATech Solutions Inc.
 * @since 3.0.0
 * @see ExampleUtil
 * @see AuthenticatedSdk
 */
public final class ExampleScenario30 {

    private ExampleScenario30() { }

    public static void main(String[] args) {
        try {
            System.out.println("=================================================================");
            System.out.println("  SCENARIO 30: Regulatory Compliance Templates");
            System.out.println("=================================================================\n");

            java.util.Properties props = loadProperties();
            AuthenticatedSdk sdk = authenticate(props);

            demonstrateBsiCompliance(sdk);
            demonstrateAnssiCompliance(sdk);
            demonstrateEtsiCompliance(sdk);
            demonstrateEuUnifiedCompliance(sdk);
            demonstrateNistCompliance(sdk);
            demonstrateEnisaCompliance(sdk);

            System.out.println("\n=================================================================");
            System.out.println("  ALL REGULATORY TEMPLATES DEMONSTRATED SUCCESSFULLY");
            System.out.println("=================================================================");

        } catch (Exception e) {
            fatal("Scenario 30 failed", e);
        }
    }

    /**
     * Demonstrates BSI TR-02102-1 (Germany) compliant key generation.
     * Requirement: Hybrid keys with Level 3+ security, SHA-384 or stronger KDF.
     */
    private static void demonstrateBsiCompliance(AuthenticatedSdk sdk) throws Exception {
        System.out.println("[1/6] BSI TR-02102-1 (GERMANY)");
        System.out.println("      Framework: Bundesamt für Sicherheit in der Informationstechnik");
        System.out.println("      Requirement: Hybrid keys MANDATORY for PQC algorithms\n");

        // BSI-compliant encryption key: P-384 + ML-KEM-1024 (both Level 3+)
        KeyRequest request = new KeyRequest()
            .kid("bsi_germany_" + System.currentTimeMillis())
            .kty("COMPOSITE_KEM_COMBINE")
            .alg("P-384+ML-KEM-1024")       // BSI recommends P-384 + ML-KEM-1024
            .kdf("HKDF-SHA384");             // BSI requires SHA-384 or stronger

        System.out.println("      Configuration:");
        System.out.println("      - Type: COMPOSITE_KEM_COMBINE");
        System.out.println("      - Classical: P-384 (Level 3)");
        System.out.println("      - PQC: ML-KEM-1024 (Level 5)");
        System.out.println("      - KDF: HKDF-SHA384 (BSI-approved)");
        System.out.println("      - Min Level: 3 (192-bit)");

        KeyMetadata result = sdk.generateKey(request);
        System.out.println("\n      ✅ Generated: " + result.getKid());
        System.out.println("      Algorithm: " + result.getAlg());
        System.out.println("      KDF: " + result.getKdf());
        System.out.println("      Compliance: BSI TR-02102-1 Level 3+\n");
    }

    /**
     * Demonstrates ANSSI RGS v2.0 (France) compliant key generation.
     */
    private static void demonstrateAnssiCompliance(AuthenticatedSdk sdk) throws Exception {
        System.out.println("[2/6] ANSSI RGS v2.0 (FRANCE)");
        System.out.println("      Framework: Agence Nationale de la Sécurité des Systèmes d'Information");
        System.out.println("      Requirement: Hybrid schemes for classified data\n");

        KeyRequest request = new KeyRequest()
            .kid("anssi_france_" + System.currentTimeMillis())
            .kty("COMPOSITE_KEM_COMBINE")
            .alg("P-256+ML-KEM-768")        // ANSSI: P-256 + ML-KEM-768
            .kdf("HKDF-SHA256");            // ANSSI-approved

        System.out.println("      Configuration:");
        System.out.println("      - Type: COMPOSITE_KEM_COMBINE");
        System.out.println("      - Classical: P-256 (Level 1)");
        System.out.println("      - PQC: ML-KEM-768 (Level 3)");
        System.out.println("      - KDF: HKDF-SHA256");

        KeyMetadata result = sdk.generateKey(request);
        System.out.println("\n      ✅ Generated: " + result.getKid());
        System.out.println("      Compliance: ANSSI RGS v2.0\n");
    }

    /**
     * Demonstrates ETSI TS 103 744 (EU Telecom) compliant key generation.
     */
    private static void demonstrateEtsiCompliance(AuthenticatedSdk sdk) throws Exception {
        System.out.println("[3/6] ETSI TS 103 744 (EU TELECOM)");
        System.out.println("      Framework: European Telecommunications Standards Institute");
        System.out.println("      Requirement: PQC algorithms for 5G/6G network security\n");

        KeyRequest request = new KeyRequest()
            .kid("etsi_telecom_" + System.currentTimeMillis())
            .kty("COMPOSITE_KEM_COMBINE")
            .alg("X25519+ML-KEM-768")
            .kdf("HKDF-SHA256");

        System.out.println("      Configuration:");
        System.out.println("      - Type: COMPOSITE_KEM_COMBINE");
        System.out.println("      - Classical: X25519 (Curve25519)");
        System.out.println("      - PQC: ML-KEM-768 (Level 3)");
        System.out.println("      - KDF: HKDF-SHA256");

        KeyMetadata result = sdk.generateKey(request);
        System.out.println("\n      ✅ Generated: " + result.getKid());
        System.out.println("      Compliance: ETSI TS 103 744\n");
    }

    /**
     * Demonstrates EU Unified (Multi-national) compliant key generation.
     */
    private static void demonstrateEuUnifiedCompliance(AuthenticatedSdk sdk) throws Exception {
        System.out.println("[4/6] EU UNIFIED (MULTI-NATIONAL)");
        System.out.println("      Framework: European Union Quantum-Safe Cryptography Guidelines");
        System.out.println("      Requirement: Flexible KDF support\n");

        KeyRequest request = new KeyRequest()
            .kid("eu_unified_" + System.currentTimeMillis())
            .kty("COMPOSITE_KEM_COMBINE")
            .alg("X25519+ML-KEM-768")
            .kdf("HKDF-SHA256");            // Can use SHA256 or SHA512

        System.out.println("      Configuration:");
        System.out.println("      - Type: COMPOSITE_KEM_COMBINE");
        System.out.println("      - Algorithm: X25519+ML-KEM-768");
        System.out.println("      - KDF: HKDF-SHA256 (flexible)");

        KeyMetadata result = sdk.generateKey(request);
        System.out.println("\n      ✅ Generated: " + result.getKid());
        System.out.println("      Compliance: EU Unified Guidelines\n");
    }

    /**
     * Demonstrates NIST SP 800-227 (USA) compliant key generation.
     */
    private static void demonstrateNistCompliance(AuthenticatedSdk sdk) throws Exception {
        System.out.println("[5/6] NIST SP 800-227 (USA)");
        System.out.println("      Framework: National Institute of Standards and Technology");
        System.out.println("      Requirement: FIPS-approved algorithms\n");

        KeyRequest request = new KeyRequest()
            .kid("nist_usa_" + System.currentTimeMillis())
            .kty("COMPOSITE_KEM_COMBINE")
            .alg("P-256+ML-KEM-768")        // NIST-approved combination
            .kdf("HKDF-SHA256");            // FIPS 140-3 compliant

        System.out.println("      Configuration:");
        System.out.println("      - Type: COMPOSITE_KEM_COMBINE");
        System.out.println("      - Classical: P-256 (FIPS 186-4)");
        System.out.println("      - PQC: ML-KEM-768 (FIPS 203)");
        System.out.println("      - KDF: HKDF-SHA256 (FIPS 140-3)");

        KeyMetadata result = sdk.generateKey(request);
        System.out.println("\n      ✅ Generated: " + result.getKid());
        System.out.println("      Compliance: NIST SP 800-227 (FIPS)\n");
    }

    /**
     * Demonstrates ENISA Guidelines (EU) compliant key generation.
     */
    private static void demonstrateEnisaCompliance(AuthenticatedSdk sdk) throws Exception {
        System.out.println("[6/6] ENISA GUIDELINES (EU)");
        System.out.println("      Framework: European Union Agency for Cybersecurity");
        System.out.println("      Requirement: Risk-based approach for critical infrastructure\n");

        KeyRequest request = new KeyRequest()
            .kid("enisa_eu_" + System.currentTimeMillis())
            .kty("COMPOSITE_SIGNATURE")
            .alg("Ed25519+ML-DSA-44")
            .verificationPolicy(KeyRequest.VerificationPolicyEnum.ALL);

        System.out.println("      Configuration:");
        System.out.println("      - Type: COMPOSITE_SIGNATURE");
        System.out.println("      - Classical: Ed25519");
        System.out.println("      - PQC: ML-DSA-44 (Level 1)");
        System.out.println("      - Verification: ALL (both signatures required)");

        KeyMetadata result = sdk.generateKey(request);
        System.out.println("\n      ✅ Generated: " + result.getKid());
        System.out.println("      Compliance: ENISA PQC Guidelines\n");
    }
}