Package co.ankatech.ankasecure.sdk.examples

Class ExampleScenario21

java.lang.Object
co.ankatech.ankasecure.sdk.examples.ExampleScenario21
public final class ExampleScenario21 extends Object
Scenario 21 — Sign-Then-Encrypt Nested Operations, Streaming (data-plane).

The bounded-memory, large-file counterpart of the compact ExampleScenario17. It signs the plaintext (inner JWS) then encrypts the signature (outer JWE) in a single incremental streaming pass, so the signer identity stays ENCRYPTED, and reverses the process with a fail-closed end-of-stream integrity verdict.

What streaming adds over the compact variant (PRD §64)

  • Bounded memory: neither the payload nor the recovered plaintext is buffered whole; they stream through in chunks (no readAllBytes).
  • End-of-stream verdict: the decrypt-verify response is multipart/mixed — PART 1 the recovered plaintext, PART 2 a StreamVerdict emitted AFTER the integrity check. In streaming, integrity (AES-GCM tag, JWS signature) is only known with the last byte.
  • Double verdict: BOTH the outer AES-GCM tag AND the inner JWS signature must pass to promote the plaintext.
  • Fail-closed write contract: the recovered plaintext is quarantined to <output>.part and atomically promoted to output ONLY on a VALID verdict. An INVALID or absent verdict deletes the sidecar, persists nothing, and throws a typed StreamIntegrityException — success is never inferred from a closed socket.
  • Overwrite protection: writes default to OverwritePolicy.FAIL_IF_EXISTS; opt into overwrite with AuthenticatedSdk.withOverwrite() (shares the same JWT, no re-authentication).

Steps:

  1. Resolve a pre-provisioned ML-DSA-65 signing key and ML-KEM-768 encryption key
  2. Stream sign-then-encrypt to a nested JWE(JWS) artifact (signThenEncryptFileStream)
  3. Stream decrypt-then-verify with a VALID end-of-stream verdict (decryptThenVerifyFileStream)
  4. Overwrite protection: the default policy refuses an existing destination; withOverwrite() allows it
  5. Fail-closed: a tampered ciphertext yields an INVALID verdict → no plaintext persisted → StreamIntegrityException

API Endpoints:

  • POST /api/v3/crypto/stream/sign-encrypt (streaming sign-then-encrypt)
  • POST /api/v3/crypto/stream/decrypt-verify (streaming decrypt-then-verify, two-verdict)

Prerequisite: a cli.properties for the cli-reference actor of the provisioned demo-cli playground, carrying the ankasecure.demo.kids catalogue and holding the streaming scopes stream.signAndEncryptStream / stream.decryptAndVerifyStream. The SDK is data-plane-only — key lifecycle lives in cli-admin, not the SDK.

Since:
3.0.0
Author:
ANKATech Solutions Inc.
See Also:

  • Method Details

    • main

      public static void main(String[] args)
      Runs the streaming sign-then-encrypt / decrypt-then-verify scenario on pre-provisioned keys.
      Parameters:
      args - command-line arguments (ignored)