Flow 30 --- Regulatory Compliance Templates for Composite Keys

/** **************************************************************************
 * FILE: ExampleScenario30.java
 * SCENARIO: Regulatory Compliance Templates for Composite Keys
 * TAGS: composite-keys, regulatory-compliance, templates, bsi, anssi, etsi
 *************************************************************************** */
package co.ankatech.ankasecure.sdk.examples;

import co.ankatech.ankasecure.sdk.AnkaSecureSdk;
import co.ankatech.ankasecure.sdk.model.*;

import static co.ankatech.ankasecure.sdk.examples.ExampleUtil.*;

/**
 * <h1>Scenario 30: Regulatory Compliance Templates for Composite Keys</h1>
 * <p>
 * Demonstrates how to create composite cryptographic keys that comply with
 * specific regulatory frameworks using pre-configured templates.
 * </p>
 *
 * <h3>What You'll Learn:</h3>
 * <ul>
 *   <li>How to use {@link RegulatoryTemplateFactory} for one-line compliance</li>
 *   <li>Differences between BSI, ANSSI, ETSI, EU, NIST, and ENISA requirements</li>
 *   <li>Which KDFs are required/allowed by each framework</li>
 *   <li>How to generate keys for different regulatory jurisdictions</li>
 * </ul>
 *
 * <h3>Regulatory Frameworks Covered:</h3>
 * <ol>
 *   <li><strong>BSI TR-02102-1</strong> (Germany) - HKDF-SHA256</li>
 *   <li><strong>ANSSI RGS v2.0</strong> (France) - HKDF-SHA256</li>
 *   <li><strong>ETSI TS 103 744</strong> (EU Telecom) - CatKDF (telecom-specific)</li>
 *   <li><strong>EU Unified</strong> (Multi-national) - All KDFs supported</li>
 *   <li><strong>NIST SP 800-227</strong> (USA) - Flexible levels</li>
 *   <li><strong>ENISA Guidelines</strong> (EU) - Risk-based approach</li>
 * </ol>
 *
 * <h3>Prerequisites:</h3>
 * <ul>
 *   <li>AnkaSecure Core API running and accessible</li>
 *   <li>Valid authentication credentials (application or user)</li>
 *   <li>Tenant with appropriate policy configuration</li>
 * </ul>
 *
 *
 * @see RegulatoryTemplateFactory
 * @see RegulatoryTemplate
 * @see Kdf
 */
public class ExampleScenario30 {

    public static void main(String[] args) {
        try {
            System.out.println("=================================================================");
            System.out.println("  SCENARIO 30: Regulatory Compliance Templates");
            System.out.println("=================================================================\n");

            // Initialize SDK
            java.util.Properties props = loadProperties();
            AnkaSecureSdk sdk = authenticate(props);

            // Template 1: BSI (Germany)
            demonstrateBsiCompliance(sdk);

            // Template 2: ANSSI (France)
            demonstrateAnssiCompliance(sdk);

            // Template 3: ETSI (EU Telecom)
            demonstrateEtsiCompliance(sdk);

            // Template 4: EU Unified (Multi-national)
            demonstrateEuUnifiedCompliance(sdk);

            // Template 5: NIST (USA)
            demonstrateNistCompliance(sdk);

            // Template 6: ENISA (EU General)
            demonstrateEnisaCompliance(sdk);

            System.out.println("\n=================================================================");
            System.out.println("  ALL REGULATORY TEMPLATES DEMONSTRATED SUCCESSFULLY");
            System.out.println("=================================================================");

        } catch (Exception e) {
            fatal("Scenario 30 failed", e);
        }
    }

    /**
     * Demonstrates BSI TR-02102-1 (Germany) compliant key generation.
     */
    private static void demonstrateBsiCompliance(AnkaSecureSdk sdk) throws Exception {
        System.out.println("[1/6] BSI TR-02102-1 (GERMANY)");
        System.out.println("      Framework: Bundesamt für Sicherheit in der Informationstechnik");
        System.out.println("      Requirement: Hybrid keys MANDATORY for PQC algorithms\n");

        // One-line BSI-compliant encryption key
        GenerateCompositeKeySpec spec = RegulatoryTemplateFactory.bsiHybrid(
            "bsi_germany_" + System.currentTimeMillis(),
            GenerateCompositeKeySpec.Mode.HYBRID_KEM_COMBINE
        );

        System.out.println("      Configuration:");
        System.out.println("      - Mode: " + spec.getMode());
        System.out.println("      - Classical: X25519 (Level 3)");
        System.out.println("      - PQC: ML-KEM-768 (Level 3)");
        System.out.println("      - KDF: HKDF-SHA256 (BSI-approved)");
        System.out.println("      - Min Level: 3 (192-bit)");

        KeyGenerationSummarySpec result = sdk.generateCompositeKey(spec);
        System.out.println("      ✅ BSI-compliant key generated: " + result.getKid());
        System.out.println("      Status: " + result.getStatus() + "\n");
    }

    /**
     * Demonstrates ANSSI RGS v2.0 (France) compliant key generation.
     */
    private static void demonstrateAnssiCompliance(AnkaSecureSdk sdk) throws Exception {
        System.out.println("[2/6] ANSSI RGS v2.0 (FRANCE)");
        System.out.println("      Framework: Agence Nationale de la Sécurité des Systèmes d'Information");
        System.out.println("      Requirement: Hybrid keys MANDATORY, conservative KDF policy\n");

        GenerateCompositeKeySpec spec = RegulatoryTemplateFactory.anssiHybrid(
            "anssi_france_" + System.currentTimeMillis(),
            GenerateCompositeKeySpec.Mode.HYBRID_KEM_COMBINE
        );

        System.out.println("      Configuration:");
        System.out.println("      - Mode: " + spec.getMode());
        System.out.println("      - Classical: X25519 (Level 3)");
        System.out.println("      - PQC: ML-KEM-768 (Level 3)");
        System.out.println("      - KDF: HKDF-SHA256 (ANSSI-approved)");
        System.out.println("      - ⚠️  CatKDF/CasKDF NOT allowed (France-specific restriction)");

        KeyGenerationSummarySpec result = sdk.generateCompositeKey(spec);
        System.out.println("      ✅ ANSSI-compliant key generated: " + result.getKid());
        System.out.println("      Status: " + result.getStatus() + "\n");
    }

    /**
     * Demonstrates ETSI TS 103 744 (EU Telecom) compliant key generation.
     */
    private static void demonstrateEtsiCompliance(AnkaSecureSdk sdk) throws Exception {
        System.out.println("[3/6] ETSI TS 103 744 (EU TELECOMMUNICATIONS)");
        System.out.println("      Framework: European Telecommunications Standards Institute");
        System.out.println("      Requirement: CatKDF or CasKDF REQUIRED for 5G/6G networks\n");

        GenerateCompositeKeySpec spec = RegulatoryTemplateFactory.etsiHybrid(
            "etsi_telecom_" + System.currentTimeMillis(),
            GenerateCompositeKeySpec.Mode.HYBRID_KEM_COMBINE
        );

        System.out.println("      Configuration:");
        System.out.println("      - Mode: " + spec.getMode());
        System.out.println("      - Classical: X25519 (Level 3)");
        System.out.println("      - PQC: ML-KEM-768 (Level 3)");
        System.out.println("      - KDF: CatKDF (ETSI TS 103 744 Section 5.2.1)");
        System.out.println("      - Use Case: EU 5G/6G base stations");

        KeyGenerationSummarySpec result = sdk.generateCompositeKey(spec);
        System.out.println("      ✅ ETSI-compliant telecom key generated: " + result.getKid());
        System.out.println("      Status: " + result.getStatus() + "\n");
    }

    /**
     * Demonstrates EU Unified (multi-national) compliant key generation.
     */
    private static void demonstrateEuUnifiedCompliance(AnkaSecureSdk sdk) throws Exception {
        System.out.println("[4/6] EU UNIFIED (MULTI-NATIONAL EU)");
        System.out.println("      Framework: Intersection of BSI + ANSSI + ETSI");
        System.out.println("      Requirement: Strictest EU requirements, all KDFs supported\n");

        // Encryption key
        GenerateCompositeKeySpec encSpec = RegulatoryTemplateFactory.euUnifiedHybrid(
            "eu_unified_enc_" + System.currentTimeMillis(),
            GenerateCompositeKeySpec.Mode.HYBRID_KEM_COMBINE
        );

        System.out.println("      Configuration (Encryption):");
        System.out.println("      - Mode: " + encSpec.getMode());
        System.out.println("      - Classical: X25519 (Level 3)");
        System.out.println("      - PQC: ML-KEM-768 (Level 3)");
        System.out.println("      - KDF: HKDF-SHA256");

        KeyGenerationSummarySpec encResult = sdk.generateCompositeKey(encSpec);
        System.out.println("      ✅ EU encryption key generated: " + encResult.getKid());

        // Signature key
        GenerateCompositeKeySpec signSpec = RegulatoryTemplateFactory.euUnifiedHybrid(
            "eu_unified_sign_" + System.currentTimeMillis(),
            GenerateCompositeKeySpec.Mode.DUALSIGN
        );

        System.out.println("\n      Configuration (Signature):");
        System.out.println("      - Mode: " + signSpec.getMode());
        System.out.println("      - Classical: Ed25519 (Level 3)");
        System.out.println("      - PQC: ML-DSA-65 (Level 3)");

        KeyGenerationSummarySpec signResult = sdk.generateCompositeKey(signSpec);
        System.out.println("      ✅ EU signature key generated: " + signResult.getKid());
        System.out.println("      Status: " + signResult.getStatus() + "\n");
    }

    /**
     * Demonstrates NIST SP 800-227 (USA) compliant key generation with flexible levels.
     */
    private static void demonstrateNistCompliance(AnkaSecureSdk sdk) throws Exception {
        System.out.println("[5/6] NIST SP 800-227 (USA)");
        System.out.println("      Framework: National Institute of Standards and Technology");
        System.out.println("      Requirement: Hybrid OPTIONAL, flexible security levels\n");

        // Level 3 (standard)
        GenerateCompositeKeySpec level3 = RegulatoryTemplateFactory.nistHybrid(
            "nist_level3_" + System.currentTimeMillis(),
            NistSecurityLevel.LEVEL_3,
            sdk.getSupportedAlgorithms()
        );

        System.out.println("      Configuration (Level 3):");
        System.out.println("      - Classical: X25519 (Level 3)");
        System.out.println("      - PQC: ML-KEM-768 (Level 3)");
        System.out.println("      - KDF: HKDF-SHA256");

        KeyGenerationSummarySpec result3 = sdk.generateCompositeKey(level3);
        System.out.println("      ✅ NIST Level 3 key generated: " + result3.getKid());

        // Level 5 (high security)
        GenerateCompositeKeySpec level5 = RegulatoryTemplateFactory.nistHybrid(
            "nist_level5_" + System.currentTimeMillis(),
            NistSecurityLevel.LEVEL_5,
            sdk.getSupportedAlgorithms()
        );

        System.out.println("\n      Configuration (Level 5 - Classified):");
        System.out.println("      - Classical: RSA-4096 (Level 5)");
        System.out.println("      - PQC: ML-KEM-1024 (Level 5)");
        System.out.println("      - KDF: HKDF-SHA512");

        KeyGenerationSummarySpec result5 = sdk.generateCompositeKey(level5);
        System.out.println("      ✅ NIST Level 5 key generated: " + result5.getKid());
        System.out.println("      Status: " + result5.getStatus() + "\n");
    }

    /**
     * Demonstrates ENISA (EU) risk-based compliant key generation.
     */
    private static void demonstrateEnisaCompliance(AnkaSecureSdk sdk) throws Exception {
        System.out.println("[6/6] ENISA RISK-BASED (EU GENERAL)");
        System.out.println("      Framework: European Union Agency for Cybersecurity");
        System.out.println("      Requirement: Hybrid RECOMMENDED (not mandated)\n");

        GenerateCompositeKeySpec spec = RegulatoryTemplateFactory.enisaRiskBased(
            "enisa_eu_" + System.currentTimeMillis(),
            GenerateCompositeKeySpec.Mode.HYBRID_KEM_COMBINE
        );

        System.out.println("      Configuration:");
        System.out.println("      - Mode: " + spec.getMode());
        System.out.println("      - Classical: X25519 (Level 3)");
        System.out.println("      - PQC: ML-KEM-768 (Level 3)");
        System.out.println("      - KDF: HKDF-SHA256");
        System.out.println("      - Approach: Risk-based (organization decides)");

        KeyGenerationSummarySpec result = sdk.generateCompositeKey(spec);
        System.out.println("      ✅ ENISA-compliant key generated: " + result.getKid());
        System.out.println("      Status: " + result.getStatus() + "\n");
    }

}