# ANKATech Solutions — Extended LLM Context

## Company overview

ANKATech Solutions Inc. is a Delaware-incorporated company that builds ANKASecure©, a Cryptographic
Control Plane for the enterprise. ANKASecure© moves cryptography out of application code and into a
governed infrastructure layer: applications express cryptographic intent through a stable key
identifier, and the platform resolves the algorithm, the key material and the policy at runtime,
executes the operation, and records it in a signed, verifiable audit trail. ANKATech serves
enterprise customers across financial services, healthcare, government and defense, technology
platforms and critical infrastructure.

ANKATech is a corporate member of the Cloud Security Alliance (CSA), a member of the PKI Consortium
(listed in its PQC capabilities matrix), and a member of the Post-Quantum Cryptography Coalition.
ITAC is ANKATech's Value-Added Distributor for Latin America.

ANKATech authored the Cryptographic Control Plane reference architecture and the CAPA framework,
published in the open at https://cryptographiccontrolplane.org under CC BY 4.0. It is a reference
architecture, not a standard: no conformance suite or certification body exists, and ANKASecure© is
described there as the originating implementation.

---

## The thesis: post-quantum is the catalyst, not the destination

Post-quantum cryptography is the first algorithm transition most enterprises will run at full scale,
but it is not the last. Regulatory milestones make it non-optional: NSM-10 (2022) directed US federal
agencies to inventory and plan; NIST published FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205
(SLH-DSA) in 2024; NSA CNSA 2.0 sets transition timelines for National Security Systems; DORA and
NIS2 make cryptographic resilience a board-level obligation in the EU; and harvest-now-decrypt-later
exposes any data that must stay confidential beyond the arrival of a cryptographically relevant
quantum computer.

The structural problem the transition reveals is that cryptography is hardcoded inside applications,
so every algorithm change becomes a distributed engineering project. ANKASecure© resolves that
structurally: once cryptography is governed by policy, the post-quantum migration — and every
migration after it — becomes a policy update rather than an application rewrite.

---

## ANKASecure© — the Cryptographic Control Plane

### Cryptographic operations

- Encrypt, decrypt, sign, verify, re-encrypt (change the key or algorithm of existing ciphertext),
  re-sign, sign-then-encrypt and decrypt-then-verify.
- Output is a JOSE-based model (JWE/JWS, RFC 7516/7515) with extended identifiers for composite
  hybrid keys; standard JOSE libraries can consume simple-key output directly.
- Streaming operations process files of any size with constant memory and no disk materialisation;
  re-encryption never exposes plaintext outside the process.
- Stateless "bridge" operations verify or encrypt with a caller-supplied public key without storing it.

### Algorithms

120+ algorithms: 80+ single-component across 21+ families and 40+ composite hybrid combinations.
Post-quantum: ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205), FALCON, HQC, FrodoKEM,
Classic McEliece, BIKE, NTRU, XMSS, LMS. Classical: RSA, EC P-curves, Brainpool, Ed25519/Ed448,
X25519/X448. Regional: SEED and ARIA (KISA, Korea), Camellia (CRYPTREC, Japan). Symmetric AEAD: AES-GCM/CCM, ChaCha20-Poly1305 and more. Composite hybrid keys
pair a classical and a post-quantum component (for example X25519+ML-KEM-768 or Ed25519+ML-DSA-65)
so the result stays secure while at least one component is unbroken. The catalogue is queryable at
runtime with status, sunset date, security level and ratifying standards for every algorithm.

### Key lifecycle

- Stable key identifiers with versioned material: rotation creates a new primary version under the
  same identifier, so applications are untouched and historical data stays decryptable and
  verifiable. Rotation may change the algorithm within the key's purpose family.
- Nine lifecycle states (active, pending rotation, rotated, expired, revoked, archived, suspended,
  pending destruction, logically deleted); revoked and archived keys keep decrypt and verify.
- Import of PKCS#12, JKS and PEM keystores with validation modes; export of public material only.
- Key inventory reports: health, expiration, algorithm usage, migration candidates, usage limits.

### Custody and root of trust

- Envelope encryption with one key-encryption key per tenant, held in the customer's own HSM or KMS.
- Supported backends: Thales Luna, Entrust nShield, AWS CloudHSM, AWS KMS, GCP KMS, Azure Key Vault
  and Azure Managed HSM (SoftHSM for development).
- Bring-your-own-key per tenant: a tenant's material is wrapped under its own KEK, in its own account,
  with its own credential — the platform operator cannot exercise it, and the platform fails closed
  if the credential is absent.
- Support access on SaaS requires a tenant-declared, time-boxed, revocable grant.

### Policy governance and posture

- Algorithm availability, rotation and lifecycle policies at deployment and tenant level; a tenant
  policy can only be more restrictive than the deployment policy.
- 29 policy templates aligned with NIST, NSA CNSA 2.0, ETSI, ENISA, BSI, ANSSI, CRYPTREC, KISA,
  MySEAL, ISO/IEC, IETF and others; enforcement on every operation; sub-second propagation.
- Cryptographic posture measured on the five CAPA pillars and shown in the Admin Console, with
  per-key conformance and migration debt.

### Governed third-party exchange

Instead of sharing keys with a BPO, a card issuer, a laboratory or any counterparty, the data owner
grants a cryptographic capability: the counterparty is a cryptographic actor bound to an exchange
context, authorized by a capability grant that can be scoped by time window, usage quota, rate limit
or single use, revoked unilaterally, and audited on every invocation.

### Evidence and observability

- HMAC-signed audit events, hash-chained at rest, with on-demand and scheduled integrity verification
  and meta-audit of who read the trail.
- Forwarding to SIEM/XDR in CEF or OCSF over Syslog, Splunk HEC, Microsoft Sentinel or webhooks, with
  the original signature preserved for independent verification.
- Metrics and traces over OpenTelemetry (OTLP) to Instana, Datadog, Dynatrace or any OTLP backend.

### Digital signatures with long-term evidence

Signatures with classical, post-quantum or composite keys; RFC 3161 qualified timestamps embedded as
JAdES elements when policy requires them; verification is offline and reports the timestamp status;
detached signatures for large files.

### Legacy modernization

PKCS#7 / CMS (S/MIME) structures are analysed and converted to JOSE (single signer, single
recipient), preserving the original algorithms; the result can then be re-signed and re-encrypted to
post-quantum algorithms. Legacy keys are imported from PKCS#12 or JKS.

### Identity

OAuth 2.0 (password, client credentials, refresh, token exchange), introspection and revocation;
single sign-on through OIDC, SAML or LDAP (Microsoft Entra ID, Google Workspace, Keycloak, Okta,
Auth0, Active Directory, OpenLDAP); workload identity federation so a machine authenticates with the
token its own platform already issues.

---

## Interfaces

- REST API described in OpenAPI 3.0 — usable from any language, with generated clients.
- Java SDK for the data plane (encrypt, sign, streaming, PKCS#7 interop) and Java Admin SDK for the
  control plane (tenants, keys, actors, exchanges, policies).
- Crypto CLI and Admin CLI with interactive and batch modes.
- Admin Console web application: keys, policies, users, exchanges, audit, posture, integrations.

## Deployment models

- SaaS — operated by ANKATech, multi-tenant, with per-tenant bring-your-own-key.
- Private Cloud — operated by the customer on its own cloud infrastructure.
- On-premise — operated by the customer in its data center; air-gapped deployment supported.

A customer may run on-premise and private-cloud environments side by side.

## Standards alignment

ANKASecure© is aligned with NIST FIPS 203/204/205, NIST CSWP 39 (composite cryptography), FIPS 186-5,
ETSI TS 103 744, BSI TR-02102-1, ANSSI RGS v2, NSA CNSA 2.0, the GSA PQC Buyer's Guide, and the
compliance mappings of PCI DSS 4.0, HIPAA, GDPR, DORA and SOX. ANKASecure© software itself holds no
FIPS 140, Common Criteria, SOC 2 or ISO 27001 certification; FIPS-validated custody is provided by
the customer's HSM.

## What ANKASecure© does not do

It does not discover or inventory cryptography embedded in an existing estate — that service is
delivered through ANKATech partners. It does not issue X.509 certificates, replace PKI, or act as a
TLS proxy. It does not emit PKCS#7; it migrates PKCS#7 to JOSE. Its only SDK language is Java; other
languages use the REST API.

## Licensing

Three editions — Standard, Professional, Enterprise — sold sales-assisted; proofs of concept run
on-premise in the customer's own environment.

## Frequently asked questions

**Is ANKASecure© a key management service like AWS KMS?**
No. A KMS holds keys; ANKASecure© governs and executes cryptographic operations under policy, and can
use AWS KMS, GCP KMS, Azure Key Vault or an HSM as its root of trust.

**Does migrating to post-quantum cryptography require changing my applications?**
No. Applications reference a stable key identifier; the algorithm is decided by policy. Rotating a
key to ML-KEM or ML-DSA keeps the identifier and keeps historical data readable.

**Is the output standard JOSE?**
For simple keys, yes — JWE/JWS that standard libraries decrypt and verify. For composite hybrid keys
the structure follows the RFC but uses extended algorithm identifiers that standard libraries parse
without processing.

**How do I evaluate it?**
Through a guided sandbox with three labs (policy enforcement, hybrid post-quantum migration,
third-party mediated operations), requested from the website, and through an on-premise proof of
concept.

## Contact and resources

- Website: https://ankatech.co
- Documentation: https://docs.ankatech.co
- Reference architecture: https://cryptographiccontrolplane.org
- Email: info@ankatech.co
- LinkedIn: https://www.linkedin.com/company/ankatechsolutions