CNSA 2.0 Validator — Compliance Validation Engine

For each CBOM component:
│
├── Asset is a Certificate?
│   ├── Signature algo is RSA/ECDSA/DSA? → NonCompliant
│   └── Otherwise → Compliant
│
├── Algorithm is in CNSA 2.0 approved list?
│   ├── Parameter check: meets ML-KEM-1024/ML-DSA-87/AES-256 minimum?
│   │   ├── Yes → Compliant (with low-confidence flag if applicable)
│   │   └── No  → NonCompliant (parameter set too low)
│   └── Not in approved list
│
├── Algorithm is known to be CNSA-excluded?
│   └── NonCompliant (excluded: RSA, ECDSA, SLH-DSA, DES, MD5, low param sets)
│
├── Algorithm is known in KB (but not CNSA-approved)?
│   └── NonCompliant (known, needs review)
│
└── Algorithm is completely unknown to KB?
    └── Indeterminate (FAIL-SAFE: never a silent pass)

dotnet add package CipherShift365.Core.Analysis

<PackageReference Include="CipherShift365.Core.Analysis" Version="1.0.0" />

CipherShift365.Core.Analysis
  ├── CipherShift365.Core.Runtime (KB types, contracts, CBOM model)
  ├── Microsoft.CodeAnalysis.CSharp (Roslyn source analysis)
  ├── Microsoft.CodeAnalysis.CSharp.Workspaces
  └── Microsoft.Extensions.Logging.Abstractions

using CipherShift365.Core.Runtime;
using CipherShift365.Core.Analysis;
using CipherShift365.Core.Analysis.Cnsa;

// 1. Load the Knowledge Base
var loader = new KbLoader(encryptionKey, signingKey);
var result = loader.Load(File.ReadAllBytes("kb.cskb"));
var kb = new SignedKnowledgeBase(result.Content!);

// 2. Create the CNSA 2.0 profile
var (profile, entries, timeline) = CnsaProfileFactory.Create();

// 3. Run an analysis to produce a CBOM (or load one)
var analysisEngine = new AnalysisEngine(new RiskModel());
var ctx = new AnalysisContext("./src/MyApp", kb, new IdentityService());
var analysis = await analysisEngine.AnalyzeAsync(ctx);

// 4. Validate against CNSA 2.0
var validator = new CnsaValidator(kb, profile, timeline);
var validationResult = validator.Validate(analysis.Cbom!);

// 5. Inspect the results
Console.WriteLine($"Overall: {validationResult.OverallVerdict}");
Console.WriteLine(validationResult.Summary);

// If you already have a CBOM (e.g., from a file)
var cbom = CbomSerializer.Deserialize<Cbom>(json);

var (profile, _, timeline) = CnsaProfileFactory.Create();
var validator = new CnsaValidator(kb, profile, timeline);
var result = validator.Validate(cbom);

// Check the verdict
if (result.OverallVerdict == CnsaVerdict.Compliant)
    Console.WriteLine("PASS: All crypto assets are CNSA 2.0 compliant.");
else if (result.OverallVerdict == CnsaVerdict.NonCompliant)
    Console.WriteLine($"FAIL: {result.AssetVerdicts.Count(a => a.Verdict == CnsaVerdict.NonCompliant)} non-compliant assets.");
else
    Console.WriteLine($"INDETERMINATE: {result.IndeterminateCount} assets need manual review.");

Algorithm: ML-KEM-1024
Verdict: Compliant
Reason: Algorithm 'ML-KEM-1024' is CNSA 2.0 approved for Key Establishment.

Algorithm: RSA
Verdict: NonCompliant
Reason: Algorithm 'RSA' is NOT CNSA 2.0 approved.
Requirement: CNSA 2.0 algorithm approval
Deadline: 2033-01-01
PqcTarget: ML-DSA-87

Algorithm: ML-KEM-768
Verdict: NonCompliant
Reason: ML-KEM variant is CNSA 2.0 approved but parameter set 'ML-KEM-768' is too low.
Requirement: CNSA 2.0: parameter set minimum
PqcTarget: ML-KEM-1024

Algorithm: CustomCryptoV3
Verdict: Indeterminate
Reason: Algorithm 'CustomCryptoV3' is not recognized — manual review required.
Requirement: CNSA 2.0: unclassified algorithm

foreach (var gap in result.Gaps)
{
    Console.WriteLine($"Asset: {gap.AssetIdentifier}");
    Console.WriteLine($"  Algorithm: {gap.Algorithm}");
    Console.WriteLine($"  Gap: {gap.GapDescription}");
    Console.WriteLine($"  Requirement: {gap.Requirement}");
    Console.WriteLine($"  Action: {gap.RecommendedAction}");
    Console.WriteLine($"  Deadline: {gap.Deadline}");
}

Algorithm: ML-KEM-1024
Verdict: Compliant
Reason: Algorithm 'ML-KEM-1024' is CNSA 2.0 approved for Key Establishment. [FLAGGED: low-confidence finding — verify manually]

CnsaProfileFactory (static)
  ├── ProfileName: "CNSA 2.0"
  ├── ProfileVersion: "2024-09"
  ├── ProfileSource: "CNSSP-15 Annex B / NSA CNSA 2.0 Advisory"
  └── Create() → (ComplianceProfile, IReadOnlyList<KbEntry>, IReadOnlyList<CnsaTimelineEntry>)

CnsaValidator
  ├── Constructor: IKnowledgeBase, ComplianceProfile, IReadOnlyList<CnsaTimelineEntry>
  ├── Validate(Cbom) → CnsaValidationResult
  ├── (private) ComputeOverallVerdict()
  ├── (private) EvaluateAsset() → AssetEvaluation
  ├── (private) EvaluateCertificate() → AssetEvaluation
  ├── (private) CheckParameters() → (verdict, reason, requirement)
  ├── (private) IsCnsaExcluded() → bool
  ├── (private) MapAlgorithmToRole() → string
  ├── (private) GetRelevantDeadline() → string?
  ├── (private) GetPqcTarget() → string?
  └── (private) GetRecommendedAction() → string?

CnsaValidationResult (record)
  ├── OverallVerdict: CnsaVerdict
  ├── AssetVerdicts: IReadOnlyList<CnsaAssetVerdict>
  ├── Gaps: IReadOnlyList<CnsaGapItem>
  ├── Evidence: CnsaEvidence
  ├── Timeline: IReadOnlyList<CnsaTimelineEntry>
  ├── Summary: string
  ├── IndeterminateCount: int
  └── LowConfidenceFlaggedCount: int

CnsaAssetVerdict (record)
  ├── AssetIdentifier, Algorithm, Verdict, Reason
  └── Requirement?, Deadline?, Confidence?, PqcTarget?

CnsaGapItem (record)
  ├── AssetIdentifier, Algorithm, GapDescription, Requirement
  └── RecommendedAction?, Deadline?

CnsaEvidence (record)
  ├── ProfileName, ProfileVersion, KbVersion
  ├── EvaluatedAt, DrivingAssets, ProfileSource

CnsaTimelineEntry (record)
  ├── Category, Deadline, Description

CnsaVerdict (enum)
  ├── Compliant
  ├── NonCompliant
  └── Indeterminate

Validate(Cbom cbom):
  assetVerdicts = []
  gaps = []
  drivingAssets = []
  indeterminateCount = 0
  lowConfidenceCount = 0

  for each component in cbom.Components:
    if component.CryptoProperties is null → skip (not a crypto asset)

    assetId = component.BomRef ?? component.Name
    algorithm = component.Name
    confidence = extract from component.Properties (CipherShiftAnnotations.PropConfidence)

    if confidence == Low → lowConfidenceCount++

    eval = EvaluateAsset(algorithm, cryptoProperties, confidence)

    if eval.IsIndeterminate → indeterminateCount++

    deadline = GetRelevantDeadline(cryptoProperties)  // Timelines-aware
    pqcTarget = GetPqcTarget(algorithm)

    assetVerdicts += new CnsaAssetVerdict(assetId, algorithm, eval.Verdict, eval.Reason,
        eval.Requirement, deadline, confidence, pqcTarget)

    if eval.Verdict != Compliant:
      gaps += new CnsaGapItem(assetId, algorithm, eval.Reason, eval.Requirement,
          GetRecommendedAction(algorithm, cryptoProperties), deadline)

  overallVerdict = ComputeOverallVerdict(assetVerdicts)
  // NonCompliant > Indeterminate > Compliant (worst-case wins)

  evidence = new CnsaEvidence(profile.Name, profile.Version, kb.Version,
      UtcNow, drivingAssets, CnsaProfileFactory.ProfileSource)

  return new CnsaValidationResult(overallVerdict, assetVerdicts, gaps, evidence,
      timeline, summary, indeterminateCount, lowConfidenceCount)

// If algorithm is not in approved list, not excluded, and not in KB:
return new AssetEvaluation(CnsaVerdict.Indeterminate,
    $"Algorithm '{algorithm}' is not recognized — manual review required.",
    "CNSA 2.0: unclassified algorithm", isIndeterminate: true);

static CnsaVerdict ComputeOverallVerdict(IReadOnlyList<CnsaAssetVerdict> assets)
{
    if (assets.Count == 0) return CnsaVerdict.Compliant;
    if (assets.Any(a => a.Verdict == CnsaVerdict.NonCompliant)) return CnsaVerdict.NonCompliant;
    if (assets.Any(a => a.Verdict == CnsaVerdict.Indeterminate)) return CnsaVerdict.Indeterminate;
    return CnsaVerdict.Compliant;
}

// In CnsaValidator.IsCnsaExcluded(), add a new case:
private static bool IsCnsaExcluded(string algorithm)
{
    var upper = algorithm.ToUpperInvariant();
    return upper switch
    {
        // ... existing cases ...
        var a when a.StartsWith("CHACHA", StringComparison.Ordinal) => true, // NEW
        _ => false
    };
}

// Add the corresponding KB entry in CnsaProfileFactory.Create()
new("ChaCha20", CryptoRole.Symmetric, RiskLevel.QuantumVulnerable,
    Description: "Not CNSA 2.0 approved. Use AES-256.",
    StandardsReferences: new[] { "CNSA 2.0" },
    MigrationNotes: "Replace with AES-256-GCM.")

// ✅ Data-driven: the approved list is in the KB profile
var profile = new ComplianceProfile("CNSA 2.0", "2024-09",
    new[] { "ML-KEM-1024", "ML-DSA-87", "AES-256", "SHA-384", "SHA-512", "LMS", "XMSS" },
    RiskLevel.QuantumSafe);

// ❌ Anti-pattern avoided: no hardcoded lists in the validator
// if (algo == "ML-KEM-1024" || algo == "ML-DSA-87") ...

// Build the CNSA 2.0 profile
var (profile, entries, timeline) = CnsaProfileFactory.Create();

// Run analysis to produce a CBOM
var kb = new SignedKnowledgeBase(content);
var engine = new AnalysisEngine(new RiskModel());
var context = new AnalysisContext("./src", kb, new IdentityService());
var analysis = await engine.AnalyzeAsync(context);

// Validate
var validator = new CnsaValidator(kb, profile, timeline);
var result = validator.Validate(analysis.Cbom!);

// Print results
Console.WriteLine($"CNSA 2.0 Validation: {result.OverallVerdict}");
Console.WriteLine(result.Summary);
Console.WriteLine($"  Compliant: {result.AssetVerdicts.Count(a => a.Verdict == CnsaVerdict.Compliant)}");
Console.WriteLine($"  Non-Compliant: {result.AssetVerdicts.Count(a => a.Verdict == CnsaVerdict.NonCompliant)}");
Console.WriteLine($"  Indeterminate: {result.IndeterminateCount}");
Console.WriteLine($"  Low Confidence: {result.LowConfidenceFlaggedCount}");

if (result.Gaps.Count > 0)
{
    Console.WriteLine("\n--- GAP ANALYSIS ---");
    foreach (var gap in result.Gaps)
        Console.WriteLine($"  [{gap.Deadline ?? "N/A"}] {gap.AssetIdentifier}: {gap.GapDescription}");
}

Console.WriteLine("\n--- TIMELINE ---");
foreach (var t in result.Timeline)
    Console.WriteLine($"  {t.Deadline:yyyy-MM-dd} — {t.Category}: {t.Description}");

var result = validator.Validate(cbom);

Console.WriteLine("=== CNSA 2.0 Migration Roadmap ===\n");

// Sort non-compliant assets by deadline
var needsMigration = result.AssetVerdicts
    .Where(a => a.Verdict != CnsaVerdict.Compliant)
    .OrderBy(a => a.Deadline);

foreach (var asset in needsMigration)
{
    Console.WriteLine($"📦 {asset.AssetIdentifier}");
    Console.WriteLine($"   Algorithm: {asset.Algorithm}");
    Console.WriteLine($"   Verdict:   {asset.Verdict}");
    Console.WriteLine($"   Reason:    {asset.Reason}");
    Console.WriteLine($"   Migrate to: {asset.PqcTarget ?? "manual review needed"}");
    Console.WriteLine($"   Deadline:  {asset.Deadline ?? "unknown"}");
    Console.WriteLine();
}

// Summary for leadership
var byDeadline = needsMigration.GroupBy(a => a.Deadline);
Console.WriteLine("=== SUMMARY BY DEADLINE ===");
foreach (var group in byDeadline.OrderBy(g => g.Key))
    Console.WriteLine($"  {group.Key ?? "unknown"}: {group.Count()} assets");

[HttpGet("cnsa/verdict")]
public async Task<IActionResult> GetCnsaVerdict([FromQuery] string project)
{
    // Load KB
    var kb = LoadKb();
    var (profile, _, timeline) = CnsaProfileFactory.Create();

    // Run analysis
    var engine = new AnalysisEngine(new RiskModel());
    var ctx = new AnalysisContext(project, kb, new IdentityService());
    var analysis = await engine.AnalyzeAsync(ctx);

    if (analysis.Cbom is null)
        return BadRequest("Analysis produced no CBOM.");

    // Validate
    var validator = new CnsaValidator(kb, profile, timeline);
    var result = validator.Validate(analysis.Cbom);

    return Ok(new
    {
        overallVerdict = result.OverallVerdict.ToString(),
        compliant = result.AssetVerdicts.Count(a => a.Verdict == CnsaVerdict.Compliant),
        nonCompliant = result.AssetVerdicts.Count(a => a.Verdict == CnsaVerdict.NonCompliant),
        indeterminate = result.IndeterminateCount,
        summary = result.Summary,
        gaps = result.Gaps.Select(g => new
        {
            g.AssetIdentifier, g.Algorithm, g.GapDescription,
            g.Requirement, g.RecommendedAction, g.Deadline
        }),
        timeline = result.Timeline
    });
}

// Fail the build if CNSA 2.0 validation fails
var result = validator.Validate(cbom);

if (result.OverallVerdict != CnsaVerdict.Compliant)
{
    Console.Error.WriteLine("=== CNSA 2.0 VALIDATION FAILED ===");
    Console.Error.WriteLine(result.Summary);

    foreach (var gap in result.Gaps)
        Console.Error.WriteLine($"  GAP: {gap.AssetIdentifier} — {gap.RecommendedAction}");

    Environment.Exit(1); // Fail the build
}

Console.WriteLine("CNSA 2.0 validation passed.");

// Compare CNSA 2.0 against a hypothetical future profile
var (cnsaProfile, _, cnsaTimeline) = CnsaProfileFactory.Create();
var (customProfile, customEntries, customTimeline) = MyProfileFactory.Create();

var cnsaValidator = new CnsaValidator(kb, cnsaProfile, cnsaTimeline);
var customValidator = new CnsaValidator(kb, customProfile, customTimeline);

var cnsaResult = cnsaValidator.Validate(cbom);
var customResult = customValidator.Validate(cbom);

// Assets that pass CNSA but fail the stricter profile
var additionalFailures = customResult.AssetVerdicts
    .Where(c => c.Verdict != CnsaVerdict.Compliant)
    .Where(c => !cnsaResult.AssetVerdicts
        .Any(n => n.AssetIdentifier == c.AssetIdentifier && n.Verdict != CnsaVerdict.Compliant));

Console.WriteLine($"CNSA 2.0 violations: {cnsaResult.AssetVerdicts.Count(a => a.Verdict == CnsaVerdict.NonCompliant)}");
Console.WriteLine($"Additional custom violations: {additionalFailures.Count()}");

// Default CNSA 2.0 profile
var (profile, entries, timeline) = CnsaProfileFactory.Create();

// Or use a custom profile from the KB
var customProfile = kb.ComplianceProfiles.First(p => p.Name == "Custom Profile");
var validator = new CnsaValidator(kb, customProfile, myTimeline);

var evidence = result.Evidence;
Console.WriteLine($"Validated with KB v{evidence.KbVersion} (profile v{evidence.ProfileVersion})");

// Store evidence for auditors
File.WriteAllText("cnsa-evidence.json", JsonSerializer.Serialize(evidence));

var customTimeline = new[]
{
    new CnsaTimelineEntry("InternalGate", new DateTimeOffset(2026, 6, 1, 0, 0, 0, TimeSpan.Zero),
        "Internal PQC migration deadline."),
    new CnsaTimelineEntry("ExternalGate", new DateTimeOffset(2028, 1, 1, 0, 0, 0, TimeSpan.Zero),
        "Customer-facing PQC requirement."),
};

var validator = new CnsaValidator(kb, cnsaProfile, customTimeline);

// Custom wrapper that treats Low-confidence as failures
public static class StrictCnsaValidator
{
    public static CnsaValidationResult ValidateStrict(CnsaValidator inner, Cbom cbom)
    {
        var result = inner.Validate(cbom);
        if (result.LowConfidenceFlaggedCount > 0)
        {
            // Optionally promote low-confidence to failures
            // Currently, low-confidence findings are flagged but don't change the overall verdict
            // This is a policy choice you can implement in a wrapper
        }
        return result;
    }
}

Q: "Are our 15 microservices CNSA 2.0 compliant?"
A: "We cross-referenced our crypto inventory against the advisory. 
    It took 2 analysts 3 weeks. The spreadsheet is on SharePoint somewhere.
    Also, we're not sure about the third-party libraries."
Risk: HIGH — manual, slow, incomplete, not reproducible

Q: "Are our 15 microservices CNSA 2.0 compliant?"
A: "Ran Compass with CNSA 2.0 profile across all repos. 
    12 are Compliant. 2 have NonCompliant assets (RSA in legacy modules). 
    1 has Indeterminate (unknown NuGet crypto). 
    Gap analysis with deadlines and migration targets attached. 
    Evidence timestamped and signed. 
    Total time: 4 seconds."
Risk: LOW — automated, complete, reproducible with evidence