Use of Insufficient Cryptographic Key Lengths

// Java - SECURE: Strong RSA key generation
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.security.spec.RSAKeyGenParameterSpec;
import java.math.BigInteger;

public class SecureRSAKeys {
    
    // Recommended key sizes based on security requirements
    public static final int RSA_KEY_SIZE_STANDARD = 3072;  // Good until ~2030
    public static final int RSA_KEY_SIZE_HIGH = 4096;      // Long-term security
    
    public KeyPair generateSecureRSAKey() throws NoSuchAlgorithmException {
        return generateSecureRSAKey(RSA_KEY_SIZE_STANDARD);
    }
    
    public KeyPair generateSecureRSAKey(int keySize) throws NoSuchAlgorithmException {
        if (keySize < 2048) {
            throw new IllegalArgumentException("RSA key size must be at least 2048 bits");
        }
        
        KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
        
        // Use secure random and proper key size
        SecureRandom secureRandom = new SecureRandom();
        keyGen.initialize(keySize, secureRandom);
        
        return keyGen.generateKeyPair();
    }
    
    public KeyPair generateHighSecurityRSAKey() throws Exception {
        KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
        
        // Use RSA key generation parameters for maximum security
        RSAKeyGenParameterSpec spec = new RSAKeyGenParameterSpec(
            RSA_KEY_SIZE_HIGH,
            BigInteger.valueOf(65537) // Standard public exponent
        );
        
        keyGen.initialize(spec, new SecureRandom());
        
        return keyGen.generateKeyPair();
    }
    
    // Key size validation
    public boolean isKeySecure(KeyPair keyPair) {
        if (keyPair.getPublic().getAlgorithm().equals("RSA")) {
            // Get key size from public key
            java.security.interfaces.RSAPublicKey rsaPublicKey = 
                (java.security.interfaces.RSAPublicKey) keyPair.getPublic();
            
            int keySize = rsaPublicKey.getModulus().bitLength();
            
            return keySize >= 2048; // Minimum acceptable
        }
        
        return false;
    }
    
    // Secure RSA encryption with proper padding
    public byte[] encryptWithSecureKey(String plaintext) throws Exception {
        KeyPair keyPair = generateSecureRSAKey();
        
        javax.crypto.Cipher cipher = javax.crypto.Cipher.getInstance("RSA/ECB/OAEPSHA256AndMGF1Padding");
        cipher.init(javax.crypto.Cipher.ENCRYPT_MODE, keyPair.getPublic());
        
        return cipher.doFinal(plaintext.getBytes());
    }
    
    // Key upgrade utility
    public KeyPair upgradeWeakKey(KeyPair oldKeyPair) throws Exception {
        if (isKeySecure(oldKeyPair)) {
            return oldKeyPair; // Already secure
        }
        
        System.out.println("Upgrading weak RSA key to secure key size");
        return generateSecureRSAKey(RSA_KEY_SIZE_STANDARD);
    }
    
    // Generate keys for different use cases
    public KeyPair generateSigningKey() throws NoSuchAlgorithmException {
        // For digital signatures, use high security
        return generateSecureRSAKey(RSA_KEY_SIZE_HIGH);
    }
    
    public KeyPair generateEncryptionKey() throws NoSuchAlgorithmException {
        // For encryption, standard security is acceptable
        return generateSecureRSAKey(RSA_KEY_SIZE_STANDARD);
    }
}

# Python - SECURE: Strong symmetric encryption with AES-256
import os
import secrets
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives.kdf.scrypt import Scrypt
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.backends import default_backend

class SecureSymmetricEncryption:
    
    # Recommended key sizes
    AES_KEY_SIZE = 32      # 256 bits
    HMAC_KEY_SIZE = 32     # 256 bits (same as hash output)
    SALT_SIZE = 32         # 256 bits
    NONCE_SIZE = 12        # 96 bits for AES-GCM
    
    def generate_secure_aes_key(self):
        """Generate cryptographically secure 256-bit AES key"""
        return secrets.token_bytes(self.AES_KEY_SIZE)
    
    def generate_secure_hmac_key(self):
        """Generate secure HMAC key (at least as long as hash output)"""
        return secrets.token_bytes(self.HMAC_KEY_SIZE)
    
    def encrypt_with_aes_gcm(self, plaintext, key=None, associated_data=None):
        """Encrypt using AES-256-GCM (authenticated encryption)"""
        if key is None:
            key = self.generate_secure_aes_key()
        
        if len(key) != self.AES_KEY_SIZE:
            raise ValueError(f"AES key must be {self.AES_KEY_SIZE} bytes (256 bits)")
        
        # Generate random nonce
        nonce = secrets.token_bytes(self.NONCE_SIZE)
        
        # Use AES-GCM for authenticated encryption
        aesgcm = AESGCM(key)
        ciphertext = aesgcm.encrypt(nonce, plaintext, associated_data)
        
        return {
            'ciphertext': ciphertext,
            'nonce': nonce,
            'key': key
        }
    
    def decrypt_with_aes_gcm(self, encrypted_data, associated_data=None):
        """Decrypt AES-256-GCM ciphertext"""
        aesgcm = AESGCM(encrypted_data['key'])
        
        try:
            plaintext = aesgcm.decrypt(
                encrypted_data['nonce'],
                encrypted_data['ciphertext'],
                associated_data
            )
            return plaintext
        except Exception as e:
            raise ValueError(f"Decryption failed: {e}")
    
    def derive_key_from_password_pbkdf2(self, password, salt=None, iterations=600000):
        """Derive 256-bit key from password using PBKDF2"""
        if salt is None:
            salt = secrets.token_bytes(self.SALT_SIZE)
        
        if iterations < 100000:
            raise ValueError("PBKDF2 iterations must be at least 100,000")
        
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=self.AES_KEY_SIZE,  # 32 bytes = 256 bits
            salt=salt,
            iterations=iterations,
            backend=default_backend()
        )
        
        key = kdf.derive(password.encode('utf-8'))
        
        return {
            'key': key,
            'salt': salt,
            'iterations': iterations,
            'algorithm': 'PBKDF2-SHA256'
        }
    
    def derive_key_from_password_scrypt(self, password, salt=None, n=32768, r=8, p=1):
        """Derive 256-bit key from password using scrypt (more secure)"""
        if salt is None:
            salt = secrets.token_bytes(self.SALT_SIZE)
        
        # Validate scrypt parameters
        if n < 16384:
            raise ValueError("Scrypt N parameter should be at least 16384")
        if r < 8:
            raise ValueError("Scrypt r parameter should be at least 8")
        
        kdf = Scrypt(
            algorithm=hashes.SHA256(),
            length=self.AES_KEY_SIZE,  # 32 bytes = 256 bits
            salt=salt,
            n=n,
            r=r,
            p=p,
            backend=default_backend()
        )
        
        key = kdf.derive(password.encode('utf-8'))
        
        return {
            'key': key,
            'salt': salt,
            'n': n,
            'r': r,
            'p': p,
            'algorithm': 'scrypt-SHA256'
        }
    
    def secure_hmac_generation(self, data, key=None):
        """Generate HMAC with secure key length"""
        import hmac
        import hashlib
        
        if key is None:
            key = self.generate_secure_hmac_key()
        
        if len(key) < 32:  # SHA-256 output length
            raise ValueError("HMAC key should be at least 32 bytes for SHA-256")
        
        return hmac.new(key, data, hashlib.sha256).digest()
    
    def encrypt_file_securely(self, file_path, output_path, password=None):
        """Encrypt file with strong encryption"""
        with open(file_path, 'rb') as f:
            plaintext = f.read()
        
        if password:
            # Derive key from password
            key_data = self.derive_key_from_password_scrypt(password)
            key = key_data['key']
        else:
            # Generate random key
            key = self.generate_secure_aes_key()
            key_data = {'key': key, 'random': True}
        
        # Encrypt data
        encrypted = self.encrypt_with_aes_gcm(plaintext, key)
        
        # Save encrypted file with metadata
        with open(output_path, 'wb') as f:
            # Write salt if password-derived
            if 'salt' in key_data:
                f.write(len(key_data['salt']).to_bytes(4, 'big'))
                f.write(key_data['salt'])
                f.write(key_data['iterations'].to_bytes(4, 'big'))
            else:
                f.write((0).to_bytes(4, 'big'))  # No salt
            
            # Write nonce
            f.write(len(encrypted['nonce']).to_bytes(4, 'big'))
            f.write(encrypted['nonce'])
            
            # Write ciphertext
            f.write(encrypted['ciphertext'])
        
        return key_data
    
    def validate_key_strength(self, key, key_type='AES'):
        """Validate that key meets security requirements"""
        if key_type == 'AES':
            if len(key) < 16:
                return False, "AES key too short (minimum 128 bits)"
            elif len(key) < 32:
                return False, "AES key should be 256 bits for optimal security"
            else:
                return True, "AES key length is secure"
        
        elif key_type == 'HMAC':
            if len(key) < 32:  # SHA-256 output length
                return False, "HMAC key should be at least 32 bytes for SHA-256"
            else:
                return True, "HMAC key length is secure"
        
        return False, "Unknown key type"
    
    def generate_key_bundle(self):
        """Generate a complete set of secure keys"""
        return {
            'encryption_key': self.generate_secure_aes_key(),
            'signing_key': self.generate_secure_hmac_key(),
            'kdf_salt': secrets.token_bytes(self.SALT_SIZE),
            'created_at': secrets.token_bytes(8).hex(),  # Timestamp placeholder
            'key_version': 1
        }

# Example usage
if __name__ == '__main__':
    crypto = SecureSymmetricEncryption()
    
    # Generate secure keys
    aes_key = crypto.generate_secure_aes_key()
    print(f"Generated AES-256 key: {len(aes_key)} bytes")
    
    # Encrypt data
    plaintext = b"This is sensitive data that needs strong protection"
    encrypted = crypto.encrypt_with_aes_gcm(plaintext)
    
    print(f"Encrypted {len(plaintext)} bytes to {len(encrypted['ciphertext'])} bytes")
    
    # Decrypt data
    decrypted = crypto.decrypt_with_aes_gcm(encrypted)
    print(f"Decryption successful: {decrypted == plaintext}")
    
    # Key derivation from password
    password = "strong_password_123!@#"
    key_data = crypto.derive_key_from_password_scrypt(password)
    print(f"Derived key from password: {len(key_data['key'])} bytes")
    
    # Validate key strength
    is_secure, message = crypto.validate_key_strength(aes_key, 'AES')
    print(f"Key security validation: {is_secure} - {message}")

// Node.js - SECURE: Strong elliptic curve cryptography
const crypto = require('crypto');
const { generateKeyPairSync, createSign, createVerify, diffieHellman } = require('crypto');

class SecureEllipticCurves {
    
    // Recommended curves with their security levels
    static CURVES = {
        'secp256r1': { bits: 256, security: 128, description: 'NIST P-256 (recommended)' },
        'secp384r1': { bits: 384, security: 192, description: 'NIST P-384 (high security)' },
        'secp521r1': { bits: 521, security: 256, description: 'NIST P-521 (maximum security)' },
        'prime256v1': { bits: 256, security: 128, description: 'Same as secp256r1' }
    };
    
    constructor() {
        this.defaultCurve = 'secp256r1'; // Good balance of security and performance
        this.highSecurityCurve = 'secp384r1'; // For high-security applications
    }
    
    generateSecureECKey(curveName = this.defaultCurve) {
        // Validate curve security
        if (!this.isCurveSecure(curveName)) {
            throw new Error(`Curve ${curveName} does not meet security requirements`);
        }
        
        const { publicKey, privateKey } = generateKeyPairSync('ec', {
            namedCurve: curveName,
            publicKeyEncoding: {
                type: 'spki',
                format: 'pem'
            },
            privateKeyEncoding: {
                type: 'pkcs8',
                format: 'pem'
            }
        });
        
        return {
            publicKey,
            privateKey,
            curve: curveName,
            securityLevel: SecureEllipticCurves.CURVES[curveName].security
        };
    }
    
    generateHighSecurityECKey() {
        // Use P-384 for high security requirements
        return this.generateSecureECKey(this.highSecurityCurve);
    }
    
    generateMaxSecurityECKey() {
        // Use P-521 for maximum security
        return this.generateSecureECKey('secp521r1');
    }
    
    // Modern curve support (when available)
    generateCurve25519Key() {
        try {
            // X25519 for ECDH
            const { publicKey, privateKey } = generateKeyPairSync('x25519', {
                publicKeyEncoding: {
                    type: 'spki',
                    format: 'pem'
                },
                privateKeyEncoding: {
                    type: 'pkcs8',
                    format: 'pem'
                }
            });
            
            return {
                publicKey,
                privateKey,
                curve: 'X25519',
                securityLevel: 128,
                type: 'ECDH'
            };
        } catch (error) {
            throw new Error('X25519 not supported in this Node.js version');
        }
    }
    
    generateEd25519Key() {
        try {
            // Ed25519 for digital signatures
            const { publicKey, privateKey } = generateKeyPairSync('ed25519', {
                publicKeyEncoding: {
                    type: 'spki',
                    format: 'pem'
                },
                privateKeyEncoding: {
                    type: 'pkcs8',
                    format: 'pem'
                }
            });
            
            return {
                publicKey,
                privateKey,
                curve: 'Ed25519',
                securityLevel: 128,
                type: 'Signature'
            };
        } catch (error) {
            throw new Error('Ed25519 not supported in this Node.js version');
        }
    }
    
    isCurveSecure(curveName) {
        const curve = SecureEllipticCurves.CURVES[curveName];
        if (!curve) {
            console.warn(`Unknown curve: ${curveName}`);
            return false;
        }
        
        // Require at least 256-bit curves (128-bit security)
        return curve.bits >= 256;
    }
    
    signWithSecureCurve(data, privateKey) {
        const sign = createSign('SHA256');
        sign.update(data);
        sign.end();
        
        return sign.sign(privateKey);
    }
    
    verifyWithSecureCurve(data, signature, publicKey) {
        const verify = createVerify('SHA256');
        verify.update(data);
        verify.end();
        
        return verify.verify(publicKey, signature);
    }
    
    performSecureECDH(privateKey, publicKey) {
        // Perform ECDH key agreement with secure curves
        try {
            const sharedSecret = diffieHellman({
                privateKey: privateKey,
                publicKey: publicKey
            });
            
            return sharedSecret;
        } catch (error) {
            throw new Error(`ECDH failed: ${error.message}`);
        }
    }
    
    deriveKeyFromECDH(sharedSecret, keyLength = 32, info = '') {
        // Derive symmetric key from ECDH shared secret using HKDF
        const hkdf = crypto.createHmac('sha256', '');
        
        // Simplified HKDF (use proper HKDF library in production)
        const okm = crypto.createHmac('sha256', sharedSecret)
            .update(info)
            .digest();
        
        return okm.slice(0, keyLength);
    }
    
    validateKeyPair(keyPair) {
        try {
            // Test signing and verification
            const testData = 'test message for key validation';
            const signature = this.signWithSecureCurve(testData, keyPair.privateKey);
            const isValid = this.verifyWithSecureCurve(testData, signature, keyPair.publicKey);
            
            return {
                valid: isValid,
                curve: keyPair.curve,
                securityLevel: keyPair.securityLevel
            };
        } catch (error) {
            return {
                valid: false,
                error: error.message
            };
        }
    }
    
    // Migration utility for upgrading weak curves
    upgradeWeakCurve(oldKeyPair, targetSecurityLevel = 128) {
        const requiredCurve = targetSecurityLevel >= 192 ? 'secp384r1' : 'secp256r1';
        
        console.log(`Upgrading key to ${requiredCurve} for ${targetSecurityLevel}-bit security`);
        return this.generateSecureECKey(requiredCurve);
    }
    
    // Generate keys for different use cases
    generateSigningKeys() {
        // For digital signatures
        try {
            return this.generateEd25519Key(); // Preferred for signatures
        } catch {
            return this.generateSecureECKey('secp256r1'); // Fallback
        }
    }
    
    generateKeyExchangeKeys() {
        // For key exchange (ECDH)
        try {
            return this.generateCurve25519Key(); // Preferred for ECDH
        } catch {
            return this.generateSecureECKey('secp256r1'); // Fallback
        }
    }
}

// Example usage
const ecc = new SecureEllipticCurves();

// Generate secure EC key pair
const keyPair = ecc.generateSecureECKey();
console.log(`Generated EC key with curve: ${keyPair.curve}`);
console.log(`Security level: ${keyPair.securityLevel} bits`);

// Generate high-security key pair
const highSecKeyPair = ecc.generateHighSecurityECKey();
console.log(`High-security key curve: ${highSecKeyPair.curve}`);

// Test modern curves if available
try {
    const ed25519Keys = ecc.generateEd25519Key();
    console.log('Ed25519 keys generated successfully');
} catch (error) {
    console.log('Ed25519 not available, using fallback');
}

// Validate key pair
const validation = ecc.validateKeyPair(keyPair);
console.log(`Key validation: ${validation.valid}`);

// Demonstrate ECDH
const alice = ecc.generateSecureECKey();
const bob = ecc.generateSecureECKey();

const aliceSecret = ecc.performSecureECDH(alice.privateKey, bob.publicKey);
const bobSecret = ecc.performSecureECDH(bob.privateKey, alice.publicKey);

console.log(`ECDH shared secrets match: ${aliceSecret.equals(bobSecret)}`);

module.exports = SecureEllipticCurves;

// C# - SECURE: Modern TLS configuration and strong cryptographic protocols
using System;
using System.Net;
using System.Net.Security;
using System.Security.Authentication;
using System.Security.Cryptography;
using System.Text;
using Microsoft.AspNetCore.Builder;
using Microsoft.Extensions.DependencyInjection;

public class SecureProtocolConfiguration
{
    // Configure secure TLS settings
    public static void ConfigureSecureSSL()
    {
        // SECURE: Enable only strong TLS versions
        ServicePointManager.SecurityProtocol = 
            SecurityProtocolType.Tls12 |    // TLS 1.2 (minimum)
            SecurityProtocolType.Tls13;     // TLS 1.3 (preferred)
        
        // Disable weak protocols completely
        ServicePointManager.SecurityProtocol &= 
            ~(SecurityProtocolType.Ssl3 |
              SecurityProtocolType.Tls |
              SecurityProtocolType.Tls11);
    }
    
    // ASP.NET Core HTTPS configuration
    public static void ConfigureSecureHttps(IServiceCollection services)
    {
        services.Configure<HttpsRedirectionOptions>(options =>
        {
            options.RedirectStatusCode = StatusCodes.Status308PermanentRedirect;
            options.HttpsPort = 443;
        });
        
        services.AddHsts(options =>
        {
            options.Preload = true;
            options.IncludeSubDomains = true;
            options.MaxAge = TimeSpan.FromDays(365);
        });
    }
    
    // Secure RSA key generation with proper sizes
    public class SecureRSAProvider
    {
        private const int MINIMUM_KEY_SIZE = 2048;
        private const int RECOMMENDED_KEY_SIZE = 3072;
        private const int HIGH_SECURITY_KEY_SIZE = 4096;
        
        public RSA CreateSecureRSA(SecurityLevel securityLevel = SecurityLevel.Recommended)
        {
            var rsa = RSA.Create();
            
            int keySize = securityLevel switch
            {
                SecurityLevel.Minimum => MINIMUM_KEY_SIZE,
                SecurityLevel.Recommended => RECOMMENDED_KEY_SIZE,
                SecurityLevel.High => HIGH_SECURITY_KEY_SIZE,
                _ => RECOMMENDED_KEY_SIZE
            };
            
            rsa.KeySize = keySize;
            
            Console.WriteLine($"Generated RSA key with {keySize} bits");
            return rsa;
        }
        
        public enum SecurityLevel
        {
            Minimum,      // 2048 bits
            Recommended,  // 3072 bits  
            High         // 4096 bits
        }
    }
    
    // Secure Diffie-Hellman implementation
    public class SecureDiffieHellman
    {
        private const int MINIMUM_KEY_SIZE = 2048;
        private const int RECOMMENDED_KEY_SIZE = 3072;
        
        public ECDiffieHellman CreateSecureECDH()
        {
            var ecdh = ECDiffieHellman.Create();
            
            // Use secure curves
            try
            {
                ecdh.GenerateKey(ECCurve.NamedCurves.nistP384); // 384-bit curve
                Console.WriteLine("Generated ECDH key with P-384 curve");
            }
            catch
            {
                ecdh.GenerateKey(ECCurve.NamedCurves.nistP256); // Fallback to P-256
                Console.WriteLine("Generated ECDH key with P-256 curve");
            }
            
            return ecdh;
        }
        
        public byte[] DeriveKeyMaterial(ECDiffieHellman ecdh, ECDiffieHellmanPublicKey otherPartyPublicKey, int keyLength = 32)
        {
            // Derive key material using secure hash algorithm
            return ecdh.DeriveKeyMaterial(otherPartyPublicKey);
        }
    }
    
    // Secure symmetric encryption with proper key sizes
    public class SecureSymmetricCrypto
    {
        private const int AES_KEY_SIZE_BITS = 256;
        private const int AES_KEY_SIZE_BYTES = AES_KEY_SIZE_BITS / 8;
        private const int HMAC_KEY_SIZE = 32; // 256 bits
        
        public Aes CreateSecureAES()
        {
            var aes = Aes.Create();
            aes.KeySize = AES_KEY_SIZE_BITS; // Force 256-bit keys
            aes.Mode = CipherMode.GCM;       // Use authenticated encryption
            
            return aes;
        }
        
        public byte[] GenerateSecureKey()
        {
            using (var rng = RandomNumberGenerator.Create())
            {
                var key = new byte[AES_KEY_SIZE_BYTES];
                rng.GetBytes(key);
                return key;
            }
        }
        
        public byte[] GenerateSecureHMACKey()
        {
            using (var rng = RandomNumberGenerator.Create())
            {
                var key = new byte[HMAC_KEY_SIZE];
                rng.GetBytes(key);
                return key;
            }
        }
        
        public EncryptionResult EncryptWithAESGCM(byte[] plaintext, byte[] key, byte[] associatedData = null)
        {
            if (key.Length != AES_KEY_SIZE_BYTES)
            {
                throw new ArgumentException($"Key must be {AES_KEY_SIZE_BYTES} bytes (256 bits)");
            }
            
            using (var aes = new AesGcm(key))
            {
                var nonce = new byte[12]; // 96-bit nonce
                var ciphertext = new byte[plaintext.Length];
                var tag = new byte[16]; // 128-bit authentication tag
                
                using (var rng = RandomNumberGenerator.Create())
                {
                    rng.GetBytes(nonce);
                }
                
                aes.Encrypt(nonce, plaintext, ciphertext, tag, associatedData);
                
                return new EncryptionResult
                {
                    Ciphertext = ciphertext,
                    Nonce = nonce,
                    Tag = tag
                };
            }
        }
        
        public class EncryptionResult
        {
            public byte[] Ciphertext { get; set; }
            public byte[] Nonce { get; set; }
            public byte[] Tag { get; set; }
        }
    }
    
    // Password-based key derivation with secure parameters
    public class SecureKeyDerivation
    {
        private const int MINIMUM_ITERATIONS = 100000;
        private const int RECOMMENDED_ITERATIONS = 600000;
        private const int SALT_SIZE = 32;
        private const int KEY_SIZE = 32; // 256 bits
        
        public KeyDerivationResult DeriveKeyFromPassword(string password, byte[] salt = null, int iterations = RECOMMENDED_ITERATIONS)
        {
            if (iterations < MINIMUM_ITERATIONS)
            {
                throw new ArgumentException($"Iterations must be at least {MINIMUM_ITERATIONS}");
            }
            
            if (salt == null)
            {
                salt = new byte[SALT_SIZE];
                using (var rng = RandomNumberGenerator.Create())
                {
                    rng.GetBytes(salt);
                }
            }
            
            using (var pbkdf2 = new Rfc2898DeriveBytes(password, salt, iterations, HashAlgorithmName.SHA256))
            {
                var key = pbkdf2.GetBytes(KEY_SIZE);
                
                return new KeyDerivationResult
                {
                    Key = key,
                    Salt = salt,
                    Iterations = iterations,
                    Algorithm = "PBKDF2-SHA256"
                };
            }
        }
        
        public class KeyDerivationResult
        {
            public byte[] Key { get; set; }
            public byte[] Salt { get; set; }
            public int Iterations { get; set; }
            public string Algorithm { get; set; }
        }
    }
    
    // Key validation utilities
    public static class KeyValidator
    {
        public static ValidationResult ValidateRSAKey(RSA rsa)
        {
            var keySize = rsa.KeySize;
            
            if (keySize < 2048)
            {
                return new ValidationResult
                {
                    IsValid = false,
                    Message = $"RSA key size {keySize} is too small (minimum 2048 bits)"
                };
            }
            else if (keySize < 3072)
            {
                return new ValidationResult
                {
                    IsValid = true,
                    Message = $"RSA key size {keySize} meets minimum requirements but 3072+ recommended",
                    WarningLevel = true
                };
            }
            else
            {
                return new ValidationResult
                {
                    IsValid = true,
                    Message = $"RSA key size {keySize} provides strong security"
                };
            }
        }
        
        public static ValidationResult ValidateAESKey(byte[] key)
        {
            var keyBits = key.Length * 8;
            
            if (keyBits < 128)
            {
                return new ValidationResult
                {
                    IsValid = false,
                    Message = $"AES key size {keyBits} bits is too small (minimum 128 bits)"
                };
            }
            else if (keyBits < 256)
            {
                return new ValidationResult
                {
                    IsValid = true,
                    Message = $"AES key size {keyBits} bits is acceptable but 256 bits recommended",
                    WarningLevel = true
                };
            }
            else
            {
                return new ValidationResult
                {
                    IsValid = true,
                    Message = $"AES key size {keyBits} bits provides strong security"
                };
            }
        }
        
        public class ValidationResult
        {
            public bool IsValid { get; set; }
            public string Message { get; set; }
            public bool WarningLevel { get; set; }
        }
    }
}

// Example usage
public class Program
{
    public static void Main()
    {
        // Configure secure protocols
        SecureProtocolConfiguration.ConfigureSecureSSL();
        
        // Generate secure RSA keys
        var rsaProvider = new SecureProtocolConfiguration.SecureRSAProvider();
        using (var rsa = rsaProvider.CreateSecureRSA(SecureProtocolConfiguration.SecureRSAProvider.SecurityLevel.High))
        {
            var validation = SecureProtocolConfiguration.KeyValidator.ValidateRSAKey(rsa);
            Console.WriteLine($"RSA key validation: {validation.Message}");
        }
        
        // Generate secure symmetric keys
        var symCrypto = new SecureProtocolConfiguration.SecureSymmetricCrypto();
        var aesKey = symCrypto.GenerateSecureKey();
        
        var aesValidation = SecureProtocolConfiguration.KeyValidator.ValidateAESKey(aesKey);
        Console.WriteLine($"AES key validation: {aesValidation.Message}");
        
        // Demonstrate secure encryption
        var plaintext = Encoding.UTF8.GetBytes("Sensitive data requiring strong protection");
        var encrypted = symCrypto.EncryptWithAESGCM(plaintext, aesKey);
        
        Console.WriteLine($"Encrypted {plaintext.Length} bytes with AES-256-GCM");
        
        // Generate ECDH keys
        var dhProvider = new SecureProtocolConfiguration.SecureDiffieHellman();
        using (var ecdh = dhProvider.CreateSecureECDH())
        {
            Console.WriteLine("ECDH key pair generated with secure curve");
        }
    }
}