Attacks · Replay, relay & forgery
Revocation is one state change: deactivate the circuit handle in the registry. Burned or revoked circuits cannot re-authorize.
~6 min readContinue: Prove it
The bypass attacker keeps using a revoked or burned identity as if the handle were still active — cached bearers, shadow binaries, CRL lag races. The conversion is sticky authority: survive the revoke announcement. Ambient revocation fails as a campaign across copies; circuit revocation succeeds as a registry state.
Ambient estates rotate passwords and API keys across every workload. Revocation is a campaign; miss one copy and the bypass stays open. Sticky sessions and offline caches make “revoked” eventual rather than immediate. Shadow binaries and cached bearers are the classic bypass trays.
Gate handle resolution requires an active circuit in the registry. Deactivating the handle revokes identity without a fleet-wide secret rotation. Combined with burn-before-validate, spent nonces and revoked handles both fail before application logic. Revoked or burned cannot re-authorize. Pair handle deactivation with burn so neither sticky tokens nor spent nonces return.
Read the dual plates as ambient success versus mechanism denial for revocation bypass: the surface plate shows why classical estates pay; the denial plate shows which ENI6MA check family stops the conversion without dumping an NDA attack-to-stage matrix. Claims below stay model-scoped.
Revoked still authorizes
How to read: revocation lag left; keep-calling ambient win. Takeaway: revoke is eventual; copies linger.
Ambient bypass success is the shadow copy that keeps calling after revoke.
Burned handles cannot return
How to read: revoked-handle myths fail; deactivate + ledger reject return. Takeaway: revoked or burned cannot re-authorize.
One registry state change plus ledger memory close the return path.
Revocation is one state change.ShippingDeactivating a circuit handle in the registry revokes the identity; there is no rotation campaign across every workload.Holds under the reference architecture
Public gate order only — which check family denies this conversion. Not an NDA attack-to-stage matrix.
The gate hashes the body it actually received and compares it to the envelope.
Rejects: A body that was altered after the proof was made.
The envelope names the endpoint and the policy it was made for; both must match this route.
Rejects: A valid proof relayed to a different endpoint.
The handle is resolved against the registry and must be active. Deactivating a handle is how revocation happens.
Rejects: A proof from a revoked identity.
The envelope timestamp must fall inside the freshness window configured for the route.
Rejects: A captured envelope replayed after the window closed.
The nonce is spent here, before the proof is validated. Every submission spends it, including one that is about to fail validation.
Rejects: Any second use of the same envelope. This is where replay dies.
Only now is the proof itself checked, against the local binary or the registry. Both modes are equivalent at the envelope layer.
Rejects: A forged or malformed proof.
Ordinary authorization runs in the post-proof zone: arguments, limits, and business rules.
Rejects: A well-proved request asking for something it is not allowed to ask for.
The application does its work, and the response is bound back to the request that earned it.
One registry flip stops further calls.
Revoke a tool identity without redistributing secrets.
Keep certificates; revoke request authority separately.
This multi-part work positions ENI6MA as a cognitive layer alongside self-sovereign identity primitives (DIDs, verifiable credentials, wallets, and registries). It reviews SSI’s key-centric model and edge cases such as device loss, key compromise, and rotation burden, then motivates “keyless sovereignty” where memory and meaning become the user’s primary credential.
This essay critiques the systemic problems not addressed by contemporary passwordless trends (passkeys, FIDO tokens, and mobile MFA apps). While hardware-bound credentials reduce phishing and stuffing for interactive users, the author argues they bind users to specific devices and vendor escrow or sync services, ceding sovereignty over storage and recovery.
Revocation-one-state-change is a registry/handle claim paired with burn so authority cannot return after deactivate.