Security
Reference architecture requirements
Absolute mechanism claims on this site assume a deployment that meets the requirements below. Follow this as a specification, not a disclaimer.
Related: Security architecture · Coexistence with PKI
Requirements that earn the guarantees
Durable nonce ledger
Burn operations persist in a durable ledger with a defined freshness window. Ephemeral in-memory stores do not earn the replay guarantee.
TLS in transit
All Gate ↔ Control and client ↔ Gate channels run over TLS. Envelope integrity assumes a confidential, authenticated channel.
Integrity checks enabled
Request-hash recomputation and envelope field checks are enabled on every protected route. Audit-only or hash-disabled modes do not earn absolute claims.
Workload attestation bound
Where origin_evidence is required by policy, workload attestation is bound into the envelope path so a proof cannot migrate to an unattested host.
Registry-managed circuit lifecycle
Activation, deactivation, and revocation flow through Control’s registry. Ad-hoc local trust stores without registry consultation do not earn the revocation claim.
Absolute claims this architecture earns
Each claim below is stated in absolute terms on the public site because the requirements above make the structural reason hold. Deployments that omit a requirement do not inherit that claim.
Replay is impossible by design.ShippingThe nonce is burned before validation in a durable ledger; it is spent even when validation later fails.Holds under the reference architecture
Immune to keylogging.ValidatedNothing typed has lasting value; bearings are one-shot and already burned by the time an observer could reuse them.Holds under the reference architecture
Immune to phishing.ValidatedNo reusable credential exists to harvest; endpoint_id binding means a relayed proof fails on any other route.Holds under the reference architecture
Immune to credential-vault breach.ValidatedNo vault of reusable secrets exists; identity is compiled into the circuit binary, not stored as a transferable credential.Holds under the reference architecture
Authority expires at the end of each request.ShippingThe envelope binds method, endpoint_id, request hash, policy hash, tau, and nonce (one message, one use).Holds under the reference architecture
Revocation is one state change.ShippingDeactivating a circuit handle in the registry revokes the identity; there is no rotation campaign across every workload.Holds under the reference architecture
Every envelope is bound to a specific method, endpoint, request body, policy, freshness window, and nonce.Shippingsha256(method || endpoint_id || request_body_hash || policy_hash || tau || nonce_uuid)Holds under the reference architecture
Burn-before-validate is the structural reason a second submission of the same envelope always fails.ShippingGate stage 5 spends the nonce in the durable ledger before stage 6 validates the proof.Holds under the reference architecture
Deploy against this spec
Start with Gate on a high-risk endpoint, or request the Deployment Security Package for threat-model depth under NDA.