background gif
eni6ma

Attacks · Replay, relay & forgery

Relay

A proof bound to one method, endpoint, body, and policy cannot be retargeted to another route. Server constants deny relay of captured authority.

~6 min readContinue: Request tamper

Opening

What the attacker wants

The relay attacker already has something that looks valid — a proof, envelope, or ceremony fragment minted for one route — and wants to present it against a different endpoint, method, or policy. The conversion is retargeting: keep the expensive proof bytes, swing them at a higher-value call. Classical ambient keys make this trivial because the key grants an estate of paths, not a single request context. Relay is the sibling of replay: same captured authority, different destination, still trying to cash out.

How it works today

In ambient API estates, possession often works on any caller path the key grants. A stolen service token that can hit /poll can often hit /admin if the ACL is coarse. Relaying a captured bearer is free once possession succeeds. Observers and middleboxes that can see a successful call can try the same credential elsewhere while the lifetime window remains open. Coarse ACLs and shared service accounts make retargeting look like normal multi-route usage rather than an attack.

Why it fails against one-shot proofs

ENI6MA envelopes bind method, endpoint_id, request hash, policy hash, freshness, and nonce. The gate recomputes and checks those bindings as server-side constants — not attacker fields. A retargeted proof fails endpoint and policy checks before business logic runs. Valid crypto aimed at the wrong route is still a bind fail. Relay dies because authority was never “a blob that works wherever you paste it.” Binding is the visitor-facing word for “the route is part of the authority object,” not an optional header the attacker gets to edit.

Read the dual plates as ambient success versus mechanism denial for relay: the surface plate shows why classical estates pay; the denial plate shows which ENI6MA check family stops the conversion without dumping an NDA attack-to-stage matrix. Claims below stay model-scoped.

Valid proof · wrong route

How to read: retarget arrow left; same-bearer any-path ambient win. Takeaway: key grants the estate.

Ambient relay is the retarget arrow: same bearer, different route, still allowed.

Relay fails binding

How to read: swap-endpoint myths fail; bind checks gold-reject. Takeaway: server constants, not attacker fields.

Binding makes the route part of the authority object. Wrong route means reject — even if the proof looks pretty.

Scoped claims

Every envelope is bound to a specific method, endpoint, request body, policy, freshness window, and nonce.Shippingsha256(method || endpoint_id || request_body_hash || policy_hash || tau || nonce_uuid)Holds under the reference architecture

Immune to phishing.ValidatedNo reusable credential exists to harvest; endpoint_id binding means a relayed proof fails on any other route.Holds under the reference architecture

Where Gate stops it

Public gate order only — which check family denies this conversion. Not an NDA attack-to-stage matrix.

  1. Recompute the request hash

    The gate hashes the body it actually received and compares it to the envelope.

    Rejects: A body that was altered after the proof was made.

  2. Check endpoint and policy

    The envelope names the endpoint and the policy it was made for; both must match this route.

    Rejects: A valid proof relayed to a different endpoint.

  3. Confirm the circuit is active

    The handle is resolved against the registry and must be active. Deactivating a handle is how revocation happens.

    Rejects: A proof from a revoked identity.

  4. Check freshness

    The envelope timestamp must fall inside the freshness window configured for the route.

    Rejects: A captured envelope replayed after the window closed.

  5. Burn the nonce

    The nonce is spent here, before the proof is validated. Every submission spends it, including one that is about to fail validation.

    Rejects: Any second use of the same envelope. This is where replay dies.

  6. Validate the proof

    Only now is the proof itself checked, against the local binary or the registry. Both modes are equivalent at the envelope layer.

    Rejects: A forged or malformed proof.

  7. Apply application policy

    Ordinary authorization runs in the post-proof zone: arguments, limits, and business rules.

    Rejects: A well-proved request asking for something it is not allowed to ask for.

  8. Serve the request

    The application does its work, and the response is bound back to the request that earned it.

Where it shows up

Watch it fail

Go deeper

  • ENI6MA ALGO1 Proof Variants: Formal Model and Proofs

    This text formalizes the principal ENI6MA proof mechanism, focusing on the ALGO1 family and its challenge/response variants. ALGO1 is modeled not as a SNARK/STARK circuit proof system but as a multi-round identification protocol based on position-wise bucket membership: the verifier accepts when the prover selects, each round, a zone whose witness contains the corresponding secret character.

  • SYSTEM

    This deep dive describes E6-Agent: a security-first communications substrate built around symmetric clone agents, identical binaries configured with peer identities that communicate over encrypted, proof-gated channels. Agents are designed to be operationally Stateless: single-shot messages or continuous oscillation handshakes without retaining sensitive state across invocations.

  • Holographic Entanglement for Keyless Proof

    This paper proposes an “informational entanglement” framing that unifies spatio-temporal entropy and attestation into a keyless authentication primitive. Two compiled twins sharing a sealed private morphism transform fresh session entropy, timestamp, and contextual inputs into a one-time holographic witness (an ephemeral trajectory on a discrete orientation ring).

  • Information-Theoretic Boundaries of the Rosario Primitive: Observable-Channel Isolation

    This paper formalizes information-theoretic boundaries of the Rosario Primitive with emphasis on the observable channel and adversarial inference limits. The central claim is that, in the ideal regime, the observable channel carries zero mutual information about the hidden state beyond a nonce-scoped event-validity residue; in the non-ideal regime, leakage remains small, measurable, and non-accumulative under proper constraints.

Formal note

Envelope request binding treats method, endpoint, body digest, and policy as server constants recomputed at the gate.