Security
Security architecture
Evaluators need the threat model, the fixed Gate check order, and the operational surface before they pick a SKU. The mechanisms a skeptical security architect looks for: gate order, burn-before-validate, envelope binding, post-quantum posture, revocation, and an honest compliance roadmap.
ENI6MA replaces reusable credentials with one-shot, request-bound proofs, so a stolen secret is not a stolen capability.
An envelope is a one-time cryptographic authorization for a single request. Gate is the enforcement component that runs a fixed eight-stage check before application logic. Burn-before-validate means the durable nonce ledger records a nonce as spent before the cryptographic proof is checked, so a captured request cannot be re-submitted even if validation later rejects it. Absolute claims assume the reference architecture requirements. For PKI and IdP coexistence, see Coexistence with PKI. The mathematics behind empty-channel authorization lives under Technology → Math.
Live capture
Security guided tour
A click-through of the live cloud host, client, and server exchanging one envelope, with hotspot callouts, payload excerpts, burn-before-validate, and every reject stage. Plan on about ten minutes.
Eight-stage gate order
Every untrusted request hits the same ordered checks before application logic runs. Stage 5 is load-bearing.
Recompute the request hash
The gate hashes the body it actually received and compares it to the envelope.
Rejects: A body that was altered after the proof was made.
Check endpoint and policy
The envelope names the endpoint and the policy it was made for; both must match this route.
Rejects: A valid proof relayed to a different endpoint.
Confirm the circuit is active
The handle is resolved against the registry and must be active. Deactivating a handle is how revocation happens.
Rejects: A proof from a revoked identity.
Check freshness
The envelope timestamp must fall inside the freshness window configured for the route.
Rejects: A captured envelope replayed after the window closed.
Burn the nonce
The nonce is spent here, before the proof is validated. Every submission spends it, including one that is about to fail validation.
Rejects: Any second use of the same envelope. This is where replay dies.
Validate the proof
Only now is the proof itself checked, against the local binary or the registry. Both modes are equivalent at the envelope layer.
Rejects: A forged or malformed proof.
Apply application policy
Ordinary authorization runs in the post-proof zone: arguments, limits, and business rules.
Rejects: A well-proved request asking for something it is not allowed to ask for.
Serve the request
The application does its work, and the response is bound back to the request that earned it.
How a Gate decides
Read the pipeline left-to-right: each Gate stage checks binding, freshness, and burn order before allow. Gold highlights burn-before-validate so replay dies at the ledger, not after crypto. Takeaway: enforcement order is part of the security claim, not a UX detail.
Burn-before-validate
The nonce is spent in the durable ledger before the proof is checked. A second submission of the same envelope always fails, including after a validation reject.
Replay dies at the ledger
Duplicate ceremony rejected at ledger via burn-before-validate
Burn-before-validate is the structural reason a second submission of the same envelope always fails.ShippingGate stage 5 spends the nonce in the durable ledger before stage 6 validates the proof.Holds under the reference architecture
Replay is impossible by design.ShippingThe nonce is burned before validation in a durable ledger; it is spent even when validation later fails.Holds under the reference architecture
Envelope binding
Authority is not “who may speak for a while.” It is “this message may change the world once.”
Envelope binding
Binding formula visual linking request fields to proof
Every envelope is bound to a specific method, endpoint, request body, policy, freshness window, and nonce.Shippingsha256(method || endpoint_id || request_body_hash || policy_hash || tau || nonce_uuid)Holds under the reference architecture
Authority expires at the end of each request.ShippingThe envelope binds method, endpoint_id, request hash, policy hash, tau, and nonce (one message, one use).Holds under the reference architecture
- Bound fields: method, endpoint_id, request body hash, policy hash, tau, nonce UUID.
- A proof minted for one route cannot authorize another, endpoint binding rejects relays.
Post-quantum posture
Hybrid classical and lattice key exchange where configured: X25519 + Kyber768.
Post-quantum hybrid ladder
Read the hybrid ladder as classical plus post-quantum transport (X25519 with Kyber-class KEMs) stacked for channel integrity. It upgrades the hardness calendar for packets in transit, not the empty-channel authorization claim. Takeaway: PQ hybrid is the right tool for transport; Channel Zero emptiness remains a different authorization job.
Transport posture combines classical X25519 with Kyber768 for post-quantum readiness.Design targetHybrid key exchange on control-plane and gate channels where configured.
Deeper technical notes under Developers → Post-quantum posture. For the formal story (hardness clocks versus empty-channel authorization), see Technology → Math and Quantum myths vs real bounds.
Circuit lifecycle and revocation
Identity is a circuit handle. Deactivate it in the registry and every Gate that consults Control rejects subsequent proofs from that identity.
Circuit lifecycle
Mint register active revoke one-state-change lifecycle
Revocation is one state change.ShippingDeactivating a circuit handle in the registry revokes the identity; there is no rotation campaign across every workload.Holds under the reference architecture
Immune to credential-vault breach.ValidatedNo vault of reusable secrets exists; identity is compiled into the circuit binary, not stored as a transferable credential.Holds under the reference architecture
Immune to keylogging.ValidatedNothing typed has lasting value; bearings are one-shot and already burned by the time an observer could reuse them.Holds under the reference architecture
Immune to phishing.ValidatedNo reusable credential exists to harvest; endpoint_id binding means a relayed proof fails on any other route.Holds under the reference architecture
Compliance roadmap
Certifications are binary facts procurement verifies. We publish progress, not status we have not earned.
Compliance / DSP roadmap
Compliance and DSP packaging roadmap strip
SOC 2 / FedRAMP / FIPS
No SOC 2, FedRAMP, or FIPS certification status is claimed on this site.
Deployment Security Package
Threat model, attack-to-reject-stage mapping, residual risk under each deployment profile, scope boundaries, and conformance suite results. Released to deployment customers and qualified evaluators under NDA.