Manu Fontaine

Founder and CEO

Hushmesh Inc.

A Public Benefit Corporation

To whom it may concern:

Recent advances in Trusted and Confidential Computing (2020) have enabled a new approach to

cross-domain cybersecurity, with groundbreaking benefits for secure supply chain automation. This new

approach solves "universal authenticity" for things and people by enabling cryptographic "chains of data

custody" at global scale.

Today's supply chain systems are built on relational databases. Identifiers (for things and people) and

related data are all domain-centric, and all bindings are merely relational. Insiders and attackers (with

sufficiently escalated privileges) can tamper with them with potentially devastating consequences for

any system relying on them. This current state precludes "universal authenticity", i.e., the global

assurance of provenance and integrity.

The new approach contemplates the use of global cryptographic identifiers for all real-world entities.

Called "Stem IDs", these identifiers are 256-bit truly random numbers generated and exclusively

managed within trusted and confidential computing environments. By design, Stem IDs are both

identifiers and cryptographic keys, which inherently solves the entity-key binding.

This elemental construct enables the cryptographic derivation and binding of aliases, keys, encrypted

data, signed software agents, attested hardware and cryptographic routing for any real-world entity. The

new approach in turn enables the automation of end-to-end cryptography between any such entities to

create globally assured "chains of data custody".

Cryptographically-bound aliases can then be expressed as QR codes on individual items of any product in

any supply chain. These cryptographic codes can be resolved with global assurance to their original Stem

IDs and all that is bound to them. This secures all supply chain data in a global, cross-domain fashion that

was simply not possible before. The resulting attack surface is as small as can be, as all bindings are

cryptographic, all data are encrypted, all software is signed, and all hardware is attested.

We propose that NIST consider this approach as a new "Cryptographic Name System" for everything and

everyone. Today's domain-centric approaches to naming and relational databinding inherently preclude

global supply-chain security. Only by closing domain-centric vulnerabilities will we be able to securely

and seamlessly automate global supply chains.

As a Public Benefit startup, we would love to present our work to NIST and anyone else who should see

it. We look forward to hearing from you.

Best Regards,

Manu Fontaine
 

 

 

 

 

 

 

SolvingUniversalAuthenticityforEverythingandEveryone

SolutionOverview- April2022

Theinternethasabigproblem.Tothisday,ithasremainedimpossibleforanytworeal-worldentitiesto

seamlesslytransactorexchangedatawithglobalassuranceofauthenticityandconfidentiality.

Uncertaintyaboutorigin,fidelityandauthorityisaroot-causeofcyberattacksandfraud,afast-growing

trillion-dollarproblem,impactingbillionsofpeople,acrossallindustriesandcommunitiesworldwide.

Everyoneagreesthatubiquitous,end-to-endcryptographyisthesolution.Butcryptographyis

unforgiving,andhumansareunreliable.Today’scryptographicapproachesrelyonpeople’sskills,

attentiontodetails,andgoodbehavior,whichmakesthemfragileandvulnerableasaresult.Removing

humansfromallcryptographicoperationsishenceessentialtoachievingglobalassuranceofdata

provenanceandintegrity.Allkeymanagementandcryptographicprimitivesmustbeautomatedatthe

edgeinawaythatcanberemotelyverifiedandgloballyattested.

Thesolutionistobindeachandeveryreal-worldentity(people,orgs,apps,files,things...)toitsown

uniqueandunclonableCryptographicTwin.EachTwinexclusivelyrepresentsitsreal-worldentityand

actsonitsbehalfincyberspace.CryptographicTwinsrunonTrustees:trustedandconfidential

computingenvironmentsthatenableremoteattestationoftheirintegrity.Trusteesprovideglobal

assuranceofthequalityandconfidentialityofallcryptographicmaterialandprimitivesmanagedbythe

Twins.TrusteesarepoweredbyMicrosoft’sAzureSphereandAzureConfidentialComputing.

EachTwinis“born”fromasecret,trulyrandom256-bitStemID,generatedbyahigh-qualitytrue

randomnumbergenerator,andprotectedatalltimeswithintrustedcomputingsilicon.Thankstoits

truerandomnatureoveranenormousrangeofpossiblevalues,aStemIDissimultaneouslyaTwin’s

definitiveprivateidentifieranditsmain256-bitAESkey.

LeveragingthestrongcryptographicqualityofitsStemID,eachTwincanderiveanunlimitednumber

ofprivateCryptographicCells,andusetheStemIDforexclusiveandsecureaccesstoallitsdaughter

Cells.ACryptographicCellisavirtualunitofencryptedstoragedefinedbyauniqueCellKeyandunique

CellNumber.ATwinderivesCellKeysandCellNumbersfromitsprivateStemIDthroughaseriesof

one-wayhashes,witheachdaughterCellbeingspecifictoadifferentapplicationcontext.EachTwincan

thenencrypttheentity’sdataforthatapplicationwiththecorrespondingCellKey,andstorethe

encrypteddatainanydatastoreatalocationpointedtobythecorrespondingCellNumber.

– Hushmesh Proprietary and Confidential – 1
 

 

 

 

 

 

 

 

 

 

 

ThisuniversalandrecursiveconstructguaranteesthecryptographicbindingofeveryCellandofall

encrypteddataineachCellbacktotheTwin’sStemID.Inturn,thisprovidesglobalassuranceofthe

integrityofeachTwinasanauthenticcryptographicrepresentationofitscorrespondingentity.

TrusteesrunsignedsoftwareAgentswhichenableTwinstotransactwithoneanother.Theexchangeof

keysandestablishmentofconfidentialconnectionscanbefullyautomatedbetweenanytwoTwins,as

allTwinsareremotelyattestedasauthenticandcryptographicallyhealthythroughtheAzureSphere

andConfidentialComputingattestationservices.Thisapproachgivesrisetoacryptographicallydefined

networktopologywecalltheMesh.IntegraltotheMeshareremoteattestation,durabilitymonitoring,

orchestrationservices(suchascryptographicroutingandsecuremessaging),distributedblobstorage,

andauniquedistributedpeer-to-peerbackupservice.

Wenowhavethetantalizingopportunitytobindeveryreal-worldentitytoitsownCryptographicTwin,

witheveryTwinsecurelyaddressablebyanyotherTwin.TheMeshisaglobalcryptographic“switch

board”thatautomatesend-to-endcryptographicsecuritybetweenanytworeal-worldentities,which

solvesseamlessauthenticityandconfidentialityforallad-hocdataexchangesandtransactions.

BenefitsoftheMesh

● Entity-centricautomatedkeymanagement

● Entity-centricdataencryption

● Anonymizedencrypteddatastorage

● Non-replayabledataclaimsbyentities

● Automatedsecurepair-wiseencryption

● Ad-hoc,secureIoTconnections

● Zero-knowledgeproofs

● Entitycryptographicrecords/auditability

– Hushmesh Proprietary and Confidential – 2