[saag] New Internet-Draft: draft-hebbar-hiremani-scswp-01 — Continuous Zero-Trust Authentication Protocol

Dear SAAG Members,

We wish to bring to your attention a new Internet-Draft specifying a
continuous zero-trust security architecture for multi-client collaborative
file workspaces:

  Title:       Secure Collaborative State Workspace Protocol (SCSWP)
  Draft:       draft-hebbar-hiremani-scswp-01
  Datatracker: *https://datatracker.ietf.org/doc/draft-hebbar-hiremani-scswp/
<https://datatracker.ietf.org/doc/draft-hebbar-hiremani-scswp/>*

Authors:
  Sripad Hebbar  <[email protected]>
  Sharan Hiremani <[email protected]>

Security Architecture Summary:

  1. Three-level key hierarchy:
       K1 = HKDF-SHA256(ECDH/P-384 shared secret)         [Session Root]
       K2 = HKDF-SHA256(K1 || workspace || session_id)    [Authorization]
       K3 = HKDF-SHA256(K1||K2, epoch_nonce) -> 96 octets [Active Key]
       K3 is expanded into: auth_key | ctrl_key | payload_key

  2. Continuous trust evaluation: D/N/P/S signals are evaluated on every
     message. HMAC-SHA-256 authenticated context blobs enforce trust scores
     that trigger K3 epoch rotation (REKEY_THRESHOLD) or session suspension
     (SUSPEND_THRESHOLD).

  3. Key-Dissolving Bootstrap: Provisioning tokens are single-use,
     entropy-verified (>=128 bits), and permanently invalidated upon use.

  4. DNAC Session Recovery: Reconnecting clients prove prior authenticated
     state via a SHA-256 hash-chain without retransmitting key material.

  5. AES-256-GCM authenticated encryption on all payload data; HMAC-SHA-256
     on all trust signals using K3.auth_key.

  6. Tamper-evident SHA-256 hash-chained audit ledger covering every
     protocol event.

Reference Implementation:
  GitHub:
https://github.com/sripad2020/Secure-Collaborative-State-Workspace-Protocol
  PyPI:   https://pypi.org/project/scswp/

We believe this work is relevant to SAAG's coordination mandate across
security architecture efforts and welcome any feedback from the community.

Regards,
Sripad Hebbar <[email protected]>
Sharan Hiremani <[email protected]>

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]