HashDome Whitepaper

Authentication on military and critical-infrastructure networks has come to rely almost exclusively on central authorities serving as trusted third parties to issue and validate credentials. While the model works well enough in garrison conditions, it inherits the weaknesses inherent in the trust-based model. A certificate authority, a key-distribution center, or an identity provider is a single entity whose continued availability the entire network depends upon. Authentication cannot proceed when that entity is unreachable, and an adversary who degrades or destroys it disables admission for every node at once. The cost of this dependence is paid precisely when it is least affordable: in the opening phase of a conflict, when the central authority is the first and most valuable target.

The dependence also spreads. To admit a new participant — a coalition partner, a newly deployed platform — its key material must be enrolled with the central authority in advance, a procedure that presumes connectivity, prior coordination, and time. A certain fraction of operational delay is accepted as unavoidable. These costs cannot be avoided entirely in a centralized model, because the authority must be consulted to establish whether any given credential is genuine.

What is needed is an authentication system based on cryptographic and physical proof instead of trust, allowing any two authorized nodes to verify each other directly without a trusted third party, and without a live connection to any central service. Admission that is computationally and economically impractical to forge would protect a network from infiltration, and the record of admissions, once written, would be impractical to alter after the fact. In this paper we propose such a system. Authorization is delegated through sponsors who commit verifiable stake, and admission is gated by a proof-of-work receipt anchored to an external timestamp chain — concretely, the most computationally secured such chain in existence. The system is secure as long as honest sponsors collectively control more staked value than any cooperating group of adversaries, and as long as the underlying chain's honest participants control a majority of its hashing power.

A note on trust. This construction does not eliminate trust; it relocates it. The precise claim is narrower and more defensible: no continuously reachable online authority is required at the moment of admission. Trust is instead placed in the integrity of the external proof-of-work chain, in the honesty of the sponsor set, and in the one-time distribution of root key material before deployment. These are weaker and more durable assumptions than continuous reachability of a central server in a contested environment, but they are assumptions nonetheless.

We define a network admission credential as a chain of signatures. The network is founded by a root authority, which we treat not as a continuously trusted server but as a one-time genesis: a key, or a quorum of keys, whose public component is distributed to every node before deployment. The root signs a set of sponsors. Each sponsor in turn signs the nodes it vouches for. A verifier can follow the signatures back to the root to confirm that a presenting node has been authorized, in the same way that a chain of endorsements can be followed to its origin.

Let a node hold a key pair (sk_N, pk_N) on the curve secp256k1, the curve of the underlying chain. A sponsor S, itself authorized by the root, issues a credential:

where class is the access tier granted, and h_issue and h_expireare block heights of the external chain that bound the credential's validity in time. A verifier accepts C if the signature verifies under the sponsor's public key, if that public key is authorized by the root, and if the current chain height h satisfies h_issue ≤ h < h_expire.

The problem is that a verifier cannot tell from the signature chain alone whether a key has been authorized more times than it should be, or whether a sponsor has been duplicated by an adversary who wishes to vouch for arbitrarily many fraudulent nodes. This is the analogue, in authentication, of the double-spending problem: a signature can be copied at no cost, so the mere possession of a syntactically valid credential proves nothing about its scarcity.

We need a way for a verifier to know that a credential is scarce — that it could not have been manufactured cheaply and at scale — without consulting a trusted party at the time of admission. We accomplish this with two independent and externally anchored costs: a committed stake bound to each sponsor (§3, §4), and a proof-of-work bound to each admission (§5, §6). The first makes authorization expensive to grant fraudulently; the second makes admission expensive to attempt at scale.

The longest signature chain, by itself, establishes only that a credential traces to the root. It does not establish that the sponsor who issued it is scarce. An adversary who obtains one sponsor key may sign an unbounded number of node credentials at no marginal cost. To make authorization costly, we require each sponsor to bind its identity to a quantity of value that is committed on the external chain and that can be verified by anyone.

Let the external chain carry, at each height h, a set of unspent outputs whose values are public. A sponsor S controls a key pk_S associated with one or more such outputs holding total value v_S. We define the sponsor weight as:

where τ_S is the duration for which the value is demonstrably committed and f is monotonically increasing in both arguments. The weight determines the tiers a sponsor may grant and the number of nodes it may vouch for: a node's admitted tier is capped by its sponsor's weight, and authority flows downward and cannot be amplified.

The purpose of binding standing to committed value is to invert the economics of the Sybil attack. In the one-key-one-vote model, authority can be subverted by anyone able to generate many keys, since key generation is free. Sponsorship is instead one-unit-of-stake-one-unit-of-authority. An adversary wishing to obtain sponsor weight W must commit value proportional to W, drawn from the same scarce asset that secures the external chain, and must do so visibly, where every verifier can observe and discount it.

A long-term holder of the underlying asset can post such a commitment at little opportunity cost. This aligns incentives in the system's favor: the parties best able to become sponsors cheaply are precisely those with a durable stake in the asset, who have the least interest in degrading a network whose security rests upon it.

A sponsor proves control of committed value without transferring it. Before stating the construction, we must be precise about what a Bitcoin block header does and does not attest, because this distinction shapes every offline guarantee the system can honestly make.

Stake makes authorization costly to grant; it does not by itself make admission costly to attempt. To impose a per-admission cost we require that each admission carry a proof-of-work using the same hash function and header format as the external chain — but with an independent admission target T_adm, not necessarily equal to the external chain's live mining difficulty. The distinction matters: requiring full Bitcoin block difficulty would be impractical for constrained platforms such as embedded sensors or shipborne terminals. T_adm is a calibrated parameter carried in the cached state (§8), chosen to make admission costly relative to the capabilities of expected adversaries without being prohibitive for legitimate nodes.

The work is performed over an 80-byte structure of the same form as a block header of the external chain:

in which b_prev is the hash of a recent block of the external chain, bits_adm encodes the admission target T_adm, and the field m — occupying the position of the Merkle root — commits to the admission:

The prover varies the nonce until the double hash falls below the admission target:

This is the same scanning problem solved by miners of the external chain, using Bitcoin-format proof-of-work. Anchoring b_prev to a recent block of the external chain ensures the receipt could not have been pre-computed before that block existed. The admission receipt presented by node A to node B is:

Node B admits A if and only if every one of the following holds, each checkable in the time of a small constant number of hash and signature operations:

1. b_prev is a block in B's cached header chain;
2. b_prev lies within the last N blocks of that chain (§6);
3. H(H(β)) < T_adm, with T_adm taken from the cached admission parameters;
4. m = H(pk_A ‖ pk_B ‖ s) for the s that B issued;
5. the credential chain of C_A verifies to the root, and Π_S_A proves w_S_A sufficient for C_A's tier;
6. the credential is unexpired: h_issue ≤ h < h_expire.

If all hold, the session is established. No server is consulted and no central authority is involved; the only shared reference is the cached chain state that both nodes already hold. The work is required only of admission — the establishment of a session — and not of the traffic that follows.

The reference to b_prev does more than seed the work. Because the header committing to the admission contains the hash of a specific block, the receipt cannot have been computed before that block existed. By embedding b_prev in β, an admission inherits this timestamp. The receipt proves that the admission occurred no earlier than the moment b_prev was mined.

We use this to bound freshness and to forbid replay. Let h be the height of the verifier's chain tip and h_prev the height of b_prev. Condition 2 of §5 requires:

A receipt computed against an older block falls outside the window and is rejected. An adversary who intercepts a valid receipt gains nothing by replaying it after the window closes, and within the window the session nonce s in m binds the receipt to a single challenge, so a replay against the same verifier is detected by reuse of s.

The same anchoring gives the admission record an evidentiary property absent from conventional logs. A log entry asserting that a node was admitted at a given time is only as trustworthy as the host that wrote it and can be altered after the fact. An admission receipt referencing block b_prev asserts its timing against a chain whose reordering is computationally infeasible. The timing of every admission is thus pinned to a reference that no participant in the network, and no party outside it, can revise. This immutability concerns the timestamp and the committed trust state; it is independent of the choice of T_adm.

The commitment of stake in §3 deters fraudulent authorization only if a sponsor that authorizes fraud can be made to suffer for it. A signature, once issued, cannot be recalled by the issuer; what the system can do is publish the fact of a sponsor's removal in a manner every node will observe and act upon. We treat revocation as a committed event rather than a message.

When the root determines that a sponsor S has acted in bad faith — by vouching for a node later shown to be hostile, by exceeding its authorized weight, or by losing control of its key — full nodes compute and publish a new trust-state root G_h' that omits S entirely. This updated root is committed on-chain via OP_RETURN (§4). Upon observing it, every verifier rejects not only S but the entire subtree of credentials descended from S:

The system cannot confiscate the sponsor's committed value. What it imposes instead is the forfeiture of everything the stake purchased. The committed value remains locked under its time lock, while the standing it conferred is destroyed and the sponsor's public key is permanently marked on an immutable ledger as revoked. We can state the resulting incentive precisely. Let a sponsor hold committed value v_S and derive a continuing benefit b per unit time from honest participation, and let defection yield a one-time gain g. Honest behavior dominates whenever:

Revocation, like admission, must function while disconnected. A verifier that has cached the trust-state root up to its last sync will reject any credential in a revoked subtree without consulting the chain. Revocation records, once observed by any connected node, are propagated peer-to-peer on a best-effort basis, so that the knowledge that a sponsor has fallen spreads through the network ahead of, and independently of, routine header synchronization.

Honest limitation: a disconnected node cannot act on a revocation it has not yet received. A node that has been isolated since before a revocation was committed will continue to accept credentials from the revoked sponsor until it next synchronizes. This is a known bound on the offline freshness guarantee, stated explicitly in §12.

The defining environment of the system is one in which no central service can be reached and the external chain itself may be unreachable for extended periods. We now state what the system guarantees under such isolation, and on what cached state the guarantee rests.

Each node retains from its last period of connectivity: the block headers of the external chain from genesis to the last synced height h*; the committed trust-state root G_h* and its inclusion proof (the Merkle branch linking the OP_RETURN transaction to M_h*); the sponsor membership paths needed to verify the expected peer set; the set of enrollment and revocation records propagated peer-to-peer; and the admission target T_adm, carried in the cached state so that the cost of admission does not collapse offline. The headers are 80 bytes each; the full history is on the order of tens of megabytes — transmissible over any intermittent channel, including out-of-band ones.

What degrades under isolation is bounded and of a specific character. Three things worsen as time since last sync grows: new enrollments are unknown (nodes not in G_h* cannot be admitted); committed outputs may have been spent since h* (the system cannot detect this offline); and revocations committed after h* have not been received. All three degrade toward stale acceptance — the system may admit nodes that a current full node would reject — never toward unconditional acceptance of nodes outside the cached trust state. The admission target T_adm is carried in cache and does not degrade.

A system whose admission depends on contacting a certificate authority or a revocation responder offers no analogous guarantee: deprived of that contact, it either fails closed, denying all admission, or fails open, admitting without check. The construction here fails to neither extreme, because the evidence it requires was made portable in advance and the cost it imposes is carried in the receipt itself.

The records committed to the external chain accumulate without bound. Every enrollment, every key rotation, every revocation adds to the set a verifier must account for, and a node that has been deployed for years cannot be required to retain each event individually. As with the spent transactions of the original construction, the older records can be discarded once their effect has been absorbed into a compact summary.

The events relevant to authorization form, at any height, a current trust state: the set of authorized sponsors with their weights, and the set of nodes presently admitted under unrevoked credentials. Once an enrollment has been revoked or has expired, the pair of records no longer affects any present admission and need not be retained in full.

This compact summary is precisely the committed trust-state root G_h introduced in §4. A credential's continued validity is shown by a membership path to G_h rather than by replaying the entire history of events that produced it:

The storage required of a node is thereby bounded by the size of the current state, not by the length of the network's history. The audit trail remains available on the external chain for any party that wishes to reconstruct history in full; what is pruned is the local obligation to store it, not the global record itself.

It is possible to verify admissions without retaining the full state of the external chain. A node need keep only the block headers of the longest proof-of-work chain. From the headers alone it can check that the referenced block b_prev is in the longest chain and that the work H(H(β)) < T_adm was performed against the cached admission target.

For the proofs that reference chain state — the trust-state membership and the commitment transaction — the verifier obtains Merkle branches linking the claimed items to roots carried in block headers. A lightweight verifier thus checks two things: first, that the commitment transaction tx_G_h was included in block h (transaction inclusion via M_h), and second, that the sponsor or credential is a member of the committed root G_h extracted from that transaction:

A node wanting stronger assurance — in particular, confirmation that sponsor outputs remain unspent — can run a full node. The lightweight path provides the guarantees headers can give; the full-node path provides the remainder (§12).

The reliability of this method is exactly that of the original: it holds as long as honest nodes control the external chain. A lightweight verifier can be deceived by a fabricated branch only for as long as an attacker can sustain a chain that outpaces the honest majority — the condition whose probability §11 shows to vanish exponentially.

This is what permits the construction to run on the platforms that need it most. The submarine, the unmanned vehicle, the forward terminal cannot carry the full chain state nor reach a server to compensate, but each can carry the headers and verify, against them, that an admission carries real work bound to a real block and that a sponsor proved real stake in the committed trust state — the whole of the security argument, reduced to what a header chain can attest.

We consider three ways an adversary may attempt to defeat the system: by manufacturing identities at scale (the Sybil attack), by forging an admission without performing its work, and by rewriting the external chain so as to falsify the timestamp or committed trust state on which an admission depends.

This document is a protocol sketch. The following limitations are known and stated plainly.

1. Headers do not commit to the unspent-output set.As stated in §4, a Bitcoin block header contains no UTXO root. Verifying that a sponsor's committed outputs remain unspent requires a full node. The offline construction rests on the integrity of validators who computed G_h, and on the assumption that committed outputs have not been spent since the last trust-state update.
2. Admission difficulty is a calibration. T_adm is a system parameter chosen to balance latency and security against an anticipated adversary compute budget. If adversary capabilities are underestimated, or if hardware costs fall faster than T_adm is updated, the admission cost may become insufficient. The calibration is not self-adjusting in the current design.
3. Trust is relocated, not eliminated. The construction depends on the honesty of the root key holders, the validators computing G_h, and the integrity of the external chain. These are weaker assumptions than continuous server reachability in a contested environment, but they are real assumptions.
4. Offline freshness is bounded. A disconnected node accepts credentials from the cached trust state. It cannot detect enrollments, revocations, or spent bonds that occurred after its last sync. The staleness window is open-ended; the system does not currently bound how long a node may safely operate disconnected.
5. Key compromise. A node whose private key is extracted can be impersonated within an isolated partition until revocation is received. The system provides no defense against key compromise beyond the staleness bound above.
6. Privacy and traffic analysis. The transparent construction reveals sponsor identities and stake amounts. Admission receipts may leak session timing and peer relationships to a network observer. The zero-knowledge variant (§4) addresses stake privacy but does not address traffic analysis.
7. Absence of formal proofs. The security arguments in this document are informal. The construction has not been reduced to a formal security model, proven under standard cryptographic assumptions, or subjected to external cryptographic review. It should not be deployed in production without such analysis.

We have sketched a direction for network authentication that does not depend on a continuously reachable central authority. The construction uses the external proof-of-work chain only for what it can attest: transaction inclusion via Merkle branches to block headers, and the ordering and immutability of committed records. It does not claim to derive UTXO-set facts from headers, and it acknowledges explicitly where full-node data is required for stronger guarantees.

Two independent and externally anchored costs address the core problem. A sponsor's stake, committed in scarce value and proven via the committed trust-state root G_h, makes authorization expensive to grant fraudulently. A proof-of-work bound to a recent block, performed using Bitcoin-format hashing against an independently calibrated target T_adm, makes admission expensive to attempt at scale and pins its timing to a record that is computationally impractical to alter.

The construction is designed to remain operational while wholly disconnected. A cached header chain, a cached trust-state root with its inclusion proof, and the admission target are sufficient to verify admissions with no live connection. What degrades offline is bounded and of a known character: stale acceptance within the cached trust state, not unconditional acceptance outside it.

This document is a sketch of a direction, not a finished design. The limitations in §12 are real. The next steps are a formal security model, reduction proofs under standard assumptions, and external cryptographic review before any consideration of deployment.

1. S. Nakamoto, "Bitcoin: A Peer-to-Peer Electronic Cash System," 2008.
2. A. Back, "Hashcash — A Denial of Service Counter-Measure," 2002.
3. C. Dwork, M. Naor, "Pricing via Processing or Combatting Junk Mail," in Advances in Cryptology — CRYPTO '92, LNCS 740, pp. 139–147, 1993.
4. R. C. Merkle, "Protocols for Public Key Cryptosystems," in Proc. 1980 Symposium on Security and Privacy, IEEE, pp. 122–133, 1980.
5. H. Massias, X. S. Avila, J.-J. Quisquater, "Design of a Secure Timestamping Service with Minimal Trust Requirements," in 20th Symposium on Information Theory in the Benelux, 1999.
6. S. Haber, W. S. Stornetta, "How to Time-Stamp a Digital Document," in Journal of Cryptology, vol. 3, no. 2, pp. 99–111, 1991.
7. C. Belcher, "Design for Improving JoinMarket's Resistance to Sybil Attacks Using Fidelity Bonds," 2019.
8. BIP 46: Fidelity bonds for JoinMarket, Bitcoin Improvement Proposals, 2021.
9. J. R. Douceur, "The Sybil Attack," in Peer-to-Peer Systems (IPTPS 2002), LNCS 2429, pp. 251–260, 2002.
10. D. Chaum, "Blind Signatures for Untraceable Payments," in Advances in Cryptology — CRYPTO '82, pp. 199–203, 1983.
11. A. Poelstra, "Curve Trees: Practical and Transparent Zero-Knowledge Accumulators for Unspent Outputs," Delving Bitcoin, 2024.
12. Bitcoin Developer Documentation, "Block chain and Simplified Payment Verification," bitcoin.org/en/developer-guide, accessed 2026.
13. W. Feller, An Introduction to Probability Theory and Its Applications, 1957.
14. National Institute of Standards and Technology, "FIPS 180-4: Secure Hash Standard (SHS)," 2015.