Introduction
EdSSA is a zero-trust, post-quantum, stateless M2M authentication
engine. The Community Edition (CE) ships as a single binary,
edssa-server-ce, that sits as a sidecar in front of any HTTP
service and refuses inbound traffic that doesn’t carry a valid
X-EdSSA-Token.
What problem does it solve?
Most service-to-service authentication today is “send a bearer token in a header”. The token is a long-lived shared secret:
- If it leaks (logs, env files, exception traces), it remains valid until rotated.
- It can be replayed indefinitely by any party that observes one valid request.
- It binds no information about the caller’s environment, identity, or per-request claim.
EdSSA replaces “send a secret” with “derive a per-request verifier from shared state”. The token on the wire is a fixed- width, wire-safe byte sequence whose content depends on:
- A long-lived seed shared between client and server.
- A per-request sub-identifier the client claims in the token itself (so the verifier knows which sub-fleet / sub-tenant to consult).
- Chaff slots that contain random bytes the verifier ignores (so observed tokens don’t reveal the secret layout).
The verifier performs an O(N) byte comparison with no heap allocations, no locks, no async calls, and no network hops. On the Phase-0 microbench at N=64 the verify call is ~22 ns — within the budget of even the most aggressive operator-grade deployment.
What’s in the Community Edition?
CE is a strict subset of the Enterprise build (see CE feature subset):
- One fleet per binary.
- Token width pinned at 64 bytes.
- Audit tiers 0–2 (
silent/errors/result). - No multi-fleet routing, no swarm, no payload channel, no Tier-3 response-chain replay defence, no Tier-4 Merkle audit.
Held-back paths refuse to validate at boot rather than running in a degraded mode. Operators who need them upgrade to the Enterprise build.
License
CE ships under the Business Source License 1.1 with Apache-2.0 as the Change License after 4 years per file. Additional Use Grant: “non-commercial OR commercial ≤ $1M ARR”. An explicit non-revocable patent grant covers permitted use.
See ADR-005 (D-5)
for the policy + the executed LICENSE / PATENTS / NOTICE
files at the repo root.
Where to next?
- New to EdSSA? Start with Quickstart.
- Operator standing up CE in production? Read the Operator runbook.
- Wondering what the patent covers? See Patent advisory.