NTN · 2026-05-08
Identity Federation for Cislunar Operations: Extending Trust Beyond Earth Orbit
By J. W. Bouckaert
A trust architecture that cannot phone home
Every identity system in production today shares one assumption: the verifier can reach the issuer in roughly the time it takes a packet to cross a continent. OAuth 2.0, WebAuthn, OCSP, OpenID Connect—none of them were designed to function when the round-trip to the certificate authority is measured in seconds, the link is occluded by a planetary body for a third of every orbit, and the relying party belongs to one space agency while the credential was issued by another.
NASA's Artemis programme is returning crewed missions to the lunar surface. The Lunar Gateway—a small space station in a near-rectilinear halo orbit around the Moon—is scheduled for initial assembly later this decade as a multi-agency platform involving NASA, ESA, JAXA, and CSA. Commercial lunar logistics providers under the Commercial Lunar Payload Services (CLPS) initiative are already delivering payloads to the surface. Each of these efforts will, within the operational lifetime of the systems being designed today, require humans, robots, and autonomous agents from different organisations to authenticate to one another in cislunar space.
The distance from Earth to the Moon is approximately 384,400 km. At the speed of light, that is a one-way delay of roughly 1.28 seconds. A round-trip authentication ceremony to a terrestrial identity provider therefore costs at least 2.56 seconds of pure propagation, before any compute, before any queueing, before any retransmission. During lunar far-side operations the link to Earth is blocked entirely unless a relay satellite is in view. Faster radios do not solve this. The delay is a constraint of physics, and identity architecture must be designed around it from first principles.
The cislunar operating environment
To understand why terrestrial identity primitives break down here, it helps to be precise about the environment.
| Parameter | Value | Identity implication |
|---|---|---|
| One-way Earth-Moon light delay | ~1.28 s (mean) | Synchronous challenge-response is not viable for interactive flows |
| Round-trip latency (Earth-Moon-Earth) | ~2.56 s minimum | OAuth 2.0 authorization-code flow exceeds typical timeouts |
| Far-side communication blackout | Continuous without relay | Surface assets need autonomy windows of hours, not seconds |
| Direct Earth contact by site class | Near-side: ~continuous (tidal lock); far-side: 0% without relay; south-polar Artemis sites: partial, topography- and libration-dependent | Credential issuance must tolerate predictable disconnection at polar and far-side sites |
| Lunar Gateway orbital period | ~6.5 days (NRHO) | Relay availability varies on a multi-day cadence |
| Multi-agency stakeholders | NASA, ESA, JAXA, CSA, primes, CLPS providers | No single root of trust acceptable to all parties |
The combination is what makes cislunar identity architecturally novel. A LEO satellite at 550 km is, from an authentication latency standpoint, indistinguishable from a 4G handover. A geostationary asset at 35,786 km adds roughly 120 ms one-way (about 240 ms round-trip) and remains workable for cached-proof flows. The Moon is an order of magnitude further than GEO, and the link is not always there.
NASA and its international partners are building the network layer to address this through LunaNet, an interoperable framework of services covering communications, navigation, detection and information. The LunaNet Interoperability Specification defines how providers expose those services to user missions. LunaNet is essential, but it is a network and services framework. It does not, on its own, define how a Japanese rover authenticates a command issued by a European astronaut routed through an American relay belonging to a commercial provider. That gap is the identity layer.
Earth-based roots of trust run out
The dominant trust model on Earth is hierarchical PKI rooted in a small number of certificate authorities, supplemented by federation protocols (SAML, OIDC) that let one identity provider vouch for users to another. Both rely on a verifier being able to reach an authoritative endpoint within an interactive timeout.
Three things break in cislunar operations.
Revocation freshness. OCSP and CRL distribution points are designed to be reachable in milliseconds. On the lunar surface the most recent revocation list a system possesses may be hours old, and during a far-side traverse it may be a full lunar day old. A pure status-list model degrades to "trust the most recent snapshot you cached, and hope". The W3C's Bitstring Status List is well-suited to bulk caching, but the verifier must still decide what to do when the cached list predates the current shift handover.
Cross-agency federation. Earth-based federation assumes that two identity providers can complete a metadata exchange and a token introspection within the same browser session. In cislunar operations the relying party may be a JAXA-built rover and the credential issuer may be the NASA Mission Control Center; the rover cannot block on a token introspection that requires a 2.56-second round trip per call. Bilateral trust must be negotiated in advance and represented locally as cryptographic material the rover already holds.
Single-vendor failure modes. A constellation of commercial relay providers will serve cislunar space within the decade. If any single relay vendor's PKI is compromised, the entire surface fleet's ability to authenticate inbound commands cannot depend on that vendor still being operational. Multi-rooted trust, with explicit policy on quorum and failover, is non-negotiable.
The IETF DTN working group has done foundational work on the transport problem with the Bundle Protocol Version 7 (RFC 9171) and the associated Bundle Protocol Security (RFC 9172) framework. Bundle Protocol Security defines integrity and confidentiality blocks that travel with the bundle and can be verified at any hop. It does not, however, define an identity federation model for crewed multi-agency operations, which is the layer above.
A cislunar identity federation model
The architecture that follows from these constraints has four properties.
1. Surface-issued, surface-verified credentials with Earth reconciliation. A lunar surface trust authority—implemented as a hardened module physically resident at the surface site or on the Lunar Gateway—is delegated authority by Earth-based roots to issue short-lived operational credentials to crew, robots, and autonomous agents working that site. Earth retains the long-lived root identity and the policy that defines what the surface authority is allowed to issue; the surface authority handles every interactive verification locally, then ships an append-only audit log back to Earth on each contact window for reconciliation. The pattern mirrors the event-sourced identity model PasskeyBridge already uses on Earth, where every signal is an immutable event and trust can be rescored retroactively without rewriting history.
2. Delegated trust with explicit lifetimes tied to physical operations. A surface-issued credential is bound to a specific operational window: an EVA, a traverse, a payload deployment. The credential's expiry is set from the planned operation duration plus a margin rather than a fixed clock-time TTL, so a stalled traverse does not silently produce a long-lived high-privilege token. This is the same principle behind DPoP token binding on Earth: short-lived, sender-constrained, replaceable.
3. Cached proofs with PQC-signed freshness. Every relying party in cislunar space holds cached proofs for the agents it expects to interact with, signed by the issuing surface authority and timestamped with ML-DSA-65 (FIPS 204). When a relay window opens, the cache is refreshed; when the link is lost, verification continues against the most recent cached proof. The same pattern is described in detail in our piece on delay-tolerant identity authentication.
4. Multi-agency policy negotiated before launch, executed locally. Bilateral and multilateral trust agreements between agencies—what credentials NASA will accept from ESA, what operational permissions a CLPS provider's autonomous agent has on a NASA-procured surface asset—are encoded as policy documents signed by each party's root and provisioned to surface trust authorities ahead of mission. At runtime the surface authority evaluates policy locally and never asks Earth for a permission decision during an active operation.
Latency and identity flows: A concrete comparison
The shape of the problem becomes clearer when the same authentication intent is plotted across operational regimes.
| Flow | Terrestrial 4G | LEO direct-to-cell | Cislunar (Earth IdP) | Cislunar (surface IdP) |
|---|---|---|---|---|
| OAuth 2.0 auth-code (3 round trips) | ~150 ms | ~120 ms | ~7.7 s | ~150 ms |
| WebAuthn assertion (1 round trip) | ~50 ms | ~40 ms | ~2.6 s | ~50 ms |
| OCSP staple check | ~30 ms | ~30 ms | hours stale at worst | seconds stale at worst |
| Cached-proof verification | ~5 ms local | ~5 ms local | ~5 ms local | ~5 ms local |
| Cross-agency policy decision | ~80 ms | ~80 ms | ~5 s+ | ~10 ms local |
The pattern is unambiguous. Any flow that requires an Earth round trip during an active operation is already broken at lunar distances. Any flow that can be served from a local surface authority is operationally indistinguishable from terrestrial performance.
Comparable architectures worth studying
This is not a green-field design. There are precedents.
The CCSDS Bundle Protocol Specification (CCSDS 734.2-B-1) and CCSDS's broader work on space data systems already define how data is moved across DTN links between agencies. The CCSDS Space Data Link Security (SDLS) Protocol addresses authenticated and confidential link-layer transport. These are the right lower-layer plumbing; the identity federation layer above them is what is missing.
NATO's Federated Mission Networking (FMN) framework is the closest terrestrial analogue for the federation problem. Coalition operations require multi-nation identity federation across networks of varying trust posture, often over satellite backhaul, with locally enforced policy. Cislunar operations inherit the same patterns and amplify the latency constraints by two orders of magnitude.
The W3C Verifiable Credentials Data Model 2.0, and in particular the SD-JWT-VC selective-disclosure profile, gives a credential format suitable for offline verification with optional minimisation of disclosed claims. This is the right credential shape for a cislunar surface authority: issue once, verify many times offline, disclose only the claims the verifier needs.
Decisions the identity industry faces now
A handful of decisions taken in the next two to three years will shape what is operationally available when crewed Artemis surface missions enter sustained cadence.
- Whether commercial identity platforms invest in delay-tolerant verification today. The architecture that serves a cislunar customer in 2030 must be running in production on Earth in 2026, hardened against terrestrial adversaries, before it is asked to operate where mistakes are not recoverable.
- Whether cross-agency policy languages are standardised. Without a common policy expression for who-may-do-what across NASA, ESA, JAXA and the commercial providers, every surface deployment will reinvent its own ACL semantics. This is a job for CCSDS in coordination with the OpenID Foundation and the W3C Credentials Community Group.
- Whether autonomous agents are first-class identity subjects from day one. Surface and orbital robotics will outnumber crewed actors in cislunar space within the lifetime of the first sustained Artemis base. The same agent-to-agent trust negotiation primitives being defined for terrestrial autonomous systems must extend to lunar operations without retrofit.
- Whether the credential lifecycle assumes connectivity by exception. Every token TTL, every revocation propagation budget, every freshness check has to be designed for a world where the link is gone for hours and Earth is the slowest peer in the federation.
PasskeyBridge's working position is that cislunar identity federation is the natural extension of the same architectural commitments the platform already makes on Earth: zero-PII, cached-proof verification, local decisions taken without a round trip to Earth, post-quantum signed freshness, multi-rooted trust, and event-sourced state that can be reconciled across asynchronous links. The constraints of cislunar operations do not require a new identity model. They require the disciplined application of one that was already designed to function when the network does not cooperate.
The Apollo programme proved that humans could reach the Moon. The next phase will be defined by who, and what, can be trusted there.