Security · 2026-03-08
Identity is a Physics Problem, Not a Math Problem
By J. W. Bouckaert
The cryptographic ceiling
Post-quantum cryptography (PQC) is a significant advance. NIST's FIPS 204 standardization of ML-DSA (formerly Dilithium) and other lattice-based algorithms gives us signatures and key exchanges that resist known quantum attacks. PasskeyBridge already supports PQC co-signing for verifiable credentials and cross-references.
But PQC solves a math problem: ensuring that quantum computers cannot efficiently factor large primes or compute discrete logarithms. What it cannot solve is the physics problem: proving that a credential is bound to a specific physical device in a specific physical location at a specific moment in time.
This is the gap that NF-08, our Spatially-Bound Identity Attestation specification, addresses.
Limits of mathematics alone
Consider the threat model. An attacker with a quantum computer could break RSA and ECC. PQC defeats that attacker.
But what about an attacker who:
- Clones a private key from a compromised device?
- Replays a valid credential from a different geographic location?
- Simulates the cryptographic ceremony in a virtualized environment?
PQC cannot detect any of these attacks. The math is correct; the physics is wrong.
For a deeper look at how PasskeyBridge handles post-compromise scenarios, see Why SIM-Swap Detection Is Not Enough and our parametric revocation architecture.
The NF-08 Atomic Fingerprint
NF-08 introduces the concept of an Atomic Fingerprint: a composite hash derived from physically non-deterministic sensor readings captured within a strict temporal window (≤100ms).
The fingerprint combines:
- EMI spectral energy: Electromagnetic interference patterns from the device's RF environment
- On-die thermal variance: Micro-fluctuations in CPU/GPU thermal sensors
- Accelerometer noise floor: The baseline vibration signature of the physical device
These readings are fundamentally non-reproducible. No two devices, even identical models, produce the same fingerprint. And the same device produces different fingerprints at different times, in different locations.
The NF-08 flow
When a high-security authentication event occurs, the NF-08 flow proceeds as:
- Trigger: A critical action (e.g., high-value transaction, credential issuance) initiates attestation
- Capture: The device SDK reads EMI, thermal, and accelerometer sensors within a 100ms window
- Hash: Sensor readings are combined and hashed (SHA-256 or SHA-3)
- Sign: The Atomic Fingerprint is co-signed with the user's PQC key and transmitted
- Verify: The server validates the PQC signature and stores the fingerprint hash for future anomaly detection
If the same credential is later used with a fingerprint that deviates significantly from the enrollment baseline, the transaction is flagged for step-up authentication.
The dual-path architecture
NF-08 requires a dual-path implementation:
Backend: Spatial Binding controller
The Spatial Binding Controller enforces the temporal window, validates incoming fingerprints, and maintains the anomaly detection model. It runs as a PasskeyBridge edge function with access to the shield_cross_references table for storing fingerprint hashes.
Client: Native SDK access
Capturing EMI, thermal, and accelerometer data requires privileged access to hardware sensors. On iOS, this means enterprise entitlements. On Android, it requires system-level permissions typically available only to MDM-managed devices.
This is intentional. NF-08 is designed for high-security verticals:
- Military device attestation: Proving a credential is bound to an authorized hardware unit
- Financial terminal binding: Ensuring trading terminals are physically present in verified locations
- Critical infrastructure: Binding operator credentials to specific control room hardware
See also: Reg S-ID Compliance Without Storing a Single Phone Number for regulatory alignment.
Scope of NF-08
NF-08 does not replace passkeys, PQC, or verifiable credentials. It sits alongside them as an additional attestation layer for scenarios where cryptographic proof is necessary but not sufficient.
For most consumer applications, WebAuthn passkeys (Pillar III) provide adequate hardware binding. For enterprise compliance, verifiable credentials (Pillar II) with PQC co-signing satisfy regulatory requirements.
NF-08 is for the edge cases where you need to prove more than "the right key signed this". It proves "the right key signed this, on this device, in this location, at this moment."
Integration with PasskeyBridge
NF-08 integrates with all three pillars:
- Pillar I: SIM-swap and device compromise signals can trigger mandatory NF-08 re-attestation as a playbook action
- Pillar II: Verifiable credentials can include an NF-08 claim, binding the credential to the issuing device's fingerprint
- Pillar III: Passkey authentication ceremonies can require NF-08 attestation for high-risk transactions
For enterprise customers on the dedicated instance tier, NF-08 support is available as a preview integration. Contact us to discuss your use case.
Summary
Identity security is evolving beyond pure cryptography. As quantum threats mature, every vendor will ship PQC. The differentiator will be systems that can prove physical presence, not just mathematical correctness.
NF-08 is PasskeyBridge's answer to that challenge. Identity is a physics problem, not a math problem. And physics problems require physics solutions.
Read the NF-08 specification → | Build your first playbook →