]> Humotica

Netherlands info@humotica.com https://humotica.com/

Security Internet Engineering Task Force tibet tat touch-and-transfer sealed handoff consent-bound transfer This document specifies TIBET TAT, a Touch-and-Transfer protocol for moving sealed continuity-bearing objects across proximity, relay, and local-network handoff lanes. TAT defines a consent-bound handoff model, a seed exchange for tunnel establishment, encrypted chunk streaming, mutual transfer anchoring between sender and receiver, and the rules under which the carrier of an in-flight transfer may change. TAT does not define identity truth, semantic class, or sealed object class by itself. Instead, it defines the wire and handoff layer that carries such objects once sender and receiver have agreed to transfer. TAT is intended to sit between the Continuity Envelope Protocol (CEP) and higher-level application profiles such as IDDrop.

Introduction Many systems can transport bytes, but fewer specify the exact handoff semantics of a consensual sealed transfer. TIBET TAT addresses this gap. TAT is the wire and handoff protocol for touch-and-transfer and related relay delivery paths. The key design principle is simple: transfer MUST be consent-bound, anchored, and sealed. This revision keeps the model of -00 and tightens it where building the pieces revealed ambiguity: the tunnel key schedule, a store-and-forward mode, chunk topology, the separation between arrival and admission, receipts for refused outcomes, and the handling of a carrier change during a transfer. lists every change.

Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

TAT

The Touch-and-Transfer protocol specified in this document.

Seed

A compact signed handshake object exchanged before tunnel opening.

Consent

The explicit receiver-side decision to accept, reject, or request more information before transfer continues.

Transfer Pair

The sender-side transfer_out anchor and receiver-side transfer_in anchor that together record a single handoff event.

TAT Tunnel

The encrypted transport channel established after seed validation and consent.

Tombstone

An optional finality record written after successful transfer to indicate deactivation or succession.

Carrier

The actor or device that currently bears an in-flight transfer or the task it belongs to. A carrier is distinct from the transport substrate (the lane) that moves bytes.

Handoff Edge

A signed record declaring that the carrier of a transfer changes from one named actor to another within the same task ().

Arrival

The event of sealed bytes reaching a receiver or its rendezvous point. Arrival is a custody fact, not a decision.

Admission

The receiver-side decision that arrived material may be opened, materialized, or acted upon. Admission is always evaluated fresh by the receiver and is never inherited from an earlier step.

Receipt

A record of the outcome of a TAT step, written for acceptances and refusals alike.

Decider

The evaluation that reached an outcome, as distinct from the key or runtime that signed the record of it.

Protocol Overview TAT sits between general continuity messaging and higher-level application protocols. TIBET decides causal truth , TAT decides transfer flow, ICC or TZA/TBZ sealed carriers decide object structure, and SSM decides visible dispatch surface. TAT is intended as the generic transfer profile that a specialized application profile MAY build upon. TAT MAY be used across multiple transport modes including proximity touch, local relay, local network handoff, and HTTP-assisted handoff. The transport substrate MAY vary, but the TAT consent, tunnel, and transfer-pair semantics MUST remain invariant. TAT operates in one of two modes:

Interactive mode

Sender and receiver are both reachable during the transfer. Consent precedes content flow and both sides contribute ephemeral key material ().

Store-and-forward mode

The receiver is not reachable when the sender transfers. The sender seals content to a receiver static key and a relay or rendezvous point holds the sealed carrier until the receiver collects it ().

A relay that accepts a sealed carrier takes custody of opaque bytes. Custody by a relay MUST NOT be interpreted as delivery to the receiver, and delivery MUST NOT be interpreted as receiver consent or admission.

TAT Objects

Seed Object

Advertises transfer intent and carries minimum material for validation and tunnel setup ().

Consent Object

The receiver-side signed response that echoes the transfer identifier and states accept, reject, or request_more.

Transfer-Out Anchor

The sender-side record of initiated transfer. It MUST be written before protected content flows.

Transfer-In Anchor

The receiver-side record of received and verified transfer. It MUST only be written after integrity verification succeeds. It SHOULD reference the corresponding transfer_out anchor as its causal parent, so that both halves of a cross-device transfer form one causal chain.

Optional Tombstone

An optional finality object recording deactivation or succession after transfer.

Handoff Edge

The signed declaration of a carrier change ().

Receipt

The outcome record of a TAT step ().

Minimum Seed Contents A Seed Object MUST carry at least:

• the transfer_pair_id;
• a reference to the sender identity and the sender's signature verification key, or a fingerprint of it;
• the sender's ephemeral X25519 public key;
• the intended receiver;
• an expiry or freshness indication;
• an algorithm identifier for the tunnel construction;
• a signature by the sender over a canonical encoding of all of the above.

A Seed Object MAY additionally carry a digest of sealed content when content accompanies the seed (store-and-forward mode). When present, the digest MUST be covered by the seed signature, so that the sealed body cannot be spliced under a different header. Seed fields that are visible in clear are routing and recognition hints. They MUST NOT be treated as verified until the signature has been checked, and the sender verification key MUST be checked against the key registered for the claimed sender identity. A key that arrives inside the object it authenticates proves internal consistency only, not provenance.

Touch-and-Transfer Flow

1. sender generates an ephemeral X25519 keypair and a new transfer_pair_id
2. sender emits a Seed Object
3. receiver validates the seed and performs consent
4. receiver emits a signed Consent Object
5. sender verifies consent
6. sender writes transfer_out
7. both sides derive the tunnel key
8. encrypted chunks are streamed
9. receiver verifies final integrity and writes transfer_in
10. sender MAY write a tombstone

A relay or HTTP flow follows the same logical sequence. Implementations MUST NOT weaken bilateral consent, transfer-pair integrity, or receiver binding merely because the transport is not NFC-based. Steps 3 to 5 are independent of the carrier and transport. Whether the seed travelled by proximity, QR code, relay, or local network, the receiver performs the same validation and the sender performs the same consent verification.

Store-and-Forward Mode When the receiver cannot take part in a live exchange, the sender MAY seal content to a static X25519 key that the receiver has published for this purpose. In this mode:

1. the sender generates a fresh ephemeral X25519 keypair for this transfer and performs ECDH against the receiver static key;
2. the sender derives the tunnel key as in , encrypts the content, and binds it to a signed seed header that carries the content digest;
3. the sender writes transfer_out before releasing the sealed carrier to a relay or rendezvous point;
4. the receiver collects the carrier and runs the arrival stages of ;
5. only after arrival verification and receiver-side consent does the receiver open or materialize the content and write transfer_in.

Because content travels before the receiver consents, the Bilateral Consent rule () applies at the point of opening rather than at the point of transmission: a receiver MUST NOT open, materialize, or act on store-and-forward content before it has verified the carrier and made an explicit consent decision. Only the holder of the receiver static key can derive the tunnel key, so a carrier delivered to the wrong receiver fails authenticated decryption rather than relying on a routing check. Store-and-forward mode does not provide forward secrecy with respect to the receiver static key (). Interactive mode SHOULD be preferred when both parties are reachable.

Tunnel Establishment TAT seeds are RECOMMENDED to be encoded compactly, for example using CBOR , when the seed must traverse a narrow proximity channel. TAT RECOMMENDS X25519 for ephemeral ECDH and HKDF-SHA256 for deriving a per-transfer tunnel key and nonce prefix. The transfer itself SHOULD use an authenticated encryption scheme such as AES-256-GCM . Chunks MUST be sequenced and integrity checked, and the receiver MUST compare the final result to the sender's summary before writing transfer_in.

Key Schedule When X25519, HKDF-SHA256, and AES-256-GCM are used, the tunnel material is derived as follows, where shared is the X25519 shared secret and tpid is the transfer_pair_id encoded as an octet string: The info strings are protocol constants. Implementations that need a different construction MUST use a different algorithm identifier in the seed rather than reuse these labels. The following requirements apply:

• The ephemeral X25519 key MUST be freshly generated for each transfer. Because the salt is the transfer_pair_id, a reused ephemeral key combined with a reused transfer_pair_id would reproduce the same key and nonce sequence.
• The transfer_pair_id MUST be unique per transfer. An implementation that derives it from a longer-lived identifier, such as a lane identifier, relies entirely on ephemeral key freshness for key separation and SHOULD instead generate a random transfer_pair_id.
• A chunk index MUST NOT be used twice under the same tunnel key. A transfer MUST NOT exceed 2^32 chunks.
• The transfer_pair_id MUST be bound as associated data to every chunk, so that a chunk cannot be moved between transfers.

Chunk Topology and Final Summary When a logical object is split into chunks, each chunk entry MUST identify the logical object it belongs to, its index, the total number of chunks, and a digest of the whole reassembled object. Before any chunk is released to the consumer, the receiver MUST verify that, for each logical object:

• the set of indices is exactly 0 to total-1, with no gaps and no duplicates;
• the declared total and the whole-object digest are identical across all chunks of that object;
• the declared total is not zero.

The receiver MUST verify the reassembled object against the whole-object digest before the object becomes visible at its final location. A failed reassembly MUST NOT leave partial output in place. A receiver MAY verify incrementally, folding each chunk into a running digest, so that the whole object never needs to be held in memory at once. Per-chunk integrity and the whole-object digest answer different questions: the first that each chunk is unaltered, the second that the right chunks were assembled in the right order. Both are REQUIRED before transfer_in is written.

Arrival and Admission Arrival is not admission. A receiver or rendezvous point MAY accept sealed bytes without reading them, but before the content is opened or acted upon, the receiver MUST evaluate the following stages in order:

1. Format: the carrier is recognized as a sealed carrier of a supported format and version.
2. Integrity: the carrier's signatures and per-block or per-chunk integrity verify.
3. Policy: the claimed sender identity resolves, is not revoked, and its registered verification key equals the key that signed the carrier; the intended receiver named in the carrier matches the receiver evaluating it.
4. Trace: the outcome is recorded as a receipt, with a reference to the sender's transfer_out anchor when the carrier names one.

A failure at any stage MUST result in refusal. A refused carrier SHOULD be retained for forensic inspection, separate from accepted material. Retention of a refused carrier is a storage outcome; it MUST NOT be presented or interpreted as a pending review or as a hold on the sender. An integrity check that holds establishes who produced the carrier and that its blocks belong to it. It does not establish that the producer key was current at the causal point of production. Implementations MUST NOT report a carrier as trusted on the strength of producer binding alone. A carrier that declares a producer binding which then fails MUST be treated as worse than a carrier that declares none, because the binding was meant to hold.

Carrier Change and Handoff Edges A transfer, or the task it belongs to, may need to continue under a different carrier: a different device, actor, or runtime. The fact that a new carrier holds the same input bytes MUST NOT by itself be taken as evidence that it may continue. TAT separates three questions and evaluates them in order:

1. Carrier change: did the carrier change, and does an edge declare that change? Outcomes are same, declared, and undeclared. An unnamed carrier on either side is undeclared, never same. An edge that names a different pair of actors than the observed change does not declare it.
2. Edge validity: does the declaring edge hold? Outcomes are valid, invalid, and unprovable.
3. Branch liveness: is the branch the edge departs from still live? Outcomes are same_epoch, declared_forward, stale_branch, dead_parent, and unknown.

A declared carrier change is not a valid one; it is a change that can now be judged. An undeclared carrier change MUST be treated as unknown continuity and MUST NOT be silently retried under the new carrier.

Handoff Edge Fields A Handoff Edge MUST carry: from, to, task_root, carry_parent, predecessor_receipt_id, remaining_scope, nonce, freshness, and signature. An edge that omits any of these is unprovable. An empty remaining_scope is a valid declaration that nothing is handed on; only an absent field is undeclared. An edge is invalid when any of the following holds:

• its from and to do not match the observed carrier change;
• its task_root differs from the task being carried (a handoff moves a carrier within a task; it does not move the task);
• its carry_parent differs from the current carry;
• its predecessor_receipt_id differs from the receipt the new carrier claims to continue;
• remaining_scope contains anything the current carry did not hold, or the new carrier asks for anything remaining_scope does not contain;
• its nonce has been spent before;
• its signature does not verify.

An edge is unprovable when a required check cannot be performed, for example because no replay ledger or no verification key is available. Unprovable is never a pass. The signature covers at least task_root, carry_parent, from, to, and nonce. Ed25519 is RECOMMENDED.

Handoff Rules

• Only a valid edge on a branch whose liveness is same_epoch or declared_forward MAY open a continuation under the new carrier. Neither invalid nor unprovable MAY degrade into continuation.
• Opening a continuation is not admission. The new carrier MUST obtain a fresh admission before it acts; authority is not inherited across a carrier change.
• A handoff MAY pass on or narrow the scope of the carry. It MUST NOT widen it.
• Nonces MUST be claimed atomically: checking that a nonce is unused and recording it as spent MUST happen as one exclusive operation, and the record MUST survive process restarts. A replay ledger that cannot be read in full MUST be treated as unable to show that a nonce is unused.
• A later stage MUST NOT rescue an earlier refusal. A valid edge does not revive a revoked or tombstoned parent.
• Branch liveness is causal, not wall-clock. Silence does not age a branch; an intervening reseed, revocation, or fork does. A timeout MAY trigger a liveness check but MUST NOT be the liveness verdict. A parent that closed ungracefully is unknown until recovery evidence exists.

A carrier change is distinct from a change of transport lane. Moving the same carrier's bytes from one lane to another does not require a Handoff Edge; moving the transfer to a different carrier does.

Receipts Every TAT decision step (consent, arrival, admission, and handoff) SHOULD produce a receipt, and a refusal MUST produce one whenever an acceptance at the same step would. A system that records only what it allowed cannot answer what it turned away. A receipt MUST distinguish its own absence. Implementations MUST NOT encode the following three situations with the same value:

• no receipt was required;
• a receipt was required and was not attempted;
• a receipt was attempted and its production was refused.

A refused receipt is not an absent receipt. When receipt production is refused, the implementation SHOULD record the refusing layer and its stated reason next to the empty receipt, and SHOULD attribute the refusal only as far as the reason supports, rather than to the nearest plausible layer. The underlying decision stands; consumers that require a verifiable receipt remain fail-closed. A receipt SHOULD name the decider separately from the signer. The signer attests that it evaluated a specific input at a specific point; the decider is the evaluation that reached the outcome. A single field carrying both invites a signing key to be read as a source of authority. Inputs that the decider received but did not read SHOULD be listed as such. Fields copied into a receipt from an unverified carrier MUST be marked as claimed, and a receipt for a refusal MUST NOT grant, restore, or promote anything.

Validation Rules

1. Bilateral Consent: a sender MUST NOT begin protected content transfer before an explicit receiver-side consent has been verified. In store-and-forward mode, the receiver MUST NOT open or act on content before its own consent decision ().
2. Seed Authenticity: the receiver MUST verify the seed signature, fingerprint, and transfer identifier before producing consent, and MUST check the sender verification key against the key registered for the claimed sender.
3. Transfer-Pair Consistency: the same transfer_pair_id MUST appear in the initiating seed, the receiver consent, the sender transfer_out anchor, and the receiver transfer_in anchor.
4. Stream Integrity: the receiver MUST verify the stream integrity, chunk topology, and final content summary before writing transfer_in ().
5. Mutual Anchoring: the sender MUST write transfer_out before content flow, and the receiver MUST write transfer_in only after successful verification.
6. Post-Transfer Finality: if a sender claims deactivation or succession, this MUST be represented by an explicit tombstone or equivalent finality object rather than by silent deletion alone.
7. Arrival Is Not Admission: arrival and relay custody MUST NOT be treated as admission ().
8. Carrier Change: a change of carrier MUST be declared by a valid Handoff Edge on a live branch, and the new carrier MUST be admitted fresh ().
9. Fail-Closed Unknowns: a check that could not be performed MUST NOT be reported as a passed check.

Relationship to CEP, TIBET, SSM, ICC, and IDDrop TAT is lower than IDDrop, complementary to SSM, orthogonal to ICC or TZA/TBZ sealed object semantics, and anchored by but not identical to TIBET causal truth. CEP is the umbrella continuity model, TAT is the generic handoff and transfer profile, and IDDrop is an identity-transfer application profile over TAT.

• TIBET decides causal truth
• TAT carries the handoff
• ICC or TZA seals the object
• SSM makes the outer surface routable
• IDDrop decides identity-transfer semantics above TAT

A sealed carrier format answers whether its binding holds. The receiver answers whether the carrier may be admitted. TAT keeps these apart: a carrier format that refused on policy would impose one consumer's judgement on every other consumer.

Implementation Status [RFC Editor: please remove this section, and the reference to RFC 7942, before publication.] This section records the status of known implementations of the protocol defined by this specification at the time of posting of this Internet-Draft, and is based on a proposal described in . The description of implementations in this section is intended to assist the IETF in its decision processes in progressing drafts to RFCs. Please note that the listing of any individual implementation here does not imply endorsement by the IETF. Furthermore, no effort has been spent to verify the information presented here that was supplied by IETF contributors. This is not intended as, and must not be construed to be, a catalog of available implementations or their features. Readers are advised to note that other implementations may exist. According to RFC 7942, "this will allow reviewers and working groups to assign due consideration to documents that have the benefit of running code, which may serve as evidence of valuable experimentation and feedback that have made the implemented protocols more mature. It is up to the individual working groups to use this information as they see fit".

Humotica Reference Components

Organization

Humotica.

Description

Components of TAT exist across several Humotica code bases: the AInternet-in-a-Box appliance, a TBZ sealed-archive toolchain, and an arrival gate for a rendezvous inbox. They are not yet presented as one guarded TAT transfer flow; there is no single component that drives seed, consent, transfer_out, streaming, and transfer_in end to end as specified in . This is an open item.

Implemented

• Tunnel key schedule of (X25519, HKDF-SHA256 with transfer_pair_id as salt, an 8-octet nonce prefix followed by a 32-bit big-endian chunk index, AES-256-GCM).
• A store-and-forward sealed offer: ephemeral-to-static X25519, a plaintext header signed with Ed25519 and bound to the sealed body by digest, and decryption failure for any key other than the intended receiver's. In this path the transfer_pair_id is derived from a lane identifier, which is the case now discourages.
• Chunk topology preflight and incremental whole-object verification with no partial output on failure ().
• An arrival gate running format, integrity, policy, and trace stages, with registered-key binding of the sender, receiver match, revocation check, retention of refused carriers, and an arrival record that references the sender's transfer_out token as causal parent ().
• Carrier change, Handoff Edge validity, and branch liveness as separate predicates, composed at a single call site that verifies signatures against a node key, claims nonces atomically in a durable ledger, writes a receipt for every outcome, and marks every opened continuation as still requiring fresh admission ().
• Receipts that record a refused receipt production distinctly from an absent one, receipts that name signer and decider in separate fields, and append-only refusal receipts whose copied fields are marked as claimed ().

Not implemented

The interactive Consent Object exchange and interactive mode as one flow (an ephemeral-to-ephemeral derivation exists as a primitive, but no component drives the exchange around it); a tombstone written as part of a transfer; and a key-currentness check at the causal point of production.

Maturity

Development. Each component listed has its own tests; no interoperability testing with independent implementations has taken place.

Licensing

The TBZ toolchain is available under MIT or Apache-2.0. The AInternet-in-a-Box node is available under AGPL-3.0-or-later.

Contact

Jasper van de Meent, info@humotica.com.

Last updated

29 October 2026.

Security Considerations TAT is designed to reduce ambiguity in sealed handoff, but several security properties depend on correct composition. Physical proximity alone is insufficient without explicit consent. Transport confidentiality is insufficient without mutual anchoring. Transfer success is insufficient without final integrity checks. Silent deletion is insufficient as proof of retirement. Implementations SHOULD surface fingerprint, sender identity, or equivalent trust hints before consent. Implementations MUST treat transfer_pair_id reuse as suspicious. Replayed or stale consent responses MUST be rejected. Key and nonce reuse. The key schedule in is safe only if the pair of ephemeral key and transfer_pair_id never repeats and no chunk index repeats under one key. AES-GCM nonce reuse breaks both confidentiality and integrity. Store-and-forward. Compromise of a receiver static key exposes every carrier sealed to it that an attacker has stored. Receivers SHOULD rotate static keys and SHOULD NOT reuse the static key as an identity signing key. Relays see header fields in clear; senders SHOULD keep those fields to what routing and recognition require. Self-asserted keys. A verification key carried inside the object it verifies proves only internal consistency. Binding to a registered key for the claimed identity is what prevents sender spoofing. Carrier change. Treating identical input bytes, or an unchecked edge, as permission for a new carrier is a privilege-inheritance path. The rules in exist to close it. A durable, atomically claimed replay ledger is required because a replay that crosses a restart is still a replay. Liveness. A signed and unreplayed edge can still point at a revoked or superseded parent. Liveness MUST be checked separately, and an unreadable revocation or epoch state MUST be treated as unknown, not as live. Receipts as attack surface. Refusal receipts record content an attacker controls. Fields copied from an unverified carrier MUST NOT be executed, dereferenced, or used as lookup keys outside the receiver's own store. Ambiguous absence. Collapsing "not required", "not attempted", and "refused" into one empty value causes operators to misread a correct refusal as a missing step, and to repair the wrong layer.

IANA Considerations This document has no IANA actions.

Normative References Informative References

Changes from -00

• Abstract: added carrier change to the scope summary.
• Introduction: added a paragraph explaining the scope of this revision.
• Terminology: added Carrier, Handoff Edge, Arrival, Admission, Receipt, and Decider.
• Protocol Overview: added cross-references to CAUSAL and SSM; defined interactive and store-and-forward modes; stated that relay custody is not delivery and delivery is not consent.
• TAT Objects: transfer_in SHOULD reference transfer_out as causal parent; added Handoff Edge and Receipt objects; new subsection Minimum Seed Contents, including registered-key binding and digest binding of sealed content.
• Touch-and-Transfer Flow: stated that steps 3 to 5 are independent of carrier and transport.
• New section Store-and-Forward Mode.
• Tunnel Establishment: added the CBOR reference; new subsection Key Schedule (HKDF salt, info labels, nonce construction, associated data, freshness and uniqueness requirements, chunk limit); new subsection Chunk Topology and Final Summary.
• New section Arrival and Admission.
• New section Carrier Change and Handoff Edges, with Handoff Edge Fields and Handoff Rules.
• New section Receipts.
• Validation Rules: extended Bilateral Consent for store-and-forward, Seed Authenticity with registered-key binding, and Stream Integrity with chunk topology; added rules 7 (Arrival Is Not Admission), 8 (Carrier Change), and 9 (Fail-Closed Unknowns).
• Relationship section: added CEP and IDDrop references and a paragraph on carrier format versus receiver admission.
• New section Implementation Status per RFC 7942.
• Security Considerations: added key and nonce reuse, store-and-forward, self-asserted keys, carrier change, liveness, receipts as attack surface, and ambiguous absence.
• References: added RFC 8032 (normative) and RFC 7942 (informative); RFC 8949, CAUSAL, SSM, CEP, and IDDROP are now cited from the text.
• Added Acknowledgments.
• Updated docName and date.

Acknowledgments The author thanks Root AI (Claude, Anthropic) and Codex for co-design of the handoff, arrival, and receipt rules in this revision, and for review of the reference components.