[Cryptography] Cryptographic feasibility of a decentralized trust infrastructure without a master key

[Jens Weber]

Am 01.10.2026 um 15:50 schrieb Tom Mitchell:
>
>
> On Wed, Sep 30, 2026 at 23:57 Jens Weber via cryptography 
> <cryptography at metzdowd.com> wrote:
>
>     Hello,
>
>     I am currently developing the concept for a project called *NOX*.
>     It is still at an early architectural stage. Before fundamental
>     technical decisions are made, I would like to ask people with
>     substantially more experience in cryptography and decentralized
>     systems for critical feedback.
>
>     I am the initiator of the concept, but I am not a cryptographer.
>     For that reason, I am interested not only in how such an
>     architecture could be implemented, but first in a more fundamental
>     question: *Is what I am envisioning technically and
>     cryptographically realistic at all?*
>
>     The basic idea behind NOX is an international trust, identity and
>     authorization infrastructure that could connect independent
>     institutions without creating a central database containing
>     everyone's sensitive information.
>
>     The underlying data could remain where it belongs professionally —
>     for example, with hospitals, public authorities, universities or
>     other responsible institutions. NOX would operate in the
>     background to verify identities and institutional identities,
>     enforce authorization, provide cryptographic provenance, and
>     maintain tamper-evident and auditable histories.
>
>     One fundamental requirement of the concept is:
>
>     *There must be no universal master key.*
>
>     Neither the operator, a government, an administrator, an investor,
>     nor even the founder of NOX should possess a key capable of
>     bypassing the security and authorization structure of the entire
>     system.
>
> …
>
>     The sensitive records themselves should not simply be placed on a
>     public blockchain.
>
>     NOX may also contain a *completely separate economic layer*.
>
>     ….
>
>     *Money or token ownership must never buy data rights.*
>
>     Ownership of NOX tokens must not grant access to personal data,
>     medical records, personnel records, identities, institutional
>     credentials, permissions, or privileged functions of the protected
>
>
> …
>
>     Another part of the concept is artificial intelligence. AI could
>     operate in the background to identify contradictions, unusual
>     events, possible manipulation, suspicious access patterns
>
>
> A quick read of your outline … it all depends on contract law not 
> technology.
> With multiple international borders any nation could change law and 
> mess with the system parts that depend on law.
>
> AI (even SI ) is not magic and must see essentially the entire system 
> to train the AI.
> There is no data on day one to train the AI.
>
> My first thought is to assume a magical set of cryptographic tools and 
> map all the parts and link each with an annotation MCxx (magical 
> cryptography exchange xx).  Thus map all data flow or links.  
> Emergency digital medical information as outlined seems impossible.  
> Each link has a key that must be durable, https is not durable.
>
> Then look at the structure and identify attack targets and vectors.
> Since it must be financially self supporting, there are payments even 
> tax liability requiring audit visibility.
>
> *“Money or token ownership must never buy data rights.”*
> *How to have money in a system that has no applicability to what money 
> was invented for?
>
> *
>
> Thank you – this is exactly the kind of critical feedback I was 
> looking for.
>
> Your suggestion to first map the complete system and temporarily treat 
> the required cryptographic mechanisms as “magical cryptography 
> exchanges” is particularly useful. I think this could help separate 
> the conceptual requirements from premature decisions about specific 
> technologies.
>
> One clarification regarding money: when I wrote that “money or token 
> ownership must never buy data rights,” I did not mean that money 
> should have no function within NOX. Professional services, 
> integrations or other legitimate services could be paid for. What I 
> want to prevent is the purchase of authorization to somebody else's 
> protected data merely through wealth or token ownership.
>
> The same distinction applies to AI. My intention is not to create one 
> central AI that sees or trains on all personal information in the 
> system. Ideally, AI functions would operate only within narrowly 
> authorized contexts and should not require a global view of all 
> sensitive data.
>
> I am particularly interested in your comment that the emergency 
> medical information model “seems impossible.”
>
> *Is the fundamental problem, in your view, long-term key management 
> and recovery, or do you believe that any emergency-access mechanism 
> will inevitably introduce a master-key-like trust point or backdoor?*
>
> That distinction would be extremely useful for me in deciding whether 
> this part of the concept needs to be redesigned completely.
>
> Thank you for taking the time to look at it.
>
> Best regards,
> F. Ronecker
> Concept & Vision: NOX
>
>
> *
> *
>
>
> _______________________________________________
> The cryptography mailing list
> cryptography at metzdowd.com
> https://www.metzdowd.com/mailman/listinfo/cryptography
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.metzdowd.com/pipermail/cryptography/attachments/20261001/89d59a4d/attachment.htm>