[Cryptography] Cryptographic feasibility of a decentralized trust infrastructure without a master key

[Jens Weber]

Hello,

I am currently developing the concept for a project called *NOX*. It is 
still at an early architectural stage. Before fundamental technical 
decisions are made, I would like to ask people with substantially more 
experience in cryptography and decentralized systems for critical feedback.

I am the initiator of the concept, but I am not a cryptographer. For 
that reason, I am interested not only in how such an architecture could 
be implemented, but first in a more fundamental question: *Is what I am 
envisioning technically and cryptographically realistic at all?*

The basic idea behind NOX is an international trust, identity and 
authorization infrastructure that could connect independent institutions 
without creating a central database containing everyone's sensitive 
information.

The underlying data could remain where it belongs professionally — for 
example, with hospitals, public authorities, universities or other 
responsible institutions. NOX would operate in the background to verify 
identities and institutional identities, enforce authorization, provide 
cryptographic provenance, and maintain tamper-evident and auditable 
histories.

One fundamental requirement of the concept is:

*There must be no universal master key.*

Neither the operator, a government, an administrator, an investor, nor 
even the founder of NOX should possess a key capable of bypassing the 
security and authorization structure of the entire system.

Nevertheless, such an architecture would need to deal with difficult 
situations. Examples include strictly limited access to critical 
information during a medical emergency, lost or compromised keys, 
revocation of institutional credentials, and corrections to records 
without silently rewriting or deleting their original history.

The sensitive records themselves should not simply be placed on a public 
blockchain.

NOX may also contain a *completely separate economic layer*.

A tradable NOX token is being considered as part of the concept. 
Individuals, organizations and investors could acquire, hold and trade 
the token and potentially benefit financially from its economic development.

However, one boundary should be technically and organizationally 
fundamental:

*Money or token ownership must never buy data rights.*

Ownership of NOX tokens must not grant access to personal data, medical 
records, personnel records, identities, institutional credentials, 
permissions, or privileged functions of the protected infrastructure.

An investor should be able to participate economically in NOX and 
potentially benefit from its success without gaining even one additional 
right to the data of an individual or an institution.

Ideally, these layers should be separated strongly enough that token 
holders cannot infer which individuals, hospitals, public authorities or 
companies are using the protected NOX infrastructure. Conversely, 
institutions using NOX should not learn, merely through their 
participation in the infrastructure, who owns or trades NOX tokens.

At the same time, NOX should eventually be capable of financially 
sustaining and maintaining itself.

Depending on the final legal and technical structure, possible revenue 
sources could include professional services and integrations, voluntary 
donations, conventional payment methods, and a limited selection of 
established cryptocurrencies.

The same principle would apply here: *a payment, donation or investment 
may serve an economic purpose, but it must never purchase special data, 
identity, authorization or security rights.*

Another part of the concept is artificial intelligence. AI could operate 
in the background to identify contradictions, unusual events, possible 
manipulation, suspicious access patterns or implausible situations.

However, AI should not become an all-powerful decision-making authority. 
It should not be able to override cryptographic proofs or established 
access rules on its own. In unusual or uncertain cases, its role should 
be to flag, warn or trigger further review rather than simply deleting 
or rejecting something that may in fact be a legitimate exception.

At this early stage, I deliberately do *not* want to prescribe a 
particular blockchain, DLT or cryptographic implementation. I believe it 
makes more sense to first determine what kind of architecture could 
satisfy these requirements — and perhaps which parts should not use a 
blockchain at all.

This leaves me with several fundamental questions:

*Can such a trust and authorization infrastructure actually be designed 
without ultimately introducing a hidden central trust point or universal 
master key somewhere in the architecture?*

*Can a tradable economic token layer be separated strongly enough, 
cryptographically and architecturally, from identity, authorization and 
sensitive data that economic participation can never become a path into 
the protected infrastructure?*

*How could recovery or strictly limited emergency access be implemented 
without unintentionally creating exactly the kind of backdoor the system 
is intended to avoid?*

*And which existing cryptographic approaches, research areas or 
architectures would you recommend investigating first?*

Critical feedback is explicitly welcome. If parts of this concept cannot 
work, rely on incorrect assumptions, or would create fundamental 
security problems, that is precisely what I would like to understand 
before the architecture becomes more firmly defined.

Best regards,
*F. Ronecker*
Concept & Vision: *NOX*

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.metzdowd.com/pipermail/cryptography/attachments/20260930/708fbb25/attachment.htm>