Zeq-SSL — the credential manager
Zeq-SSL is the framework's own approach to credentials, and it throws out the usual machinery. There is no X.509, no ACME, and no asymmetric key exchange. Instead, every machine is its own certificate authority, identity is an equation-hash row, and trust is established by a fast symmetric handshake on the clock.
The handshake
A connection is a 1-RTT HMAC derivation — one round trip, symmetric — keyed by:
Because the Zeqond is part of the key, credentials are synchronised to the clock rather than pinned to long-lived asymmetric keypairs. Issuing a credential is one row; verifying it is a constant-time HMAC check. There's no CA hierarchy to manage and no certificate-signing dance — the machine is the authority.
Manage the lifecycle
Issue
Issue a credential in a single write, stamped with the Zeqond it was issued at.
Rotate
Rotation is simply an entangled-state write — the old credential points to the new one, on the chain.
Revoke
Revocation propagates fast — within a few Zeqonds — over the live chain channel, so a pulled credential stops working almost immediately.
Every credential's state — issued, rotated, revoked, future-dated — lives on the machine's chain, in Zeqonds, so the whole credential history is auditable like any other machine state.
Why symmetric, on the clock
Asymmetric PKI buys you key exchange between strangers at the cost of complexity, revocation lag, and a CA you have to trust. Zeq-SSL takes a different trade: within the framework, machines already share a deterministic identity and a synchronised clock, so a symmetric, Zeqond-keyed HMAC gives you fast handshakes, instant issuance, and near-immediate revocation — with the machine as its own root of trust.
Open it
Read next
- The clock — the Zeqond the handshake is keyed to.
- ZeqID — the equation-hash identity a machine authenticates as.
- Mesh & self-hosting — where credentials secure the fleet.