Trust that keeps working when everything else goes dark.
Almost every security system depends on a server in the cloud. Ransomware, an outage, jamming or an air-gap takes it down — and authentication dies with it. Cairn spreads trust across the devices themselves: they admit and revoke each other with no central server, offline and post-quantum — and a key can be split across the mesh and recovered from any few survivors.
Results shown here. Technical detail, methodology, and source under NDA.THE IDEA, IN PLAIN TERMS
How it works
Almost every security system today has a single brain — a server in the cloud. Knock it out and everything stops. Cairn spreads trust across the devices themselves, so there is no brain to knock out — and the keys survive even when devices are lost.
Ransomware, an outage, jamming, or an air-gap takes the server down — and every device loses the ability to authenticate or be revoked.
Devices vouch for and revoke each other directly — offline, post-quantum, with no server to take down, censor, or outlast.
No single node holds the key. Lose nodes to attack, capture, or jamming — any quorum of survivors still recovers it, byte-for-byte. Fewer than the threshold learn nothing.
The hard problems — and how Cairn solves them
What breaks today, and what Cairn does instead.
The cloud control plane goes down — ransomware, an outage, jamming, an air-gap.
Serverless: devices admit and revoke each other directly. There’s no central thing to take down — it keeps working offline.
A captured device keeps its access — and you can’t push a “revoke” when the link is jammed.
Revocation by absence: peers simply stop vouching. Nothing to jam, censor, or forge — the device drops automatically.
Lose the device holding the key and it’s gone forever — or capture it and the key is stolen.
Threshold custody: the key is split across the force. Any quorum of survivors recovers it; fewer than the threshold learn nothing.
Tomorrow’s quantum computer breaks today’s encryption — and migration is now mandated.
Post-quantum end to end — aligned with Canada’s 2025 government migration roadmap.
After an incident, you can’t prove who was admitted, when, or on whose authority.
A signed, hash-chained, replayable audit of every decision — tamper-evident down to the exact record.
An eavesdropper records all your traffic and later reconstructs the keys.
Shares cross the wire sealed to each recipient — a listener who captures everything recovers nothing.
One engine, one offer
The application you can pilot today is identity continuity. Everything else on this page is the evidence that the engine underneath it holds up.
Identity continuity — the deployable application
Keep your workforce authenticating, admit a new user, and lock out a compromised device while the identity provider (Okta / Entra / AD, or a government SAML federation) is down — then hand authority back when it returns. A standards-complete OIDC + SAML issuer with proof-of-possession (DPoP), PKCE, admin-auth and a signed audit ledger, so you can also prove to an auditor exactly who was admitted during the outage. Proven against unmodified Keycloak and Grafana, a government-style SAML federation, and a real Kubernetes API server over the public internet. Resilience, not prevention.
Where the engine was hardened
The same admission and revocation engine was validated where the conditions are worst: real NATO Anglova battalion-mobility data, a 520-vehicle VeReMi adversarial dataset, and a software-in-the-loop ArduPilot drone fleet under emulated jamming — with the partition-locality core of the revocation bound machine-checked in Lean 4 at any force size, and a 16-angle red-team returning 0 breaks. At industrial scale it admitted 12,027 LANL hosts in 2.56 s and held ~45k signed decisions against a live third-party ICS in emulation. That is why the identity claim above is credible — it is the same engine, tested past where an enterprise will ever push it.
RUNNING RIGHT NOW
A live issuer you can point a client at
Not a screenshot. A standards-complete OIDC issuer on managed cloud, public TLS, serving discovery and JWKS this second. Fetch it yourself — or federate a real relying party to it.
$ curl https://cairn-idp-987405457802.us-central1.run.app/.well-known/openid-configuration "issuer": "https://cairn-idp-…run.app" "id_token_signing": ["EdDSA", "ES256"] "dpop_signing": ["EdDSA"] # proof-of-possession, RFC 9449 "grant_types": ["authorization_code"] # + PKCE, RFC 7636 "jwks_uri": ".../jwks.json"
A real Kubernetes API server has accepted a token from this issuer over the public internet, with proof-of-possession — and a revoked device was denied on its next request.
WHY WE BUILT IT
The world is getting more disconnected — security hasn’t caught up.
Outages, ransomware, jamming, war, the edge — more and more of the world runs where the cloud can’t reach. Yet our security still assumes a perfect connection to a perfect server. Cairn is built for the moment that assumption breaks: trust that keeps working when everything else goes dark, that no one can quietly take over, and that survives a future quantum computer.
Evaluating Cairn?
A research prototype (TRL ~4–5) — the results above are real. See exactly how they were produced on the Technical Validation page; the design, source, and formal proofs are available under NDA.