Security · CLV1
Can't be emulatedCan't be replayed
Two protection modes, one public protocol, no secret inside the binary
- 01The machine's own signatureEvery request is signed by the device. No impersonation
- 02One answer, one requestCopy a response and replay it, and it's dropped
- 03Change a byte, get caughtThe SDK throws out any edited response
CLV1
One CLV1 round tripOut and back
Four steps, each a signature or a check
- 01 · DeviceSigns the request with its own keyEd25519 · device
- 02 · ServerChecks the signature, the one-time nonce and the timenonce · ±60 s
- 03 · ServerSigns the answer with the app's private keyEd25519 · app
- 04 · SDKTrusts only an answer with the right signatureverify(appPublicKey)
Shield · CLV1
Two modesOne floor, one choice
A floor nobody can switch off, and the methods you pick per app
Standard Protection
always on- The device signs requests, the app signs answers
- Every request works exactly once
- The SDK refuses any stranger's answer
- The binary holds only an app id and a public key
- Known machines survive a reinstall
- A leaked session id is useless elsewhere
- Key guessing limited per IP
- Sign-ins and changes kept in a log
Advanced Protection
switched on per app- Device move rules
- A cap on places running at once
- Short sessions once heartbeats stop
- Offline tokens off for instant revocation
- Hidden marks that trace a leak
- Build hashes checked against signed releases
- Automatic alerts, suspensions, device blocks
- Two-factor or a passkey required for the whole team
- Block by IP, range or device
Common approach
Against the common wayMechanism for mechanism
About mechanisms, aimed at no one
| Question | Common approach | CLV1 |
|---|---|---|
| Where the secret lives | Embedded in the binary, there for anyone who looks | No secret in the binary at all |
| Server answers | Unsigned, or signed with a key everyone has | Ed25519 with a private key per app |
| A fake server | Answers "ok" and the app believes it | Without the private key it cannot sign |
| Replays | An old answer can be copied and reused | One-time nonces, a stale clock is refused |
| A leaked session id | Whoever holds it can ride along | Sessions bound to one machine's key |
| When access is refused | One generic error, no reason kept | Every refusal is logged with its reason |
Found a vulnerability?
Tell us privately before going public