Security Model

Muljax ID enforces zero-trust primitives across all authentication, cryptographic signing, and session management boundaries.

Cryptographic Guarantees

Strict Ed25519 for SSH

All SSH public keys and Certificate Authority keys are restricted strictly to Ed25519 (ssh-ed25519 / RFC 8032):

• Immunity to Timing Attacks: Ed25519 operations execute in constant time, eliminating side-channel vulnerabilities inherent in classic RSA and ECDSA implementations.
• Compact Key Sizes: 32-byte public keys and 64-byte signatures keep certificate wire sizes minimal and network transmission fast.
• Legacy Rejection: Legacy RSA (ssh-rsa), DSA (ssh-dss), and NIST curves (ecdsa-sha2-nistp256) are rejected during key validation to prevent algorithmic downgrades.

Token Hashing at Rest

Cleartext tokens and credentials are never stored in the database:

• Session Tokens: Transmitted via HTTP headers or cookies, but persisted in the sessions table exclusively as SHA-256 hashes (token_hash). If the database is read, active sessions cannot be spoofed.
• OAuth Authorization Codes & Refresh Tokens: Persisted as SHA-256 hashes (code_hash, token_hash).
• Client Secrets: Stored as cryptographic hashes (client_secret_hash).
• Passwords: Scrypt/Argon2-derived password hashes with unique random salt values.

WebAuthn Cryptographic Binding

WebAuthn registrations and assertions require cryptographic proof:

• Hardware Signature Verification: WebAuthn assertions must sign a server-generated random cryptographic challenge.
• Origin & RP ID Validation: The Relying Party identifier (rpId) and origin must strictly match the instance domain, preventing phishing attacks.
• Signature Counter Monotonicity: Sign counters returned by authenticators are checked against stored values to detect cloned authenticators.

Isolation Boundaries

1. Cloudflare V8 Isolates: Workers execute in separate V8 isolates with zero shared memory across tenant boundaries.
2. CORS Isolation: All /api/* endpoints validate request origins against explicitly whitelisted dashboard domains.
3. Short-Lived SSH Certificates: User certificates are minted with brief validity windows (typically 24 hours), bounding the exposure window of any client workstation compromise.
4. Instant Revocation via KRL: When an emergency revocation occurs, the serial number is appended to /api/ssh/ca/revoked-keys, and synchronized by hosts via systemd timers.