Why the MoD can trust a startup with this
It is the first objection in every meeting, and it deserves a structural answer rather than a reassuring one. Trust here is a property of the architecture, not a clause in an agreement.
- Security
- security@irythra.com
- Privacy
- privacy@irythra.com
- Disclosure
- Policy · security.txt
Who holds what
We hold no master key
The attribute authority and the identity root are held by the customer. We cannot decrypt customer traffic: not under contract, not under legal compulsion, not under acquisition by a foreign parent.
The customer owns every root
The PKI, the enrolment authority and every key ceremony are the customer's. The algorithms are published standards, and nationally approved algorithms are accommodated where required.
A small hardware surface
Everything but the Sigilcore root of trust is software, so the supply chain to establish is one component, not a radio fleet.
Auditable
Reproducible builds, and full source under escrow and NDA for DRDO and the designated evaluation authority. The architecture is deliberately small enough to be read.
Hybrid, not fashionable
Session keys are secure if either the lattice or the classical primitive holds, because strategic traffic has a secrecy horizon longer than any credible estimate of time-to-CRQC.
Endpoints, honestly
Endpoints are issued COTS, and a compromised endpoint sees plaintext. That risk is managed by device hardening and attestation, not wished away.
How we build
- Dependency-free core. The reference implementation has no third-party dependencies and runs air-gapped.
- Known-answer tested. Primitives are checked against RFC test vectors and against an independent implementation on every change.
- Properties tested, not asserted. Every headline claim on this site has a test that fails if it stops being true.
- Formal verification planned. Tamarin or ProVerif models of the quorum unlock and the hybrid handshake are on the 0–6 month plan.
The path, and where we are on it
| Validated crypto module | Not started Through the national approval route, with an evaluation laboratory. |
|---|---|
| Formal protocol models | Not started Planned for the first phase. |
| Source escrow | On engagement For DRDO and the designated evaluation authority. |
| Accreditation | Not started The work that turns any of this into a fielded system; a kill criterion in our plan. |
Practising what we build
- No cookies, no trackers, no analytics. Nothing on this site follows you.
- No third-party requests. Fonts and scripts are served from irythra.com under a strict content security policy.
- The lab runs locally. Everything you type in the reference lab stays in your browser.
- Briefing requests are minimal. Stored in our private database, never passed to marketing or analytics services. See the privacy notice.
Tell us what we missed
If you find a security issue in this website, the reference lab or the published prototype, write to security@irythra.com. We acknowledge reports, keep you informed, and will not pursue good-faith research that follows our responsible disclosure policy.
Never send classified information to any Irythra address or form.
The binding constraint is a signals regiment willing to run a trial.
Not capital. If you can open that door, or want the architecture note and the runnable prototype to take apart yourself, we would like to hear from you.