On August 28, 2026, Google, Microsoft, Anthropic, OpenAI, and 100 other companies signed an open letter warning of a large-scale AI attack. AI has created systemic risks in the digital world, but the physical world has no defense mechanism. This paper defines the Physical Ledger—a physical world namespace rooted in the Cui coordinate. The Physical Ledger DNS is not a copy of the domain name system; it is an object-addressing protocol for the physical world: every object (shelf position, robot, door, vehicle, starship) is assigned a unique Cui coordinate address. This paper presents a draft protocol for the Physical Ledger DNS, a catalog of 108 problems, the genesis valuation of $100,000,000, and a reward distribution scheme. It proposes the §13 security mechanism (Proof-of-Problem): a distributed firewall for the Physical Ledger DNS, powered by the 108 problems. The more solvers participate, the thicker the firewall. AI can attack digital protocols, but it cannot solve problems—because solving requires understanding the coordinate origin itself. The genesis valuation of the Cui-attribute Shell is defined as US$100,000,000, anchored at 2026-08-27. The appendix includes the Cui-coordinate naming rights and the passphrase lock (recognition of 1/7/8 for entry).
Today, biometric authentication has become a central component of user security in social governance systems, where each government department demands access to user-specific data that varies across agencies. However, storing such data in centralized repositories increases serious privacy concerns, as unrestricted access by multiple entities maximizes the risk of data leakage. To address this, our research presents a novel biometric authentication system integrating robust privacy-preserving techniques, built on advanced deep learning architectures and differential privacy algorithms. A blockchain ledger integrated with a Merkle tree is used to securely store user identities, providing tamper-evident cryptographic validation of registered users. We further develop a novel hybrid model by integrating a pre-trained Vision Transformer (ViT) with a differential privacy-based machine learning enhanced training strategy, wherein the model is trained on noise-induced images to resist inference attacks. The system without differential privacy achieves 90.80% accuracy, 0.94 precision, 0.91 recall, and an F1-score of 0.90 in the standard configuration, while the differentially private model maintains 68.97% accuracy with ε = 6.2, ensuring a strong privacy—accuracy balance. The evaluation confirms that our proposed model, incorporating differential privacy, provides a secure and scalable solution for managing sensitive citizen data while achieving reliable performance in privacy-aware biometric verification for real-world e-governance applications.
In the last few years, the Internet of Things (IoT) has grown significantly due to technological advancements. However, until recently, there has been no universal set of rules applicable to IoT security. This has opened an area for researchers. The IoT environment enables various smart devices to connect and exchange information; thus, ensuring the authenticity of devices in the IoT network is crucial. We have classified the diverse methods used to authenticate IoT devices to access the data they generate. This study conducted a systematic literature review to identify research gaps, recurring patterns, and potential future directions in IoT authentication, with particular attention to the architectures employed. This review analyzed different authentication techniques and presented their advantages and disadvantages using several criteria for categorization. This survey provides researchers and practitioners with a consolidated understanding of the current state of authentication mechanisms in the IoT. Furthermore, the survey examines emerging authentication paradigms, including blockchain-enabled authentication frameworks, machine-learning-augmented authentication models, and lightweight authentication schemes tailored for resource-constrained IoT devices. The goal of this survey is to aid in creating more robust and secure authentication solutions for the developing IoT by highlighting strengths, limitations, and emerging trends.
User Authentication and Security Systems
Advanced Authentication Protocols Security
Physical Unclonable Functions (PUFs) and Hardware Security
Madi Gali, Aray Kassenkhan, Y. Chinibayev, A. M. Abshukirova · 5 authors
Static, one-time authentication mechanisms such as passwords and PINs are increasingly inadequate for protecting mobile devices throughout an active session. Behavioral biometric continuous authentication (BBCA) addresses this gap by passively monitoring user-specific interaction patterns—keystroke dynamics, touch and swipe gestures, gait, and motion—to verify identity on an ongoing basis. This systematic review synthesizes 80 studies selected via a PRISMA-compliant protocol from IEEE Xplore, ACM Digital Library, Scopus, ScienceDirect, Web of Science, and SpringerLink (2017–2025). We examine behavioral and multimodal biometric modalities, machine learning approaches ranging from classical classifiers to deep sequence and transformer architectures, and their integration with intelligent personal agents, wearable devices, and IoT/edge infrastructures. Security analyses cover spoofing, adversarial and generative attacks, mimicry, and model-level threats including membership inference and reconstruction. Privacy-preserving mechanisms—cancelable biometrics, Bloom filter encodings, zero-knowledge proof protocols, federated learning, and blockchain-based identity management—are evaluated against practical trade-offs in energy consumption and latency on resource-constrained devices. Key research gaps are identified: the absence of standardized adversarial benchmarks, lack of end-to-end pipeline evaluations under simultaneous adversarial and privacy threat models, and limited user-centered studies on consent and acceptance of privacy-preserving mechanisms under frameworks such as GDPR. Recommended future directions combine adaptive multimodal fusion, privacy-preserving cryptography, energy-aware modality selection, and interdisciplinary human-centered evaluation to advance practical, resilient continuous authentication for mobile and assistant-enriched environments.
The rapid proliferation of Internet of Things (IoT) devices across smart homes, healthcare systems, and industrial environments has intensified the need for robust and adaptive security mechanisms in multi-user settings. Traditional password management approaches remain widely deployed; however, they suffer from persistent vulnerabilities including weak password selection, credential reuse across services, and the absence of structured lifecycle management mechanisms. This paper presents a systematic review of existing authentication, password management, and key lifecycle strategies applicable to multi-user IoT ecosystems. The study follows a structured review methodology to analyze and synthesize contemporary research contributions in the areas of context-aware authentication, secure key rotation, password expiry mechanisms, and lightweight cryptographic implementations. A comparative evaluation of diverse security techniques—such as one-time passwords (OTPs), zero-knowledge proofs (ZKP), symmetric and public-key cryptographic schemes, and machine learning-based threat detection models—is conducted with particular attention to device resource constraints, scalability challenges, and operational efficiency. Conceptual models, analytical tables, and comparative charts are utilized to highlight trade-offs between security strength, computational overhead, and system performance. The review identifies significant research gaps in integrating dynamic key rotation and expiry mechanisms into holistic, context-aware security architectures tailored for multi-user IoT environments. Finally, the paper outlines future research directions aimed at developing scalable, resource-efficient, and adaptive password lifecycle management frameworks for next-generation IoT systems. management frameworks for next-generation IoT systems.
Self-sovereign identity (SSI) represents a paradigm shift in digital authentication, transferring control from centralized identity providers to individual users (Mühle et al., 2018). This paper presents the Kathon Vault identity system, which implements self-sovereign browser identity through BIP39 mnemonic seed phrases (Palatinus et al., 2013) for Ed25519 hierarchical deterministic (HD) key generation (Bernstein et al., 2012; Wuille, 2012). The system generates a master seed from a BIP39 mnemonic (12, 18, or 24 words with configurable passphrase), derives Ed25519 keypairs through the SLIP-10 key derivation scheme (Přikryl, 2022), and enables zero-knowledge authentication across websites through a novel browser-native WebAuthn-hybrid protocol. We demonstrate that the BIP39-derived Ed25519 keys provide equivalent security to standard FIDO2/WebAuthn authenticators (316 bits of entropy for 24-word phrases) while offering three critical advantages: (1) deterministic key recovery from the mnemonic phrase alone, (2) hierarchical key organization matching the SLIP-44 registered coin type for Kathon, and (3) cryptographic privacy through zero-knowledge proofs that enable selective attribute disclosure without revealing the master public key. In a security analysis against brute-force, dictionary, side-channel, and social engineering attacks, the system achieves resistance levels exceeding NIST SP 800-63B Level 4 authentication assurance requirements (NIST, 2020). A usability study with 48 participants demonstrates that BIP39-based authentication achieves 96% successful login rates with 14% lower task completion time compared to password manager-based workflows. This work establishes mnemonic-based HD key generation as a viable and superior alternative to federated identity providers for browser-based authentication. --- Part of The Anticloud research corpus by Lois-Kleinner Alpasan (ORCID: 0009-0009-2233-6107). This work explores browser engine, privacy in the context of sovereign AI infrastructure, post-cloud computing architectures, and transparent, blackbox-free systems.
Sancaktar Pelin, Necla Kırcalı Gürsoy, Arif Gürsoy
Modern authentication architectures contain structural vulnerabilities against automated credential stuffing and server-side data breaches. Traditional solutions rely on the transmission of raw or hashed passwords over the network; for bot defense, they position third-party Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA) services, which may violate user privacy and create institutional dependencies, as an illusion of two-factor authentication (2FA). This situation raises a critical research question in cybersecurity: How can an integrated cryptographic shield be constructed that is independent of user-privacy-invasive mechanisms and external data authorities, while preventing autonomous bots from targeting the identity and human-verification layers separately?In response to this question, this paper presents a zero-dependency, original, and hybrid protocol that integrates a Zero-Knowledge Proof (ZKP) based on the Schnorr authentication scheme with a local Human Interaction Proof (HIP) mechanism. The main advantage of the proposed architecture is that it mathematically seals the user’s secret credential together with a dynamically generated one-time CAPTCHA token on the client side using the SHA-256 function, thereby transforming the verification process into an indivisible atomic “Hybrid Secret.” In this way, the transmission of password hashes over the network is completely eliminated, and the server evaluates only the mathematical validity of the proof under the Discrete Logarithm Problem (DLP) assumption.Experimental results obtained through Selenium-based automated brute-force attack simulation engines demonstrate that the system provides complete blocking against automated threat vectors. Dynamic one-time nonce mutation immediately invalidates the derived client response, even in extreme scenarios where an attacking bot obtains the correct password string and solves the CAPTCHA image, thereby mathematically defeating brute-force and replay attacks. Furthermore, the autonomous structure of the proposed protocol, with no dependency on third-party analytics services, opens the way for a highly secure and local authentication architecture for internet-isolated critical infrastructures.In this study, the theoretical and mathematical foundations of the proposed protocol are presented, the stages constituting its life cycle are methodologically explained, and Selenium-based experimental simulation results together with telemetry log analyses are detailed.
PrismEco is the showcase demonstration of the Prism Ecosystem. Where the other component demos each illustrate one capability in isolation, PrismEco shows the complete authentication triangle in a single flow: biometric authentication via WebAuthn, a Zero-Knowledge Proof generated in the browser, and NFC presence verification via a physical tag. This technical note follows a single user through the complete login flow on prismeco.globalsecurity.nu. At each step, it documents what the server receives and what it does not receive. The goal is to make visible what is structurally invisible by design: that a working authentication system can process a login without ever knowing who the user is. The three factors are verified independently and must all succeed for the session to open. No single factor is sufficient on its own. The combination is structurally resistant to remote attacks: an attacker would need to compromise biometrics, the device, and physical proximity simultaneously. The complete authentication triangle has been proven in a working PoC as of 12 June 2026. WebAuthn registration and login, ZKP generation and server-side verification (proven 10 June 2026), and NFC tap confirmation with RELAY_TOKEN verification (proven 12 June 2026) all function as an integrated flow on live infrastructure at prismeco.globalsecurity.nu. Screenshots in this document are taken from the live running demonstration. All claims are classified by status: proven in PoC, follows from open standard, or architectural design choice. Part of the Prism Ecosystem. Full technical architecture: The Prism Protocol, Invention Disclosure v20, DOI: 10.5281/zenodo.20029291.
The Metaverse represents a paradigm shift from two-dimensional internet interaction to immersive, persistent, three-dimensional environments. As this ecosystem evolves, the attack surface expands exponentially, introducing novel vulnerabilities that traditional HTTPS and TLS protocols cannot adequately address. This chapter explores the future of secure communication within the Metaverse, moving beyond standard data encryption to address the protection of biometric data, haptic feedback integrity, and avatar identity. We will analyze the unique challenges posed by the convergence of Virtual Reality (VR), Augmented Reality (AR), and the Internet of Things (IoT). The chapter will propose a multi-layered security framework integrating Quantum-Resistant Cryptography, Zero-Knowledge Proofs (ZKPs) for identity verification without exposure, and AI-driven behavioral analysis to detect “Man-in-the-Avatar” attacks. Finally, we will discuss the regulatory and ethical implications of surveillance in a world where user movements and gaze are constantly tracked.
The proliferation of centralized carrier-based authentication systems has exposed critical vulnerabilities in the preservation of privacy and personal data protection. Current implementations in Korea, such as PASS and KakaoTalk identity services, rely on centralized architectures that create single points of failure and require excessive disclosure of personal information. The large-scale security breach of SK Telecom's USIM infrastructure in 2025, affecting 23 million subscribers, highlights the urgent need for a paradigm shift in identity authentication.?This paper proposes a decentralized identity authentication system leveraging W3C Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs), combined with Zero-Knowledge Proofs (ZKPs). Our framework integrates Schnorr signatures with Sigma-protocol-based ZKPs to enable privacy-preserving authentication without revealing private keys. A three-layer architecture—comprising cryptographic, identity, and credential layers—ensures strong cryptographic guarantees based on the discrete logarithm problem over the secp256k1 curve, while eliminating reliance on centralized infrastructure. Performance evaluation shows that signature generation occurs in under 10 ms and verification in under 15 ms, meeting real-time authentication requirements while delivering formal privacy guarantees that are absent in conventional systems.
The Internet is undergoing constant transformation, driven by emerging paradigms such as Web3 and Artificial Intelligence. Despite these developments, the secure operation of Internet services remains a fundamental prerequisite for ensuring confidentiality, integrity, and availability.
Bara’a O. Ghananim, Omar A. Alzubi, Wafa’ Za’Al Alma’Aitah, Hussam N. Fakhouri · 6 authors
Healthcare information systems increasingly rely on networked access to electronic health records and clinical services, making authentication latency and usability as critical as cryptographic strength. This paper presents a lightweight hybrid authentication framework that combines Schnorr identification with a Fiat-Shamir-derived non-interactive zero-knowledge proof (NIZKP), integrates a conventional second factor (OTP and/or biometric), and enforces role-based access control (RBAC). The design eliminates transmission of reusable password secrets during routine logins, keeps proof material constant-size, and targets fast verification suitable for high-throughput hospital gateways. We implement the pipeline and evaluate it under three simulated clinical traffic patterns aligned with eICU-inspired workload modeling: low traffic (50 users), high traffic (500 users), and burst peak load (100 users). Across scenarios, the end-to-end authentication time remains stable between 0.0107 s and 0.0109 s and stays below a 0.02 s benchmark. Reliability remains high, with success rates of 100.0%, 99.8%, and 99.0%; observed failures stem from injected OTP-expiry or biometric-mismatch events rather than cryptographic verification errors. These results suggest that Schnorr-style NIZKP authentication can provide privacy-preserving, scalable access control for healthcare environments when combined with practical 2FA and RBAC enforcement.
ChitraVault is an exploratory conceptual authentication architecture that investigates whether geometric visual traversal patterns, drawn from the Chitrakavi (சித்திரக்கவி) classical Tamil literary tradition, can augment password vault security by adding a spatial-behavioral dimension to cryptographic key derivation. This paper proposes the Visual Pattern Key Derivation Function (VP-KDF), which combines a user-drawn Chitrakavi geometric pattern, a text passphrase, and a hardware-bound device fingerprint as inputs to Argon2id key stretching. The framework maps four classical Chitrakavi patterns — Chakra Bandha (wheel), Naga Bandha (serpent), Gomutrika (zigzag), and Thiruezhukkootrirukkai (triangle) — onto distinct cryptographic roles within a zero-knowledge password vault architecture. This work is framed as an exploratory research program, not a finished cryptographic system. All security arguments are bounded by stated assumptions and require empirical and cryptanalytic validation. Future work includes controlled user studies, formal security proofs, and prototype evaluation. Author: Arvind VijayakumarIndependent ResearcherMay 2026
The rapid proliferation of generative AI has collapsed the scarcity-based filters of digital trust, enabling synthetic identities, algorithmic fraud, and systemic epistemological uncertainty. Conventional authentication methods—passwords, cloud-stored biometrics, and external hardware tokens—are inherently fragile, centralized, and vulnerable to coercion or theft. This article proposes a paradigm shift toward bodily cryptographic sovereignty: a dental implant-based digital anchor that derives a Physically Unclonable Function (PUF) key from the unique acoustic resonance and microarchitecture of the human jawbone. The architecture integrates Zero-Knowledge Proofs (ZKP) for privacy-preserving verification, hardware zeroization to neutralize extraction attacks, and a configurable duress protocol for coercion scenarios. By leveraging globally established dental infrastructure and informed-consent medical protocols, the model bypasses the regulatory resistance and psychological friction associated with centralized biometric registries. It enables graded identity, scoped AI-agent delegation, and origin-verified digital communication. The proposed framework transitions digital trust from fragile external devices to an inseparable biological-cryptographic symbiosis, offering a scalable, voluntary, and regulatorily aligned architecture for the post-AI trust economy.
Open access
2 source records
Physical Unclonable Functions (PUFs) and Hardware Security
Momodu Mustapha, Susan Konyeha, Akinola Samson Olayinka
This study examines user trust and perception of cryptographic technologies specifically SHA3-512 hashing, SERPENT encryption, and Zero-Knowledge Proofs (ZKP) in the context of centralized Electronic Health Record (EHR) systems. As healthcare institutions increasingly migrate patient data to digital platforms, the security and privacy properties of underlying cryptographic mechanisms have become critical determinants of user confidence and system adoption. Using a quantitative, survey-based design, data were collected from 92 healthcare practitioners, IT professionals, and system administrators actively engaged with EHR systems in Auchi, Nigeria. A Random Forest classifier was trained to predict perceived satisfaction levels (Low, Neutral, High) based on respondents' assessments of cryptographic effectiveness, usability, and trust. Results indicate that trust in ZKP is the strongest predictor of overall perception, followed by confidence in SERPENT encryption and SHA3-512 integrity guarantees. The model achieved a classification accuracy of 63.3% on a held-out test set derived from this exploratory sample, with a Kappa statistic of 0.52 reflecting moderate agreement beyond chance. Balanced accuracy across classes (approximately 0.49–0.50) and low per class sensitivity confirm that the findings should be interpreted as preliminary and directional rather than definitive. Key themes from open ended feedback analyzed using TF-IDF text mining reveal that while respondents broadly recognize the security value of these cryptographic mechanisms, concerns about system slowdown, usability complexity, and insufficient user education present barriers to wider adoption. This study contributes a pilot-level empirical baseline for understanding stakeholder perception of layered cryptographic security in resource-constrained healthcare environments, and highlights the need for larger-scale replication studies. Keywords: SHA3-512; SERPENT encryption; Zero-Knowledge Proofs; healthcare data security; user perception; Electronic Health Records; Random Forest
José Manuel Torres, Luis P. Mota, Rui S. Moreira, Christophe Soares · 5 authors
Ambient Assisted Living (AAL) systems have become increasingly relevant as aging populations intensify the demand for technologies that promote autonomy, safety, and quality of life. However, the widespread adoption of audiovisual sensing in smart homes raises critical concerns regarding data protection, privacy, and user trust. Ensuring secure processing while maintaining accurate activity recognition remains a key challenge. This work introduces DistSense, a distributed Peer-to-Peer (P2P) system designed to enhance activity detection in domestic environments through collaborative inference among intelligent audiovisual sensors. DistSense prioritizes privacy by performing local processing, sharing only high-level events, and leveraging distributed ledger mechanisms to ensure data integrity and auditability and support cross-device validation. This collaborative strategy reduces false positives caused by occlusions, illumination variability, and acoustic noise. To assess the system, functional tests were conducted for each module, followed by two use cases evaluated in both simulated and real edge hardware environments. The trained models achieved 88% accuracy for audio and 80% for video, and the system demonstrated effective performance in detecting daily activities and domestic hazards under varying noise conditions. Results indicate that DistSense successfully balances security, user acceptance, and inference robustness, positioning it as a viable solution for privacy-preserving activity monitoring in smart home contexts.
The proliferation of sophisticated AI and bot networks necessitates robust methods for verifying human uniqueness and liveness in digital ecosystems. Existing Proof-of-Personhood (PoP) solutions rely on centralized authorities, invasive static biometrics, or socially-correlatable data, creating vulnerabilities in privacy, security, and accessibility. We introduce the Entros Protocol, a decentralized framework for PoP and Self-Sovereign Identity built on Solana. The core innovation is temporal consistency: the assertion that human identity is best proven not by a static secret, but by the bounded, chaotic drift of biological and behavioral patterns over time. The framework captures multi-modal behavioral data (voice prosody, hand tremor, touch dynamics) during a configurable behavioral challenge, extracts a 308-dimensional feature vector, and produces a 256-bit locality-sensitive hash via SimHash. A Groth16 zero-knowledge proof verifies that consecutive fingerprints fall within a bounded Hamming distance without revealing either value. Attestations are anchored to non-transferable identity tokens (SPL Token-2022) with progressive Trust Scores. We provide formal security definitions, analyze the protocol against replay, synthesis, and Sybil attacks, introduce a graduated trust model distinguishing first-time liveness checks from sustained temporal consistency, and present benchmarks from a working implementation deployed on Solana devnet.
The Prism Protocol is a privacy-native authentication and identity architecture in which a user can prove attributes or authentication state without directly revealing their identity to the server. It combines WebAuthn (W3C Level 3), Zero-Knowledge Proofs (Groth16 via circom/snarkjs), and NFC-based physical presence verification into a single coherent protocol stack. The core mechanism is a triangular key derivation model: biometric authentication (WebAuthn), a device-bound private key (FIDO2 Secure Enclave), and a time-limited NFC nonce via a passive tag (card, ring, sticker; NFC ISO 14443) jointly produce an ephemeral key. In v18, a working ZKP implementation is demonstrated: an age-threshold circuit proves that a user meets a criterion without the server ever receiving the attribute value. Verification is performed server-side via snarkjs.groth16.verify(). Within the demonstrated implementation flow, the server receives no name, no biometric data, no persistent identifier, and no direct attribute value. Sessions are designed to be unlinkable from the server perspective at the protocol level; timing and metadata correlation are addressed in the threat model as a separate concern. A working proof-of-concept was demonstrated on 25 April 2026 at prismpass.globalsecurity.nu. The broader ecosystem (PrismPass, PrismID, PrismShield, PrismAdd, PrismChat, PrismAir, PrismGuard, PrismHash, PrismWipe, PrismGate) is documented in this Invention Disclosure. The protocol introduces no novel cryptographic primitives; its novelty lies in the specific architectural combination, orchestration model, and protocol-class definition addressing thirteen authentication questions not simultaneously addressed by existing systems. Note: The post-quantum migration path (ML-KEM-768, ML-DSA-65) is documented as a formal architectural claim and forward-compatibility design decision. It describes the intended migration route, not a currently implemented feature. The working implementation uses ECDH, ECDSA, AES-256-GCM and Groth16. The protocol is designed for session unlinkability: the server receives only a cryptographic proof of validity, never a persistent identifier, name, or behavioural trace. This addresses the unlinkability gap identified in the W3C Digital Credentials API and the EUDI Wallet architecture as an unresolved open problem. Author: I. Smid-Woelders, independent inventor, Zwolle, Netherlands. First documented: 25 April 2026. Contact: contact@globalsecurity.nu
The Prism Protocol is a privacy-native authentication and identity architecture in which a user can prove attributes or authentication state without directly revealing their identity to the server. It combines WebAuthn (W3C Level 3), Zero-Knowledge Proofs (Groth16 via circom/snarkjs), and NFC-based physical presence verification into a single coherent protocol stack. The core mechanism is a triangular key derivation model: biometric authentication (WebAuthn), a device-bound private key (FIDO2 Secure Enclave), and a time-limited NFC nonce via a passive tag (card, ring, sticker; NFC ISO 14443) jointly produce an ephemeral key. In v18, a working ZKP implementation is demonstrated: an age-threshold circuit proves that a user meets a criterion without the server ever receiving the attribute value. Verification is performed server-side via snarkjs.groth16.verify(). Within the demonstrated implementation flow, the server receives no name, no biometric data, no persistent identifier, and no direct attribute value. Sessions are designed to be unlinkable from the server perspective at the protocol level; timing and metadata correlation are addressed in the threat model as a separate concern. A working proof-of-concept was demonstrated on 25 April 2026 at prismpass.globalsecurity.nu. The broader ecosystem (PrismPass, PrismID, PrismShield, PrismAdd, PrismChat, PrismAir, PrismGuard, PrismHash, PrismWipe, PrismGate) is documented in this Invention Disclosure. The protocol introduces no novel cryptographic primitives; its novelty lies in the specific architectural combination, orchestration model, and protocol-class definition addressing thirteen authentication questions not simultaneously addressed by existing systems. Note: The post-quantum migration path (ML-KEM-768, ML-DSA-65) is documented as a formal architectural claim and forward-compatibility design decision. It describes the intended migration route, not a currently implemented feature. The working implementation uses ECDH, ECDSA, AES-256-GCM and Groth16. The protocol is designed for session unlinkability: the server receives only a cryptographic proof of validity, never a persistent identifier, name, or behavioural trace. This addresses the unlinkability gap identified in the W3C Digital Credentials API and the EUDI Wallet architecture as an unresolved open problem. Author: I. Smid-Woelders, independent inventor, Zwolle, Netherlands. First documented: 25 April 2026. Contact: contact@globalsecurity.nu