In modern cloud environments, relying on simple API keys or static bearer tokens for authentication is a severe architectural vulnerability. If an API key is intercepted in transit, accidentally committed to a source control repository, or extracted from an endpoint, the attacker gains permanent, unfettered access to the infrastructure until the key is manually revoked.
StateWarden completely eliminates this attack vector. Our entire distributed architecture—from the Artemis Control Plane to the Driad Data Plane and the local Agents—communicates exclusively over Mutually Authenticated Transport Layer Security (mTLS).
1. What is mTLS?
Standard TLS (what secures your connection to a website like https://bank.com) is a one-way street. The server proves its identity to your browser using a digital certificate, ensuring you aren't talking to a malicious imposter. However, the server has no mathematical proof of who you are; it relies on you typing in a password later.
Mutual TLS (mTLS) is a two-way street. Both the Server (Artemis/Driad) and the Client (the Agent) must cryptographically prove their identity to each other before a single byte of application data is exchanged.
2. Dynamic Certificate Generation
StateWarden does not use static, hardcoded certificates, nor do we require you to manually generate and distribute keys via complex Public Key Infrastructure (PKI) software. The entire process is seamlessly abstracted during the Agent Pairing phase.
The Pairing Handshake
When you execute the sw init command on a new server and provide the one-time pairing code:
- The Agent generates a standard private key for mTLS, alongside a Post-Quantum Kyber (ML-KEM) keypair. The Kyber private key is hardware-bound to the endpoint via PrimeKEM and never leaves the machine.
- The Agent generates a Certificate Signing Request (CSR) and securely transmits it, along with its Kyber public key, to the Artemis Control Plane.
- Artemis acts as an internal Certificate Authority (CA). It validates the pairing code, signs the CSR, and issues a unique Client Certificate.
- Artemis encapsulates a highly secure symmetric key (AES-256-GCM) within the Agent's Kyber public key. The signed mTLS certificate and provisioning secrets are then encrypted with this AES key to form a "PQ-Hybrid Payload".
- The Agent receives the payload, uses its hardware-bound Kyber private key to decapsulate the AES key, decrypts its certificates, and permanently locks down its network communications.
3. The Security Benefits
By utilizing dynamic mTLS for all inter-node communication, StateWarden guarantees absolute network security:
- Immunity to Replay Attacks: An attacker intercepting network traffic cannot replay a request, because they do not possess the Agent's local Private Key required to negotiate the TLS handshake.
- Cryptographic Access Control: The Driad Storage Nodes do not use passwords. If an unauthorized client attempts to connect to a Driad node to download a backup chunk, Driad will forcefully terminate the TCP connection during the initial handshake because the client lacks an Artemis-signed certificate. The connection is dropped before the HTTP layer even loads.
- Instant Revocation: If a server is stolen or compromised, an administrator can delete the device from the StateWarden Dashboard. Artemis instantly adds the Agent's specific Client Certificate to the internal Certificate Revocation List (CRL). Any subsequent attempt by the compromised Agent to contact the Control Plane or Data Plane is mathematically rejected.
4. Total Compartmentalization
StateWarden strictly compartmentalizes trust. The Agent (which handles backups) uses dynamic, device-specific certificates. However, the StateWarden distribution and update servers (dist.statewarden.net) use entirely separate repository certificates.
This strict segregation ensures that a compromise of an endpoint Agent cannot be leveraged to pivot into the CI/CD deployment pipeline, and vice versa. Every component in the StateWarden ecosystem only possesses the exact cryptographic authority required to perform its specific duty.
StateWarden: Resilience Engineered.