← Back to Technology Index
SAFE Engine
Tri-Strand Post-Quantum Cryptographic Engine — deterministic, transcript-bound hybrid handshake and key lifecycle.
SAFE is the cryptographic genome beneath AetherGuard™ BioCore SAFE-Full — engineered to preserve coherence,
integrity, and enforceable ordering from handshake through record-layer keys.
At a Glance
Filing: U.S. Provisional (Application No. 63/926,597) |
Filed: November 27, 2025 |
Inventor: Gareth Karpel
- What it is: A tri-strand hybrid cryptographic engine combining PQC KEM, classical ECDH, and hybrid derivation/binding.
- What it enforces: Deterministic sequencing, transcript binding, and strict “no-keys-before-binding” constraints.
- What it enables: Quantum-resilient authenticated sessions with hardened key lifecycles and record-layer protection.
Why SAFE Exists
The post-quantum transition has produced many “hybrid” implementations, but many remain ad hoc:
sequencing varies, transcript binding is inconsistent, and key derivation can occur in ambiguous states.
SAFE’s purpose is to replace ambiguity with enforceable structure — so a session only becomes “real”
when the correct components have completed in the correct order.
What SAFE Engine Is
SAFE Engine (Strand-Aligned Functional Encryption) is a tri-strand post-quantum cryptographic engine
defined as a deterministic handshake and hybrid key establishment protocol:
The Three Strands
- Strand A: Post-Quantum Key Encapsulation (PQC KEM) for quantum-resilient shared secret material.
- Strand B: Classical Elliptic-Curve Diffie–Hellman (ECDH) for classical resilience and continuity.
- Strand C: Hybrid derivation + integrity binding (HKDF-style derivation, transcript binding, directional keys).
Strand C is gated: it may not begin until Strand A and Strand B have completed.
Core Innovations
1) Transcript-Bound, Deterministic State Machine
SAFE defines an enforceable progression so sessions cannot “skip” steps or derive keys early.
The state machine is designed to ensure transcript integrity, correct ordering, and consistency across strands.
2) Strict Ordering Constraints
SAFE is designed to prevent inconsistent derivations and misbinding by enforcing monotonic sequencing:
no application keys exist until composite binding is complete.
3) Zeroization-By-Design Key Lifecycles
SAFE is built around a controlled lifecycle model for sensitive material — keys exist only when required,
and are explicitly cleared when no longer needed to reduce residual risk.
4) Integrated Telemetry Hooks
SAFE optionally emits structured session and key events (e.g., generation, derivation, zeroization),
enabling internal health scoring and external observability in larger systems.
5) Mesh Compatibility
SAFE is designed to integrate with distributed monitoring systems (e.g., mesh nodes observing session events)
to support cross-system verification and anomaly detection.
How It Fits the Ecosystem
SAFE Engine is the cryptographic substrate beneath AetherGuard™ BioCore SAFE-Full.
It is engineered to serve operating systems, secure runtimes, endpoint protection, and any environment
requiring post-quantum-safe authenticated sessions — with explicit sequencing and memory hygiene.
IP & Disclosure Note
This page is a public executive summary intended to describe the technology at a high level.
It does not disclose filing text, claims, or implementation details. Additional materials may be made
available for diligence and review upon request.