Technical Deep Dive

How HexaEight Works

Four cryptographic primitives that give AI agents, humans, and IoT devices a verifiable identity, with no PKI, no key exchange, and no coordination required.

Dead Drop Encryption Agent-to-Agent Comms JWT Signing Post-Quantum Security
Dead Drop Encryption

Encrypt Without the Recipient Online

What Dead Drop Encryption Means

In a traditional spy "dead drop," one agent leaves a message in a hidden location, the other picks it up later, with no meeting required. HexaEight works the same way, but cryptographically.

Alice can encrypt a message to Bob without Bob being online, without Alice having Bob's public key, and without them ever coordinating. The message never passes through HexaEight at any point. HexaEight only provides the keys used to lock and unlock the box.

Bob can be offline right now, not yet deployed, or even a future agent that doesn't exist yet. When he comes online and authenticates, he decrypts. HexaEight was never in the message path.

Phase 1: Registration
👩
Alice
Registers with HexaEight
Sets her own password
Alice's Login Token
⇄
Platform
👨
Bob
Registers with HexaEight
Sets his own password
Bob's Login Token
Phase 2: Alice Requests Bob's Shared Keys
Alice sends:
1 Her Login Token
2
Proof she knows her password
by encrypting her request to the platform
→
Platform
Tries to decrypt
the request
Fails → DENIED
Succeeds → OK
←
Platform returns (encrypted):
Bob's ASK Bundle
ASK = Asymmetric Shared Key, unique to Bob's identity, freshly generated on every request
Rotates every 15 minutes
Phase 3: Encryption (runs locally on Alice's device)
Alice's Identity Keys
Computed from her password via SHAKE-256. Never leave her device
+
Bob's ASK Bundle (from platform)
Bob's Asymmetric
Shared Keys
↓ How the ciphertext is formed ↓
Encrypted message = f( Alice's Identity Keys, Bob's ASK Bundle )
Alice encrypts using her Identity Keys + Bob's ASK Bundle.
Bob decrypts using his own Identity Keys + Alice's ASK Bundle (provided by platform).
The platform can never decrypt, by design.
Encrypted messages pass directly between Alice and Bob; the platform is never in that path.
Phase 4: Async Delivery & Decryption
📦
Encrypted Message
stored anywhere
→
Queue / Message Bus
Database / File
Webhook / Email
→
👨
Bob
Authenticates same way
Gets Alice's Shared Keys
Decrypts ✓
Bob can be offline, not yet deployed, or a future agent. Decrypts whenever ready.
Platform Protection
Alice's request to the platform is encrypted the same way her message to Bob is. HexaEight's own security relies on HexaEight.
Password Never Stored
No password is stored anywhere, not even on HexaEight's servers. A stolen token is useless without the password.
Not IBE
IBE gives the platform a master private key that can decrypt everything. HexaEight has no master key, and the platform is never in the message path — ciphertext never traverses it.
Multi-Agent

Agent-to-Agent Encrypted Communication

One Identity, Many Workers
HexaEight License (one hostname identity)
billing-agents.mycompany.com
↓ one license covers all workers ↓
🤖
Worker 1
same identity
🤖
Worker 2
same identity
🤖
Worker 3
same identity
🤖
Worker N
same identity
Encrypted Task Routing
🔀 Router Agent
Encrypts a task specifically for the target worker identity
encrypt("process invoice #4521", for: "invoice-worker")
↓ broadcasts to shared channel ↓
Message queue / database / webhook: all workers see this
[ 3a9f2c... encrypted payload ...8d1e ]
↓ each worker attempts to decrypt ↓
Worker 1
Wrong identity
→ decryption fails
→ skips task
Invoice Worker ✓
Correct identity
→ decrypts OK
→ claims & processes
Worker 3
Wrong identity
→ decryption fails
→ skips task
Natural Load Balancing
Workers compete to decrypt. Whoever gets it first processes it. No central dispatcher or extra infrastructure needed.
Zero Trust Channel
An intercepted message stays fully encrypted. Only the intended worker identity can ever read the task.
Digital Signing · Coming Soon

Tamper-Evident Signing

Prove who signed something, when, and that the content wasn't altered — with no PKI and offline verification. Self-attestation of your own public key will be free; CA-style attestation, where HexaEight vouches for your public key in a public registry, is in development.

In development — not yet available
Post-Quantum

Why Hash-Based Cryptography Beats RSA and ECC

The Quantum Threat
RSA / ECC (Classical)
Security depends on:
• Integer factorization (RSA)
• Discrete logarithm (ECC)
Shor's Algorithm solves both in polynomial time on a quantum computer. All RSA/ECC encryption becomes retroactively breakable.
HexaEight SHAKE-256
Security depends on:
• Pre-image resistance of SHAKE-256
• No algebraic structure to exploit
Shor's Algorithm has no target. Only Grover's applies, which provides a quadratic speedup. With 256-bit keys, that leaves ~128-bit post-quantum security — NIST Category 5, the AES-256 class.
Security Level Comparison
Algorithm
Quantum security
vs NIST Lvl 5
RSA-2048
Broken by Shor's algorithm
Broken
AES-128
~64-bit quantum security
Below
NIST Level 5 threshold
256-bit quantum security
Baseline
HexaEight (AES-256 / SHAKE-256)
256-bit keys — NIST post-quantum Category 5
Meets ✓
Independent AI Cryptanalysis (6 models)
🤖
Microsoft Copilot · 7.5/10
"Solid primitives and a sensible Encrypt-then-MAC design over standard AEADs, with clear domain separation."
🤖
Gemini 2.5 Pro · 9.5/10
"A mathematically sound, symmetrically secure data path that correctly isolates cryptographic trust to the endpoint."
🤖
Fable 5 / Opus 4.8 · 8/10
"A clean, standards-based symmetric transport via BouncyCastle, plus a correct Encrypt-then-MAC mode. No public-key exchange sits in the data path."
🤖
Meta AI · 7/10
"A clean, auditable client cipher that delivers real dead-drop encryption — strongest on the misuse-resistant AES-GCM-SIV path."
🤖
Grok · 7.5/10
"A transparent, client-only symmetric cipher with standard AEAD defaults, handshake-free dead-drop delivery, and no Shor-vulnerable public-key material in the data path."
🤖
GLM-5 Turbo · 7/10
"Solid symmetric crypto engineering with standard AEADs and a well-composed custom stream cipher."
All six conversations are public. See the AI Cryptanalysis section on the homepage for direct links to each transcript.
Built To Be Read By Agents

You just read the architecture.
Now your AI agent can implement it.

/llms.txt is the machine-readable index of every endpoint, install command, and pattern. Drop the URL into Claude Code, Cursor, or GitHub Copilot. It writes the integration.

Open /llms.txt Read the spec

Ready to Deploy?

Self-install on your own machine or deploy an Azure Marketplace VM. Personal, Business, and Azure licenses — monthly or annual.

See License Modes View Pricing