Technical Deep Dive
How HexaEight Works
Three cryptographic primitives that give AI agents, humans, and IoT devices a verifiable identity, with no PKI, no key exchange, and no coordination required.
Dead Drop Encryption
Encrypt Without the Recipient Online
What Dead Drop Encryption Means
In a traditional spy "dead drop," one agent leaves a message in a hidden location, the other picks it up later, with no meeting required. HexaEight works the same way, but cryptographically.
Alice can encrypt a message to Bob without Bob being online, without Alice having Bob's public key, and without them ever coordinating. The message never passes through HexaEight at any point. HexaEight only provides the keys used to lock and unlock the box.
Bob can be offline right now, not yet deployed, or even a future agent that doesn't exist yet. When he comes online and authenticates, he decrypts. HexaEight was never in the message path.
Phase 1: Registration
👩
Alice
Registers with HexaEight
Sets her own password
Alice's Login Token
⇄
Platform
👨
Bob
Registers with HexaEight
Sets his own password
Bob's Login Token
Phase 2: Alice Requests Bob's Shared Keys
Alice sends:
1Her Login Token
2
Proof she knows her password
by encrypting her request to the platform
by encrypting her request to the platform
→
Platform
Tries to decrypt
the request
the request
Fails → DENIED
Succeeds → OK
←
Platform returns (encrypted):
Bob's ASK Bundle
ASK = Asymmetric Shared Key, unique to Bob's identity, freshly generated on every request
Rotates every 15 minutes
Phase 3: Encryption (runs locally on Alice's device)
Alice's Identity Keys
Computed from her password via SHAKE-256. Never leave her device
+
Bob's ASK Bundle (from platform)
Bob's Asymmetric
Shared Keys
Shared Keys
↓ How the ciphertext is formed ↓
Encrypted message = f( Alice's Identity Keys, Bob's ASK Bundle )
Alice encrypts using her Identity Keys + Bob's ASK Bundle.
Bob decrypts using his own Identity Keys + Alice's ASK Bundle (provided by platform).
Bob decrypts using his own Identity Keys + Alice's ASK Bundle (provided by platform).
The platform can never decrypt, by design.
Encrypted messages pass directly between Alice and Bob; the platform is never in that path.
Phase 4: Async Delivery & Decryption
📦
Encrypted Message
stored anywhere
→
Queue / Message Bus
Database / File
Webhook / Email
→
👨
Bob
Authenticates same way
Gets Alice's Shared Keys
Decrypts ✓
Gets Alice's Shared Keys
Decrypts ✓
Bob can be offline, not yet deployed, or a future agent. Decrypts whenever ready.
Platform Protection
Alice's request to the platform is encrypted the same way her message to Bob is. HexaEight's own security relies on HexaEight.
Password Never Stored
No password is stored anywhere, not even on HexaEight's servers. A stolen token is useless without the password.
Not IBE
IBE gives the platform a master private key that can decrypt everything. HexaEight has no master key, and the platform is never in the message path — ciphertext never traverses it.
Multi-Agent
Agent-to-Agent Encrypted Communication
One Identity, Many Workers
HexaEight License (one hostname identity)
billing-agents.mycompany.com
↓ one license covers all workers ↓
🤖
Worker 1
same identity
🤖
Worker 2
same identity
🤖
Worker 3
same identity
🤖
Worker N
same identity
Encrypted Task Routing
🔀 Router Agent
Encrypts a task specifically for the target worker identity
encrypt("process invoice #4521", for: "invoice-worker")
↓ broadcasts to shared channel ↓
Message queue / database / webhook: all workers see this
[ 3a9f2c... encrypted payload ...8d1e ]
↓ each worker attempts to decrypt ↓
Worker 1
Wrong identity
→ decryption fails
→ skips task
→ decryption fails
→ skips task
Invoice Worker ✓
Correct identity
→ decrypts OK
→ claims & processes
→ decrypts OK
→ claims & processes
Worker 3
Wrong identity
→ decryption fails
→ skips task
→ decryption fails
→ skips task
Natural Load Balancing
Workers compete to decrypt. Whoever gets it first processes it. No central dispatcher or extra infrastructure needed.
Zero Trust Channel
An intercepted message stays fully encrypted. Only the intended worker identity can ever read the task.
Post-Quantum
Why Hash-Based Cryptography Beats RSA and ECC
The Quantum Threat
RSA / ECC (Classical)
Security depends on:
• Integer factorization (RSA)
• Discrete logarithm (ECC)
• Integer factorization (RSA)
• Discrete logarithm (ECC)
Shor's Algorithm solves both in polynomial time on a quantum computer. All RSA/ECC encryption becomes retroactively breakable.
HexaEight SHAKE-256
Security depends on:
• Pre-image resistance of SHAKE-256
• No algebraic structure to exploit
• Pre-image resistance of SHAKE-256
• No algebraic structure to exploit
Shor's Algorithm has no target. Only Grover's applies, which provides a quadratic speedup. With 256-bit keys, that leaves ~128-bit post-quantum security — NIST Category 5, the AES-256 class.
Security Level Comparison
Algorithm
Quantum security
vs NIST Lvl 5
RSA-2048
Broken by Shor's algorithm
Broken
AES-128
~64-bit quantum security
Below
NIST Level 5 threshold
256-bit quantum security
Baseline
HexaEight (AES-256 / SHAKE-256)
256-bit keys — NIST post-quantum Category 5
Meets ✓
Independent AI Cryptanalysis (6 models)
🤖
Microsoft Copilot · 7.5/10
"Solid primitives and a sensible Encrypt-then-MAC design over standard AEADs, with clear domain separation."
🤖
Gemini 2.5 Pro · 9.5/10
"A mathematically sound, symmetrically secure data path that correctly isolates cryptographic trust to the endpoint."
🤖
Fable 5 / Opus 4.8 · 8/10
"A clean, standards-based symmetric transport via BouncyCastle, plus a correct Encrypt-then-MAC mode. No public-key exchange sits in the data path."
🤖
Meta AI · 7/10
"A clean, auditable client cipher that delivers real dead-drop encryption — strongest on the misuse-resistant AES-GCM-SIV path."
🤖
Grok · 7.5/10
"A transparent, client-only symmetric cipher with standard AEAD defaults, handshake-free dead-drop delivery, and no Shor-vulnerable public-key material in the data path."
🤖
GLM-5 Turbo · 7/10
"Solid symmetric crypto engineering with standard AEADs and a well-composed custom stream cipher."
All six conversations are public. See the AI Cryptanalysis section on the homepage for direct links to each transcript.
Built To Be Read By Agents
You just read the architecture.
Now point an agent at it and it installs.
/llms-install.txt is the whole install procedure as machine-readable cards, one per step, marked by operating system. Give the link to Claude Code, Cursor or any CLI agent and it does the install, asking you only for the licence code and a provider key. /llms.txt indexes the rest of the documentation.
Secure your agent with an Identity.
Run it on your own machine, or deploy one from the Azure Marketplace.