Skip to content

m-of-n

Key-centric semantic assertions. Authorization, local names, and artifact attestation with a model whose principals are keys, whose names are relative to a naming key, whose subjects may be k-of-n, and whose statements carry meaning a person can read.

USF CS690 Master's Project, Fall 2026. Sponsor: Paul Lambert. Everything is open source. No proprietary data, no NDA.

What this does not do

It proves origin and integrity, not truth. A perfectly valid attestation can assert something false. See Limitations.

Status

Pre-implementation. The architecture is at v0.1.0 draft. DEC-001 … DEC-005 and DEC-007 are open — no encoding, tag language, or envelope has been selected. Documents published here are drafts and are marked as such. Do not cite an open decision as settled.

The problem

Modern attestation stacks — in-toto, SLSA, SCITT (RFC 9943), C2PA — bind statements to artifacts well and say almost nothing about what a statement means to a person. Two older bodies of work solved the missing pieces and were never combined:

  • SDSI/SPKI gave us principals that are keys, names local to a naming key, delegation, and k-of-n subjects — but never standardised a first-class statement about an artifact.
  • PICS gave us signed labels about content, with rating systems published separately from the labels that cite them — but had no principal or delegation model at all.

This project builds the native model that has both.