Device to Receipt Trust Boundaries
What a signature can establish, and what remains unknown
The problem
Device evidence often jumps from a valid signature to a hardware claim. That jump is unsafe. A signature authenticates a key and message. Genuine device identity depends on how the key was enrolled, assigned, protected, and linked to a trust root.
The three profiles make uncertainty visible. Unknown trust produces an indeterminate outcome. It never becomes a favorable hardware claim by default.
Primitive map
| Receipt | Bound inputs | Derived relation | Claim boundary |
|---|---|---|---|
hiveseal.qpuf | Signed challenge response, nonce, observation time, enrollment, and trust class | Message and binding relations verify | Unclonability, physical origin, or quantum origin |
ppr.wearable | Signed reading, subject assignment, calibration, sequence, and time | Reading is bound to the enrolled key and supplied relations | Subject identity, clinical validity, or diagnosis |
s2s.signature | Device and platform messages, assignment, nonce, time, and trust root | Both signatures and trust relations verify | Genuine GPU hardware without verified trust evidence |
Verifier gates
The verifier rebuilds derived values. It does not trust a caller supplied outcome, count, root, total, or relation.
- DEVICE_SIGNATURE
- PLATFORM_SIGNATURE
- NONCE_BINDING
- TIME_RELATION
- SEQUENCE_RELATION
- ENROLLMENT_RELATION
- ASSIGNMENT_RELATION
- CALIBRATION_RELATION
- TRUST_CLASSIFICATION
Failure cases
Message substitution
The signature fails on changed canonical bytes.
Nonce replay
The message must bind the expected challenge nonce.
Stale observation
Freshness and ordering relations are recomputed.
Sequence rollback
A lower or repeated sequence fails the declared relation.
Unknown trust
The outcome remains indeterminate instead of asserting genuine hardware.
Claim boundary
- A key signature is not proof of physical device identity.
- QPUF evidence does not prove unclonability or quantum origin.
- Wearable evidence does not identify the human subject or establish clinical validity.
- S2S evidence does not claim genuine vendor hardware without a verified trust root.
Standards context
These sources describe related transparency, authorization, or evidence patterns. They do not endorse Hive or establish that a Hive receipt was present in any third party system.