NTN · 2026-05-08
Identity Federation for Cislunar Operations: Extending Trust Beyond Earth Orbit
By J. W. Bouckaert
Verifying identity far from the issuer
Most identity protocols in use today assume a verifier can reach the issuer, or a status service, within an interactive timeout. OAuth 2.0, OpenID Connect, WebAuthn and OCSP all work that way. At lunar distance that assumption fails: a round trip to Earth takes seconds, the link is unavailable from some sites unless a relay is in view, and the parties may belong to different space agencies or companies.
NASA's Artemis programme is returning crew to the lunar surface, and providers under Commercial Lunar Payload Services (CLPS) deliver payloads there. On March 24, 2026, NASA announced a phased approach to a lunar base and said it intends to "pause Gateway in its current form", repurposing applicable equipment and partner commitments for surface operations. Crew, robots and autonomous systems from different organizations will still need to authenticate to one another.
Light delay and coverage
The Moon's semimajor axis is 0.3844 million km, about 384,400 km (NASA planetary fact sheet). At the speed of light, that is about 1.28 seconds one way and 2.56 seconds for a round trip, before any processing, queueing or retransmission. By comparison, a geostationary satellite at 35,786 km altitude adds about 120 ms one way.
| Parameter | Value | Identity implication |
|---|---|---|
| One-way light delay, Earth to Moon | About 1.28 s | Interactive challenge-response with an Earth service is slow |
| Minimum round trip | About 2.56 s | A flow with three round trips spends at least 7.7 s in propagation alone |
| Far side | No direct line of sight to Earth | Contact requires a relay |
| South polar sites | Partial direct visibility, depending on terrain and libration | Disconnection is predictable and must be planned for |
| Organizations | NASA, international partner agencies, contractors, CLPS providers | No single root of trust that all parties accept |
The network layer is being addressed through LunaNet, a framework for communications, navigation, detection and information services, with a LunaNet Interoperability Specification for providers. LunaNet does not define how a rover from one agency authenticates a command from another agency's astronaut relayed by a commercial provider. That is the identity layer.
Gaps in terrestrial trust models
On Earth, trust is usually hierarchical PKI plus federation protocols such as SAML and OpenID Connect. Both assume a verifier can reach an authoritative endpoint during the transaction.
Revocation freshness. OCSP responders and CRL distribution points assume a quick fetch. A lunar system's latest revocation data may be hours old. The W3C Bitstring Status List is suited to bulk caching, but the verifier still needs a rule for how old a cached list may be.
Cross-organization federation. A rover built by one agency cannot wait 2.56 seconds per token introspection call to another agency's service during an operation. Trust between the parties has to be agreed in advance and held locally as keys and signed policy.
Single-provider dependency. If several commercial relay providers serve lunar operations, a compromise or outage at one should not stop surface systems from authenticating commands. That calls for multiple trust roots with explicit quorum and failover rules.
At the transport layer, the IETF has published Bundle Protocol Version 7 (RFC 9171) and Bundle Protocol Security (RFC 9172) for store-and-forward networking, with integrity and confidentiality blocks that travel with each bundle. They do not define identity federation between organizations.
A proposed federation model
The following design follows from those constraints. It is a proposal, not a deployed system.
1. Credentials issued and verified on site, reconciled with Earth. A trust authority at the surface site holds authority delegated by Earth-based roots to issue short-lived credentials to crew, robots and autonomous agents. Earth keeps the long-lived root identities and the policy limiting what the site authority may issue. The site authority handles verification locally and sends an append-only audit log to Earth at each contact window.
2. Lifetimes tied to operations. A credential is bound to a specific operation, such as an EVA or a traverse, and expires at the planned end plus a margin, so a stalled operation does not leave a long-lived, high-privilege credential behind. On Earth, DPoP token binding applies a similar idea: short-lived tokens bound to a key.
3. Cached proofs with post-quantum signatures. Each relying party holds proofs for the agents it expects to deal with, signed by the issuing authority with a post-quantum scheme such as ML-DSA (FIPS 204). The cache is refreshed when a relay window opens, and verification continues from cached proofs when the link is down. Delay-tolerant identity authentication covers the pattern in more detail.
4. Policy agreed before launch and evaluated locally. Agreements about which credentials each party accepts, and what an autonomous agent may do on another party's equipment, are written as policy documents signed by each party's root and loaded onto site authorities before the mission. Permission decisions during an operation are made locally.
Related standards and frameworks
- CCSDS 734.2-B-1, the CCSDS Bundle Protocol specification, covers moving data across delay-tolerant links between agencies.
- CCSDS 355.0-B-2, the Space Data Link Security protocol, covers authenticated and encrypted link-layer transport.
- NATO Federated Mission Networking is a governance and technical framework for setting up mission networks across NATO and partner nations. It is the closest terrestrial analogue for multi-party federation with locally enforced policy.
- The W3C Verifiable Credentials Data Model 2.0 and the IETF SD-JWT VC draft define credential formats that can be verified offline, with selective disclosure of claims.
Open questions
- Delay-tolerant verification. Verification that works from cached material needs to be proven on Earth before it is relied on in lunar operations.
- A shared policy language. Without a common way to express which party may do what, each deployment will define its own access rules. Bodies such as CCSDS, the OpenID Foundation and the W3C Credentials Community Group are candidates to work on this.
- Autonomous agents as identity subjects. Robots and autonomous systems need their own credentials from the start. Terrestrial work on agent-to-agent trust negotiation is relevant.
- Designing for disconnection. Token lifetimes, revocation budgets and freshness checks have to assume the link to Earth will be down for hours.
PasskeyBridge today
PasskeyBridge's shield-cached-proof function stores proofs for verification when network signals are unavailable, and revalidates them when connectivity returns. Proof payloads are encrypted with AES-256-GCM, user identifiers are stored only as keyed HMAC-SHA-256 digests, proof lifetimes range from 1 hour to 30 days with a 72-hour default, and proofs are hybrid-signed with a post-quantum signature when the tenant has post-quantum signing enabled. The cislunar federation model above is a design, and PasskeyBridge does not operate it.