Identity threat detection and response, in the same request
PasskeyBridge ingests carrier and breach signals, scores them against your playbook, and revokes, freezes, or steps up in the same request—backed by post-quantum signatures you can verify yourself.
Response to three attack types
Three attack patterns mapped to the response sequence, from signal ingestion to automated remediation. Each event records its actual decision time as decision_ms.
Attacker initiates SIM port-out request at carrier store with social-engineered credentials.
Vonage Number Insight webhook fires. PasskeyBridge ingest validates HMAC-SHA256 signature.
Carrier begins porting process. Attacker's device receives OTP.
Intelligence worker scores event. Behavioral clustering detects anomaly—device fingerprint mismatch.
Attacker attempts account login with intercepted OTP.
Cascade engine triggers. Cross-reference confirms SIM signal does not match bound passkey device.
Login attempt rejected. Attacker locked out.
All active sessions revoked. Passkey re-enrollment ceremony initiated on verified device. Audit log written.
Signals PasskeyBridge ingests
Carrier state, breach exposure, agent behavior, and device binding—ingested continuously, scored on every request.
Live carrier state
SIM tenure, port-out, and Silent Number Recycling from carrier intelligence, validated on ingest and scored inside the auth path.
Breach-sourced credentials
Leaked credentials matched against HIBP with k-anonymity—only a hash prefix ever leaves your tenant, never a password.
Behavioral trust scoring
A trust score per delegated agent, recomputed from its recorded activity; behavioral signals such as a velocity spike lower it, and a score below the narrowing threshold removes scopes automatically.
Bound passkey device
Every decision cross-references the requesting device against the passkey bound to the account—WebAuthn, phishing-resistant, revocable.
Cryptography you can verify
Every primitive is a ratified NIST standard or a provably secure construction. PasskeyBridge uses no proprietary ciphers.
ML-DSA-65 / ML-DSA-87
NIST FIPS 204 lattice-based digital signatures. Hybrid classical + post-quantum scheme with runtime algorithm branching per tenant.
ML-DSA-65 is default (3,309-byte signatures). ML-DSA-87 (Security Level 5, 4,627-byte signatures) available as Enterprise add-on.
- Dilithium-based lattice construction (mldsa-wasm)
- Hybrid co-signing: classical ES256 (P-256), or ES384 (P-384) on the ML-DSA-87 / CNSA 2.0 tier
- Per-tenant pqc_level configuration
- CNSA 2.0 aligned signature suite
BLAST Protocol
Bi-Lateral Authenticated Secure Tunnels. X25519 ECDH key exchange with perfect forward secrecy and ephemeral session keys.
Every tunnel negotiation produces a unique shared secret. Keying material is zeroized after session teardown.
- X25519 ephemeral key pairs
- HKDF-SHA256 key derivation
- AES-256-GCM tunnel encryption
- Automatic session expiry + teardown
QRNG Entropy
Hardware quantum random number generation from Outshift and QCi sources, with deterministic DRBG expansion and local CSPRNG fallback.
Entropy pool is continuously replenished. Each request draws from the highest-available source in the hierarchy.
- Outshift QRNG primary source
- QCi uQRNG secondary source
- ANU Quantum tertiary source
- Local CSPRNG guaranteed availability
Cached Trust Proofs
Time-bounded, PQC-signed proof tokens that enable offline identity verification without network connectivity.
Proofs carry a trust level, expiry, and optional ML-DSA signature. Revalidated automatically when connectivity resumes.
- Encrypted proof payload (AES-256-GCM)
- Time-bounded with automatic expiry
- Optional ML-DSA post-quantum signature
- Network-aware trust level assignment
Standards alignment you can audit.
Every cryptographic implementation, data-handling policy, and credential lifecycle maps to a ratified standard.
Use cases by problem
Each page maps a common buyer question to the exact capability that answers it.
MFA alternative
Replace SMS OTP and push-based MFA with a carrier-bound passkey verified in one request.
Fraud prevention API
A signed device-plus-carrier attestation your fraud engine consumes as a hard input, not another score.
Identity assurance platform
Continuous per-request assurance across passkeys, DPoP, carrier state, and verifiable credentials.
Account takeover prevention
Kill credential-replay ATO and SIM-swap-driven recovery fraud with a signal current controls miss.
SIM swap detection
Live carrier state (SIM tenure, port-out, Silent Number Recycling) inside the auth path, not a batch.
Post-quantum identity
Identity attestations signed with classical ES256 plus ML-DSA-65 (NIST FIPS 204), without an IdP migration.
Agentic identity
Scoped, revocable trust for AI agents, with A2A attestation and cascade revocation bound to the human principal.
Add PasskeyBridge to your identity stack
Start free in minutes, or talk to us about the enterprise and agentic tiers.
Prefer the full technical overview? Read the docs or request the whitepaper.