Optimizing Credential Blast Radius Through Trust Boundaries and Delegation Under Post-Quantum Authentication Costs
Academic paper models credential blast radius optimization across trust domains under post-quantum latency costs, cutting expected impact by up to 36%.
The paper formulates the joint selection of trust domains and credential-derivation structures under policy and latency constraints as an NP-hard optimization problem, showing the scalarized two-domain direct-issuance case reduces to a weighted minimum cut. In 195 of 230 exhaustive synthetic comparisons, joint optimization produced lower credential blast radius than choosing boundaries first, especially under chained delegation. A trace-derived replay using measured post-quantum authentication costs found the best design reduced expected impact by up to 36% relative to a single domain within the latency budget.
- Frames credential blast radius as weighted service impact after issuer compromise
- Joint optimization beats boundary-first design in 195 of 230 synthetic comparisons
- Two-domain scalarized direct issuance reduces to weighted minimum cut
- Uses measured post-quantum crossing costs in a trace-derived replay
- Best design cut expected impact by up to 36% within latency budget
Full article190 words · extracted from arxiv.org · click to collapse
Partitioning interacting services into independently rooted trust domains limits issuer-compromise reach while increasing calls across trust boundaries. Post-quantum replacements for public-key authentication and key-establishment mechanisms can increase crossing latency on constrained or lossy paths. We formulate the joint selection of trust domains and credential-derivation structures under policy and latency constraints, linking separate service-interaction and credential-derivation graphs through domain assignment. Credential blast radius measures weighted service impact after compromise. A linear upper bound supports optimization, while a joint event model gives exact expected impact. For shared issuers, the bound is exact under nonoverlapping credential reach and otherwise requires explicit propagation. While the general problem is NP-hard, scalarized two-domain direct issuance reduces to a weighted minimum cut. Joint optimization yields lower blast radius than choosing boundaries first in 195 of 230 exhaustive synthetic comparisons, especially under chained delegation. A trace-derived replay used measured post-quantum costs, synthetic risk inputs, a fixed derivation family, and one to six trust domains. The best design found reduced expected impact by up to 36% relative to one domain within the latency budget. The framework turns risk assumptions and measured crossing costs into candidate trust-domain and credential-derivation designs.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.04566