Summary

  • Wathīqa revision 01 makes wire version 3 carry a signed not-before beacon pulse, its DER certificate and, optionally, the immediate successor; it distinguishes authentication from successor-confirmed chain continuity.
  • The pulse signature is repeatable classical defense in depth. The draft's post-quantum placement argument rests instead on SHA-512 chain continuity plus independent evidence that the value belonged to the beacon's genuinely published sequence.
  • Sections 4 and 5 define version 3 while section 6 still instructs parsers to reject versions other than 1 or 2. Until that contradiction is repaired, “wire v3 interoperability” is an aspiration, not an observed property.

Revision 01 changes the evidence object

The event is a document revision, not a standards decision. On 6 September 2026, Hessa Alhemeiri and co-authors submitted revision 01 of Wathīqa: Post-Quantum Evidence Record Syntax. The Datatracker shows an active individual Internet-Draft intended for Experimental status. It has no IETF stream, responsible area director, working-group consensus or approval. Every conclusion below therefore describes the reviewed text, not an adopted protocol or deployed service.

Revision 00 already tried to preserve a renewal chain before a cryptographic break. It could include a not-after receipt and an optional witness. Its weakness was explicit: the not-before beacon value was an unauthenticated input. BTW covered that design boundary separately. Revision 01 deserves a new article only because it changes the mechanism. It introduces wire version 3, requires witnesses for that version, and makes the first witness a certificate-bound signed pulse rather than a value whose provenance the verifier must simply assume.

The new structure matters because evidence records fail at joins. A timestamp-looking number does not prove who emitted it. A valid signature does not prove where the signed object sat in a public sequence. A hash-chain link does not prove that an operator actually published or retained the chain. Revision 01 separates more of these joins than its predecessor, but it cannot make an external historical fact self-authenticating merely by serializing it inside the evidence record.

What wire version 3 authenticates

For wire version 3, witnesses is mandatory; lower versions must not carry it, and a version-3 record without it is rejected. The first witness is the not-before witness. It names a source and contains the full pulse bytes, the certificate in DER form and, optionally, a successor pulse. Additional independent beacon witnesses may follow. The evidence-record chain hash commits to the deterministic CBOR encoding of the witness array, so changing the witnesses changes the renewal-chain input.

The verification sequence is more useful than the nouns. A verifier parses the pulse, recomputes its output, derives certId as SHA-512 over the supplied DER certificate, checks that identity against a pinned certificate, and verifies the pulse signature. It also checks the pulse fields that bind the stated not-before value. A syntactically plausible pulse whose output cannot be reproduced, whose certificate is not pinned or whose signature fails is not an authenticated anchor.

This turns a previously unowned value into a reproducible cryptographic claim. The certificate pin says which signing identity the relying system intended to trust. Supplying the entire pulse and certificate makes later re-verification possible without depending only on a database label. Committing the witness array into the next evidence-record hash protects the exact witness package from silent substitution during later renewal.

But the result must keep a precise name. It says that the holder of the pinned private key signed a pulse with these fields and output. It does not yet say that this pulse was part of the public, chronological stream that outside observers saw at the claimed time.

What the successor pulse adds

The optional successor is not decorative redundancy. It must carry the next pulse index, belong to the same chain, authenticate under the relevant certificate rules and back-commit to the first pulse. If those tests pass, an attacker cannot replace only the first pulse without also satisfying the successor's backward link. The draft gives that stronger result its own verdict: CHAIN_CONFIRMED.

Without a successor, the first pulse can still be AUTHENTICATED, or more specifically AUTHENTICATED_NO_SUCCESSOR. That is not failure. It is a smaller fact. The pulse signature validated, but the package did not supply immediate forward continuity. INVALID covers authentication or structural failure. Earlier evidence records can retain a legacy classification, LEGACY_UNAUTHENTICATED, rather than being silently promoted by a new verifier.

These distinctions are operationally valuable. They let an archive say what it actually retained. They also prevent a dashboard from turning “signature valid”, “successor linked” and “historically observed” into one green badge. Those three propositions have different evidence owners and different repair paths.

A signed pulse is not yet a public timeline

Imagine that a valid beacon certificate remains available long after the date being claimed. Someone who controls or later compromises that classical signing key might generate a well-formed pulse over chosen fields. The signature can be correct. The output can recompute. Even a locally constructed pair may have matching indices and a valid backward commitment. None of that alone proves that outside observers received those pulses in the historical public sequence.

The draft recognizes this boundary. Its security argument depends on evidence that the value was part of the actual published pulse chain, mentioning an independently held copy, live retrieval or an archive. This is the decisive institutional control. The evidence record preserves the pulse; another custodian preserves the fact that the pulse occupied a public history that the record producer could not rewrite alone.

“Archive” must not become another vague checkbox. A useful receipt identifies the source, chain identifier, pulse index, exact pulse bytes or digest, observation or acquisition time, retrieval method, archive identity and retention policy. Where live retrieval is used, the verifier should retain enough of the response to reproduce what was seen. Where an independent copy is used, governance should establish that its custody is genuinely separate from the record producer and beacon operator.

This is Heng Lu's reality-layer discipline applied to time evidence. The serialized record is one layer. The cryptographic relations are another. The independently observed publication history is a third. Authority appears only when an institution declares which combination it will accept and preserves the receipts that let another institution challenge that decision.

Classical signature and post-quantum continuity answer different questions

Revision 01 is careful to call the pulse signature repeatable defense in depth. That is the right boundary. A classical RSA signature can authenticate the pulse today and can be rechecked during renewal. It should not be marketed as the post-quantum foundation of an evidence record meant to outlive classical public-key assumptions.

The longer-lived placement argument instead uses SHA-512 preimage and second-preimage resistance in a chain that commits one pulse to its predecessor. The draft's wider record syntax can renew evidence under ML-DSA and SLH-DSA, standardized in FIPS 204 and FIPS 205. Those signatures protect renewal acts under post-quantum assumptions. They do not retrospectively prove that an arbitrary beacon value was publicly emitted years earlier. That proposition still comes from hash continuity plus external observation.

This division is a strength if operators expose it. A migration can replace a classical renewal signature while retaining the older pulse, chain evidence and archive receipt. It becomes a weakness if procurement language collapses every primitive into “quantum safe”. Teams should ask which proposition depends on which assumption, when each assumption was established, and what evidence survives if one key or algorithm later fails.

The wire-version contradiction

The most immediate interoperability problem is inside revision 01 itself. Sections 4 and 5 introduce wire version 3 and specify witness processing for it. Section 6, however, still says that an absent wire_v means version 1, that version 2 is allowed, and that any other value must be rejected. A literal implementation of section 6 rejects the very version that the preceding sections require.

This is not a stylistic blemish. Version admission sits before witness verification. Different implementers may follow different sections and produce opposite results for identical bytes. One may process the signed pulse; another may reject at the gate. Until the text is corrected and test vectors establish the intended behavior, no one should claim interoperable support for wire version 3 merely because a private parser accepts a sample.

The external ASN.1 module creates a related dependency. The document refers to module material that is not included in the reviewed draft. The two media types are proposed registrations, not evidence that registration is complete. Implementations should pin the exact draft, module artifact and provisional identifiers they used. “Supports Wathīqa” is too broad to audit.

Scope limits

This report did not run an implementation, validate a beacon service, reproduce a test vector, inspect a certificate rotation or verify the draft's implementation claims. A certificate-rotation episode described by the draft is therefore not treated as an independently established incident. The article does not claim IETF adoption, IANA registration, deployment, performance, market use or consensus on the construction.

The revision is nevertheless significant as a design signal. It replaces an explicitly unauthenticated value with a verifiable witness package and names several evidence outcomes. Its remaining boundary is equally instructive: no self-contained record can manufacture independent history. The archive is not an accessory to the cryptography. It is one of the authorities that makes the time claim contestable.

Sources