NAMCHE

Network Authenticated Mesh Certificate Hub & Exchange

The gateway where Math itself verifies your identity. No human CA required.

v3.5.10

"In the high passes of the Himalayas, the Sherpa does not consult a distant committee. The Sherpa reads the snow, the wind, the angle of the ice. The mountain itself is the arbiter."

Overview

NAMCHE replaces human-operated Certificate Authorities with pure mathematical verification. Instead of trusting a third party to vouch for an identity, NAMCHE uses cryptographic proofs that anyone can verify independently.

The Problem with Traditional PKI

• Single point of failure — CA compromise affects all certificates
• Human judgment — Humans can be bribed, coerced, or make mistakes
• Jurisdictional — CAs are bound by legal frameworks that may conflict
• Centralized trust — "Trust me because I say so"

The NAMCHE Solution

Traditional:

Human says "trust this" → You trust it

NAMCHE:

Math proves "this is valid" → You verify it

The 7 Gates

Every identity document (DOKO) must pass through 7 mathematical gates. Each gate is a binary check — pass or fail. There is no "maybe."

1️⃣

STRUCTURE_OK

Valid DOKO format with all required fields present

2️⃣

SIGNATURE_OK

ML-DSA-65 signature verifies against public key

3️⃣

NODEID_OK

NodeID matches two-part derivation (network + instance)

4️⃣

TEMPORAL_OK

Not expired, not from future (±5min clock skew tolerance)

5️⃣

NETWORK_OK

Correct network name (derived from codebase hash)

6️⃣

NOT_REVOKED

Not in mesh-distributed revocation log

7️⃣

DOMAINS_OK

Quorum-verified domain claims (Sybil-resistant)

Gate Results

The verification result is a bitmask showing which gates passed:

// All gates passed (127 = 0b1111111)
{
  "verified": true,
  "gates": 127,
  "gatesChecked": [
    "STRUCTURE_OK",
    "SIGNATURE_OK", 
    "NODEID_OK",
    "TEMPORAL_OK",
    "NETWORK_OK",
    "NOT_REVOKED",
    "DOMAINS_OK"
  ],
  "dokoHash": "sha3-256:a1b2c3..."
}

// Gate 2 failed (signature invalid)
{
  "verified": false,
  "gates": 1,
  "failedGate": "SIGNATURE_OK",
  "error": "Signature verification failed"
}

Usage

import { NamcheGateway } from 'yakmesh/security/namche-gateway';

// Create gateway instance
const gateway = new NamcheGateway({
  networkName: 'mobius-rabi-junction',
  maxClockSkew: 5 * 60 * 1000,  // 5 minutes
});

// Verify a DOKO
const result = await gateway.verify(peerDoko);

if (result.valid) {
  console.log('✓ Identity verified — all gates passed');
  console.log('Checks:', result.checks);
  console.log('DOKO hash:', result.dokoHash);
} else {
  // result.reason is a VERIFY_RESULT code, e.g. INVALID_SIGNATURE,
  // EXPIRED, WRONG_NETWORK, REVOKED, INSUFFICIENT_QUORUM …
  console.log('✗ Verification failed:', result.reason);
}

Sybil Attack Protection

The domain verification gate (Gate 7) includes multiple layers of Sybil attack protection:

Age Requirement

Verifiers must have beacons older than 7 days

IP Diversity

Minimum 3 different /24 subnets required

ASN Diversity

Minimum 2 different Autonomous Systems

Claimant Exclusion

Domain claimant cannot verify themselves

Events

gateway.on('verified', ({ doko, dokoHash, checks }) => {
  console.log(`DOKO ${dokoHash} verified successfully`);
});

gateway.on('verification-failed', ({ reason, detail }) => {
  console.log(`Verification failed: ${reason} — ${detail}`);
});

gateway.on('revoked', ({ dokoHash, revocation }) => {
  console.log(`DOKO ${dokoHash} revoked`);
});

Provenance full version history →

Introduced in v2.0.0 — NAMCHE gateway + DOKO identity.

v3.5.10 — KeyResolver activation — /namche/* routes live

Continue the Journey

← Previous

NAKPAK

Onion routing

DOKO

Identity certificates