&ND v2

+++document/meta
schemaVersion = "1"
id = "aeon-security-profiles-v1"
title = "AEON Security Profiles v1"
description = "Draft security profiles defining algorithm sets and usage policies for AEON security conventions."
family = "conventions"
group = "Security Conventions"
standing = "official"
lifecycle = "draft"
normativity = "normative"
license = "CC0-1.0"
path = "specification/conventions/aeon-security-profiles-v1"
order = 250
publish = true
keywords = ["AEON", "security profiles", "algorithms", "policy", "interoperability"]
related = ["aeon-security-architecture", "aeon-gp-security-envelope-v1", "aeon-gp-integrity-v1", "aeon-gp-signature-v1", "aeon-gp-encryption-v1"]
+++


# AEON Security Profiles v1 [# aeon-security-profiles-v1]

---


## 1. Purpose [# purpose]

Security conventions define structure.

Security profiles define approved algorithm sets and usage rules for those conventions.

Profiles help independently built systems exchange secured AEON documents without each system choosing incompatible
algorithms or policy assumptions.

---


## 2. Profile Layering [# profile-layering]

Profiles sit above the security conventions:

~~~$ text
AEON Core
   ↓
Security Conventions
   ↓
Security Profiles
   ↓
Applications / Protocols
~~~$

Profiles act as policy declarations, not structural rules.

---


## 3. Profile Declaration [# profile-declaration]

Profiles should be declared in the document metadata.

Single profile:

~~~$ aeon
aeon:header = {
  profile = "aeon.secure-standard.v1"
}
~~~$

Multiple profiles:

~~~$ aeon
aeon:header = {
  profiles = [
    "aeon.secure-standard.v1"
  ]
}
~~~$

---


## 4. [$ aeon.secure-basic.v1] [# aeon-secure-basic-v1]


### Purpose [# purpose-2]

Provides a minimal, widely implementable security baseline.

Designed for:

- simple document signing
- lightweight interchange
- developer tooling
- configuration files
- small services


### Required conventions [# required-conventions]

~~~$ text
aeon.gp.security.v1
aeon.gp.integrity.v1
aeon.gp.signature.v1
~~~$


### Allowed algorithms [# allowed-algorithms]

Hash:

~~~$ text
sha256
~~~$

Signature:

~~~$ text
ed25519
~~~$


### Not included [# not-included]

- encryption
- timestamp authorities
- Merkle proofs
- audit logs


### Example [# example]

~~~$ aeon
aeon:header = {
  encoding = "utf-8"
  conventions = [
    "aeon.gp.security.v1"
    "aeon.gp.integrity.v1"
    "aeon.gp.signature.v1"
  ]
  profile = "aeon.secure-basic.v1"
  mode = "strict"
}

data = {
  value = 42
}

"aeon:envelope":securityEnvelope = {
  integrity:integrityBlock = {
    alg:string = "sha256"
    hash:bytes = #...
  }

  signatures:signatureSet = [
    {
      alg:string = "ed25519"
      kid:string = "alice"
      sig:bytes = #...
    }
  ]
}
~~~$

---


## 5. [$ aeon.secure-standard.v1] [# aeon-secure-standard-v1]


### Purpose [# purpose-3]

Provides a general-purpose secure document profile.

Designed for:

- enterprise document exchange
- APIs
- signed records
- authenticated messages


### Required conventions [# required-conventions-2]

~~~$ text
aeon.gp.security.v1
aeon.gp.integrity.v1
aeon.gp.signature.v1
aeon.gp.encryption.v1
~~~$


### Allowed algorithms [# allowed-algorithms-2]

Hash:

~~~$ text
sha256
sha512
~~~$

Signature:

~~~$ text
ed25519
ecdsa-p256
~~~$

Encryption:

~~~$ text
xchacha20-poly1305
aes-256-gcm
~~~$


### Optional features [# optional-features]

- multiple signatures
- encryption and signature combination
- signing metadata ([$ time], [$ issuer])


### Example [# example-2]

~~~$ aeon
aeon:header = {
  profile = "aeon.secure-standard.v1"
}

"aeon:envelope":securityEnvelope = {

  encryption:encryptionBlock = {
    alg:string = "xchacha20-poly1305"
    kid:string = "bob"
    ciphertext:string = "ENCRYPTED_PAYLOAD"
  }

  integrity:integrityBlock = {
    alg:string = "sha-256"
    hash:string = "7a91e4c8..."
  }

  signatures:signatureSet = [
    {
      alg:string = "ed25519"
      kid:string = "alice"
      sig:string = "BASE64_SIGNATURE"
    }
  ]
}
~~~$

---


## 6. [$ aeon.secure-advanced.v1] [# aeon-secure-advanced-v1]


### Status [# status-2]

Reserved for later specification.


### Purpose [# purpose-4]

Represents a future high-assurance profile for large-scale verifiable systems.

Candidate use cases include:

- regulatory logs
- supply chain records
- AI traceability
- long-term archives
- distributed verification

Candidate features include:

- Merkle subtree verification
- cryptographically chained audit logs
- multiple signing authorities
- timestamp proofs
- partial document verification

---


## 7. Why Profiles Matter [# why-profiles-matter]

Profiles provide:


### Interoperability [# interoperability]

Systems can exchange AEON documents knowing which algorithms are expected.


### Security baseline [# security-baseline]

Profiles prevent weak or incompatible algorithms.


### Implementation simplicity [# implementation-simplicity]

Developers can implement a profile rather than the entire security ecosystem.

---


## 8. Initial Profile Set [# initial-profile-set]

The initial AEON security profile set is:

~~~$ text
aeon.secure-basic.v1
aeon.secure-standard.v1
~~~$

[$ aeon.secure-advanced.v1] is reserved for later specification.