AEON GP Security Envelope v1

Convention identifier: aeon.gp.security.v1

Status

Draft interoperability convention

Purpose

Defines the standard AEON security envelope used for:

• document integrity
• signatures
• encryption
• additional security extensions

The envelope is the document closure.

1. Envelope Placement

The envelope must be the final binding in the document.

Rules:

• no bindings may follow aeon:envelope
• only whitespace/comments may appear after it
• envelope is excluded from integrity hashing

2. Envelope Binding

The envelope is always:

The envelope object may contain the following sections.

3. Envelope Sections

3.1 integrity

Defines canonical document hashing.

Provided by aeon.gp.integrity.v1.

Example:

Fields:

3.2 signatures

Defines one or more signatures over the integrity hash.

Provided by aeon.gp.signature.v1.

Example:

Fields:

Multiple signatures are allowed.

3.3 encryption

Defines encrypted payloads.

Provided by aeon.gp.encryption.v1.

Example:

Fields:

3.4 Optional extensions

Additional sections may appear if declared by conventions.

Examples:

These must be defined by their respective conventions.

4. Full Example

5. Verification Flow

A processor verifying integrity should:

1. Parse AEON document
2. Locate aeon:envelope
3. Remove envelope from hash coverage
4. Compute canonical hash
5. Compare with integrity.hash
6. Verify signatures

6. Design Goals

The envelope model is designed to be:

• deterministic
• streamable
• cryptographically neutral
• convention-driven
• easy to implement

AEON core remains independent of cryptographic algorithms.

7. Non-goals

The envelope does not define:

• trust models
• key distribution
• certificate authorities
• algorithm requirements

These are left to conventions or processors.

8. Architectural Summary

The AEON security architecture becomes:

Core stays minimal while the ecosystem provides security capabilities.

9. Related Security Conventions

Detailed rules for envelope sections are defined by separate conventions:

The envelope convention defines placement and section structure. The child conventions define the contents and processing rules for each section.