Proving identity with no authority to ask
Almost every identity system in production assumes you can phone home. A login checks a credential against a server. A certificate is trusted because a chain of authorities vouches for it, and revocation works because clients can reach a list that says which certificates went bad. Take away the network and all three assumptions fail at once. You cannot reach the server, you cannot walk the chain, and you cannot fetch the revocation list. Offline Protocol operates exactly where those assumptions break, so identity has to work without any of them.
The key is the identity
The starting point is to stop treating identity as a lookup. On Offline Protocol, an identity is a keypair generated on the device and never leaves it. The public key is the name; the private key is the proof. There is no registration step with a central authority, because there is no central authority. Two devices that have never seen each other, and have no path to any server, can still establish who they are talking to, because the proof travels with the party making the claim rather than living in a directory somewhere else.
Sessions are built on Ed25519 identities and encrypted with MLS (RFC 9420), the same primitives the transport layer uses end to end. That choice matters here: MLS was designed for group messaging where membership changes and no participant is guaranteed to be reachable at any given moment, which is the offline mesh’s problem restated in a different vocabulary.
Verification is a signature check, not a phone call
When device A receives a message that claims to be from device B, it does not ask anyone whether that claim is true. It checks a signature. B signed the message with its private key; A verifies it against B’s public key. The math either holds or it does not, and it holds or fails identically whether A is in a data center or eight BLE hops deep in a building with no coverage. Verification is local, constant-time in the sense that matters operationally, and completely independent of connectivity.
This is what lets identity survive the relay path. A message in the mesh can cross up to eight intermediate devices and switch transports mid-route, and every one of those relays forwards ciphertext it cannot read. The signature the recipient checks is the sender’s, not the last hop’s. Intermediaries move bytes; they do not vouch for anyone, and they are not trusted to.
Trust on first contact, then continuity
Without an authority to anchor trust, the honest question is: the first time A sees B’s key, why should A believe it belongs to B and not an impostor? The practical answer is the same one the SSH ecosystem has relied on for decades: trust on first use, then pin. A binds the key to the counterpart when they first establish a session, ideally reinforced by an out-of-band factor that physical proximity makes easy, and any later session that presents a different key for the same counterpart is a loud, detectable event rather than a silent substitution.
Proximity is an asset offline systems have that server-based ones do not. Two people standing in the same room, or two vehicles in the same convoy, can confirm a key through a channel an attacker on the far side of the world cannot touch. The mesh turns physical presence into a trust primitive.
Revocation without a bulletin board
Revocation is the hardest part to do without a network, because the whole point of revocation is to broadcast bad news. Offline Protocol handles it the way the rest of the stack handles everything: by not depending on a single reachable point. Credentials are scoped and short-lived rather than eternal, so a compromised key expires on its own timeline instead of waiting for a global list to be consulted. When revocation news does need to move, it propagates the same way messages do, hop by hop through whatever connectivity exists, so a warning issued in one pocket of the mesh reaches the others as links open, not only when everyone is back online at once.
The trade is deliberate. A server-backed system can revoke instantly for anyone who can reach the server, and not at all for anyone who cannot. A gossip-based system revokes eventually for everyone, including the devices that never touch the internet during the incident. At the disconnected edge, eventual-for-everyone beats instant-for-the-connected, because the connected devices were never the ones at risk.
Why it matters
Identity is the layer every other guarantee rests on. Encrypted sessions, service discovery and invocation, authenticated relay, all of it assumes you can name the party on the other end and hold them to it. Doing that with a live directory is easy and well understood. Doing it with nothing but the keys the participants already carry is what makes coordination possible in the places Offline Protocol is built for.
Read more on offline identity, or talk to us about verifying identities where there is no authority to ask.