Bearer, Bound, Attested: Factoring Key Binding, Provenance, and Attestation for Zero-Trust Enforcement (reproducible artefact)

Software archive

Version: v1.1. Published: 28 August 2026. Software license: MIT, as stated in the Zenodo record.

The archive compares four enforcement configurations: bearer JWTs, certificate-bound tokens using RFC 8705, an attestation-gated bound-token control, and SPIFFE X.509 SVIDs. The described architecture combines an NGINX-style policy enforcement point with Open Policy Agent.

Materials and reproduction instructions

The package includes a measurement harness, bootstrap and TOST analysis, ablations and second-host experiments, a ProVerif 2.05 model suite with replay, forwarding and self-assertion controls, and SPIRE 1.9.6 validation material. Download LNET_V3_artifact.zip from the official archive for the reproduction instructions and recorded results.

Cite the version used

Yulliwas Ameur; Soumya Banerjee; Samia Bouzefrane. Bearer, Bound, Attested: Factoring Key Binding, Provenance, and Attestation for Zero-Trust Enforcement (reproducible artefact). Version v1.1. Zenodo, 2026. Version DOI.

The concept DOI groups versions of the archive. Cite the version DOI above when using this specific release. Download the site bibliography in BibTeX.