Evidence / KruthoAir

A controlled bench demonstration of network admission and subsequent lifecycle evaluation.

Evidence state
Demonstrated
Environment
Bench

KruthoAir tested a specific architectural question: can evidence established before reaching an operational domain be evaluated there without the establishing system participating synchronously in the decision?

A phone prepared beforehand joined an aircraft-style Passpoint network. At authentication time, the issuer was not in the join path. The verifier used trust and lifecycle material available within the bench environment.

We then changed the state the verifier used. At the next network reauthentication, the verifier rejected the credential and the phone lost connectivity without further user action.

What was tested.

  1. Preparation. Credential and Passpoint profile, before admission.
  2. Join. ANQP then EAP-TLS, issuer absent from the join path.
  3. State change. Changed at the verifier, not transported to it.
  4. Evaluation. On the subsequent access-point reauthentication: rejected.
  5. Enforcement. The phone loses connectivity, not through a push.
Evaluation and enforcement stay separate. Bench sequence as exercised, not a production flow.

We prepared the phone with the credential and Passpoint profile before it reached the aircraft-style network.

At admission time, the phone encountered the Passpoint network and proceeded through ANQP and EAP-TLS. The issuer did not participate in that join path. The verifier consulted trust material and locally available state instead.

The test then changed the state used by the verifier and observed the effect through later network reauthentication.

The demonstration therefore exercised two related questions:

Question

Can network admission be evaluated without synchronous participation by the issuer?

Question

Can a later evaluation produce a different operational result when relevant lifecycle state has changed?

How the model mapped to the bench.

Several conceptual roles in the Krutho model coincided within the components used for this demonstration. They are not the same role in every deployment.

Establishment and issuance
occurred during authority-side preparation before network admission.
The holder
was the prepared phone presenting the credential during the Passpoint flow.
Verification
combined the surrounding EAP-TLS infrastructure with the Krutho-specific revocation check. FreeRADIUS and OpenSSL performed certificate-chain validation.
Evaluation and network admission
occurred through the aircraft-style network path using the trust and lifecycle material available within the bench.
Enforcement
belonged to the network infrastructure. The later operational consequence occurred through the access point's reauthentication path.

This mapping describes the exercised bench path. It does not prescribe how those responsibilities must be allocated in another Krutho deployment.

What was observed.

  1. The phone joined without the issuer in the authentication path.

    The prepared phone joined the aircraft-style Passpoint network without user action. The test record shows ANQP followed by EAP-TLS.

    That applies to the join itself. Preparing the phone took user steps, and this bench did not evaluate the enrollment experience.

    The issuer did not participate in the admission path.

  2. Evaluation used material available within the bench environment.

    The verifier operated with trust and lifecycle material available beside it rather than querying the issuer during admission.

    We also exercised the revocation hook separately against different state conditions. A missing or empty state bundle failed closed; the hook treated a credential identifier absent from an otherwise available bundle as not revoked. Those are observed properties of this bench implementation, not a policy for future deployments.

  3. A state change affected a later evaluation and network session.

    We changed the state the verifier used. On the next access-point reauthentication, the verifier rejected the credential and the phone lost connectivity without further user action.

    This demonstrates a lifecycle change affecting a later evaluation and enforcement action. It does not demonstrate immediate pushed termination at the moment the state changed.

What this demonstrates.

Taken together, the bench provides demonstrated evidence that:

  • evidence can be exercised away from its issuer;
  • an operational domain can participate in evaluating that evidence;
  • lifecycle state can be available to that domain separately from the affected holder;
  • a subsequent evaluation can produce a live operational consequence.

The admission decision did not require the issuer to participate synchronously, but the evaluator was not detached from trust or lifecycle state.

That is demonstrated evidence for part of the architectural separation described by Krutho. It is not evidence that every decision should operate this way.

Evidence boundaries.

The bench does not establish a complete production aircraft architecture.

It does not demonstrate:

  • end-to-end holder-generated key custody across the complete flow;
  • delivery of lifecycle or revocation state to an onboard verifier;
  • immediate pushed termination of active sessions;
  • Krutho-owned certificate-chain verification;
  • production airline identity integration.

The authority side generated the Wi-Fi credential and the phone installed it from a bundle, so the bench did not demonstrate holder-generated key custody. We rebuilt the revocation bundle on the verifier, so the bench did not exercise transport of that state to an onboard verifier. FreeRADIUS and OpenSSL performed chain validation; the Krutho-specific part of the path performed the revocation check.

These boundaries set what the demonstration supports.

Withdrawal was observed through reevaluation, not as an immediate push.

The active session did not terminate when the state changed.

The state the verifier used changed, the network later reevaluated through its reauthentication path, and that later evaluation produced the operational consequence.

Three things therefore remain distinct:

  • Withdrawal changes what should be accepted.
  • Evaluation determines the result when the relevant state is available.
  • Enforcement determines what happens operationally as a consequence.

The evidence is narrower than the application.

Connected Aircraft describes what the architecture makes possible when authorization decisions belong within an aircraft's operational domain.

KruthoAir establishes bounded parts of that possibility, on a bench.

Application describes architectural possibility. Evidence records what we observed.

What the bench establishes is specific.

An admission path operated without synchronous issuer participation.

Lifecycle state available to the evaluator later contributed to a different operational result through subsequent reauthentication.

Examine Connected Aircraft → How Krutho Works →