{"templateId":"markdown","versions":[{"version":"v1.40","label":"v1.40 STS","link":"/products/custody/v1.40/concepts/secure-communication","default":true,"active":false,"folderId":"c15a2701"},{"version":"v1.39","label":"v1.39 STS","link":"/products/custody/v1.39/concepts/secure-communication","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.38","label":"v1.38 STS","link":"/products/custody/v1.38/concepts/secure-communication","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/concepts/secure-communication","default":false,"active":true,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/concepts/secure-communication","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/concepts/secure-communication","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/concepts/secure-communication","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Secure communication","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"secure-communication","__idx":0},"children":["Secure communication"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Executive summary"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Ripple Custody"," protects all communications with multiple cryptographic layers: TLS, JWT authentication, mTLS, and application-layer signing."]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["TLS 1.2+"]}," encrypts all network traffic between components."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["JWT tokens"]}," authenticate every API request with cryptographic signatures."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["mTLS"]}," provides mutual authentication for critical components (notary, vault)."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application signing"]}," ensures message integrity between notary and vault."]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"success","name":"Why this matters"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Communication security prevents man-in-the-middle attacks, credential theft, and message tampering. Even if an attacker gains network access, the layered security model ensures they cannot intercept sensitive data or forge authorized requests. This is essential for meeting SOC 2, ISO 27001, and other security compliance requirements."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["For architects and operators"]},": You are responsible for providing TLS certificates and configuring your PKI. Plan certificate rotation procedures before deployment. Ensure your network infrastructure supports mTLS for notary-vault communication."]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Prerequisites"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before reading this page, you should understand:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.34/concepts/security"},"children":["Security architecture"]}," - The overall security model and zero-trust principles"]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"overview","__idx":1},"children":["Overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The platform implements defense-in-depth for all communications:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Layer"},"children":["Layer"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Protection"},"children":["Protection"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Transport"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["TLS 1.2+"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Encrypts all network traffic"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identity"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["JWT tokens"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Authenticates API requests"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Mutual authentication"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["mTLS certificates"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Verifies both client and server for critical components"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Digital signatures"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ensures message integrity and non-repudiation"]}]}]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"success","name":"Key Takeaway"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["These controls work together to prevent ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["man-in-the-middle attacks"]},". Even if an attacker intercepts network traffic, they cannot decrypt it (TLS), impersonate a user (JWT signatures), or impersonate a trusted component (mTLS certificates). Messages between the notary and vault are additionally signed at the application layer, providing defense-in-depth."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"authentication","__idx":2},"children":["Authentication"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"jwt-authentication","__idx":3},"children":["JWT authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["JSON Web Token (JWT)"]}," is a compact, digitally signed token that proves a user's identity without requiring the server to look up session data. Think of it as a tamper-proof ID badge: it contains claims about who you are, is signed by a trusted authority, and can be verified by any component that trusts that authority."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["All requests to the API backend must authenticate using a JWT passed as a bearer token."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Aspect"},"children":["Aspect"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Details"},"children":["Details"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identity provider"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The Authentication Server (a dedicated OIDC server) verifies user identity and issues JWTs"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Token expiration"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Default is four hours"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Obtaining a JWT"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Challenge-response: user signs a random challenge with their private key; server validates and returns JWT"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Challenge reuse"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Challenges can only be used once to prevent replay attacks"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"digital-signatures-for-authorization","__idx":4},"children":["Digital signatures for authorization"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Any request (Intent) to change the system state requires a digital signature. This proves the request came from the claimed user and has not been modified."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["How it works"]},": The user's application creates a unique \"fingerprint\" of the request and signs it with their private key. The platform verifies this signature using the user's registered public key. If even one character of the request was changed, the signature becomes invalid."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Technical process:"]}]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Canonicalization"]},": Request body converted to canonical JSON (spaces removed, properties sorted, null values removed)."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Hashing"]},": Canonical JSON hashed using SHA-256."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Signing"]},": Hash signed using the user's private key (stored externally—never communicated to the platform)."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Encoding"]},": Signature serialized in DER format with Base64 encoding."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The notary verifies this signature against the user's registered public key. This prevents both impersonation and tampering."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"network-security","__idx":5},"children":["Network security"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"mutual-tls-mtls","__idx":6},"children":["Mutual TLS (mTLS)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Standard TLS (Transport Layer Security) is one-way: the client verifies the server's certificate, but the server doesn't verify the client. ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Mutual TLS (mTLS)"]}," requires both parties to present and verify certificates — each side proves its identity to the other before any data is exchanged."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Ripple Custody"," uses mTLS for communication between critical components (notary, vault) to ensure that even if an attacker gains network access, they cannot impersonate a trusted component."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"your-internal-pki","__idx":7},"children":["Your internal PKI"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You must provide TLS entities from your internal PKI:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["CA certificate"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Server certificate"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Server certificate key"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["These secure the four ingress endpoints:"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Note"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The endpoints below are examples. Replace ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["open-shift-cluster-domain"]}," with your actual OpenShift cluster domain."]}]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Endpoint"},"children":["Endpoint"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["api."]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["API Gateway"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["frontend."]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Web UI"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["auth."]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Authentication Server"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["notary-bridge."]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["notary Bridge"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"internal-platform-communication","__idx":8},"children":["Internal platform communication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Communication between core components (on OpenShift) and secure components (notary/vault on HPVS) uses:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Mechanism"},"children":["Mechanism"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application-layer mutual trust"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["End-to-end encrypted connection between vault and notary"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Signed messages"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Information exchanged is signed and verified on both ends"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Key exchange at setup"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A key exchange during system setup builds the chain of trust"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"dependency-connections","__idx":9},"children":["Dependency connections"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Connections to infrastructure services you provide:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Service"},"children":["Service"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Security"},"children":["Security"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["KMS/HSM"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Cryptographic signing operations"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["mTLS or HSM-specific secure protocol"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["PostgreSQL"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Data storage"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["TLS; data integrity verified cryptographically by notary"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["AMQP (RabbitMQ)"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Async message queue"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["TLS"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Container registry"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Container image distribution"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["TLS; image signatures verified"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"blockchain-connections","__idx":10},"children":["Blockchain connections"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Connection"},"children":["Connection"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Indexer to node"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Chain-specific indexers monitor your blockchain nodes (direct or via http_proxy; Bitcoin supports socks5)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Transaction broadcast"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ledger Accounting Service broadcasts signed transactions"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"the-security-lifecycle-in-practice","__idx":11},"children":["The security lifecycle in practice"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A typical governed transaction follows this flow:"]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"sequenceDiagram\n participant User\n participant API as API Gateway\n participant Auth as Auth Server\n participant Notary\n participant Vault\n participant KMS\n\n User->>Auth: 1. Authenticate (challenge-response)\n Auth-->>User: JWT token\n\n User->>API: 2. Submit signed Intent (JWT + TLS)\n API->>Notary: 3. Forward Intent (mTLS)\n\n Notary->>Notary: 4. Verify user signature\n Notary->>Notary: 5. Check policies & Merkle tree\n Notary->>Notary: 6. Verify ARF version\n\n Notary->>Vault: 7. Request signing (mTLS + signed message)\n Vault->>KMS: 8. Sign transaction\n KMS-->>Vault: 9. Return signature only\n\n Vault-->>Notary: 10. Signed transaction\n Notary->>Notary: 11. Update Merkle tree & ARF\n","diagramHtml":"KMSVaultNotaryAuth ServerAPI GatewayUserKMSVaultNotaryAuth ServerAPI GatewayUser1. Authenticate (challenge-response)JWT token2. Submit signed Intent (JWT + TLS)3. Forward Intent (mTLS)4. Verify user signature5. Check policies & Merkle tree6. Verify ARF version7. Request signing (mTLS + signed message)8. Sign transaction9. Return signature only10. Signed transaction11. Update Merkle tree & ARF","diagramHtmlDark":"KMSVaultNotaryAuth ServerAPI GatewayUserKMSVaultNotaryAuth ServerAPI GatewayUser1. Authenticate (challenge-response)JWT token2. Submit signed Intent (JWT + TLS)3. Forward Intent (mTLS)4. Verify user signature5. Check policies & Merkle tree6. Verify ARF version7. Request signing (mTLS + signed message)8. Sign transaction9. Return signature only10. Signed transaction11. Update Merkle tree & ARF"},"children":["sequenceDiagram\n participant User\n participant API as API Gateway\n participant Auth as Auth Server\n participant Notary\n participant Vault\n participant KMS\n\n User->>Auth: 1. Authenticate (challenge-response)\n Auth-->>User: JWT token\n\n User->>API: 2. Submit signed Intent (JWT + TLS)\n API->>Notary: 3. Forward Intent (mTLS)\n\n Notary->>Notary: 4. Verify user signature\n Notary->>Notary: 5. Check policies & Merkle tree\n Notary->>Notary: 6. Verify ARF version\n\n Notary->>Vault: 7. Request signing (mTLS + signed message)\n Vault->>KMS: 8. Sign transaction\n KMS-->>Vault: 9. Return signature only\n\n Vault-->>Notary: 10. Signed transaction\n Notary->>Notary: 11. Update Merkle tree & ARF\n"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Step"},"children":["Step"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Security Controls"},"children":["Security Controls"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["1-2"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["TLS encryption, JWT authentication, digital signature"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["3-6"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["mTLS, signature verification, state validation"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["7-9"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["mTLS, application-layer signing, key isolation"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["10-11"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Cryptographic state commitment"]}]}]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"glossary","__idx":12},"children":["Glossary"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Term"},"children":["Term"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Definition"},"children":["Definition"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["ARF"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Anti-rewind file. A cryptographically protected file that tracks the current state version to prevent replay attacks. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.34/concepts/data-integrity#anti-rewind-file-arf"},"children":["Data integrity"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Bearer token"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["An authentication token included in HTTP request headers. Anyone \"bearing\" the token can use it, so it must be transmitted over TLS."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Canonical JSON"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A standardized JSON format with sorted keys and no whitespace, ensuring the same data always produces the same byte sequence for signing."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["DER format"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Distinguished Encoding Rules. A binary encoding for cryptographic data structures like signatures and certificates."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Intent"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A signed request to change system state (e.g., transfer funds, update a policy)."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["JWT"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["JSON Web Token. A compact, signed token containing identity claims, used for stateless authentication."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["mTLS"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Mutual TLS. A TLS connection where both client and server present certificates and verify each other's identity."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OIDC"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["OpenID Connect. An identity layer built on OAuth 2.0 that enables authentication and identity verification."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["PKI"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Public Key Infrastructure. A system of certificates, certificate authorities, and trust relationships used to verify identities."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["TLS"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Transport Layer Security. A cryptographic protocol that encrypts network traffic and verifies server identity."]}]}]}]}]}]},"headings":[{"value":"Secure communication","id":"secure-communication","depth":1},{"value":"Overview","id":"overview","depth":2},{"value":"Authentication","id":"authentication","depth":2},{"value":"JWT authentication","id":"jwt-authentication","depth":3},{"value":"Digital signatures for authorization","id":"digital-signatures-for-authorization","depth":3},{"value":"Network security","id":"network-security","depth":2},{"value":"Mutual TLS (mTLS)","id":"mutual-tls-mtls","depth":3},{"value":"Your internal PKI","id":"your-internal-pki","depth":3},{"value":"Internal platform communication","id":"internal-platform-communication","depth":3},{"value":"Dependency connections","id":"dependency-connections","depth":3},{"value":"Blockchain connections","id":"blockchain-connections","depth":3},{"value":"The security lifecycle in practice","id":"the-security-lifecycle-in-practice","depth":2},{"value":"Glossary","id":"glossary","depth":2}],"frontmatter":{"seo":{"title":"Secure communication"}},"lastModified":"2026-04-07T19:14:09.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/v1.34/concepts/secure-communication","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}