17. The Lighthouse Keys
Domain: Cryptography — PKI, Salting, Key Management POV: Quill Reading time: ~15 minutes
The Archipelago communicated with the Citadel through a network of lighthouses — tall stone towers scattered across the islands, their great lanterns sending coded pulses of light across the water. The codes had been established centuries ago by treaty between the two territories: each lighthouse had a unique light-pattern, and the pattern could be trusted because it came from a lighthouse that had been verified by the Lighthouse-Keepers’ Guild, which was itself verified by the ancient compact between the Archipelago and the Citadel. Trust flowed downward in a chain: the compact verified the Guild, the Guild verified the lighthouses, and the lighthouses verified the messages.
Quill had never thought about this system before — it was simply how things worked, as fundamental and as unexamined as the sunrise. But the compromised master key had changed everything. If Vale possessed a key that could bypass every access control in the city, then the same principle applied to the lighthouses. If someone could compromise the Guild, or forge a lighthouse’s credentials, or intercept and alter a message in transit, then the entire communication network between the Citadel and the Archipelago — and, by extension, the Weave-lands and every other territory that depended on the lighthouses — could be subverted.
“We need to verify the lighthouses,” Quill said to the council. “Every one of them. Not just the messages they send, but the lighthouses themselves — their identity, their authority, their right to speak for the Archipelago. And we need a system for doing this that does not depend on any single point of trust that could be compromised.”
The solution, which took Quill a week to design and another week to implement, was something he called the Lighthouse Trust.
It was built on the same principles as the digital signature system they had already established for the city’s own documents — public-key cryptography, hashing, verification — but it extended those principles across the water, creating a network of trust that could survive the compromise of any single node.
Every lighthouse in the Archipelago received a key-pair: a private key, which the lighthouse kept secret and used to sign its messages, and a public key, which was registered in a central directory maintained jointly by the Citadel and the Archipelago. When a lighthouse sent a message, it signed the message with its private key. When the Citadel received the message, it verified the signature against the lighthouse’s public key in the directory. The verification proved two things: that the message really came from that lighthouse, and that the message had not been altered in transit.
But that was only the first layer of the system. The second layer addressed the question that had been keeping Quill awake at night: who verified the directory? If the directory itself could be compromised — if someone could add a fake lighthouse to the registry, or alter a lighthouse’s public key, or delete a legitimate lighthouse’s entry — then the entire system collapsed. The signatures and the hashes and the verifications would all be flawless, and they would all be verifying a lie.
The answer was what the old cryptographic treatises called a chain of trust — or, in the more formal language that Quill preferred, a public key infrastructure.
At the top of the chain was the Root Authority: the ancient compact between the Citadel and the Archipelago, embodied not in any single person or institution but in the shared set of principles that governed relations between the two territories. The compact’s authority was not granted by any higher power — it was self-authenticating, accepted by both sides as the foundation on which all other trust was built.
Below the Root Authority were the Intermediate Authorities: the Lighthouse-Keepers’ Guild and the Citadel’s own Office of External Communications. Each intermediate authority had its own key-pair, and its public key was signed by the Root Authority — which meant that anyone who trusted the compact could verify that the intermediate authorities were legitimate.
And below the intermediate authorities were the individual lighthouses. Each lighthouse’s public key was signed by the Guild, which meant that anyone who trusted the Guild — and, by extension, the compact that verified the Guild — could trust the lighthouse.
“If anyone tries to add a fake lighthouse to the directory,” Quill explained, “its public key will not be signed by the Guild, and the verification will fail. If anyone tries to alter a lighthouse’s public key, the Guild’s signature will no longer match, and the alteration will be detected. And if anyone tries to compromise the Guild itself — to create a fake Guild with its own key-pair — the Root Authority will not recognize it, and the entire chain will break.”
“It is a chain,” Sable said, studying the diagram that Quill had drawn across three sheets of paper taped together. “Each link depends on the link above it. If any link is compromised, every link below it is compromised too. But if the chain is built correctly, the compromise of one link does not mean the compromise of the whole. You can replace the broken link and restore the chain.”
“Yes,” Quill said. “It is called a certificate authority — the entity that signs the public keys and vouches for their authenticity. The Root Authority is the ultimate certificate authority, the one that everyone trusts without needing to verify further. The intermediate authorities are certificate authorities for their specific domains. And the lighthouses are the endpoints — the entities whose identities are being verified.”
The implementation of the Lighthouse Trust was complicated by a problem that Quill had not anticipated: the old authentication tokens that the lighthouses had been using for centuries were stored in plain form — the equivalent of writing a password on a piece of paper and leaving it on a desk. Anyone who gained access to the token storage could impersonate any lighthouse in the network.
“The tokens need to be hashed,” Quill said, slamming the relevant treatise onto the workbench with more force than he intended. “We cannot store them in a form that can be read by anyone who gains access to the storage. We need to apply a hash function — the same kind we use for document integrity — but with an additional ingredient. A random value, unique to each token, that is added before the hash is computed. That way, even if two lighthouses happen to use the same token — which they should not, but people make mistakes — their stored hashes will be different.”
“A salt,” Thread said quietly. “That is what you are describing. A random value added to the input before hashing, so that identical inputs produce different hashes.”
Quill blinked. “You have read the cryptographic treatises?”
“I have read many things.”
“Yes. A salt. It prevents something called a rainbow table attack — precomputing the hashes of common tokens and using the precomputed table to reverse the hash. With a salt, even a common token produces a unique hash, because the salt makes the input to the hash function unique. The attacker would need to precompute a separate table for every possible salt value, which is computationally infeasible.”
Wren, who had been listening to the technical discussion with the slightly glazed expression of someone who was absorbing more than she appeared to be absorbing, spoke for the first time. “So we are protecting the tokens in three ways. We are hashing them so they cannot be read directly. We are salting them so that even if two tokens are the same, their hashes are different. And we are using public-key signatures so that even if a token is compromised, we can detect the compromise by verifying the signature against the public key registry.”
“Four ways,” Quill said. “We are also rotating the keys regularly. Every lighthouse in the network is scheduled to receive a new key-pair every thirty days. The old keys are revoked — added to a certificate revocation list that is distributed to every node in the network. If someone compromises a key, the compromise is limited to a thirty-day window, and after that the key is worthless.”
“Key management,” Kip said. “Generation, storage, rotation, revocation. The cryptography itself — the hashes and the signatures and the ciphers — is only one part of the system. The other part is making sure that the keys are protected throughout their entire lifecycle.”
“Yes,” Quill said, and the word carried the weight of weeks of work — the treatises, the diagrams, the arguments with skeptical lighthouse-keepers who did not understand why their centuries-old system needed to change. “Cryptography is mathematics. Key management is process. And process, in the end, is harder than mathematics — because mathematics is consistent and predictable, and people are neither.”
One month after the Lighthouse Trust was established, a lighthouse in the outer Archipelago — a remote station on a rocky island called Storm’s End — went dark for six hours and then came back online. When it did, its messages bore a signature that did not match the public key in the directory. The Guild’s verification system flagged the discrepancy immediately. The lighthouse had been compromised — its private key stolen, its identity impersonated — but the impersonation failed because the stolen key was no longer valid. It had been rotated two weeks earlier, part of the regular thirty-day cycle, and the old key had been added to the certificate revocation list.
“The system worked,” Quill said, reading the report from the Guild with a quiet, exhausted satisfaction. “The lighthouse was compromised, but the compromise was detected and contained. The impersonator could not send messages in the lighthouse’s name because the key they stole was already revoked. The damage was limited to six hours of silence — not six hours of fraudulent messages that could have poisoned the entire communication network.”
He set the report aside and looked at the diagram of the Lighthouse Trust, still pinned to the wall of the shed — the Root Authority at the top, the intermediate authorities below, the lighthouses arrayed across the bottom like stars in a constellation. It was not perfect. No system was perfect. But it was better than what had come before — better than the uncritical trust that had governed the Archipelago’s communications for centuries, better than the assumption that a lighthouse’s signal was genuine simply because it came from a lighthouse.
Trust, Quill understood now, was not a gift. It was a structure — a chain of verifications, each one depending on the ones above it, all of them depending on the integrity of the keys and the processes that managed them. And a structure, unlike a gift, could be built and rebuilt and strengthened, generation by generation, until it was strong enough to withstand whatever the Shroud — or Vale, or any other adversary — could throw against it.