[saag] Re: [EXT] Interests on Initiating the standardization work related to "Zero Trust"?

[Benfeng Chen <[e-mail]>]

Hi Usama:

Thanks for the clarification. I’m not comparing Noise with TLS here, as
that isn’t the focus of the discussion.


Both WhatsApp and NHP initially chose the Noise protocol because it was
considered secure and fast for their respective threat models. Meta’s later
transition to attested TLS was driven by deployment and integration
requirements for confidential computing, not by any identified weakness in
Noise itself.


Both documents describe the same user scenario and security objective:
enabling server-side processing while preventing the service operator from
accessing plaintext. The difference reflects an evolution in
implementation, not a change in security assumptions.


To clarify scope, NHP is not an attempt to standardize “Zero Trust.” It
addresses a concrete protocol-level gap: network resources remain globally
visible prior to authentication, enabling large-scale reconnaissance and
pre-auth exploitation. As stated in *Section 4 (Security Considerations /
Relationship to Existing Protocols)* of *draft-opennhp-saag-nhp
<https://datatracker.ietf.org/doc/html/draft-opennhp-saag>*, NHP
operates *below
and alongside TLS*, and is *explicitly complementary to attested TLS rather
than competing with it*.


We appreciate the feedback and will keep the documentation aligned with
current deployments.



On Sun, Jan 4, 2026 at 3:19 PM Muhammad Usama Sardar <
[e-mail]> wrote:

> Thanks for sharing this.
> On 04.01.26 09:21, Benfeng Chen wrote:
>
>
>    -
>
>    A full open-source implementation is available under the Apache 2.0
>    license:
>    https://github.com/OpenNHP/opennhp
>
> I am not sure how accurate and up-to-date this documentation is. The
> current README claims Whatsapp uses Noise protocol citing a white paper
> from 19 April, 2024, but Whatsapp has moved to attested TLS (see white
> paper from 10 June, 2025 [0]).
>
> We are not proposing to standardize the term “Zero Trust,”
>
> Thanks very much!
>
> -Usama
>
> [0]
> https://ai.meta.com/static-resource/private-processing-technical-whitepaper
>