Remote ATtestation procedureS D. Condrey Internet-Draft WritersLogic Intended status: Standards Track 14 February 2026 Expires: 18 August 2026 Proof of Process (PoP): Forensic Appraisal and Security Model draft-condrey-rats-pop-appraisal-00 Abstract This document specifies the forensic appraisal methodology and quantitative security model for the Proof of Process (PoP) framework. It defines how Verifiers evaluate behavioral entropy, perform liveness detection (SNR and Cognitive Load Correlation), and calculate forgery cost bounds. Additionally, it establishes the taxonomy for Absence Proofs and the Tool Receipt protocol for AI attribution within the linear human authoring process. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 18 August 2026. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. Condrey Expires 18 August 2026 [Page 1] Internet-Draft PoP Appraisal February 2026 This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Jitter Seal: Captured Behavioral Entropy . . . . . . . . . . 2 2.1. Entropy Thresholds . . . . . . . . . . . . . . . . . . . 2 3. Semantic Event Definitions . . . . . . . . . . . . . . . . . 2 4. Forensic Assessment Mechanisms . . . . . . . . . . . . . . . 3 5. Forgery Cost Bounds . . . . . . . . . . . . . . . . . . . . . 3 6. Absence Proofs and Tool Receipts . . . . . . . . . . . . . . 3 7. Privacy and Inclusivity . . . . . . . . . . . . . . . . . . . 4 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 4 8.1. Normative References . . . . . . . . . . . . . . . . . . 4 8.2. Informative References . . . . . . . . . . . . . . . . . 4 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 5 1. Introduction The value of Proof of Process (PoP) evidence lies in the Verifier's ability to distinguish biological effort from algorithmic simulation. This document provides the normative framework for forensic appraisal, defining the appraisal logic required to generate a Writers Authenticity Report (WAR). 2. Jitter Seal: Captured Behavioral Entropy Verifiers appraisal behavioral entropy (jitter) to establish a biological binding to the document. 2.1. Entropy Thresholds For a checkpoint to be considered "Biologically Bound," the JitterDigest MUST contain at least a minimum threshold of min-entropy (H_min). For ENHANCED profiles, this protocol RECOMMENDS *H_min = 128 bits* per 1,000 characters of input. 3. Semantic Event Definitions Verifiers use canonical semantic events to reconstruct the authorship topology: Condrey Expires 18 August 2026 [Page 2] Internet-Draft PoP Appraisal February 2026 INS (Insert): Content addition at specific offsets. DEL (Delete): Range-based content removal (error correction analysis). MOV (Move): Content restructuring (high cognitive load indicator). PASTE (Import): External source integration (AI agent attribution). 4. Forensic Assessment Mechanisms SNR (Signal-to-Noise Ratio) Analysis: Verifying the 1/f fractal noise signature of human motor signals to detect machine-clocked synthetic injection. Cognitive Load Correlation (CLC): To defeat high-fidelity deepfake jitter, Verifiers MUST correlate timing cadence with semantic complexity (IKIs for complex vs simple segments). Mechanical Turk Detection: Analyzing intra-checkpoint correlation (C_intra) to detect "robotic pacing" in automated systems. QR Presence Challenge (OOB-PC): Bridging the digital-physical gap via secondary physical devices to ensure a human is in the loop. 5. Forgery Cost Bounds Verifiers calculate the quantified economic cost (_C_total_) required to forge an Evidence Packet: C_total = C_vdf + C_entropy + C_hardware * *C_vdf:* Electricity and pro-rated hardware cost for sequential VDF computation. * *C_entropy:* Effort required to synthesize biological noise that satisfies SNR and CLC constraints. 6. Absence Proofs and Tool Receipts Specifies the *Tool Receipt Protocol* for AI agent attribution and the three-type taxonomy for negative evidence claims (Computationally-bound, Monitoring-dependent, and Environmental). Condrey Expires 18 August 2026 [Page 3] Internet-Draft PoP Appraisal February 2026 7. Privacy and Inclusivity To mitigate de-anonymization risks, Verifiers MUST support *Evidence Quantization*. To ensure inclusivity, Verifiers MUST support *Accessibility Modes* for non-typical authors (e.g., motor disabilities). 8. References 8.1. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . [RFC9334] Birkholz, H., Thaler, D., Richardson, M., Smith, N., and W. Pan, "Remote ATtestation procedureS (RATS) Architecture", RFC 9334, DOI 10.17487/RFC9334, January 2023, . 8.2. Informative References [Goodman2007] Goodman, A. and V. Zabala, "Using Stylometry for Biometric Keystroke Dynamics", 2007, . [Monrose2000] Monrose, F. and A. Rubin, "Keystroke dynamics as a biometric for authentication", 2000, . [PoP-Protocol] Condrey, D., "Proof of Process (PoP): Architecture, Evidence Format, and VDF", Work in Progress, Internet- Draft, draft-condrey-rats-pop-protocol-01, 2026, . Condrey Expires 18 August 2026 [Page 4] Internet-Draft PoP Appraisal February 2026 [Sardar-RATS] Sardar, M.U., "Security Considerations for Remote ATtestation procedureS (RATS)", May 2024, . Author's Address David Condrey WritersLogic Inc San Diego, California, United States Email: david@writerslogic.com Condrey Expires 18 August 2026 [Page 5]