Cryptographic Provenance

End-to-end encryption keeps a message private between sender and recipient. It does not, on its own, prove who sent it. A recipient holding only encrypted ciphertext can fabricate a plausible-looking envelope after the fact. That’s the “Alice said it, not me” deniability problem, a real concern when intel is shared between competitors, regulated entities, or organizations that may end up in a dispute.

ICDB solves this with an Ed25519 signature on every share, separate from the encryption key, published to the broker’s PKI directory. Before encryption, the sender signs the exact indicator payload with their long-term signing key. The recipient verifies the signature against the broker’s PKI, then appends the original signed payload to their own tamper-evident ledger.

This produces third-party-verifiable attribution: any member can prove, months after the fact, that this specific organization signed this specific indicator at this specific time. Senders are bound to what they shared. Recipients cannot forge new shares to blame on a peer. The signature travels with the payload through every handoff.