Lucid sovereignty (location) certificates

What it is

Sovereignty Certificates are a draft specification for "cryptographic credentials that provide verifiable, unforgeable proof of the physical location of a computing workload at a specific point in time", according to the repository README ¹. The document is version 0.1.0, dated 2025-10-21, marked "Draft" and "Prepared by: Sovereignty Certificates Working Group" ¹. It describes itself as an industry-led specification, not an official standard from a body such as ISO or IEC ¹. It is licensed CC BY 4.0 ¹.

The specification applies delay-based location verification to computing devices such as CPUs and GPUs ¹. Its repository sits in Lucid Computing's GitHub organization ¹. The working group's website describes the group as an independent initiative ². It lists participants by category, including chip makers, cloud providers, frontier AI labs and compute-governance organizations, without naming them ². Lucid's homepage links to the effort and describes Lucid's own offering as attested, confidential-computing GPU clusters with data-residency controls ³.

How it works

The specification calls its method ping-based location attestation ¹. Signals cannot travel faster than light, so a measured round-trip time gives an upper bound on the device's distance from each anchor ¹. The specification describes the following steps ¹:

1. The verifier sends the attester a fresh nonce and a signed directory of trusted anchors.
2. From inside a trusted execution environment, the attester probes several anchors chosen to give good geometry.
3. Each anchor returns a signed receipt with a timestamp and the probe's nonce, and the attester records when each reply arrives.
4. The attester bundles the receipts with a hardware attestation quote that binds a per-cycle key and the verifier's nonce to the platform.
5. The verifier checks signatures, freshness and platform integrity, then runs a deterministic multilateration to compute a feasible region.
6. The verifier issues a short-lived certificate stating the location, radius and confidence, and which policies passed.

Workloads must fail closed when a certificate expires ¹. The specification argues that tunnels and VPNs add latency, so they generally cannot make a device appear closer to an anchor than it is, and usually produce geometrically inconsistent measurements ¹. It requires rejecting evidence whose distance bounds have an empty or impossible intersection ¹. Anchors should monitor each other's round-trip times, and an anchor that deviates from the physical baseline should be temporarily removed from the directory ¹.

Evidence

• Specification. The draft is version 0.1.0, dated 2025-10-21 ¹. The working group's site listed January 2026 as the target for a final version ². As of September 2026 the repository still holds draft 0.1.0 and no reference implementation ¹.
• Worked example. Annex B illustrates a result with a 45 m radius and 0.92 confidence from seven anchor receipts. It is an example, not a measurement ¹. For comparison, Brass and Aarne report that delay-based methods locate devices to within about 10 km to 1,000 km, depending on the algorithm ⁶.
• Lucid's statements. Lucid's homepage says that "every cluster can prove where it is, whose silicon ran, what executed, and how data moved" ³. Its developer documentation lists a "Data Sovereignty & Localization" auditor, described as "Ensuring data remains within approved geographic jurisdictions" ⁴. Neither explains how location is determined or reports results ^{3 4}.

As of September 2026 no test deployment or measured location results have been published ^{1 3 4}.

Limitations

• Trusted hardware. The threat model lets the attacker control the network and hold root on the host, including where the host is an untrusted cloud provider. It trusts the hardware root of trust and the TEE, and leaves sophisticated physical attacks as a residual risk ¹.
• Key extraction. Tee and Happel argue that keys stored on the chip, on which ping-based protocols rely, may be extractable by adversaries with physical access ⁵.
• General delay attacks. Adding delay, using faster network paths and compromising landmarks are known weaknesses of delay-based location verification ⁶. The specification relies on signed anchor directories, HSM-protected keys, diverse and independently operated anchors, and anchor peer monitoring against some of these ¹.