xWall: The Firewall That Proves It Never Saw Your Data

Fast Onboarding

Traditional firewall deployment requires manual configuration of inspection nodes, share distribution paths, MPC coordination, and zero-knowledge proof infrastructure. xWall collapses this to 15 seconds with zero-click accept, 90 seconds with one-line CLI, and 10 minutes with deploy buttons.

Speed Tiers

Quick Start: Zero-Click

# 1. Set invite code (from platform onboarding email)
export XWALL_INVITE_CODE=XWALL-abc123

# 2. Deploy your first gateway (auto-accepts invite)
npx @private.me/xwall deploy \
  --threshold 2 \
  --total-shares 3 \
  --nodes "node1.example.com,node2.example.com,node3.example.com"

CLI Setup (90 seconds)

# Install CLI globally
npm install -g @private.me/xwall

# Initialize (generates gateway DID, configures inspection nodes)
xwall init

# Deploy your first gateway
xwall deploy \
  --threshold 2 \
  --total-shares 3 \
  --nodes "node1.example.com,node2.example.com,node3.example.com"

# Output:
#  Gateway DID generated
#  Inspection nodes registered
#  Share distribution paths configured
#  MPC coordinator initialized
#  Ready to inspect traffic

Deploy Button Setup (10 minutes)

Click one button to provision gateway + inspection nodes + ZK prover on Vercel/Railway/DigitalOcean:

Viral Growth Mechanics

Every xWall deployment becomes a growth vector:

The Inspection Paradox

Every firewall in production today must see your data to protect it. TLS inspection is a man-in-the-middle attack you agreed to. One compromised appliance exposes everything.

Why Every Firewall Must See Your Data

To inspect encrypted traffic, traditional firewalls perform TLS interception: they terminate the TLS session, decrypt the plaintext, apply firewall rules, re-encrypt, and forward. This creates a single point of total visibility. Compromise one appliance and the attacker sees every byte of traffic flowing through it.

This is not a theoretical risk. In 2024-2025 alone, major firewall vendors disclosed critical vulnerabilities that gave attackers remote code execution on inspection appliances. Over 16,620 devices were found with persistent backdoors that survived firmware patches via symbolic link persistence.

The Privacy/Security Conflict

Regulations demand both inspection and privacy — simultaneously. HIPAA prohibits exposing protected health information to middleboxes. GDPR requires data minimization. CCPA restricts processing of personal data. Yet security best practice demands deep packet inspection.

The result: only 3% of organizations inspect all encrypted traffic. The other 97% are flying partially blind — and the problem is getting worse. TLS 1.3 Encrypted Client Hello (ECH) eliminates the last metadata-based filtering workaround (SNI). Certificate lifespans are dropping to 47 days by 2029, making break-and-inspect architectures increasingly fragile.

Failed Alternatives

The Harvest-Now, Decrypt-Later Threat

State actors are capturing encrypted traffic at scale today, banking on future quantum computers to retroactively decrypt it. The industry is spending $15B migrating to post-quantum cryptography — but even PQ algorithms (lattice-based, code-based) rely on computational assumptions that may fall to future mathematical advances.

xWall does not rely on computational assumptions at all. Information-theoretic security means there is no algorithm to break — not today, not with quantum computers, not ever.

Information-Theoretic Network Inspection

Inspect on shares. Traffic is threshold-split via XorIDA. Each share is mathematically proven to contain zero information. Firewall rules are evaluated via multi-party computation on shares. Plaintext never exists at any firewall node.

Core Concept

Instead of decrypting traffic to inspect it, xWall splits traffic into K-of-N threshold shares using XorIDA (threshold sharing over GF(2)). Each share is routed to an independent firewall node via a separate network path. The nodes evaluate firewall rules collaboratively via multi-party computation (MPC) — without any node ever possessing the plaintext.

Why This Works at Wire Speed

Generic MPC is too slow because it requires extensive communication between parties for every operation. XorIDA's XOR-homomorphic property eliminates this for the majority of firewall rules. At packet sizes (64B–1KB), XorIDA splitting is 2–11x faster than AES-256-GCM encryption:

Packet-sized payloads are the sweet spot for this technology. The crossover point where AES-256-GCM becomes competitive is around 1–2 KB — well above typical packet sizes.

Rule Classification

Firewall rules compile to boolean circuits with two classes of gates:

Most common firewall rules are Class 1 — free evaluation. Complex DPI requiring AND gates adds approximately 500µs per round, but the fast path eliminates this for established connections.

Split-Path Architecture

Each node processes exactly one share. No node can reconstruct the traffic. The destination reconstructs only after MPC approval. Independent network paths for share delivery ensure that compromising the network path to one node does not compromise the path to another.

Fast Path for Established Sessions

Full MPC evaluation runs on the first packet of a new connection. Once the connection is classified as allowed, subsequent packets use the information-theoretic fast path (~1ms via xChange key transport). Session binding prevents bypass. Periodic re-evaluation is configurable per policy.

Zero-Knowledge Compliance

The first firewall that can prove its rules were correctly applied — without revealing the traffic. Compliance by architecture, not by policy.

The Audit Problem

Enterprise firewalls accumulate rules over years. Studies consistently find 47% unused rules in the average enterprise, with 23% shadow rules and 12% with conflicts. Manual audits cannot keep pace with 15–20% annual rule growth. Organizations must demonstrate compliance with PCI-DSS, HIPAA, SOX, NIST 800-207, NIS2, and DORA — often simultaneously.

Provably Correct Inspection

Every rule evaluation in xWall produces a zero-knowledge proof (via xProve Tier 4 KKW). The proof is approximately 50 KB per evaluation and can be verified by anyone — auditor, regulator, or automated compliance system — without access to the traffic itself.

What the Proof Contains

• Cryptographic commitment to the rule that was evaluated
• Commitment to the decision (allow or block)
• Execution receipt with timing metadata
• Chain hash linking to the previous evaluation (HMAC-chained audit trail)
• The auditor verifies: correct circuit, correct evaluation, correct decision — all without seeing a single byte of traffic

Compliance Framework Mapping

Eliminating the Attack Surface

Traditional firewalls are high-value targets because they see everything. xWall nodes are low-value targets because each one sees nothing.

No Single Point of Compromise

In a traditional architecture, compromising one firewall appliance gives the attacker total traffic visibility. In xWall, compromising K-1 nodes reveals zero information about the inspected traffic. This is not a computational hardness assumption — it is an information-theoretic guarantee that holds regardless of the attacker's resources.

Supply Chain Resilience

Firmware never exists on disk in plaintext. Each node boots via threshold reconstruction from K shares (xBoot split-boot). Rule sets are never extractable from any single node. Persistent backdoors — like the FortiGate symbolic link persistence technique that survived firmware patches across 16,620+ devices — extract noise, not data.

Ephemeral Rule Protection

Rules are reconstructed per-evaluation and purged immediately afterward (via xGhost). The full ghost cycle completes in less than 2 milliseconds. An attacker with memory access to a running node sees the reconstructed rule for microseconds before it is purged. A tamper-evident audit entry is generated for every evaluation.

Identity-Based Administration

No passwords. No certificates. No PKI. Administrators authenticate with decentralized identifiers (DIDs) via xBind. Sessions use ephemeral per-session DIDs derived via xId (~50µs seed exposure). High-privilege operations require K-of-N multi-factor convergence via xFuse. Rule changes require K-of-N multi-approver gates via Authorize.

Quantum Immunity

xWall does not use post-quantum cryptography. It uses information-theoretic security. There is no algorithm to break. No mathematical advance changes this. No migration cost. No transition period. The security is already unconditional.

Solving Industry Pain Points

Seven critical network security problems. One architecture.

Orchestrator Architecture

Production-ready flagship with 628-line orchestrator and 20 integration modules. Real-time traffic analysis without plaintext reconstruction.

Core Orchestrator (628 LOC)

The orchestrator implements an 8-step atomic pipeline that coordinates all 20 integrated ACIs:

20 Integration Modules

Each ACI is wrapped in a dedicated integration module. The orchestrator composes all 20:

Split-Path Architecture

Traffic never exists in plaintext at any single inspection node. Each node evaluates firewall rules on its share via MPC. The orchestrator coordinates decision aggregation without any node reconstructing the packet.

Technology Stack

Data plane, management plane, and infrastructure. Complete ACI integration mapping.

Data Plane

Management Plane

Infrastructure

Complete Integration List

All 20 ACIs integrated with dedicated modules:

Rule Circuit Compilation

Firewall rules compile to boolean circuits. The compiler maps each operation to Class 1 (XOR, free) or Class 2 (AND via Beaver triples, 1 round). The optimization target is minimizing AND gates for performance.

// Firewall rule: Block TCP port 443 from 10.0.0.0/8 to external

const circuit = compile({
  src_ip:   { match: '10.0.0.0/8',  gates: 'XOR' },  // Class 1, free
  dst_port: { match: 443,            gates: 'XOR' },  // Class 1, free
  protocol: { match: 'TCP',          gates: 'XOR' },  // Class 1, free
  action:   'AND(src_ip, dst_port, protocol)'    // Class 2, 1 round
})

// Evaluated on shares via xCompute
// Decision bit: 0 = allow, 1 = block
// ZK proof generated via xProve Tier 4 KKW

Deployment Models

Benchmarks

Performance at every stage of the inspection pipeline.

Splitting Performance

Rule Evaluation Performance

End-to-End Latency

Proof Generation

How xWall Compares

Side-by-side comparison across six dimensions.

Honest Limitations

What xWall cannot do today, and the mitigations in progress.

Ready to deploy xWall?

Talk to Sol, our AI platform engineer, or book a live demo with our team.