The Marks Protocol: Information-Theoretic Mutual Authentication for Network Access via Out-of-Stream One-Time Pads

We present the Marks Protocol, a network-access authentication scheme that uses a previously-distributed one-time pad for mutual identification between two or more parties. Unlike PKI-based authentication (WPA3-Enterprise, Passpoint), Marks requires no certificate authority, exposes no per-party identifiers at the radio layer, and provides information-theoretic — not computational — mutual authentication when the underlying pad is true OTP. Unlike pre-shared-key authentication (WPA3-Personal), Marks's pad bytes are consumed per session and never reused, providing forward secrecy by mathematical construction rather than by ephemeral key agreement. The protocol is federated: it specifies a transport-agnostic handshake over the local network of an access point, after standard 802.11 association completes, and is independent of how the pad was distributed. Pads can come from any out-of-band channel — Number Stations 2.0, Self-Renewing OTP, NFC-OTP, USB-C transfer, microSD swap, animated QR, or printed sneakernet. The protocol supports two-party mutual authentication as its core case and extends naturally to N-party mesh deployments where multiple paired devices authenticate one another, with cross-party temporal priority anchored to Bitcoin via OpenTimestamps and audited through HNBP-CORE tamper-evident chains. We give the protocol design, the security proofs (confidentiality, mutual authentication, forward secrecy), five deployment profiles spanning portable AP through enterprise enclave, and an honest accounting of what the protocol does not defend against. The protocol is named for Leo Marks, the SOE cryptographer who pioneered the operational use of one-time pads printed on silk for wartime resistance networks; the Marks Protocol is the digital extension of that lineage.