Sold by: Kenosian
Deployed on AWS
AWS Free Tier
Customer-local 180-octet Draft-13 verification with direct TLS 1.3 holder binding, persistent single-node replay protection and Linux XDP IPv4 TCP ingress limits. Existing 143B release remains available; new version is subject to Marketplace approval.
Overview
OpenTTT Edge TTTPS Verifier extends the existing Amazon Linux 2023 product with a customer-local 180-octet v2 delivery. The v2 gateway handles customer event bytes, authenticated sealing and native Rust verification before returning a signed admission receipt. It verifies issuer signature, context, configured time freshness and direction-bound holder proof against the actual client TLS 1.3 session. Direction is bound in the external holder transcript. Client-supplied exporter headers are not trusted; terminate TLS directly or use L4 TCP passthrough.
Duplicate JSON keys, including equivalent escaped keys, are rejected. The v2 default TLS endpoint is TCP8090; legacy 143B requests are rejected rather than padded or converted. Existing core services and their storage remain for local maintenance; non-loopback 8082/TCP and 8443/UDP are blocked. Per-instance signing and TLS keys are generated at customer launch. Replace or securely pin the initial self-signed certificate and protect the local sealing token.
Single-node replay claims and admission receipts use SQLite WAL with FULL synchronization and atomic transactions, surviving service and instance restarts. Signed validity bounds and a persisted clock high-water mark control expiry and rollback rejection. The customer application must use receipt_id as a unique key in its own business transaction; the verifier does not atomically commit arbitrary customer databases. Linux CLOCK_TAI and synchronized chrony supply this time profile, not a Roughtime quorum. Configure an approved non-smearing time source for continuous TAI across leap events.
Linux generic XDP limits IPv4 TCP ingress at the detected or explicitly configured interface. XDP does not inspect TLS proofs, implement GRG proof validation at L4, cover IPv6 or guarantee all-DDoS prevention. Published source, checksums and AWS boot-test evidence describe the tested scope; no 100ns, line-rate, regulatory compliance or universal attack-blocking claim is made.
The existing Marketplace seal-unit dimensions are preserved. A successful v2 seal records durable usage; the hourly reporter uses the customer's EC2 instance role and Marketplace MeterUsage. Configure aws-marketplace:MeterUsage, monitor delivery failures and reconcile expired records. No seller credentials are embedded. Admission verification and replay remain local; Marketplace billing needs AWS connectivity. MemoryDB is not created or activated. Multi-node replay requires separately configured shared state before a clustered customer deployment. Existing running instances are not automatically upgraded. HydraAudit is optional.
Highlights
- Customer-local 180-octet v2, authenticated sealing and actual TLS 1.3 direction-bound holder verification
- Durable single-node replay and signed admission receipts; bounded IPv4 TCP XDP ingress protection
- Per-instance keys, public source and AWS boot-test evidence; MemoryDB is not provisioned
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
AmazonLinux 2023
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
If you are an AWS Free Tier customer with a free plan, you are eligible to subscribe to this offer. You can use free credits to cover the cost of eligible AWS infrastructure. See AWS Free Tier for more details. If you created an AWS account before July 15th, 2025, and qualify for the Legacy AWS Free Tier, Amazon EC2 charges for Micro instances are free for up to 750 hours per month. See Legacy AWS Free Tier for more details.
Dimension | Description | Cost/unit |
|---|---|---|
TTTPS proof-of-time sealing (t3.small) Recommended | One proof-of-time sealing operation performed by the OpenTTT Edge TTTPS AMI on t3.small. | $0.001 |
TTTPS proof-of-time sealing (t3.micro) | One proof-of-time sealing operation performed by the OpenTTT Edge TTTPS AMI on t3.micro. | $0.001 |
TTTPS proof-of-time sealing (t3.medium) | One proof-of-time sealing operation performed by the OpenTTT Edge TTTPS AMI on t3.medium. | $0.001 |
Dimensions summary
You pay per proof-of-time sealing operation, so cost scales with how many sealing operations the product performs. The three dimensions differ only by the AWS EC2 instance size running the sealing engine: t3.micro, t3.small, or t3.medium. Each dimension charges for one sealing operation on that specific instance type. There are no tiers or commitments; you select the instance size that fits your throughput and performance needs, then pay for each operation it completes. Larger instance types handle heavier workloads, letting you match capacity to demand.
Top-of-mind questions for buyers
One sealing operation is a single proof-of-time record the engine issues for one event or call. Each record binds the payload and a timestamp into a signed cryptographic hash. Every API call that generates one receipt counts as one billable operation.
Each dimension runs the same sealing engine on a different AWS EC2 instance size: t3.micro, t3.small, or t3.medium. You pick one instance type and pay per operation it performs. Larger instances handle heavier throughput. You do not combine dimensions; each meters its own operations independently.
Billing meters each sealing operation the engine completes, so idle time with no operations produces no per-operation software charge. An instance left running may still incur standard AWS compute and storage fees separately. The sealing charge applies only when a proof-of-time record is issued.
kenosian.com
Helpful?
Vendor refund policy
No refunds for metered usage already incurred.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Extends the existing AMI with authenticated customer event sealing, native Rust fixed 180B verification, actual TLS1.3 holder binding, persistent single-node SQLite replay/admission, strict JSON, detected-interface generic IPv4 TCP XDP and customer EC2 role hourly seal-unit metering. Per-instance keys and explicit legacy external-port restriction. MemoryDB is not provisioned. Existing instances are not automatically upgraded. Source e123ba9; AWS boot, TLS, restart and bounded-load evidence published separately. Customer business idempotency, TLS certificates, time source and IAM remain deployment configuration.
Additional details
Usage instructions
Launch t3.small with an EC2 instance role permitting aws-marketplace:MeterUsage and AWS Marketplace connectivity. The customer-local v2 service starts on TLS TCP8090. Replace the self-signed certificate or securely pin it, retrieve the per-instance sealing token through authenticated SSH, and restrict client/admin security groups to your own CIDRs (replace the example 10.0.0.0/16). Use /v2/seal and /v2/verify; enforce receipt_id uniqueness in your business transaction. Monitor openttt-v2.service and openttt-v2-metering.service. Direct TLS termination or L4 TCP passthrough is required. Configure chrony with an approved non-smearing time source. Legacy external ports are blocked; MemoryDB is not provisioned. Single-node operation only unless shared replay is separately configured. Full instructions: https://github.com/Helm-Protocol/openttt-mcp/blob/e123ba965d38cfb9bf41e674d2e948e3f4bd3c37/production/README.md
Support
Vendor support
For OpenTTT Edge TTTPS Verifier AMI deployment, configuration, and troubleshooting, contact info@kenosian.com . We aim to provide an initial response within 24 hours. This is not a 24/7 or uptime SLA.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
This API allows to check the validity of TIN (Tax Identification Number) numbers. The vaildity is assesed based on the pubilcally available specifications published by the OECD for the purpose of CRS (Common Reporting Standard) and, in some cases, other publically available information when the validity check can be improvded.
This API allows to check the validity of TIN (Tax Identification Number) numbers. The vaildity is assesed based on the pubilcally available specifications published by the OECD for the purpose of CRS (Common Reporting Standard).
(Region: eu-west-2)
This API allows to check the validiti of TIN (Tax Identification Number) numbers. The vaildity is assesed based on the pubilcally available specifications published by the OECD for the purpose of CRS (Common Reporting Standard) and, in some cases, other publically available information when the validity check can be improvded.
Security and Compliance Framework consulting services for NYS DFS 500, including our DFS Reference Architecture to guide AWS customers through full deployments.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.