Security and Trust Model

Security and Trust Model

This page explains, in plain language, what recovery checks mean and when you may need stronger trust controls.

Three Different Guarantees (Simple View)

When recovering, separate these concepts:

1. Integrity: did data get damaged or changed?
2. Consistency: do these files belong to the same backup set?
3. Identity: is this from the signer you expected?

Ethernity is strong on integrity and consistency checks. Identity assurance depends on how you handle trust and custody in your environment.

What Verification Proves Today

Recovery checks prove that the inputs are internally valid for the set you provided.

This is very good at catching:

• accidental corruption
• mixed files from different backup sets
• malformed input data

It is weaker if someone can replace the entire artifact set and you do not use an external trust anchor.

Practical Trust Modes

A) Self-contained trust (default operational posture)

Interpretation:

• verification is rooted in the artifact set itself
• simple and practical for many teams

Use when:

• artifact custody is controlled
• your main risk is operator mistakes, not hostile substitution

B) Externally anchored trust (high-assurance posture)

Interpretation:

• verification is tied to a trust anchor managed outside the artifact set
• stronger identity assurance in adversarial environments

Use when:

• artifact source path may be adversarial
• regulated or high-assurance operations require independent trust anchors

Operator Recommendations

• Run periodic recovery drills from printed artifacts.
• Keep independent backups and separate custody for different artifact classes.
• Treat rescue/bypass controls as incident-only procedures.
• For high-assurance environments, document and enforce external trust-anchor policy.

If you are unsure which mode to use:

• Start with self-contained trust for normal operations.
• Move to externally anchored trust when policy/compliance requires stronger identity guarantees.

Threat Model Quick Map

Scenario	Self-contained checks	External trust anchor needed?
Random file damage	strong	no
Mixed shard sets	strong	no
Full artifact-set substitution	limited	yes

Related

• Threat Model
• Recovery Workflow
• Troubleshooting
• Maintainer Release Runbook