Security and Trust Model

Security and Trust Model

This page explains what recovery verification proves, where trust boundaries are, and how to run high-assurance workflows.

Three Different Guarantees

When recovering, separate these concepts:

1. Integrity: did bytes change unexpectedly?
2. Consistency: do these artifacts belong together?
3. Authenticity/identity: did this set come from the signer you intended to trust?

Ethernity strongly validates integrity and internal consistency. Authenticity strength depends on your operator trust model and artifact custody controls.

What Verification Proves Today

Recovery validation checks establish that inputs are internally coherent and cryptographically valid for the provided artifact set.

This is strong against:

• accidental corruption
• mixed inputs from different backup sets
• malformed payload/frame data

It is weaker against full-set substitution if artifact provenance is untrusted. In that case, a fully self-consistent replacement set may still pass internal checks.

Practical Trust Modes

A) Self-contained trust (default operational posture)

Interpretation:

• verification is rooted in the artifact set itself
• useful and practical for many workflows

Use when:

• artifact custody is controlled
• threat model is primarily accidental error and operational mixups

B) Externally anchored trust (high-assurance posture)

Interpretation:

• verification is tied to an external trust anchor (for example, separately managed signer key policy)
• stronger identity assurance in adversarial environments

Use when:

• artifact supply path may be adversarial
• regulated or high-assurance operations require independent trust anchors

Operator Recommendations

• Run periodic recovery drills from printed artifacts.
• Keep independent backups and separate custody for different artifact classes.
• Treat rescue/bypass controls as incident-only procedures.
• For high-assurance environments, document and enforce external trust-anchor policy.

Threat Model Quick Map

Scenario	Self-contained checks	External trust anchor needed?
Random file damage	strong	no
Mixed shard sets	strong	no
Full artifact-set substitution	limited	yes

Related

• Threat Model
• Recovery Workflow
• Troubleshooting
• Maintainer Release Runbook