Threat Model

Threat Model

This page describes the deeper security assumptions behind Ethernity and where operational controls are still required.

If you want day-to-day guidance, start with Security and Trust Model.

Security Goals

• Preserve confidentiality of backup payloads.
• Detect corruption and cross-set mixing during recovery.
• Preserve recoverability from printed and offline artifacts.
• Support release provenance verification for distributed binaries.

Assets

• Backup payload plaintext
• Passphrase material
• Shard artifacts (passphrase and signing-key shards)
• Recovery artifacts (qr_document.pdf, recovery_document.pdf, optional shard docs)
• Trust-anchor expectations in high-assurance workflows

Trust Boundaries

1. Backup-producing endpoint
2. Artifact custody and transport
3. Recovery endpoint (CLI/kit environment)
4. Release distribution and verification path

In-Scope Threats

Threat	Built-in controls	External controls still needed
Corrupted QR/fallback data	strict parsing, hash checks, conflict checks	reacquire clean input sources
Mixed artifacts from different sets	doc-id/hash consistency checks	enforce one-set-per-run recovery process
Missing artifacts	fallback and optional sharding support	custody/retention policy
Supply-chain tampering	Sigstore verification guidance	always verify before execution
Full artifact-set substitution	internal checks still run	external trust anchors in high-assurance workflows

Out of Scope

• Fully compromised endpoint at backup or recovery time
• Coercion/insider abuse beyond your custody policy
• Hardware/firmware implant attacks

These require endpoint hardening and organizational controls beyond the product.

Recommended Operational Controls

• Separate custody for QR docs, recovery docs, and shards.
• Scheduled recovery drills (for example, quarterly).
• Explicit incident policy for rescue/bypass controls.
• Release verification before execution.
• Documented trust-anchor policy for high-assurance operations.

Incident Escalation Triggers

Pause normal operations and escalate if you observe:

• repeated parser/conflict failures with known-good artifacts
• unexpected trust/signer mismatch in high-assurance workflows
• provenance verification failures for release binaries
• unexplained mismatch between recovered output and trusted references

Related

• Security and Trust Model
• Recovery Incident Runbook
• Recovery Workflow
• Release Artifacts
• Maintainer Release Runbook