Skip to content

THREAT_MODEL.md

Latest commit

 

History

History
94 lines (73 loc) · 6.13 KB

THREAT_MODEL.md

File metadata and controls

94 lines (73 loc) · 6.13 KB
Raw

Threat model and residual risks (relay)

This is the go-live threat / security document for the relay challenge. It states the trust model honestly, maps principal threats to enforced mitigations, and documents irreducible residuals — especially TEE.fail — with the managed-cloud mitigation. It is the greppable source for VAL-HARDEN-004 and VAL-HARDEN-023.

Trust model

Authenticity is cryptographically-anchored trust-but-audit. A scrape is authentic under:

{TEE vendor honest AND host not physically compromised} OR {honest witness + clean network path} OR {honest-majority audit + slashing}.

No code, docs, API response, or UI copy may claim absolute authenticity (never the absolute-trust vocabulary prohibited by VAL-HARDEN-023). The primary anchor is TEE attestation, reinforced by R≥2 cross-scrape quorum, replay-audit sampling, and economic slashing. A bare SDK outside a TEE proves nothing; enforcement is the validator checking the enclave measurement against an allowlist (L1).

Absolute TEE claims are forbidden

Absolute TEE security claims are forbidden in docs, code comments, API responses, and UI copy across both relay and basecrawl (never the absolute-TEE vocabulary prohibited by VAL-HARDEN-004).

TEE.fail residual (explicit)

Residual: a self-hosted DDR5 bus interposer can forge quotes and read enclave memory. There is no vendor fix. On self-hosted hardware, content-confidentiality therefore degrades to trusting the host's physical security, and a determined physical attacker can produce misleading attestation evidence unless other layers (quorum, audit, economic damage) intervene.

Managed-cloud mitigation: managed-cloud TEEs (e.g. Phala TDX) keep DDR5 bus access away from the miner. High-reward and confidential tasks are therefore routed toward managed-cloud only; managed-cloud earns strictly more weight than self-hosted for equivalent work; self-hosted is replay-audited at a strictly higher rate. This restores the confidentiality property relative to the self-hosted residual. It does not convert the design into an absolute TEE trust claim; authenticity remains cryptographically-anchored trust-but-audit.

Machine-readable sources of the same residual + mitigation:

  • GET /confidentiality → tee_fail_residual, tee_fail_mitigation, trust_model
  • POST /internal/v1/scoring/teefail-tiering → tee_fail.{residual,mitigation,trust_model}
  • Python constants relay.confidentiality.TEE_FAIL_RESIDUAL / TEE_FAIL_MITIGATION / TRUST_MODEL

Threat → mitigation map (architecture §7 family)

Machine-readable, greppable probe surface for this table (VAL-HARDEN-016..020, 022):

  • GET /internal/v1/scoring/threat-model → full architecture §7 map (threat_map, orphans=[] when complete)
  • POST /internal/v1/scoring/threat-model → scenario probes (replay | sybil | origin_cloaking | geo_spoof | fake_failure | threat_map | all)
Threat Enforced mitigation (probe surface) Residual if irreducible
Fabricated response L1 measurement allowlist + L2 report_data binding (result_hash/response_hash); also threat-model fake_failure None if authentic gate is closed (zero reward)
TEE.fail (self-hosted DDR5 interposer forges quotes / reads memory) Managed-cloud tiering + higher self-hosted audit (teefail-tiering, assignment eligibility) Self-hosted residual; no vendor fix — see section above
Replay L0 nonce freshness + report_data nonce binding (threat-model replay) —
Sybil / self-quorum Distinct-owner R=2 grading on the worker plane (threat-model sybil) —
Origin cloaking / personalization Dispute → audit (never auto-slash on a single divergence) (threat-model origin_cloaking) Audit latency residual
Geo spoof (VPN/relay) Latency landmark upper bound (speed-of-light) + composition (threat-model geo_spoof) Soft IP-geo error residual
Fake failure dodge Failure response is attested; L5 integrity + quorum attribution (threat-model fake_failure) —
Malicious / colluding witness proxy Witness-proxy disabled (default) or scored strictly below TEE (witness-proxy) Weaker trust on proxy operator + un-hijacked network path
Chromium / OS 0-day in TCB Minimal documented TCB + digest-pinned reproducible image + image-rotation-on-CVE runbook + allowlist rotate + replay-audit backstop (threat-model residual; monorepo diary in basecrawl/docs/tcb-inventory.md + image-rotation-on-cve.md when sibling present) measured-but-exploited residual until the CVE is patched and the image measurement is rotated
Policy bypass on open-web targets Pre-seal policy gate is authoritative; miners fetch blind —
Non-TEE / witness-only submit Reject with non_tee_unsupported, reward_gate=closed, zero weight when the witness-proxy tier is disabled (GET /internal/v1/scoring/config,POST /internal/v1/verify); when enabled, weight and audit rates score it strictly below TEE Weaker trust rests on the proxy operator + un-hijacked network path, not the TEE anchor (see docs/WITNESS_PROXY.md)

What content-confidentiality does and does not cover

See also GET /confidentiality and architecture §7:

  • Does cover (enclave-only): path, query, body, headers, cookies, tokens, result plaintext (absent physical tampering / TEE.fail on self-hosted).
  • Does not cover (expected residual leakage): destination IP, SNI (absent ECH), DoH resolver destination, traffic metadata (sizes/timing/subresource graph). Target-anonymity is an explicit non-goal.

Honesty of claims checklist

  1. Grep both repos: no authenticity claim matching the absolute-trust vocabulary prohibited by VAL-HARDEN-023 except honest denials listing that ban set and the wording cryptographically-anchored trust-but-audit.
  2. Grep both repos: no absolute TEE claim matching the absolute-TEE vocabulary prohibited by VAL-HARDEN-004 except honest denials listing that ban set.
  3. This document plus basecrawl/docs/SECURITY.md carry the TEE.fail residual (forge quotes / read enclave memory; no vendor fix) and the managed-cloud mitigation.