ba1212361f
Commit the previously-untracked standard directories and catalog them in the
root README alongside proof:
- aac/ — communication cargo class: portable boards + a ten-level
offline-first cascade (Apache-2.0 code / CC-BY-4.0 spec).
- map/ — geospatial cargo class: range-requestable signed tilesets +
an F0–F4 fidelity cascade (Apache-2.0 code / CC-BY-4.0 spec).
- sandbox/— isolated, metered, attested execution across the heterogeneous
compute fabric (Apache-2.0 code / CC-BY-4.0 spec).
- jouleclaw-otel-authz, jouleclaw-trust — new jouleclaw reference crates.
Root README now lists aac, map, sandbox, and proof in the catalog, the tree,
and the contribution guide.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
75 lines
5.5 KiB
Markdown
75 lines
5.5 KiB
Markdown
# Security
|
||
|
||
This standard is built from proven primitives, composed in one new way. The
|
||
primitives are not re-litigated here; the composition and its boundaries are.
|
||
|
||
## Primitives
|
||
|
||
- **Content addressing** — BLAKE3-256 over deterministic CBOR (SPEC §3–§4). Identity is the hash of the canonical bytes; a changed artifact is a changed id.
|
||
- **Sealed receipts** — JCR-1 (det-CBOR + COSE/EdDSA), the family's signed-receipt format (SPEC §6).
|
||
- **Attestation** — Ed25519 over the JCS-canonical form (SPEC §7), the same primitive as ARL-S, so the two interoperate.
|
||
- **Confidential evidence** — AMD SEV-SNP report verification: ECDSA-P384/SHA-384 against a VCEK chained to the AMD root (SPEC §7.6, `sandbox-tee`). Verification is hardware-independent and complete; generation requires the CPU security processor, and the reference says so rather than faking it.
|
||
- **Deny-by-default capabilities** — every resource a unit may touch is named by an explicit grant; anything unnamed is denied (SPEC §5).
|
||
|
||
The reference proves these run and self-attest across substrates, operating
|
||
systems, clouds, and accelerator classes — each cell of `proof/matrix.jsonl` is
|
||
a signature over a real run referencing an attestation that itself verifies. A
|
||
host records what it cannot prove as *unavailable*, never as passed.
|
||
|
||
## The composition: isolation across a heterogeneous fabric
|
||
|
||
The new part is making the unit of isolation a **heterogeneous unit of work**
|
||
across CPU/GPU/NPU/TPU/photonic/quantum, with the accelerator a first-class
|
||
metered and attested line item rather than an opaque passthrough. The isolation
|
||
ladder (S0–S7) runs a unit at the **lowest tier its grants require**; escalation
|
||
is the escape hatch, not the default.
|
||
|
||
## Shared-resource side channels
|
||
|
||
Logical isolation separates memory and code. It does **not** partition the
|
||
*physical* resources a tier shares — and a shared resource is a channel. At
|
||
S0–S2 the host kernel and device I/O paths are shared, so co-tenants can observe
|
||
one another through **contention**, with no privileged access on either side.
|
||
|
||
### Worked example — storage-contention fingerprinting (FROST)
|
||
|
||
A current, well-credentialed instance is **FROST** (*Fingerprinting Remotely
|
||
using OPFS-based SSD Timing*, Weissteiner et al., Graz University of Technology /
|
||
Liebherr-Transportation Systems, 2026; disclosed to Google, Mozilla, Apple). A
|
||
page in an ordinary browser sandbox writes an oversized file through the Origin
|
||
Private File System — large enough to exceed the OS page cache — then times
|
||
continuous random 4 KiB reads. Every read hits the physical SSD; when other
|
||
tabs or applications do their own I/O, the contention shows up as latency
|
||
spikes the page reads off from JavaScript, fingerprinting active sites and
|
||
applications (~89%/~96% reported) with no permission prompt and no exploit. It
|
||
breaks no logical boundary; it rides a physical one the sandbox never partitioned.
|
||
|
||
This is the general shape, not a storage-only quirk: any tier that shares a
|
||
device shares a contention channel through it.
|
||
|
||
### What the standard does about it
|
||
|
||
The standard does not claim to abolish physical channels. It gives the structure
|
||
to **reason about, bound, and price** them, with two levers and one inversion:
|
||
|
||
1. **Bound it — capability (I/O ceiling).** A `StorageGrant` may carry sustained-I/O ceilings (`max_iops`, `max_read_bps`; SPEC §5.2). Deny-by-default extends from *which* I/O to *how much*: a unit whose rate is capped cannot drive the high-rate random-read storm a contention channel needs. Enforced in `sandbox-capability` (`Enforcer::may_sustain_io`), bound into `grants_content_id`, and attested — so the ceiling a run claimed is part of its signed record.
|
||
2. **Close it — tier partitioning.** Where throttling is not enough, the floor rises: **S3** partitions device I/O so contention no longer crosses the boundary; **S5** (direct device assignment) removes the shared device entirely. Tier minimization is **side-channel-aware** (SPEC §2.4): a workload sensitive to — or, as an untrusted neighbor, capable of — cross-tenant leakage has its floor raised, by the ceiling lever held at S2 or by partitioning at S3+.
|
||
3. **Price it — measurement (the inversion).** The same physics, **measured cooperatively by the host and disclosed**, is honest telemetry for a resource the platform otherwise cannot meter. `sandbox-meter::StorageActivity` reports observed `iops`/`bytes`/`contention_ns` and a model-based energy figure. It is a distinct axis (never folded into a compute device class) and **never `HwShunt`** — a timing channel is not a hardware shunt, and the provenance discipline (SPEC §6.3) is enforced for it. What leaks information undisclosed becomes auditable joules disclosed.
|
||
|
||
## Provenance honesty
|
||
|
||
Every energy figure carries a provenance tag — `HwShunt` (measured at a hardware
|
||
interface for that class), `ModelBased` (calibrated model), or `Estimator`
|
||
(coarse constant) — and the (provenance, measured) coupling is enforced (SPEC
|
||
§6.3, vector class C3). The standard's claim is that the figure is **reported and
|
||
honestly tagged**, never that an estimate is a measurement. Remote silicon a
|
||
prover does not own is metered by token-level `Estimator`, not dressed as
|
||
measured; a contention probe is `ModelBased`, not a shunt.
|
||
|
||
## Reporting
|
||
|
||
Security issues in the reference implementation: open an issue at
|
||
<https://github.com/Transaction-Science/open-standards>, or contact
|
||
security@transaction.science. This document covers the standard and its
|
||
reference; it is not a deployment's security posture, which depends on the host,
|
||
the tiers it advertises, and the grants it issues.
|