490a592223
Three reference estimators priced work by a coefficient no host calibrated and graded the figure ModelBased: - sandbox-exec-microvm: with no live CPU counter, vCPU-seconds × the reference 12,000 µJ/vCPU-second (a nominal work-unit cost), and the accelerator's "coarse proxy" (that cost × 10); - sandbox-exec-wasm: fuel × the reference 20,000 µJ per million fuel; - sandbox-meter StorageActivity (from_samples, from_volume): ops and bytes × nominal NVMe-class pJ coefficients documented as "calibrated". By the family's ladder (JCP SPEC §5.1) a model earns ModelBased by a calibration on the host; a nominal coefficient is the whole of such a model, so the figure is an estimate. - MicroVmConfig.calibrated and WasmConfig.fuel_cost_calibrated (both false by default) keep a ModelBased path for a cost the operator calibrated on the host, as spec/receipts.md's "calibrated table" describes; the accelerator proxy is Estimator either way. Neither config is constructed outside its crate. - Tests that pinned the over-claim now pin Estimator: cpu_only_run_meters_modelbased (renamed ..._an_estimate), a_cpu_counter_that_held_across_a_run_is_not_a_measured_zero, power.rs's two RAPL fallback tests, runs_a_unit_and_meters_cpu_energy, storage_globs_enforced_through_execution, contention_is_loaded_minus_ baseline. New tests: a fallback is a model only at a host-calibrated cost (CPU) and never for the proxy (accelerator); the same for the fuel cost; both storage constructors are estimates. - boot_microvm example's 15 W/vCPU fallback is Estimator too. - SPEC §6.3, spec/receipts.md, SECURITY.md, README and sandbox-meter's Provenance docs say a nominal or assumed coefficient is Estimator. No vector changes: sandbox-conformance passes every class, file-backed vectors included, and conformance/v1 is untouched (its builders use fixed constructors, none of these estimators). Co-Authored-By: Claude Opus 5.5 <[email protected]>
76 lines
5.6 KiB
Markdown
76 lines
5.6 KiB
Markdown
# Security
|
||
|
||
This standard is built from proven primitives, composed in one new way. The
|
||
primitives are not re-litigated here; the composition and its boundaries are.
|
||
|
||
## Primitives
|
||
|
||
- **Content addressing** — BLAKE3-256 over deterministic CBOR (SPEC §3–§4). Identity is the hash of the canonical bytes; a changed artifact is a changed id.
|
||
- **Sealed receipts** — JCR-1 (det-CBOR + COSE/EdDSA), the family's signed-receipt format (SPEC §6).
|
||
- **Attestation** — Ed25519 over the JCS-canonical form (SPEC §7), the same primitive as ARL-S, so the two interoperate.
|
||
- **Confidential evidence** — AMD SEV-SNP report verification: ECDSA-P384/SHA-384 against a VCEK chained to the AMD root (SPEC §7.6, `sandbox-tee`). Verification is hardware-independent and complete; generation requires the CPU security processor, and the reference says so rather than faking it.
|
||
- **Deny-by-default capabilities** — every resource a unit may touch is named by an explicit grant; anything unnamed is denied (SPEC §5).
|
||
|
||
The reference proves these run and self-attest across substrates, operating
|
||
systems, clouds, and accelerator classes — each cell of `proof/matrix.jsonl` is
|
||
a signature over a real run referencing an attestation that itself verifies. A
|
||
host records what it cannot prove as *unavailable*, never as passed.
|
||
|
||
## The composition: isolation across a heterogeneous fabric
|
||
|
||
The new part is making the unit of isolation a **heterogeneous unit of work**
|
||
across CPU/GPU/NPU/TPU/photonic/quantum, with the accelerator a first-class
|
||
metered and attested line item rather than an opaque passthrough. The isolation
|
||
ladder (S0–S7) runs a unit at the **lowest tier its grants require**; escalation
|
||
is the escape hatch, not the default.
|
||
|
||
## Shared-resource side channels
|
||
|
||
Logical isolation separates memory and code. It does **not** partition the
|
||
*physical* resources a tier shares — and a shared resource is a channel. At
|
||
S0–S2 the host kernel and device I/O paths are shared, so co-tenants can observe
|
||
one another through **contention**, with no privileged access on either side.
|
||
|
||
### Worked example — storage-contention fingerprinting (FROST)
|
||
|
||
A current, well-credentialed instance is **FROST** (*Fingerprinting Remotely
|
||
using OPFS-based SSD Timing*, Weissteiner et al., Graz University of Technology /
|
||
Liebherr-Transportation Systems, 2026; disclosed to Google, Mozilla, Apple). A
|
||
page in an ordinary browser sandbox writes an oversized file through the Origin
|
||
Private File System — large enough to exceed the OS page cache — then times
|
||
continuous random 4 KiB reads. Every read hits the physical SSD; when other
|
||
tabs or applications do their own I/O, the contention shows up as latency
|
||
spikes the page reads off from JavaScript, fingerprinting active sites and
|
||
applications (~89%/~96% reported) with no permission prompt and no exploit. It
|
||
breaks no logical boundary; it rides a physical one the sandbox never partitioned.
|
||
|
||
This is the general shape, not a storage-only quirk: any tier that shares a
|
||
device shares a contention channel through it.
|
||
|
||
### What the standard does about it
|
||
|
||
The standard does not claim to abolish physical channels. It gives the structure
|
||
to **reason about, bound, and price** them, with two levers and one inversion:
|
||
|
||
1. **Bound it — capability (I/O ceiling).** A `StorageGrant` may carry sustained-I/O ceilings (`max_iops`, `max_read_bps`; SPEC §5.2). Deny-by-default extends from *which* I/O to *how much*: a unit whose rate is capped cannot drive the high-rate random-read storm a contention channel needs. Enforced in `sandbox-capability` (`Enforcer::may_sustain_io`), bound into `grants_content_id`, and attested — so the ceiling a run claimed is part of its signed record.
|
||
2. **Close it — tier partitioning.** Where throttling is not enough, the floor rises: **S3** partitions device I/O so contention no longer crosses the boundary; **S5** (direct device assignment) removes the shared device entirely. Tier minimization is **side-channel-aware** (SPEC §2.4): a workload sensitive to — or, as an untrusted neighbor, capable of — cross-tenant leakage has its floor raised, by the ceiling lever held at S2 or by partitioning at S3+.
|
||
3. **Price it — measurement (the inversion).** The same physics, **measured cooperatively by the host and disclosed**, is honest telemetry for a resource the platform otherwise cannot meter. `sandbox-meter::StorageActivity` reports observed `iops`/`bytes`/`contention_ns` and a model-based energy figure. It is a distinct axis (never folded into a compute device class) and **never `HwShunt`** — a timing channel is not a hardware shunt, and the provenance discipline (SPEC §6.3) is enforced for it. What leaks information undisclosed becomes auditable joules disclosed.
|
||
|
||
## Provenance honesty
|
||
|
||
Every energy figure carries a provenance tag — `HwShunt` (measured at a hardware
|
||
interface for that class), `ModelBased` (a model calibrated on the host), or
|
||
`Estimator` (a coarse constant, or a nominal coefficient no host calibrated) —
|
||
and the (provenance, measured) coupling is enforced (SPEC
|
||
§6.3, vector class C3). The standard's claim is that the figure is **reported and
|
||
honestly tagged**, never that an estimate is a measurement. Remote silicon a
|
||
prover does not own is metered by token-level `Estimator`, not dressed as
|
||
measured; a contention probe's figure is an `Estimator`, not a shunt.
|
||
|
||
## Reporting
|
||
|
||
Security issues in the reference implementation: open an issue at
|
||
<https://github.com/Transaction-Science/open-standards>, or contact
|
||
security@transaction.science. This document covers the standard and its
|
||
reference; it is not a deployment's security posture, which depends on the host,
|
||
the tiers it advertises, and the grants it issues.
|