Security Model
Implementation scope: The security controls described here are implemented for authenticated, consent-gated Linux CLI ping/pong sessions. Graphical capture, remote input, file transfer, and relay paths are planned but not yet validated.
Implemented Controls
Identity and Trust-on-First-Use
Per-device Ed25519 cryptographic identities with visible fingerprints. First connection establishes trust; subsequent connections verify against the stored peer identity. Identity mismatches fail closed.
Authentication and Handshake
The current session handshake authenticates peers with signed ephemeral values, transcript-bound key derivation, and key confirmation. Consent is local, explicit, expiring, and bound to the session transcript.
Encrypted Session Framing
The current CLI ping/pong data plane uses authenticated encryption and directional keys from the established session. The implementation uses standard cryptographic primitives and does not invent a cipher.
Consent-Gated Authorization
Interactive CLI sessions require explicit approval and default-deny consent. Graphical view/control scopes, clipboard, file transfer, unattended access, and relay authorization are not implemented yet.
Planned Controls
Scoped View and Control Permissions Planned
Per-session capability tokens for screen capture (view-only), input control (keyboard/mouse), clipboard sync, and file transfer. Each scope requires separate approval. Planned for graphical sessions.
Relay and Discovery Security Planned
Self-hosted signaling service with device registry, presence, NAT assist, and relay handoff. Relay forwards encrypted ciphertext only. Rate limiting and backoff on signal and relay. Planned for deployment.
Audit Trail and Transfer Handling Planned
Append-only logs of enrollment, approval, connection start/end, and file transfer metadata (name, size, hash — never contents or keystrokes). Per-file transfer confirm to quarantine directory with size cap. Clipboard off by default. Planned features.
Platform Permissions and Elevation Planned
Windows service model for elevation, UAC path logging. Ubuntu X11 capture/input APIs. Platform permission prompts and consent flows. Planned for graphical desktop clients.
Known Limitations
Implementation Scope
Current evidence: authenticated, consent-gated Linux CLI ping/pong sessions only. No graphical screen capture, no remote input injection, no file transfer, no clipboard sync, no signaling/relay deployment, no unattended access enrollment.
Cross-Host Validation
Linux headless test results do not validate Windows or Ubuntu graphical behavior. No Windows ↔ Ubuntu cross-platform sessions tested. Acceptance criteria require real graphical sessions.
Performance and Benchmarks
No benchmarks exist. Capacity figures in operations documentation are assumptions pending measurement. Performance claims require evidence from real workloads.
Deployment Status
No releases available. Self-hosting procedures are designs only, not executed or verified. Server migration plans require explicit approval at execution time.
Abuse Resistance and Supply Chain
Implemented
- Pinned dependency lockfile
- Rust core with memory safety
- No custom cryptography
- Standard cryptographic primitives
- Fail-closed on identity mismatch
Planned
- cargo deny/audit CI enforcement
- Reproducible build verification
- Rate limiting on signal/agent
- Clipboard abuse prevention
- File transfer size caps
- Update artifact signatures
Source Documentation
The repository contains detailed security documentation:
docs/security-model.md
Threat model, normative MVP controls, verification mapping, and security acceptance criteria. Binding reference for implementation.
docs/architecture.md
Control plane separation from media plane, UI/agent boundaries, session token flow, and trust model integration.
docs/licensing.md
License obligations, AGPL assessment, permissive-leaf boundary design, and legal-review flags. Distribution duties documented.
Related Resources
Review the full documentation index and feature list to understand implementation status.