Formal Security Matrix
Threat Model & Boundary Disclosures
A sovereign security posture requires knowing exactly what you are protected against—and what remains outside technical bounds.
Protected Assets
- ›User Network Anonymity: Real client IP address, ISP identity, and physical geographic location.
- ›Host Hard Drive Neutrality: Ensuring internal NVMe and SATA disks remain completely untouched and unindexed.
- ›Volatile Transient State: Browser caches, cryptographic private keys in RAM, and bash history.
- ›Encrypted Persistence Integrity: LUKS2 container confidentiality protected by Argon2id key derivation.
Core Trust Assumptions
- ›Hardware Silicon Integrity: The host x86_64 CPU is assumed to execute instructions faithfully without undocumented hardware backdoors.
- ›Untampered Motherboard Firmware: Motherboard UEFI implementation properly verifies UKI signatures during Secure Boot.
- ›Tor Network Health: The distributed Tor directory authorities and majority of consensus relays remain operational and uncompromised.
- ›User Operational Discipline: The user does not intentionally paste identifying credentials or expose their identity over authenticated sessions.
Adversary Capability & Mitigation Matrix
| Adversary Profile | Observed Capability | System Mitigation | Outcome |
|---|---|---|---|
| Local Network / Public Wi-Fi Sniffer | Intercepting unencrypted LAN traffic, ARP spoofing, captive portal manipulation. | NetGuard transparently routes all outbound TCP through Tor circuits. Direct cleartext DNS and UDP are dropped fail-closed. MAC address randomization prevents AP hardware tracking. | Defeated |
| Commercial Internet Service Provider (ISP) | Logging destination IP addresses, SNI headers, DNS requests, and connection durations. | All external destinations are masked inside multi-hop onion-routed circuits. DNS queries are intercepted to Tor DNSPort (5353). ISP observes only encrypted traffic to Tor entry guard or bridge. | Defeated |
| Host Device Forensic Seizure | Post-session physical inspection of internal hard drives and NVMe SSDs. | Amnesic volatile execution: root filesystem runs in RAM tmpfs. Internal disks are neither mounted nor indexed. All session changes vanish when power is removed. | Defeated |
| Malicious Web Script / Browser Exploit | Attempting arbitrary code execution or local privilege escalation via WebAssembly or browser bug. | Tor Browser runs under strict AppArmor enforce profile, unprivileged user namespaces via Bubblewrap, and compiled Seccomp-BPF filters blocking raw sockets and ptrace. | Mitigated |
| Targeted USB Removal by Hostile Actor | Yanking boot flash drive to disrupt active session and inspect device. | snigdha-media-watchdog detects physical disconnection within milliseconds and triggers emergency kernel unmount, cache flush, and power-off. | Defeated |
| Compromised Motherboard UEFI Firmware | Modifying SPI flash chip, installing SMM implants, or overriding Secure Boot validation. | Out of scope: no operating system can protect against compromised host firmware. Snigdha OS provides UKI Secure Boot verification, but trusts genuine motherboard hardware. | Inherent Risk |
| Cryogenic DRAM Cold-Boot Attack | Freezing physical RAM modules immediately after power-off to read capacitor charge remnants. | Kernel memory scrubbing (init_on_free=1 and page_alloc.shuffle=1) wipes deallocated pages during runtime, but physical DRAM capacitor discharge laws cannot be bypassed without BIOS scrubbing. | Inherent Risk |
| Global Passive Network Adversary | Monitoring traffic volume and timing simultaneously at Tor entry guard and destination exit node. | Statistical end-to-end timing correlation remains mathematically possible for adversaries with universal global wiretap infrastructure. Tor minimizes correlation but cannot eliminate it entirely. | Inherent Risk |
| Malicious GUI Window Snooping (X11 Protocol) | Querying global X11 input events or window titles from another graphical application. | Mitigated via AppArmor socket confinement and Bubblewrap private namespaces. Full Wayland compositor migration is planned for future major releases. | Inherent Risk |
In-Depth Disclosure: Inherent Physical & Protocol Residual Risks
True security engineering requires explicitly documenting where software guarantees end. Operating systems that promise “absolute untraceability” are dishonest. Here are the exact physical and protocol realities of modern x86_64 computing:
1. Cold-Boot DRAM Capacitor Retention
When a computer loses power, dynamic RAM capacitors do not immediately lose electrical charge. At room temperature, state can persist for several seconds; when cooled with liquid nitrogen or inverted compressed air, retention lasts minutes. If an adversary seizes hardware immediately upon power-off, physical cold-boot attacks can recover keys from physical RAM.
2. Statistical Traffic Correlation
Tor encrypts traffic in multiple layers and routes it through three random nodes. However, Tor is not a high-latency mix network (like mixminion). An adversary with global wiretap visibility (observing both the local ISP connection and the target server connection) can statistically correlate traffic packet sizes and timings to de-anonymize endpoints.
3. X11 Window System Input Isolation Limits
Snigdha OS Decentralized utilizes the lightweight i3 window manager with Xorg. The legacy X11 protocol allows any connected client to inspect window titles and global keyboard events unless restricted. While AppArmor and Bubblewrap confine untrusted applications, true client isolation requires Wayland, which is planned for future architecture phases.
4. Operational Security (OpSec) Vulnerabilities
The strongest cryptographic defenses are nullified if the user logs into personal social accounts, discloses identifying metadata in documents, sends funds from KYC cryptocurrency exchanges, or falls victim to targeted phishing. Technical software privacy is only one half of sovereign security.