sovm protocol family

Category: Experimental

SSP/1 · SOP/1

Status: specification, no released implementation

sovm.ioRead the specifications

For the privacy-minded

There is no vendor-held recovery key to subpoena.

One authority holds the keys and sets the policy — a person, a household, a research group, an organization. sovm does not care which. What it guarantees is that nobody outside it can decrypt the data, including whoever operates the hardware it happens to be sitting on.

What the design actually does

Privacy is not a feature here. It is the constraint the rest of the design bends around.

Which is why encryption is per object, why the file footer is encrypted so schemas and statistics do not leak, why identifiers on the wire are opaque, and why there is no vendor-held recovery key to subpoena.

Plaintext exists only as transient state on an authorized machine. A machine can hold a complete replica while being cryptographically unable to decrypt any of it — “who stores this” and “who can read this” are separate sets, neither inferred from the other.

Encrypted footers

Objects are encrypted Parquet whose footer is encrypted too, so a holder learns neither contents nor schema, column statistics or row counts.

Content addressing

An object’s identifier is the hash of its exact encrypted bytes, and those bytes cannot change under it. Tampering is detectable without trusting the path.

Reviewed primitives

Group membership and key distribution use MLS (RFC 9420); records and signatures use COSE (RFC 9052). No bespoke cryptography.

No consensus, no master

Writes happen offline and publish on reconnect. There is no central node that sees everything by construction.

Explicit exit

Where data must leave the encrypted domain, that boundary is singular and auditable — an export operation, never transparent background replication.

What it does not claim

The limits are part of the specification, not an omission from it.

sovm does not make a model private. It provides no differential privacy and no secure aggregation, and a node that trains must decrypt.

It also spans exactly one trust authority. It is not a protocol for sharing data between mutually distrusting parties, and it does not provide collaborative multi-writer editing semantics.

Implementation status →

Note — Revocation does not reach back in time

A machine that was authorized cannot be made to forget what it already read. Revocation stops future access only.

Note — Traffic analysis is reduced, not eliminated

Sizes are padded and identifiers opaque, but storage providers still observe object sizes and transfer timing.

Note — Lose the keys, lose the data

If the trust authority loses its key material and its backups, the data is gone. That is the design.

Note — Nothing has shipped yet

SOP/1 is a frozen architecture baseline with ten open decision gates; SSP/1 is a new specification whose conformance corpus does not exist yet.