Skip to content
sovm.io

Security, gates and prior art

1. What is inherited

Section titled “1. What is inherited”

The SOP/1 threat model (section 23) applies unchanged: honest-but-curious and malicious storage, malicious fleet peers, network observers, stolen media. Blob objects add no new key-management surface — DEK, KEK, access record, rewrap, and historical-entitlement behavior are byte-for-byte the tabular rules. This section covers only what is different because the payload is media.

2. Traffic and size analysis

Section titled “2. Traffic and size analysis”

Media magnifies the size-fingerprint problem padding exists for:

  • Thumbnails are countable. A grid of N photos fetches N small objects; their number and rhythm reveal library size and browsing activity even when each size is padded. Padmé bounds per-object size leakage; it does not hide object count or access pattern, and this extension does not claim otherwise (SOP/1 section 1.2 excludes ORAM explicitly).
  • Range-read patterns leak playback behavior. A blind replica serving 1 MiB ranges of one object observes a scrubbing pattern consistent with video playback, and the ranges’ positions are the seek positions. Readers MAY prefetch or over-read to blunt this; the protocol does not mandate it.
  • Derivative linkage is catalog state. derived_from, derivative_kind and asset_id live in encrypted manifests, so untrusted storage cannot group an original with its derivatives by metadata — but it can correlate by co-access timing. Fetching a thumbnail and its original in one round-trip pattern links them observationally. Implementations SHOULD NOT name derivative kinds in any cleartext transport field.

3. Cryptographic notes

Section titled “3. Cryptographic notes”
  • Truncation and reorder. The final-flag byte and the counter nonce make truncation, chunk reordering, and chunk duplication authentication failures, independent of content addressing. Content addressing already rejects any modified byte stream; the AEAD-level protection exists so that a decryptor holding only a DEK and a byte stream — the forensic and recovery paths — fails closed too.
  • No AAD. Context binding rests on the fresh per-object DEK, content addressing, and the signed manifest/access-record chain, matching the age design. Adding contextual AAD would bind ciphertext to catalog state and break the property that rewrapping never touches object bytes.
  • Decrypt-before-verify does not occur. Transfer-layer verification is incremental (16 KiB), AEAD verification is per chunk (1 MiB), and readers release plaintext only after the chunk tag verifies (format, section 3). A streaming player therefore consumes only doubly-verified plaintext.
  • Plaintext handling. The at-rest invariant of SOP/1 section 17 applies: decrypted media is transient computation state. Decoded frames in a display pipeline are accepted as transient; persistent decrypted caches (a thumbnail cache on disk) MUST be encrypted at rest like any derived store.
  • EXIF is data, not envelope. Capture metadata inside the original’s bytes is encrypted with the original. The queryable copy in metadata tables is protected by the tabular plane. Implementations MUST NOT emit cleartext sidecar files during ingestion or export (section 21.6’s explicit-export rule covers deliberate plaintext export).

4. Residual honesty

Section titled “4. Residual honesty”

Statements SOP/1 makes that bear repeating for media, because user expectations are strongest here:

  • A device that ever held the photo domain’s keys may hold plaintext copies forever (section 9.6). Revocation is forward-looking.
  • “Deleted everywhere” is four distinct states (section 14.8) and a product MUST NOT collapse them into one checkmark.
  • A compromised entitled device is full exposure of what it could decrypt; the plane encrypts transport and storage, not endpoints.

5. Decision gates

Section titled “5. Decision gates”

Promotion of this extension follows the same gate discipline as SOP/1 (section 27). Three gates, all open:

GB1  alignment and range access
     an SOP-BLOB-1 object imported into the transfer layer; a plaintext
     range served via one verified range request from a non-decrypting
     holder; decrypt of only the fetched chunks; tamper in any 16 KiB
     group and any chunk tag detected


GB2  streaming viability
     seek-and-play of a large video derivative on a constrained device at
     the profile's 1 MiB granularity, including cold-fetch over a lossy
     link; measured decode-path overhead of chunked AES-GCM


GB3  padding and overhead accounting
     Padmé padding implemented in the writer (no fail-open); measured
     storage overhead across a realistic photo+video corpus, reported per
     derivative kind

GB1 is the extension’s load-bearing claim and SHOULD be prototyped with the transfer layer’s actual group size before any other implementation work; if group size or hashing behavior differs from the reference assumptions, the chunk constant in format, section 2 is re-derived, not worked around.

6. Prior art and borrowings

Section titled “6. Prior art and borrowings”

The constructions here are deliberately unoriginal:

  • Chunked AEAD with counter nonce and final flag — the STREAM shape as deployed by the age file-encryption format (64 KiB chunks; seekable because chunk keys/nonces are index-derived). SOP-BLOB-1 changes the chunk size for transfer alignment and the suite for family consistency, nothing structural. Chained alternatives (libsodium secretstream) were rejected because nonce chaining forbids random access — the operational lesson of Ente, which encrypts with secretstream and consequently implements video seek by client-side HLS transcoding rather than by seeking the encrypted original.
  • Verified ciphertext ranges from untrusted storage — Tahoe-LAFS has served seekable, Merkle-verified ciphertext segments from untrusted servers since 2008; Signal added per-chunk incremental MACs to attachments for streaming playback. Hashing ciphertext and verifying ranges against the content address is the established composition.
  • Derivatives as sibling encrypted objects — Ente encrypts file, thumbnail, and metadata as separate objects under one per-file key; Peergos hides thumbnails inside encrypted metadata. No surveyed system embeds previews in the media object.
  • Index references blobs — Perkeep’s permanode/claim/indexer split: immutable content-addressed blobs, mutable metadata and search kept entirely outside them, referencing by hash.
  • Independent encrypted blocks over content-addressed storage with O(1) seek — WNFS private files (256 KiB-bounded XChaCha20-Poly1305 blocks, index-derived block names) and Peergos (5 MiB independently encrypted chunks).
  • Reuse-not-adopt for the sync layer — Syncthing’s untrusted-device encryption was evaluated and set aside: it is documented as beta, password-derived, and file-sync-shaped, with no group key management to bind to MLS domains. Its offset-keyed block-hash design is a useful cross-check that the blind-replica correlation concerns above are the right ones.

7. References

Section titled “7. References”