Threat model

The canonical threat model is PRD §9.9. This page is the public publication of that section, with the operational mapping the design doc §7.8 / §7.10 added inline. Validators, traders, and external security researchers should read this before integrating, signing a bug bounty report, or filing a coordinated disclosure.

Architectural principle: shared infrastructure, not shared trust

Every TEE sits behind a CDN/WAF layer (Cloudflare by default, CloudFront / Fastly as alternates) that the validator provisions and owns. The CDN is industry-standard shared infrastructure: it routes packets, it does not see data, and it is not the marketplace.

The validator's TEE security group accepts inbound 443 traffic from the CDN's published IP ranges only. The TEE never sees direct internet traffic.

Threat matrix

The 14 threats below are the v1 surface. Each is mitigated at a specific layer. Mitigation latency targets are tracked in PRD §9.9 and the design doc §7.8.

Defense layers, outermost to innermost

A request follows ten layers before reaching the Ed25519 signature that justifies its existence. Any layer can refuse, and the layer that refuses is the layer that owns the breach.

[1]  Internet
  ↓
[2]  CDN / WAF (Cloudflare / CloudFront / Fastly): DDoS, bot mgmt, geo, WAF rules
  ↓
[3]  AWS Security Group: IP allow-list, CDN ranges only
  ↓
[4]  Host-proxy auth (FR-T3, FR-T4): short-lived ES256 JWT + 9-step verification
  ↓
[5]  Host-proxy rate limits: `governor` token bucket per-IP + per-sub (jwt claim)
  ↓
[6]  Host-proxy gRPC validation: body size cap 1 KB, deadline 100 ms
  ↓
[7]  Nitro Enclave isolation: vsock only, no shared memory, no network outside vsock
  ↓
[8]  Enclave payload validation: `fd_keyguard_payload_matches_tls_cv` matcher;
     refuses to sign anything that isn't a TLS 1.3 CertificateVerify
  ↓
[9]  KMS envelope decryption gated on PCR attestation: tampered enclave cannot decrypt
  ↓
[10] Ed25519 signature (the actual work)

The defense-layer-to-threat mapping (from design doc §7.8) gives the operational view:

Kill switch (T12)

The marketplace publishes a signed revocation_manifest at releases.swqos.dev/revocation.json, signed with the K5 cosign key (design doc §7.1).

{
  "revoked_eif_versions": ["1.3.1"],
  "action": "halt",
  "revoked_at": "2026-04-21T12:00:00Z"
}

• host-proxy polls every 1 min (stricter than the PRD's 5 min).
• If its own release version is in the list → service halts immediately. Every SignCertificateVerify returns gRPC UNAVAILABLE (14).
• Propagation delay: < 1 min worst case.

A mandatory annual end-to-end test pushes a manifest with a dummy EIF version and verifies that staging TEEs halt.

Side-channel posture

• Timing attacks on Ed25519 sign: ed25519-dalek is constant-time for private operations (audited). No further mitigation.
• JWT verification timing: constant-time comparison on the signature check and sensitive-claim string comparisons (subtle::ConstantTimeEq).
• Cache attacks in Nitro: AWS guarantees no cross-VM cache sharing. Documented residual risk, accepted for v1.

Shared responsibility

Inspired by the AWS shared-responsibility model. Trader, validator, and platform each own a slice. None can substitute for the others.

Trust boundaries

The eleven trust boundaries (design doc §7.6) make the cryptographic contract between actors explicit.

Pre-GA hardening checklist

Before declaring GA, every item below must be true (PRD §9.9 + design doc §7.10):

• External security audit completed (FR-O6), with critical findings remediated and others documented.
• Penetration test against reference TEE deployment + marketplace platform.
• Bug bounty program live with ≥ 1 vendor. See bug bounty.
• SLSA Level 3 attestation on host-proxy + EIF + marketplace release binaries (or documented gap with mitigation).
• Kill-switch tested end-to-end (signed remote-revoke halts every TEE within 5 min).
• Incident response runbook approved by external counsel.
• CDN provisioning works against at least 2 providers (Cloudflare
  • CloudFront), with documented failover.
• Status page live, monitoring fully wired.
• Threat model published publicly: this page.

Documented gaps relative to PRD §9.9

The PRD-canonical text uses placeholder language for a handful of items that operators must close at GA. They are flagged here for transparency rather than silently dropped:

• External audit firm + report URL: TBD. Will be linked in the Pre-GA checklist above once contracted.
• Bug bounty vendor + rewards table: see bug bounty. The program launches once the account is provisioned with a vendor (HackerOne preferred per design doc §7.10).
• SLSA-3 verification example: .github/workflows/release.yml emits SLSA-3 provenance on every release. The verification command is documented in the bug bounty page until a dedicated release-verification page lands.

References

• PRD §9.9: canonical threat matrix and defense layers.
• Design doc §7: cryptographic key inventory (K1-K11), trust boundaries, threat mitigation mapping, side-channel notes.
• Design doc §7.8.1: kill switch.
• Design doc §7.10: pre-GA hardening checklist.
• Security overview: trust boundaries summary.
• Security whitepaper: long-form attestation and key-lifecycle write-up.