Specification
Specification 90 — Security model
* Threat model: [93 — Threat model](/specs/93-threat-model/)
status: framework
Trust roots
| Trust root | Compromise impact | Recovery |
|---|---|---|
| BIML root signing cert | All CNML certs forgeable | Root renewal ceremony |
| BIML identity CA cert | Director identity forged | Identity CA re-issuance |
| Bitcoin blockchain | OTS proofs invalid | Use alternative anchor |
| Publisher root keys | Malicious plugins trusted | Registry-wide revocation |
| HSM firmware | Per-device compromise | Replace HSMs |
Defense in depth
| Layer | Defense |
|---|---|
| Hardware | YubiKey / HSM (keys never leave) |
| Memory | Sensitive |
| Process | Confium sandbox (WASM / out-of-process) |
| Transport | TLS + per-message signatures |
| Coordinator | Threshold property (cannot reconstruct from < T shares) |
| Quorum | T-of-N requires collusion of T parties |
| Transparency | Public log catches compelled/silent issuance |
| Audit | Every action logged with director signatures |
| Ceremony | Annual in-person verification (root operations) |
Adversary tiers
| Tier | Capability | Defense |
|---|---|---|
| Script kiddie | Network attacks, phishing | TLS, password hygiene |
| Organized crime | Malware, insider threat | Threshold (T > 1), code signing |
| Nation-state | 0-days, coercion, side-channels | High T, hardware tokens, transparency |
| Quantum (future) | Breaks discrete-log | PQ migration via composite signatures |
Cross-references
- Threat model: 93 — Threat model
- FIPS strategy: 94 — FIPS 140-3 positioning
- Privacy: 95 — Privacy-preserving operation