Security Model

Security Model

Dual Hardware Authentication

Two independent hardware factors required:

graph LR
    subgraph "Factor 1 — Platform"
        TPM["TPM 2.0<br/>Measured boot, key sealing<br/>Anti-cloning"]
    end
    subgraph "Factor 2 — Person"
        YK["YubiKey Bio<br/>FIDO2, PIV certs<br/>Fingerprint"]
    end
    TPM & YK --> UNLOCK["🔓 Both required"]
    style UNLOCK fill:#0f3460,color:#fff,stroke:#e94560

Loading

Why Both?

Scenario	TPM Alone	YubiKey Alone	Both
Device stolen	❌	✅ Blocked	✅
YubiKey stolen	✅	❌	✅
Remote exploit	Keys extractable	No presence	✅

Key Hierarchy

graph TD
    HW["Hardware Root<br/>TPM-sealed + YubiKey challenge"] --> SK["Session Key<br/>HKDF(master, 'session:' + boot_id)"]
    HW --> FK["File Key<br/>HKDF(master, 'file:' + path_hash)"]
    HW --> VK["Vault Key<br/>HKDF(master, 'vault:' + entry_id)"]
    style HW fill:#e94560,color:#fff

Loading

Secure Boot Chain

flowchart TD
    FW[UEFI Firmware] -->|Verify| BL[Signed Bootloader]
    BL -->|Verify| KRN[Signed Kernel + initrd]
    KRN -->|Verify| SQ[squashfs — dm-verity]
    SQ -->|Extend PCRs| TPM[TPM: Unseal master key]
    style TPM fill:#0f3460,color:#fff

Loading

Threat Model

Threat	Mitigation
Physical theft	TPM + YubiKey dual-factor; encrypted storage
Malware persistence	Immutable root; tmpfs volatile state
Lateral movement	Per-app LXC; ring isolation
Network MITM	mTLS + cert pinning
Cloud breach	Client-side encryption only
Credential phishing	No passwords — biometric YubiKey
Supply chain	Minimal deps; signed builds

App Containerization

graph TD
    subgraph "Isolated LXC Containers"
        B["Browser"]
        E["Email"]
        F["Files"]
    end
    B & E & F -->|"Wayland socket only"| COMP[Compositor]
    B x--x E
    E x--x F
    B x--x F

Loading

Each app: separate PID, mount, network, user namespaces + cgroup v2 limits.

See the full security model document for kernel hardening, update verification, and comparison table.