[Decision] Define encryption threat model, deployment profiles, and disable semantics #1

New Issue

zemion · 2026-07-30T17:34:18+02:00

zemion commented

2026-07-30 17:34:18 +02:00

Define the boundary before implementing cryptography. The module may provide key vaults and E2EE capabilities, but business ownership, access control, and key custody must remain distinct.

Acceptance criteria

Threat actors, protected assets, metadata leakage, server trust, client trust, and backup/recovery assumptions are documented.
Deployment profiles distinguish server-side envelope encryption, tenant-held keys, and true end-to-end encryption.
Disable/uninstall behavior is explicit: encrypted content must be migrated/decrypted by an authorized workflow or remain unavailable; disabling never silently destroys keys or data.
Recovery, legal hold, export, rotation, revocation, and ownership-transfer consequences are decided per profile.
Approved algorithms/libraries and cryptographic-agility/versioning rules are recorded.
No implementation claims E2EE before the selected profile satisfies the threat model.

Define the boundary before implementing cryptography. The module may provide key vaults and E2EE capabilities, but business ownership, access control, and key custody must remain distinct. ## Acceptance criteria - Threat actors, protected assets, metadata leakage, server trust, client trust, and backup/recovery assumptions are documented. - Deployment profiles distinguish server-side envelope encryption, tenant-held keys, and true end-to-end encryption. - Disable/uninstall behavior is explicit: encrypted content must be migrated/decrypted by an authorized workflow or remain unavailable; disabling never silently destroys keys or data. - Recovery, legal hold, export, rotation, revocation, and ownership-transfer consequences are decided per profile. - Approved algorithms/libraries and cryptographic-agility/versioning rules are recorded. - No implementation claims E2EE before the selected profile satisfies the threat model.

zemion added the

labels 2026-07-30 17:34:18 +02:00