George Lambert
da60402e88
Some checks are pending
ci / markdown (push) Waiting to run
source/ is the Sphinx tree. Companion PDF hrefs are relative, not Markdown.
43 lines
1.4 KiB
ReStructuredText
43 lines
1.4 KiB
ReStructuredText
Architecture (audit interview)
|
|
==============================
|
|
|
|
::
|
|
|
|
Endpoint (keys stay here / HSM)
|
|
│ HPKE content (NPE suite)
|
|
│ routing: dest + subject in the clear
|
|
▼
|
|
Untrusted NATS (cannot read bodies)
|
|
│
|
|
▼
|
|
Verae DataCube chain (append-only hashes)
|
|
│ written through Peergos client
|
|
▼
|
|
Peergos cryptree (encrypted names, sizes, graph)
|
|
│ chunks → CID / hash
|
|
▼
|
|
IPFS (distributed, hash-verified ciphertext)
|
|
|
|
* **At rest:** Peergos cryptree + IPFS. Hosts with disk/backup see
|
|
**opaque hashed ciphertext**, not PHI, if they lack keys.
|
|
* **In transit (NATS):** HPKE-Base to directory public keys. Broker is
|
|
honest-but-curious: destinations yes, bodies no.
|
|
* **Integrity:** cube JSONL chain + dual hash + IPFS CID check on
|
|
restore (re-fetch blocks, re-verify hashes — not a plaintext tape).
|
|
|
|
NATS remains an untrusted router. Production E2E is NPE/HPKE.
|
|
Passthrough means destination in the clear; the body is ciphertext.
|
|
|
|
.. only:: html
|
|
|
|
Live: https://pfc.georgelambert.org/v1/npe/keys (public keys only).
|
|
Controls: https://docs.pfc.georgelambert.org/controls.html
|
|
|
|
.. only:: latex
|
|
|
|
See companion ``peergos-for-compliance.pdf`` (same folder) for
|
|
controls, custody, and variables chapters.
|
|
|
|
.. raw:: latex
|
|
|
|
\href{peergos-for-compliance.pdf}{peergos-for-compliance.pdf}
|