---
layout: default
title: Threat Model
---

<h3>Pond threat model</h3>

<p>The threat model is defined in terms of what each possible attacker can achieve. The list is intended to be exhaustive, i.e. if an entity can do something that is not listed here then that should count as a break of Pond. (For now, this document is very new and I may have missed some things.)</p>

<p>Firstly, assumptions about the user:</p>

<ol>
	<li>The user acts reasonably and in good faith. (Starting off very vaguely! But if the user were to give their private key material to the attacker that would be unreasonable, for example.)</li>
	<li>The user obtains an authentic copy of Pond.</li>
</ol>

<p>Secondly, assumptions about the user's computer:</p>

<ol>
	<li>The computer correctly executes the program and is not compromised by malware.</li>
	<li>The computer has a TPM or other form of erasable storage.</li>
</ol>

<p>Lastly, assumptions about the world:</p>
<ol>
	<li>The security assumptions of curve25519, Ed25519, salsa20, poly1305, HMAC-SHA256, Rijndael (with a 256-bit block) and pairing based group-signatures are valid.</li>
</ol>

<p>What the user's home server can achieve:</p>

<ol>
	<li>A server can learn when a user is online by observing transactions.</li>
	<li>A server can learn how many messages a user receives, and when they receive them. (But not who sent them.)</li>
	<li>A server can learn the approximate size of any uploaded detachments, when they are uploaded and when they are downloaded.</li>
	<li>A server can drop or corrupt any messages.</li>
	<li>A server can spam a user with invalid messages.</li>
	<li>A server can duplicate old messages.</li>
	<li>A server can drop or corrupt any uploaded detachments.</li>
	<li>A server can estimate the number of contacts who send messages to a given account after that account has issued a revocation based on the number of clients who try to send messages using an expired group generation number.</li>
	<li>(Future) A server can falsely inform a contact that they have been revoked.</li>
</ol>

<p>What a global, passive adversary (one who can observe all Internet traffic) can achieve:</p>
<ol>
	<li>A GPA can learn who is using Pond and where their home servers are located.</li>
	<li>A GPA can learn when messages are sent to a non-home server and which server that is.</li>
	<li>A GPA can observe detachment uploads and downloads, and who is performing each of those actions.</li>
	<li>A GPA can observe when a shared-secret key exchange is performed and can limit possible set of other parties to those who were also performing a key exchange at the same time.</li>
</ol>

<p>What a local network attacker can achieve:</p>
<ol>
	<li>A local network can observe when a user is using Pond.</li>
	<li>A local network can block Pond.</li>
	<li>A local network can observe the approximate size of any detachment uploads and downloads.</li>
	<li>A local network can observe when a shared-secret key exchange is performed.</li>
</ol>

<p>What a physical seizure of the user's computer can achieve:</p>
<ol>
	<li>After a seizure, an attacker can perform an offline attack against the user's passphrase and obtain undeleted messages if successful.</li>
</ol>

<p>What a physical compromise of the user's computer can achieve:</p>
<ol>
	<li>A compromise of the user's computer can obtain all messages from the point of compromise, onwards.</li>
</ol>

<p>What the shared-secret key exchange (PANDA) server can achieve:</p>
<ol>
	<li>The PANDA server can run offline attacks against the shared secret and can MITM any in-progress exchanges that it can break.</li>
	<li>The PANDA server can drop or delay any key exchanges that it wishes.</li>
</ol>

<p>What a contact can achieve:</p>
<ol>
	<li>A contact can spam a user with messages.</li>
	<li>A contact can, to some extent, prove to a third-party that a message came from a user (<a href="http://www.phrack.org/issues.html?issue=68&id=14#article">paper</a>)</li>
	<li>A contact can retain messages from a user, forever.</li>
	<li>A contact can learn that a user has revoked a contact (but not which contact, unless they are the revoked contact) at some time after the time of the previous message that they sent to the user.</li>
	<li>A contact can learn if two of their contacts are actually the same user.</li>
	<li>Two contacts can confirm if they are communicating with the same user.</li>
</ol>

<p>What a random person on the Internet can achieve:</p>
<ol>
	<li>A random person can attempt an online attack against running PANDA key exchanges and MITM one of the users if they succeed. The other will receive an error.</li>
	<li>A random person can attempt to DoS a Pond server.</li>
</ol>