papers/hip-0302-replicate/sections/08-security-analysis.tex

\section{Security Analysis}


\subsection{Threat Model}

\begin{table}[H]
\centering
\begin{tabular}{@{}lll@{}}
\toprule
\textbf{Threat} & \textbf{Mitigation} & \textbf{Layer} \\
\midrule
S3 bucket compromise         & age encryption             & Layer 2 \\
S3 operator reads replicas   & age encryption             & Layer 2 \\
Network interception          & TLS 1.3 to S3 endpoint    & Layer 3 \\
Pod filesystem access         & sqlcipher encryption       & Layer 1 \\
Age identity theft            & KMS access control, HKDF  & Key mgmt \\
Key loss                      & Offline recovery identity  & Key mgmt \\
Replay attack on WAL          & Generation counters, HMAC  & Protocol \\
\bottomrule
\end{tabular}
\caption{Threat model and mitigations.}
\label{tab:threats}
\end{table}

\subsection{Isolation Guarantees}

Per-org isolation is maintained at three levels:

\begin{enumerate}[nosep]
    \item \textbf{Database level.} Each org has a separate SQLite file with a
    separate sqlcipher key. Compromise of one org's sqlcipher key does not
    expose another org's data.

    \item \textbf{S3 path level.} Each org's replica is stored at a distinct
    S3 prefix. S3 bucket policies restrict access by prefix.

    \item \textbf{Encryption level.} Each service has its own age identity.
    The ATS age identity cannot decrypt IAM replicas. Cross-service access
    requires the master key.
\end{enumerate}

\subsection{What This HIP Does Not Cover}

\begin{itemize}[nosep]
    \item \textbf{Application-level backup testing.} HIP-0065 specifies
    automated restore verification. This HIP defers to HIP-0065 for backup
    testing schedules and alerting.

    \item \textbf{Cross-region replication.} S3 bucket replication to a
    second region is an operational concern configured at the
    \texttt{hanzoai/s3} level (HIP-0032), not at the replicate level.

    \item \textbf{PostgreSQL replication.} Services using PostgreSQL
    (HIP-0029) use WAL-G or pgBackRest. This HIP applies only to SQLite
    databases managed by Hanzo Base.
\end{itemize}

% ============================================================================
% 9. MIGRATION
% ============================================================================