N NexusFS

Security Model

Received is not the same as accepted.

NexusFS is verifier-first: every boundary where bytes arrive from somewhere else — a peer, a facade, a proof file — re-derives the fact rather than trusting the claim. The page below states what is actually enforced, and then what is not, because a security page that only lists the wins is a marketing page.

Signed operations

Verified before they change state, through the same apply path local writes use. There is no route into the state machine that skips it.

Content matched to the request

A chunk is hashed before it is stored — and content that was never requested is dropped even when it hashes correctly. Self-consistency is not the same as having been asked for.

Sealed per recipient

A write seals its file key to each enrolled peer and to this device, so a replica holding every stored byte still cannot read a file it is not a recipient of. No key is shared across replicas.

Rotation withdraws access

Removing a peer and running nexusfs rotate re-encrypts content under fresh keys, so it loses access from then on. What no system can do is reach the copy it already took.

Pinned peer keys

An ed25519 key pinned on first use, independent of TLS. Replacing one needs --rotate, so an unexpected key is never silently accepted as a planned rotation.

Malformed evidence is refused

A proof bundle that does not parse, or does not match its operation, is rejected deterministically. Evidence that can be malformed and still accepted only looks like a check.

A proof names its own subject

check-proof reports the inode the proof commits to, not the labels the file carries — those are not covered by the proof, so they are printed as unverified and flagged when they disagree.

Adjacency, actually checked

Absence rests on two entries being adjacent, not merely bracketing. The claimed map size is prover-supplied, so the whole space of lies is swept by test rather than argued for.

Assumed about the world

  • Devices may be offline for long periods.
  • Peers may be honest, buggy, stale, or malicious.
  • Local disks may need at-rest encryption.
  • Bandwidth and energy are constrained resources.

Limits worth stating plainly

  • Access cannot be withdrawn retroactively: rotation re-encrypts, but the copy a peer already took still decrypts.
  • identity.toml is what opens your content — losing it loses everything sealed to this device.
  • File names, directory structure and file sizes are not encrypted.
  • The commitment layer is not zero-knowledge: a verifier learns the entry proved, just not the rest of the tree.
  • The S3 facade has no request signing, so it belongs on loopback unless a shared secret is set.
  • Identical plaintext does not deduplicate; convergent encryption would leak whether a node stores a candidate file.

Auditing

One command reads the whole repository back

nexusfs verify checks every signature and proof and reads every file — so missing chunks, wrong keys and tampered ciphertext all surface. It exits non-zero on failure, which makes it usable directly as a cron or CI check, and the same report is served at /api/security.

Operations Guide Protocol