Cybersecurity & Cryptographic Architecture
SafePrint Security Threat Model & Cryptographic Guarantees
Designed from first principles to mitigate permanent document persistence in untrusted environments like cyber cafes and printing shops.
1. STRIDE Threat Model & Mitigations
| Threat (STRIDE) | Attack Vector | SafePrint Architectural Defense |
|---|---|---|
| Spoofing | Forging recipient session or link tokens | 256-bit cryptographically secure random bearer tokens ($2^256$ entropy). Stored as SHA-256 hashes in database. |
| Tampering | Modifying encrypted documents or parameters | AES-256-GCM authenticated encryption checks 128-bit authentication tags. Any byte tampering causes instant decryption abort. |
| Repudiation | Denying print initiation or access | Immutable access logs with SHA-256 hashed IPs, timestamps, and user agents. |
| Information Disclosure | Bearer tokens leaking into server access logs or proxy headers | Bearer tokens delivered exclusively in URL fragment (#token). URL fragments are never sent across HTTP or recorded in server logs. |
| Denial of Service | Flooding upload endpoint or brute-forcing share links | Sliding-window IP rate limiting, strict 25MB file upload ceiling, and magic byte validation. |
| Elevation of Privilege | Accessing another tenant's files or path traversal | UUID storage paths disconnected from user filenames; tenant WHERE clauses enforced at ORM level. |
2. Envelope Encryption & Key Lifecycle
Unique Data Encryption Keys (DEKs)
Each document receives a unique 256-bit random key. Ciphertext is stored in an isolated vault. The plaintext DEK is held only in memory during upload and zeroed immediately.
Cryptographic Key Shredding
When a share expires or is manually revoked, SafePrint shreds the encrypted DEK. Even if un-scrubbed raw ciphertext exists in block storage or cold backups, it is mathematically unrecoverable.
3. Technical Realities & Honest Limitations
SafePrint is committed to cybersecurity integrity. We never make scientifically impossible claims:
- Physical Mobile Cameras: No software can prevent someone pointing a smartphone camera at a physical monitor. Dynamic watermarks serve as forensic deterrents.
- Physical Printer Verification: Web browsers can verify that the print dialog was invoked, but cannot verify mechanical paper emergence without custom OS agent drivers.
- Pre-Existing Copies: SafePrint guarantees destruction of server keys and storage objects, but cannot delete documents saved outside our platform prior to revocation.