Security

Threat model, audit reports, and the cryptographic foundations.

LUKSbox is built around defence in depth: AEAD-protected chunks, HMAC-authenticated headers, AAD-bound keyslots, rollback-detection anchors, and memfd_secret master-key memory on Linux.

In this section

• Architecture - trust boundaries, on-disk graph, unlock + crash-safety pipelines, with diagrams
• Threat model - what we defend against and what we don't
• Cryptography - the primitives we use and why
• Tests & how to help - regression suite, fuzz harnesses, contribution paths for external researchers
• Audit reports - internal audit rounds + the third-party engagement package
• Vulnerability disclosure - how to report a security issue

• Security architecture Trust boundaries, on-disk protection graph, unlock flow, and concurrency / crash-safety pipeline, with diagrams.
• Threat model What LUKSbox defends against, and what it explicitly doesn't.
• Cryptography The primitives LUKSbox uses and where each one comes from.
• Audit reports Internal audit rounds + the third-party engagement package.
• Security tests & how to help Regression suite, fuzzing harnesses, audit rounds, and concrete contribution paths for external researchers.
• Vulnerability disclosure How to report a security issue in LUKSbox.