= Security Considerations =

This page exists so that there is one page to read to learn about the security guarantees that Tahoe is designed to provide, as well as about any current known issues that might have security consequences.


'''The following is not complete.'''

However, you can view [source:architecture.txt@1432#L472 a complete technical explanation] of which this page is eventually intended to be a summary.

= The Distributed Filesystem =

== Access Control ==

The Tahoe distributed filesystem is composed of files and directories.

=== Files ===

==== read access ====

Each file has a unique and unguessable identifier, called a "CHK-URI", which is derived from the file contents.  Possession of this identifier is necessary and sufficient to download, reconstruct, decrypt, and verify the integrity of the file.  If a person is not given the CHK-URI, then they cannot see the contents of the file.

==== mutation ====

Files in the Tahoe grid are immutable.  If you upload a file to the grid, and then change part of it and upload it again, then there are now two files in the grid -- the old one and the new one -- and each has a distinct, unique, CHK-URI.

== Traffic Analysis ==

''To be filled in.''  Traffic analysis is subtle and powerful.  For the moment, assume that if someone wants to, they can learn everything about your every act, including when were, and which file, by its unique identifier and its length ''except'' that they can't learn the actual contents of the files, except that if the file happens to be a file whose contents they already know then they can.  Make sense?  I'll come back later.