> For the complete documentation index, see [llms.txt](https://cifer.gitbook.io/cifer-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cifer.gitbook.io/cifer-docs/network-whitepaper/threat-model-and-limitations.md).

# Threat model and limitations

Cifer reduces concentrated key-custody and authorization risk. It does not make applications, devices, operators, or users immune to compromise.

### Failure scenarios

| Scenario                                 | Expected effect                                                                                                                                         |
| ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| One or two custody nodes unavailable     | Authorized decryption can continue with three responsive nodes.                                                                                         |
| One or two custody nodes compromised     | The attacker does not have the three fragments required for reconstruction.                                                                             |
| Three relevant custody nodes compromised | Critical threshold compromise; confidentiality may be at risk.                                                                                          |
| Orchestration unavailable                | New cryptographic operations may pause while encrypted data remains protected.                                                                          |
| Control-plane partition                  | Operations requiring fresh authorization should fail safely or wait for verified state.                                                                 |
| Application administrator compromised    | The attacker remains constrained by cryptographic identity, policy, threshold custody, and audit controls—but application-level damage may still occur. |
| User device compromised                  | Plaintext visible on that device or valid sessions may be exposed. Cifer cannot fully protect a hostile endpoint.                                       |

### Required assumptions

* Threshold fragments are genuinely isolated and independently operated.
* Hardware-isolated environments and their attestation are correctly configured.
* Randomness and cryptographic implementations are sound.
* Applications validate identity, freshness, authorization, and integrity correctly.
* Software dependencies, nodes, and endpoint applications are patched and monitored.
* Recovery and emergency controls cannot silently bypass threshold protections.

### Communication boundaries

Avoid claims such as “unbreakable,” “impossible to hack,” “completely anonymous,” or “quantum-proof.” Prefer precise statements about architecture, the threat addressed, and the assumptions required.

Independent code review, smart-contract review where applicable, penetration testing, node monitoring, incident response, and periodic cryptographic review remain necessary.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cifer.gitbook.io/cifer-docs/network-whitepaper/threat-model-and-limitations.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.