Concepts

Threat Model & Non-Goals

Most of Zajil's design force comes from what it deliberately refuses to do. Stating the non-goals first prevents relitigating them every few months.

Non-goals

• Anonymity

  Every device maps to a physically verified human. This is a deliberate design choice, not a limitation to be fixed later. Zajil is the opposite of an anonymity network — it is an accountability network that happens to be end-to-end encrypted.

• Open enrollment

  There is no remote or self-service path onto the network. You cannot sign up. You are enrolled, in person, against an institutional ID.

• Content inspection

  Payloads are end-to-end encrypted and stay that way. Abuse enforcement runs on attribution and revocation, never on reading traffic. See accountability.

• Internet-scale / public operation

  The network runs on operator-controlled infrastructure, not the open internet. Scale beyond ~10k devices is handled by adding cells, not by changing the architecture.

Why refuse content inspection when the goal is preventing misuse?

This is the central tension, and it resolves cleanly. The same capability that would let an operator read traffic is the capability that makes a compromised Barid node survivable. Build a content-inspection backdoor and every future attacker who takes a server inherits it.

Accountability is achieved instead at the identity layer: no anonymous registration, no bulk enrollment, no disposable identity, every device bound to a named person at a desk. A report resolves to a human in one roster lookup. That delivers enforcement — the network genuinely cannot be a haven for what it should not carry — without ever weakening the encryption. The deterrent is knowing you are known, not being watched.

What an attacker gets by compromising each layer

Compromise	What the attacker gains	What they do not gain
A single address (learns today's endpoint)	A place to send packets that will fail the handshake	Nothing. Not authentication, not content.
A single cell (roots one machine)	Metadata for that cell's devices: who ↔ who, when, how much	Message content (E2E), ability to impersonate (identity chains to root), other cells
A client device (stolen/rooted phone)	That device's cell secrets → future addresses for its cells, until rotation	The root key, other devices, the roster
A checkpoint (enrollment desk)	A stack of printed enrollment tokens	Any key material — checkpoints hold none. See enrollment.
The root key	Total control — can sign manifests and certs	— this is the catastrophic case; defended by offline storage + Shamir split

The design goal, stated as one line: everything except the root key is disposable, and the root key never touches anything that runs.

The primary attacker capabilities we assume

• Can take a server. Barid nodes are assumed individually compromisable. Answer: servers hold no authority and can be burned. See burn & replace.
• Can spoof time. Because address rotation depends on a shared clock, an attacker who controls a client's clock can deny it service. Answer: a root-signed time source (planned) plus a monotonic floor (interim). See time buckets.
• Can observe the network. Traffic analysis is possible per-cell. Answer: compartmentalisation limits how much any one compromised cell sees. See blast radius.
• Can steal a device. Answer: cell-granular revocation and passive deprovisioning bound the damage and its duration.

What we explicitly do not defend against

• A global passive adversary correlating traffic across all cells at once. Zajil is not Tor; that is not its threat model.
• Coercion of the root key holder. No cryptography defends against a wrench. Mitigation is operational (Shamir split, offline storage), not protocol-level.
• A malicious operator. The operator is the root of trust. This is an owned network; that is the point.