Architecture

What this page is

We publish the architecture rather than describing it in general terms. A design that only holds while it is secret is not one we would put a client's book behind, so this page sets out how the platform is built and where it is open.

It describes what is designed. Nothing here is running yet, and where a part exists only on paper we say so in the same sentence that describes it.

The two planes

Manifest holds two kinds of information and treats them differently.

• The public plane. What any observer of shipping can already establish: that a vessel exists, its identifiers, its type and its build. Held in the clear, because it is already in the clear.

• The private plane. Which vessels sit on AJG's book, what they are rated at, and everything a broker writes about them. Encrypted, and readable only through the steps below.

The line between the two is the product. Anyone reading our database learns which vessels exist in the world, which they could establish anyway, and nothing about whose book they sit on.

Where the parts run

• The application. The pages a broker works in. Holds no key material.

• The store. Every encrypted record, and the log of every request. Computes nothing.

• The custodian services. One share each, and the list of who currently has access. Separate services, separate credentials, run by a different team from the application.

The separation is the control. A part that is trusted and a part that is harmless are different things, and the store is arranged to be harmless.

Opening one record

A broker holds proof of who they are and no key material. The key for a record is computed at the moment it is used, and exists nowhere before or after.

1. 01

   The broker proves who they are, holding no key material.

2. 02

   Their browser asks the custodian services for help.

3. 03

   Each custodian answers from its own share, and learns nothing about the key.

4. 04

   The answers combine into the key for that record, which is used once and discarded.

There is no partial progress below the threshold. Two custodians short of a quorum are exactly as far from the key as none of them.

Withdrawing access

Access is a row held at the custodian services rather than a key in someone's hands, so withdrawing it is a single write that completes on its own and cannot be stalled by anything else.

That closes the future completely. It does not reach backwards into records nobody has touched since, and we would rather state that here than have a reviewer find it. Those records close as brokers edit them in the normal course, and a deliberate pass over the archive closes the remainder.

What it would take to read the book

• A quorum of the custodian services

• The value the derivation starts from

• The stored ciphertext

Only with all three together does the book open

Microsoft cannot read the book. Azure holds the ciphertext and the request log and can compute nothing from either. That holds provided the custodian services run apart from the application and the store, under separate credentials, which is a deployment requirement rather than a preference.

Gallagher can. We operate all three, so the three parts sit inside one company, and an organisation that decided to combine them would read everything. The obligation not to is contractual and sits with the legal team. It is a normal enterprise arrangement, and it is a contractual control rather than a mathematical one, which is not something we will present as the latter.

• A breach of the store on its own yields nothing readable.

• One compromised service is contained, because the custodians answer separately.

• Reading a record leaves an attributable trace at services the store's operator does not run.

The code in the browser

The page that opens a record reaches the broker over the web. If that code is altered before it arrives, it can act as the broker, and no rule written inside that code changes it. This is the open gap in the design and we would rather name it than leave it to be found.

The answer we agree with is a browser extension holding the pinned custodian set and making the calls itself, which leaves the page as a shell nobody has to trust. It is deferred, because it carries regulatory and logistics work that this stage of the build should not take on. What we ship is the web application and an installable version of it, and installing it is not a security measure: same origin, same certificate and same update path as a bookmarked tab.

What is designed and not built

The mathematics that lets the custodian services hold a key none of them can compute is cited in our specification and not yet written out in full. Most of what this page describes rests on it. Until that is written and reviewed, this is a sound shape with a gap at the centre.

What this page does not carry is the deployment: regions, the thresholds in force, and hostnames. Those are configuration rather than design, and publishing them helps an attacker without helping a reviewer.