Privacy and confidentiality: intent and current limits

Development status: Overview — In the experimental implementation, confidentiality and proving features are simulated or switched off, so it provides no confidentiality protection; interfaces for encrypted computation and a library of privacy-protection building blocks exist only as experimental prototype code in which protections are simulated. Visibility controls, selective disclosure and ways to bound observable metadata are being explored, and optional residency controls are planned. Nothing is publicly available for live use.

Before you read: What Cubane is designed to do.

What confidentiality is Cubane intended to provide, and what is actually protected today? The second half of that question has the shorter answer, so it comes first: nothing is protected today. The rest of this page outlines the confidentiality Cubane is intended to provide, gives each topic in this section its own status, explains how to read privacy statements anywhere in this documentation and suggests where each kind of reader should go next.

What is actually protected today

Status of this section: Experimental implementation exists — internal prototype only; confidentiality features are simulated or switched off.

• In the experimental implementation, confidentiality and proving features are simulated or switched off, so it provides no confidentiality protection.
• Interfaces for encrypted computation exist in an internal prototype, but they simulate the behaviour. No real encrypted computation is performed.
• The experimental implementation holds no encrypted or access-controlled data, and the step that would reveal results to authorised parties is only simulated.
• Outputs of simulated components can look like protected data or like proofs. They are not evidence that anything has been protected or proven, and they should not be presented as such in demonstrations, reports or evaluations.
• Nothing in the experimental implementation should be used with real or sensitive data.

For planning purposes, treat every confidentiality capability described in this section as absent until its own page says otherwise and gives release evidence.

What confidentiality is intended to mean here

The project’s overall aim is set out on What Cubane is designed to do. Within this section, confidentiality is described as a small set of intended goals, each explained on its own page:

• Confidential computation. Computing over encrypted data is a design goal of the project. See Confidential computation.
• Visibility controls. Data owners would decide who can see which data, including granting time-limited access to auditors. See Visibility controls and selective disclosure.
• Selective disclosure. Selected results would be shared with parties authorised to receive them, rather than everyone receiving all of the underlying data. The same page explains this goal.
• Acknowledged limits. Some protocol metadata is expected to remain observable even with confidentiality features in place, and ways to bound it are being explored. See What remains observable.

These are goals, not assurances. None of them is implemented, and this documentation does not describe how any of them would be achieved.

The topics at a glance

Table: privacy and confidentiality topics, their status label, what exists today and the primary page for each.

Topic	Status label	What exists today	Primary page
Confidential computation	Experimental implementation exists	Interfaces in an internal prototype that simulate the behaviour; no real encrypted computation is performed	Confidential computation
Visibility controls and selective disclosure	Being explored	No access-controlled data exists; the step that would reveal results is simulated	Visibility controls and selective disclosure
What remains observable	Being explored	Neither measures to bound metadata nor residency controls are implemented	What remains observable
Privacy-protection building blocks	Experimental implementation exists	A prototype library for internal testing, in which several protections are simulated	Privacy-protection building blocks in the experimental prototype

Every row states its status in words. “Experimental implementation exists” describes maturity only; it does not mean usable, released, reviewed or protective, and no row describes anything publicly available.

How to read privacy statements in this documentation

The same reading rules apply on every page that mentions confidentiality:

• Status and scope. Every confidentiality statement names its status and its scope. Data is not described as private or secure without saying in what sense and under what status.
• No absolutes. Absolute wording such as “guaranteed” or “never” is not used for confidentiality. If a sentence seems to promise more than the status label beside it, read it at the level of the label.
• Assumptions. Confidentiality would always rest on assumptions, such as who holds the relevant keys and what remains observable. See Trust assumptions and responsibilities by participant and What remains observable.
• No legal or compliance claims. This section makes no legal or compliance claims. What is and is not claimed about compliance is set out on Compliance position and data-protection intent.

Suggested reading paths

• Evaluating fit: Confidential computation, then Known limitations of the experimental prototype.
• Organisations and integrators: Visibility controls and selective disclosure, then What remains observable, then Compliance position and data-protection intent.
• Researchers: What remains observable, then Design note: confidential computation with verifiable results.
• Assurance readers, such as auditors and regulators: Privacy-protection building blocks in the experimental prototype, then Known limitations of the experimental prototype.

Assumptions, trust and limitations

• Everything in this section describes goals. The experimental implementation provides no confidentiality protection.
• Some information is expected to remain observable even once confidentiality features exist; confidentiality of data contents would not make activity itself invisible.
• How confidentiality would be achieved is not described, and no encryption technique, construction or parameter is named.
• Whatever confidentiality is eventually provided would depend on assumptions about participants, keys and observable information, and each statement about it would carry its own status and scope.

Not yet available, and how this section will grow

Designs, parameters and assurances are not described. Further technical reference is not yet available. The Research: problems, properties and open questions section records goals, assumptions and open questions for confidentiality, and is the place where approved evaluation material would appear. Status labels on these pages change only with evidence of implementation and release, and the Documentation change log records each change.

What this page does not claim

This page does not claim:

• any confidentiality, privacy or security assurance;
• any encryption technique, construction or parameter;
• any comparison with other platforms.

Anything not stated here as available or assured should be treated as neither.

Related pages

• Confidential computation — the intended capability and what the prototype simulates.
• Visibility controls and selective disclosure — who would see which data, and how selected results would be shared.
• What remains observable — information expected to stay visible, and residency intent.
• Privacy-protection building blocks in the experimental prototype — prototype components and their simulated protections.
• Known limitations of the experimental prototype — the full list of prototype limitations.
• What Cubane is designed to do — the prerequisite statement of the project’s aim.

Glossary

• Confidentiality
• Confidential computation
• Visibility
• Selective disclosure
• Observable metadata
• Experimental implementation

References

No approved public references yet.