BukDesk security: the technical paper

This paper is for the reader who decides whether software that carries keystrokes is allowed on a computer or a network. It follows BukDesk's own security documents, and says what is built, what is not, and what has not been tested.

Nothing here has been reviewed by an outside party yet. An independent review is planned before launch.

1. Who it defends against

Attacker	Defended?
Someone on the same network, watching or tampering	Yes for content and for who gets paired. Not for availability or for traffic patterns
A computer that is not paired	Yes, unless a person at each computer presses for it, having seen the same code on both
A paired computer that turns bad	Only in part. See section 8
Someone with a copy of the disk or a backup	Yes for the key, on Windows: it is not in a file
Someone with a stolen account on the site	Yes by design: an account never allows connecting to a computer
Whoever runs or breaks into the relay	Yes for content and for connecting. No for metadata
Someone on the internet who is not paired	Yes
An AI session with a shell, or another program of the same Windows user	Only in part
Whoever runs or breaks into the update host	Yes: it holds no key. It can hold updates back and do no more
Whoever can use the key that signs updates	Only in part. See section 7
Malware, or an administrator, on the computer itself	No

2. The channel

On the local network: Noise_XX_25519_ChaChaPoly_BLAKE2s, through the snow library, over length-prefixed frames.

Every frame is encrypted and authenticated. A changed or replayed frame ends the connection.
Each session has fresh keys, so a key stolen later does not open recorded sessions.
The handshake has a fixed prologue, so it completes only between two copies of BukDesk.
Small-order Curve25519 points are refused.
There is one cipher suite and one protocol version. There is nothing to downgrade to.

3. The serial

A serial is 20 characters: 100 bits of a SHA-256 hash of the computer's public key. It says which key to expect the first time. After pairing it no longer matters: the whole key is saved and compared.

4. Pairing

A computer takes pairing requests only while a person has a pairing window open. It is closed by default and closes by itself. Opening it, and every press in pairing, takes that computer's own mouse.

A person types the other computer's serial, or chooses it from those announced nearby. The connection is refused unless the other side proves it holds a key matching that serial.
The side that asks sends a commitment to a random nonce.
The side that answers sends its own nonce.
The side that asks reveals its nonce, which has to match the commitment.
Both work out six digits from the handshake and both nonces, and both show them.
The person at the answering computer approves only if both screens show the same digits.
The person at the asking computer presses to say that the same digits show on the other screen.

The commitment is there because the side that asks moves last in the handshake. Without it, that side could try variations until the digits were ones it chose. With it, a stranger gets about one chance in a million for each attempt, and attempts are slowed: each request that ends without approval doubles the wait before the next, up to 5 minutes.

Step 7 exists because a serial says which key to expect, and not whose computer it is. Anyone on a network can announce a serial of their own. So a key is saved only after a person has looked at a code on a screen they can see.

What is left: a person who presses without looking, and a person talked through it on the phone.

5. Over the internet: the relay

Off by default. Nothing connects to the relay until a person opens it on both computers.

The relay is untrusted. It joins two connections and passes bytes along. It holds no key and has no list of computers, and nothing registers with it.

Inside TLS 1.3, the two computers run Noise_XXpsk0_25519_ChaChaPoly_BLAKE2s. The extra secret comes from a key agreement between the two keys saved at pairing, so a relay, or a stranger who connects to a waiting computer, gets no answer at all. Through the relay, where a session can last a long time, the keys also move on every 65,536 messages each way.

What	Does the relay learn it?
The addresses and ports of both computers	Yes, while they are connected. Not logged
That two addresses are talking to each other	Yes. Not logged
Timing	Yes
Sizes	Yes. Input goes in frames of one size on a steady tick, which hides typing rhythm and not that someone is active
A token that changes every hour	Yes. A computer that waits without a break can be followed from token to token
Public keys, serials, names	No. They are never sent to it
Frame contents	No

What it keeps: who is connected, in memory. A keyed hash of each address, in memory, for about 10 minutes. One line of counts a minute, with no address, token or content in it, which the server's journal keeps for 30 days. The relay itself writes nothing to disk.

What never goes through it: files, and pictures of a screen.

Control over the internet takes its own approval in each direction, at the computer it concerns, and ends at the emergency keys, at the lock screen, at a time the person set, or when the connection drops. When control of a computer ends and nobody is using its own mouse or keyboard, it locks, after a warning of 30 seconds. A crash or a forced end of BukDesk locks nothing. A message to an AI session that came through the relay always waits for a person.

Premium is not on sale yet, and its check at the relay is not built. It will add a check that whoever connects has paid, and a count of connection time. Today the relay asks for no proof of purchase and knows of no customers. This paper will say what that check lets the relay and the site learn once it is built.

6. Keys

On Windows, a computer's private key is in Windows Credential Manager, for the current user, kept on that computer only. It is not in a file.

A stolen disk, a backup or another user of the computer does not yield the key.
Malware running as the same user can ask the store for it, and so can an administrator.
There is no way to revoke a key across computers. Each one has to end the pairing by hand.

7. Updates

An update can run code on every user's computer, so nothing about it rests on the server it comes from.

The app asks one fixed address for a manifest. The address and the public keys are fixed in the source.
It checks the manifest's Ed25519 signature before it reads anything out of it, then that it is for this product and platform, not past its date, and not older than the version running.
It fetches the installer, and counts it as downloaded only if the size and the SHA-256 match what was signed.
A separate updater, which Windows asks an administrator to approve, checks everything again for itself and starts the installer.

No redirect is followed. A manifest holds no setting, no address and no key.

If the update host is taken over, it can hold updates back. It cannot serve its own installer, or an old one as new.

If someone can use the signing key, they can ship anything. What limits that: the key is in a cloud key service that does not let it be exported, apart from the site and the update host. An update does not install by itself until a computer has known about it for 24 hours, so there is a day to notice. A person who presses Install does not wait.

The installer and every program in it are signed for Windows by Bukchair Ltd.

8. What is not protected

Malware or an administrator on either computer. It can read keystrokes, take the key and change the list of paired computers.
A paired computer that turns bad. It can send any message to the app. Once a person has put it in the layout, it can type and move the pointer, and it sees what is typed and what the clipboard holds when the keyboard and pointer go to it, except what the copying program marked as private. With full trust, which is on by default for a computer paired by the code on both screens and has a switch on each pairing, a real press of its mouse or keyboard on the local network also approves messages, loop stops, automatic delivery, file transfers, screen viewing and changes to the arrangement. It cannot open a pairing window, pair a stranger or change that trust, and input made by a program does not count.
A person who approves without comparing the code.
A person talked into it over the internet. Each step is a separate act and a chance to stop. None of that stops someone who is believed. This is the classic scam against remote-control software, and no protocol prevents it.
A computer nobody is sitting at, with control over the internet left approved. The far side can use it, unlocked, until the lock screen comes up or the connection is lost. There is no time limit unless the person sets one. The computer locks when that control ends, and not while it lasts. A far side in control can get around that lock, as it can type: it can end BukDesk, and a crash or a forced end locks nothing.
Being blocked. Someone on the network can cut connections and flood announcements.
Traffic patterns. Anyone in the path sees when traffic flows and how big each frame is. A relay also sees which addresses talk to which.
What whoever runs the relay chooses to do. It keeps no record because the code does not. Someone who changes the code, breaks in or compels us could start keeping one: addresses, timing, sizes and tokens, and no keys or content.
Being seen on a network. Each computer announces its serial on the networks it uses. The serial never changes.
Future quantum computers. X25519 is not safe against a large one. No post-quantum protection is in place.
A stolen key. See section 6.
Prompt injection. A message from another computer to an AI session is text from outside, even when the channel is sound.
An AI tool that can run commands. It runs as the signed-in person. Tools that ask before running commands are the only thing in the way, and that is theirs to enforce.
A copied disk or virtual machine. Two computers would share one identity, and nothing notices.
Whoever can sign the updates. The signing key can ship anything to every user. See section 7.
Bugs in what BukDesk is built on. The cryptography comes from snow and the Rust crates under it. We rely on them and have not audited them.

9. What has not been tested

A real domain network, and a real Group Policy.
Other security software, which can block input hooks.
Hundreds of computers on one network.
The relay on an office network.
An outside review or a penetration test.

10. Reporting a problem

See the disclosure policy.