Novich0k: zero-trust, inverted
Zero-trust is normally a defensive posture: trust no node, verify everything. Novich0k models what happens when an attacker adopts it: relays that are cryptographically blind, threshold-split, and disposable. It is not a paper exercise, the v3 stack is a working Rust/WASM build, verified end-to-end against live edge infrastructure.
A built system, not a slide deck
Novich0k v3 is a pure-Rust workspace of five crates. Every claim on this page traces to running code, and the full pipeline was verified live in April 2026: beacon registration, command delivery, result return, signature rejection, replay rejection, and multi-worker failover.
| Crate | Target | Role |
|---|---|---|
n0k-wire | no_std + alloc | Shared protocol types, Umbral serialization, HMAC helpers, the Segment-shaped traffic profile. Compiles for native and WASM alike. |
phantom-ts | x86_64 native | Team server (Axum + SQLite). Queues commands, generates and distributes key fragments, verifies and decrypts results. The only component that ever holds decryption capability. |
n0k-worker | wasm32-unknown-unknown | Edge relay on Cloudflare Workers. Stores fragments and ciphertext in KV (10-minute TTL), re-encrypts on demand. Deployed and exercised live. |
n0k-beacon | x86_64-pc-windows | Windows implant. Keys derived at runtime from an embedded seed; stripped release binary; polls the worker on a jittered interval. Knows the worker's address and nothing else. |
n0k-gui | x86_64 native | Operator interface (egui). Talks to the team server over a local, token-authenticated HTTP API. |
| Primitive | Crate | Purpose |
|---|---|---|
| Threshold PRE | umbral-pre 0.11 | Re-encryption on secp256k1; the relay-blindness guarantee |
| AEAD | chacha20poly1305 | Payload encryption inside the Umbral construction |
| KDF / hash | hkdf, sha2 | Key derivation from ECDH shared secrets; digests for signatures |
| Request auth | hmac (SHA-256) | Authenticating beacon polls and pushes at the worker |
| Signatures | ECDSA (secp256k1) | Every envelope signed; beacons reject unsigned or mis-signed commands |
CONFIRMED: live end-to-end testing, April 2026: registration, command delivery, result return, auth and replay rejection, failover. Internal crate names appear here for provenance; nothing deployable is published.
The relay trust problem
Every major C2 framework concentrates trust in its relay. The table is the whole argument: what the server can read is what a seizure yields.
| Framework | Relay can read traffic? | Team server reachable from relay? | Forward secrecy |
|---|---|---|---|
| Cobalt Strike | Yes, redirector terminates HTTP/S | Yes, exposed by proxy config and memory | Per session |
| Havoc | Yes, reverse proxy has bidirectional visibility | Yes, discoverable from the proxy host | Per session |
| Sliver | Yes, mTLS terminates at the relay | Yes, embedded in implant configuration | Per session |
| Mythic | Yes, the C2 profile container is the outer boundary | Yes, container re-initiates internal sessions | Profile-dependent |
| Novich0k v3 | No; key fragments only, mathematically incapable of decryption | No; the beacon never learns it; the worker reaches it only through an ephemeral tunnel | Per message: a fresh ephemeral key in every capsule |
Framework rows describe public, documented behavior only, see About for sourcing discipline. ASSESSED: to our knowledge, Novich0k is the first published C2 architecture applying PRE as first-class relay isolation.
The blind relay
The worker is the unusual component: a relay that performs cryptographic work on traffic it cannot read.
In a traditional framework the relay is trusted: it holds session keys, decrypts commands, and often logs plaintext. A Novich0k worker is cryptographically blind. It holds one fragment of a threshold re-encryption key, useless for decryption alone, and useless below threshold even in collusion. Its key-value store holds only ciphertext blobs indistinguishable from random data to anyone without the operator's or beacon's secret keys.
The mechanism, proxy re-encryption with threshold splitting, is built diagram by diagram in the PRE Primer, including Fig. D4, the threshold-seizure walkthrough this page's claims rest on.
Key insight
Seizing a Novich0k relay recovers three things: one useless key fragment, a pile of ciphertext, and metadata about when blobs arrived. The first two are cryptographically empty. The third, timing, is where detection lives.
Text equivalent
- The operator's workstation and the team server form the only trusted zone; they hold the operator secret key and all plaintext.
- The edge worker sits outside that zone. It stores key fragments and ciphertext and performs re-encryption, but holds no key capable of decryption.
- The beacon holds its own secret key, verifies operator signatures, and communicates only with the worker; the team server's address never reaches it.
- Results return to the team server through an ephemeral tunnel, so the worker's view of the team server is transient.
| A fully compromised worker… | Specifics |
|---|---|
| Yields | Key fragments (both directions), public and verifying keys, auth secrets, every capsule and ciphertext it relayed, and traffic metadata: source IPs, timing, sizes. |
| Still cannot | Decrypt any command or result (no secret keys exist at the relay). Forge commands or results (envelopes are ECDSA-signed; verification fails). Recover secret keys from fragments below threshold (unconditional, not computational). |
| Honestly, still can | Delay or drop traffic, and abuse its fragments to re-encrypt toward attacker-chosen keys. PRE removes the relay's read access, not its position; that residual trust is why fragments are threshold-split across independent providers. |
Detection note
Blob arrival times, sizes, and fan-out patterns are visible at the relay host and the CDN edge even when contents never are. See Detection Surfaces → timing and byte-count rows.
Zero-trust as an attacker property
Three properties define the model. Each one trades away something defenders rely on, and each one leaves something behind.
| Property | Attacker gain | What defenders lose | What defenders keep |
|---|---|---|---|
| Relay blindness | Seized relays expose no content, keys, or history | Content inspection at the relay; seizure as intelligence | Timing, sizes, cadence, TLS fingerprints, edge logs |
| Threshold redundancy | No single seizure degrades the network | Takedown as a decisive action | Threshold-rebalancing events are themselves observable |
| Disposable infrastructure | Replacement relays in minutes, at near-zero cost | The cost asymmetry that made takedown worthwhile | Churn rate as a signal; new-hostname DNS telemetry |
Detection note
Read the right-hand column as the research agenda. Each "what defenders keep" cell is expanded into a testable hunting hypothesis on the Detection Surfaces page.
Proof surfaces, and their limits
Each security property names its mechanism, its guarantee, and its verification status. The limits are stated with the same confidence as the guarantees.
| Property | Mechanism | Guarantee | Status |
|---|---|---|---|
| Relay blindness | Umbral threshold PRE (2-of-3 default) | Relay holds fragments that cannot decrypt; sub-threshold compromise reveals nothing | CONFIRMED: live |
| Envelope authenticity | ECDSA signatures over the full envelope, both directions | Forged commands fail at the beacon; forged results fail at the team server | CONFIRMED: live |
| Replay protection | Monotonic sequence per beacon | Stale or re-sent envelopes are rejected | CONFIRMED: live; counter is currently timestamp-derived, a known production gap |
| Per-message forward secrecy | Fresh ephemeral key in every capsule | Later compromise of long-term keys does not open captured traffic, a stronger unit than TLS's per-session guarantee | ASSESSED: construction-level |
| Fragment integrity | Umbral correctness proofs, verified before use | Tampered fragments in the KV store fail verification and never produce output | CONFIRMED: live |
| Residual relay trust | None; inherent to PRE | The worker remains a trusted re-encryption oracle: it can misuse its transform, never its contents | OPEN: mitigated by threshold distribution, not eliminated |
Honest limits
Team server compromise is total; it holds every secret that matters and must be defended accordingly. Beacon compromise is session compromise, as with any implant. PRE changes what the middle of the path is worth to an adversary, it does not harden the ends.
Traffic mimicry, at detection-relevant depth
The model's V2 profile shapes its traffic to resemble product-analytics batching, batched JSON events to a Segment-shaped endpoint, plausible event names, dynamically generated timestamps. The full anatomy, including what each field does and exactly where the imitation breaks, is on the Traffic Analysis page.
What it imitates. The request shape of mainstream analytics pipelines: batched JSON events, plausible event names and timestamps, payload sizes drawn from realistic distributions. To a flow log, a session is meant to read as ordinary product telemetry.
What distinguishes the imitation. The imitator's problems are behavioral, not cryptographic: analytics-shaped traffic originating from processes that are not browsers; cadence that holds machine-regularity a human product never does; size distributions that match a corpus too well; and TLS fingerprints that belong to a cloud worker runtime rather than a browser fleet.
Scope discipline. Published detail is chosen for detection value: field semantics, fingerprints, and behavioral signatures a defender can hunt on. Operational parameters and deployment recipes stay unpublished.
Detection note
Each distinguishing behavior above maps to a hunting hypothesis (H1–H5) with confidence ratings in Detection Surfaces, including honest notes on where mimicry may hold.
FURTHER READING · There Is No Handshake · How Do C2s Get Away with Murder?