4-Tier System Architecture & Trust Boundaries
The STEGNOLINES system is engineered under a decentralized, client-side execution model. By eliminating server-side data ingestion, all compression, encryption, spatial mapping, and decoding happen exclusively within the local browser sandbox.
1. Four-Tier Sequential Architecture
1. Tier 1 — User Interface (UI) Layer: Built with HTML5, CSS3, and JavaScript to manage real-time user inputs, dynamic capacity meters, interactive previews, and strict input validation.
2. Tier 2 — WebAssembly (WASM) Compression Layer: Embedded Base64-compiled Rust Brotli engine providing high-speed in-browser stream compression with the 0xFE adaptive flag protocol.
3. Tier 3 — Cryptographic Engine Layer: Web Crypto API executing AES-256-CTR with PBKDF2-HMAC-SHA256 (100,000 iterations) using a dynamic salt extracted from the cover text hash.
4. Tier 4 — Steganographic Bit-Mapping & VS Codec Layer: AES-256-CTR CSPRNG with Unbiased Rejection Sampling and O(K) Lazy Fisher-Yates spatial position scattering (with Dual-Engine Fallback for legacy message compatibility), bitwise XOR matching ($K = C \oplus M$), and Unicode Variation Selector injection.
2. Physical Deployment Model
The physical system topology separates static code delivery from user data execution:
- Web Hosting Server (Static CDN): Only delivers static HTML, CSS, JavaScript, and WASM binaries via HTTPS GET requests. It contains no database, no backend APIs, and processes zero user data.
- Sender Device (Hardware / Browser Sandbox): Receives the static assets, initializes WASM in volatile RAM, captures plain secret inputs, compresses, encrypts, and produces the final stego-text.
- Third-Party Public Network (Social Media / Messaging): Transports the stego-text. The secret payload is doubly protected: encrypted with AES-256 and visually invisible.
- Receiver Device (Hardware / Browser Sandbox): Accepts pasted stego-text, extracts Variation Selectors, re-derives identical crypto keys locally, performs reverse XOR mapping, and decompresses the secret message.
3. Trust Boundary Analysis (4 Trust Boundaries)
| Boundary | Zone Name | Trust Level | Data Security & Isolation State |
|---|---|---|---|
| TB 1 | Web Hosting Environment | Medium Trust | Stores and serves static assets. No private keys, plain text, or payloads are ever sent to this layer. |
| TB 2 | Sender Local Device & Sandbox | Highest Trust | Processes raw secrets and encryption keys entirely in volatile memory. Emits only ciphertext-masked stego-text. |
| TB 3 | Untrusted Public Internet & Social Media | Zero Trust | Public networks, chat servers, and logs. Protected by AES-256-CTR and 100% visual imperceptibility. |
| TB 4 | Receiver Local Device & Sandbox | Highest Trust | Decodes VS symbols, executes reverse XOR and decryption inside the isolated browser runtime. |
4. Security Principles & CIA Triad
Confidentiality — Defense in Depth (Tri-Security Layer)
- Layer 1 (Cryptographic): AES-256-CTR stream cipher renders the compressed payload mathematically undecipherable.
- Layer 2 (Key Diversification): PBKDF2 key stretching (100,000 rounds) defends against dictionary and brute-force attacks.
- Layer 3 (Steganographic): PRNG bitwise XOR mapping scatters the data across random carrier positions, hiding the existence of the message.
Integrity & Availability
- Zero-Trust Client Execution: Complete independence from external third-party APIs guarantees service availability even in offline modes.
- Fail Securely: Comprehensive
try-catchboundaries across all pipelines ensure the system fails gracefully with actionable error alerts without data exposure.