NONOS
NØ NOS is an operating system built around privacy at the kernel level. Its design position is that programs should not obtain any permissions that have not been explicitly granted. The kernel uses a microkernel with capability-based security. The component responsible for granting and checking permissions is fewer than thousand lines and has been formally verified: Rust code is translated into Lean by Charon and Aeneas 4, the model is machine-checked, proving that it refines the extracted code; therefore, this theorem covers the capability system shipped with the system. Every program runs as a capsule, launched with the exact permission signature declared in its manifest, and checked at build time against the upper bounds carried by its certificate. A capsule without network capabilities cannot connect to the network; it has no interface through which to request network capabilities and no consent dialog that could persuade a user to grant network capabilities. The system has no root account and no administrator, so there is no authority through which privileges can be escalated. Device drivers,TCP/IP the stack, display server, browser, wallet, and applications all run as capsules outside the kernel. Approximately lines of system code hold no privileges and have no path into the kernel address space. The system resides on RAM. After shutdown, no logs, caches, browsing history, or device identity remain on the machine. Network traffic exits through an onion mix network implemented inside the kernel, with a new key exchange at every hop. Nothing unproven is executed. The bootloader verifies the kernel under two mutually independent signature schemes, one of them post-quantum, and then checks the kernel's own STARK proof against the root compiled into the bootloader. Each capsule's proof is verified before its image is mapped; a missing or invalid proof means that the capsule will not run. The proof system is the project's transparent STARK over the Goldilocks field, requiring neither a trusted setup nor pairing-based cryptography. The same prover also determines the NOX Shield, a private transfer protocol verified on Ethereum through Solidity contracts.NOX is the ERC-20 token of the Ethereum ecosystem.
Overview
NØ NOS is an operating system built around privacy at the kernel level. Its design position is that programs should not obtain any permissions that have not been explicitly granted. The kernel uses a microkernel with capability-based security. The component responsible for granting and checking permissions is fewer than thousand lines and has been formally verified: Rust code is translated into Lean by Charon and Aeneas 4, the model is machine-checked, proving that it refines the extracted code; therefore, this theorem covers the capability system shipped with the system. Every program runs as a capsule, launched with the exact permission signature declared in its manifest, and checked at build time against the upper bounds carried by its certificate. A capsule without network capabilities cannot connect to the network; it has no interface through which to request network capabilities and no consent dialog that could persuade a user to grant network capabilities. The system has no root account and no administrator, so there is no authority through which privileges can be escalated. Device drivers,TCP/IP the stack, display server, browser, wallet, and applications all run as capsules outside the kernel. Approximately lines of system code hold no privileges and have no path into the kernel address space. The system resides on RAM. After shutdown, no logs, caches, browsing history, or device identity remain on the machine. Network traffic exits through an onion mix network implemented inside the kernel, with a new key exchange at every hop. Nothing unproven is executed. The bootloader verifies the kernel under two mutually independent signature schemes, one of them post-quantum, and then checks the kernel's own STARK proof against the root compiled into the bootloader. Each capsule's proof is verified before its image is mapped; a missing or invalid proof means that the capsule will not run. The proof system is the project's transparent STARK over the Goldilocks field, requiring neither a trusted setup nor pairing-based cryptography. The same prover also determines the NOX Shield, a private transfer protocol verified on Ethereum through Solidity contracts.NOX is the ERC-20 token of the Ethereum ecosystem.