LIMITS
What Kionel does not do.
Security tools are chosen by people who have to defend the choice. So here is the list we would rather you read before buying than discover afterwards. It is the same list our threat model carries internally.
It does not protect against
- A compromised endpoint. Malware, a screen recorder or a tampered viewer on either device defeats everything below it. Encryption cannot rescue a dirty machine.
- An operator who skips the code comparison. If nobody checks that both screens show the same code, the protection against a screen or camera placed in the middle is gone.
- Malicious file content. Moving a file optically does not inspect or sanitise it. An encrypted, signed file can still be malware. Content scanning is a separate control.
- Proof of who a person is. A receipt proves that two keys signed, not that two people did. Binding keys to people needs your identity system and hardware-backed keys.
- Proof that a file was read or understood. A delivery receipt says the bytes arrived and verified, nothing more.
- Coercion. If an operator is forced to approve a transfer, the protocol cannot tell.
- Traffic analysis. Anyone watching the room can see that a transfer happened and roughly how large it was.
- Screen emanation (TEMPEST). We make no claim here at all.
Where time comes from
Without a trusted timestamp, the time in a receipt is the device's own clock. Two parties who agree can backdate it. We support RFC 3161 timestamps, verified offline against the timestamping authority's certificate; until one is attached, the receipt states that the time is a device clock.
Where the software still needs proving
- No independent security audit yet. We will not call the protocol "audited" until someone outside has audited it.
- No published device matrix yet. Speed and success rates on real phones, screens and lighting have not been measured and published, so we promise no throughput figure.
- Qualification is not validation. We can produce a signed qualification report; it does not replace your IQ/OQ/PQ, supplier audit or change control.
- Accessibility. Aligning a camera and comparing codes are visual acts. The codes can be read aloud by a screen reader; audible and haptic alignment feedback is not built yet.
When you do not need us
If a printed QR code carries your data (up to about 3 KB), it already works and costs nothing. If the instrument PC may join a network, or an approved USB route with its own audit trail already exists, use those. Kionel is for the case where the gap has to stay and the handover still has to be provable.
What "no server" means precisely
File content never reaches a server: the transfer happens between your two devices. Buying a licence, and the enterprise services for device enrolment and revocation, do use our infrastructure. Both sentences are true and we say them together.