PUBLIC / OBSERVE
Public surface
Read product information, architecture and sanitized snapshots without connecting to a mailbox.
View overview →AENET MAIL / SECURITY ISLAND
Communication.
Separated by design.
Understand the boundary before connecting. From the public surface through an access gate to a separately managed private mail space.
This page does not read mailboxes or display keys. It is not a live threat detector or an operating AI system.
01 / BOUNDARY MODELIllustration
xₙ = (17n + 23) mod 97An illustrative number sequence, not an encryption algorithm or live data.
Three layers. Clear responsibilities.
Public visibility does not grant access to private mail.
GATE / VERIFY
Access gate
Identity verification and access authorization are separate from the public page. Registration does not automatically grant mail access.
Access boundaries →MAIL / PRIVATE
Private mail space
The zone contract is in design, owned outside the public site. The finance zone additionally requires the finance role.
Finance system information →Visible boundaries. Traceable evidence.
Tools and cryptography: what each part does
These technical details support research and identify the evidence available for each part.
Blue · navigation / published information
Magenta · research
Amber · awaiting evidence
Green · action
E2EE · Mail Gateway · Archive
Described in the public snapshot- E2EE
- End-to-end encryption primitives protect message content from parties without its keys. The snapshot does not specify the complete cipher suite or key-management design.
- Mail Gateway
- Handles mail transport and routing. Transport policy and sender authentication still need verified deployment configuration.
- Archive · Compression
- Archives mail and compresses payloads. Compression does not encrypt data; storage encryption and recovery require separate verification.
Technology names from earlier descriptions
Mail implementation not confirmed by the snapshot- Curve25519 / X25519
- Curve25519 supports key agreement such as X25519 to establish a shared secret. Peer authentication and a content-encryption algorithm are still needed. RFC 7748 ↗
- Kyber-1024 / ML-KEM
- Kyber is the basis of ML-KEM, a post-quantum key-encapsulation standard. An earlier Kyber label does not establish a FIPS 203 implementation. FIPS 203 ↗
- Ed25519
- Digital signatures verify a signer and data integrity; they do not provide message confidentiality. AENET API signing documentation does not confirm Mail's implementation. RFC 8032 ↗
- 4096-bit · HSM
- Earlier descriptions named a key size and key-storage hardware. Algorithm, key type and hardware evidence are required before deriving a security level from these labels.
SPF · DKIM · DMARC
SPF checks sending-server authorization, DKIM associates signed mail with a domain, and DMARC checks domain alignment and failure policy. These mechanisms differ from E2EE. Service DNS, DKIM keys and DMARC policy need deployment evidence before being marked active.
Published evidence: the 2026-08-18 snapshot reports 269 passed tests and zero failures. This is historical evidence. Actual use requires verified cipher suites, key management, peer authentication, DNS and recovery testing. View system evidence ↗
One-way information flow
- Private runtime
- Sanitized snapshot
- Public page
This display provides no reverse path to control or read mailboxes.
- Zone contract
- v1.0.0 · design
- Mail access through registration
- Not granted automatically
- Public evidence
- View status and sources ↗
04 / NEXT STEP
Follow AENET Mail development
Registering interest does not activate a mailbox or guarantee security.