Send and receive files in an air-gapped system

Question

Is it possible to have an air-gapped system which can send and receive files?

From a high level perspective, I can't seem to figure out how this can work and I am starting to think it is impossible. But before I give up, I thought I should ask the experts here if it is possible or not.

I have tried using USB drive, one way ethernet cables, public-private key pairs, web cams, ocr etc, but I can't seem to work it out.

How about using a system similar to the blockchain? The blockchain can send and receive data and remain secure, as in an off line computer can sign a transaction where the private key is safe, then the signed transaction can be broadcasted on an online computer, which means the off line private key never gets connected to an online computer.

Can this model somehow be adapted to make it possible to send and receive files in an air gapped system?

When I say "system" I mean I don't mind if I have to have multiple computers in the system to make air gap sending/receiving possible.

Here is a quick high level diagram. Any method I think of to send files between OF1 and OF2 (red dashed line) seems to compromise everything.

How do I send encrypted files from OF1 to OF2 without compromising everything in the system? So far, I have not be able to think of a solution.

The difficulty for me is the red dashed line. How do I transfer a file between OF1 and OF2.

Is it even possible?

Answer 1

Assumptions:

1. OF1 is compromised and wants to send unencrypted data to ON1, which wants to receive it.

2. OF2 is not currently compromised and wants to prevent ON1 and OF1 from conspiring.

3. OF2 is unable to analyze the plaintext to ensure it is safe without getting compromised.

There are two ways for OF1 to covertly send data to ON1. First, OF1 can send it unencrypted data and hope it relays that unencrypted data to ON1. Second, it can use a covert channel such as timing delays and hope that OF2 faithfully reproduces any variation in transmission latency or time of transmission.

In this case, You must do two things. The first thing you need to do is ensure that OF2 is capable of verifying that the data it has received has been encrypted with the correct public key, without knowing the corresponding private key or the plaintext. There is a technique which can accomplish this called a zero-knowledge proof of encryption. It is possible to verify this with very simple code (potentially even from a formally-verified library) that you can assume is not vulnerable to exploitation when parsing untrusted data. This is a lot easier to do with cryptographic code than it is to do with other code that parses complex data. You should have a good understanding of cryptography before attempting to do this.

The second thing you must do is turn OF2 into a buffer which blocks all covert communication methods. This is easy enough if it transmits data on a schedule or on-demand, for example. If OF2 is a buffer which collects data from OF1 and only sends it to ON1 at scheduled times, it is impossible for OF1 to send covert data through a timing side-channel by varying when or how fast it transmits data. In order to prevent covert information from being exfiltrated in the size of the data, it should be padded to a specific size. From the perspective of ON1, it always receives a specific amount of unreadable, encrypted data at a specific, predictable time (on a schedule, or when you want to send the data, not when OF1 does).

---

The actual protocol you use for the red line doesn't matter very much, as long as it is extremely simple. You should assume that Ethernet interfaces can be compromised, and that OCR scanning software is vulnerable. A possible solution would be a very simple serial protocol, such as RS-232.