Aurora logo

Rust · no_std aarch64 · amnesic by design

Leave nothing
behind.

Aurora is a real bootable aarch64 kernel, Tails rebuilt for AI agents. It comes up on its own in QEMU at EL1, runs entirely in RAM behind a guard that refuses every durable write, keeps an encrypted vault in memory with ChaCha20-Poly1305 written from scratch to RFC 8439, authenticates over a from-scratch TLS 1.3 client with hand-written Ed25519, ECDSA P-256, and RSA, and scrubs the session key and every byte it protected to zero on wipe, on panic, and on shutdown. no_std, no_main, zero external crates. This page is a browser model of the amnesic core; the real kernel boots and proves itself in QEMU.

Watch a session wipe View on GitHub

This is a browser model of Aurora's amnesic core. The ciphertext below is a real ChaCha20 keystream (RFC 8439) running in your browser; the authentication tag shown is illustrative. The real bootable kernel and full source are on GitHub.

How to use this visualization
  1. Step through a session. Press Next step to advance one stage at a time, or Play to auto-advance. Press Back to revisit a stage, and Reset to start over.
  2. Watch the key appear. At session start a fresh session key is generated and shown byte by byte. This key encrypts every secret in the vault.
  3. Seal secrets. As secrets go into the vault, the Vault region grid fills with nonce, ciphertext, and tag bytes. The Vault contents table shows the plaintext that went in next to the ciphertext that is actually stored.
  4. Run the task. The agent task runs on the sealed secrets and leaves scratch bytes in the Frame pool. The sentinel planted by the amnesia proof stays readable as SENTINEL::AURORA.
  5. Wipe. The wipe runs in order. The key is zeroed first, then the vault region, then the frame pool. Watch the ciphertext and the sentinel fall to 00, and the sentinel readout turn to zeros.
  6. Confirm nothing remains. At the end the key is gone, all managed RAM reads zero, and durable writes this session is still 0. A stolen or imaged machine would yield nothing.

Session walk-through

Step 1 of 9
Machine booted, session RAM empty
Press Next to start an agent session.

Kernel state

0
durable writes this session
0
secrets in vault
none
session key
-
last wipe (cycles)

Session key

Generated per session from the ARMv8.5 RNDR hardware RNG when the CPU has one, falling back to timer jitter only when it does not. Kept only in RAM. It is the first thing zeroed on wipe, so an interrupted wipe still loses the ability to decrypt anything.

No session key yet.

Vault region (RAM)

Each secret is stored as nonce plus ciphertext plus a 16-byte tag. The plaintext never rests here.

nonce ciphertext tag zero

Frame pool (RAM)

Task working memory. The amnesia proof plants a known sentinel here, then scans for it after the wipe. It must be gone.

sentinel bytes read as text:
SENTINEL::AURORA
sentinel plaintext task scratch zero

Vault contents

Plaintext is shown here only to illustrate what went in. In the kernel it exists in RAM only for the moment of sealing, and only the ciphertext to the left is stored.

keyplaintext (in only)stored ciphertext (hex)

The one claim that matters

Everything rests on a single promise: a wipe really erases the session. Aurora proves it on every build, headless inside QEMU, not in a slideshow. A distinctive secret is put in the vault, scattered across memory, wiped, then scanned for. It is present before the wipe and gone after, or the build fails.

# the QEMU boot gate: build, boot headless, drive every gate
$ ./scripts/boot-test.sh
127 gates passed, 0 missing, 0 bad
QEMU exit code: 0
BOOT TEST PASSED

# the amnesia gate: sentinel planted across session RAM and the free stack
AMNESIA PROOF: sentinel present before wipe, zero occurrences after
# authenticated TLS 1.3 to a local ECDSA P-256 chain, root in the trust store
TLS 1.3 handshake ok, chain verified, validation level: authenticated

# the host vector tests: the exact pure modules the kernel compiles
$ cargo test --workspace
total 195 passed, 0 failed   # ChaCha20/Poly1305, RFC 8448 TLS 1.3
                              # schedule, x25519, HKDF, Ed25519, HMAC,
                              # SHA-256/512, ECDSA P-256, RSA, X.509,
                              # allocators, page tables, scheduler

Every from-scratch cryptographic primitive is checked against its official RFC or NIST known-answer vectors, and the amnesia claim is proven inside QEMU on every build. The full boot transcript is committed at docs/boot-test.log.

Where Aurora sits

The amnesic idea is not new. Aurora's contribution is to make "leave nothing behind" small enough to read end to end and to prove it on every build, for agent workloads rather than people.

Tails and other amnesiac live systems

A mature amnesiac OS, a full live Linux that forgets when the machine powers off. Built for a human at a desktop, with the whole general-purpose stack behind it.

From-scratch and unikernel teaching kernels

Boot on QEMU virt and show how a kernel comes up: MMU, timer, scheduler, syscalls. They teach the machine, but forgetting and authenticated networking are not the point they are making.

Aurora

A real bootable aarch64 kernel in that from-scratch lineage, rebuilt around amnesia for agents. It adds an in-RAM encrypted vault, an EL0 isolation boundary, a hand-written authenticated TLS 1.3 client, and a measured wipe on demand, on panic, and on shutdown, all with zero external crates and a boot test that asserts the secret is gone.

No wall-clock revocation, no secure boot, no defense against a physical bus or cold-RAM attacker. The honest limits are written down in full, not glossed over.

A real kernel, written from scratch

Under the amnesic core visualized above sits a full aarch64 kernel: boot from EL2 down to EL1, a PL011 UART console, an MMU with caches on, a bitmap frame allocator and a free-list heap, GICv2 with a 100 Hz timer, a preemptive scheduler with an assembly context switch, and SVC syscalls. All of it, and the crypto, the network stack, and the TLS client, written by hand with zero external crates.

Amnesic core wipe

A persistence guard sits in front of every storage path and refuses each durable write, so the count stays zero. On command, on a syscall, on panic, and on shutdown the wipe scrubs the key first, then the vault, the frame pool, and the free kernel stack, and times itself in CPU cycles. The boot test scans for the sentinel and asserts it is gone.

Encrypted in-RAM vault crypto

ChaCha20, Poly1305, and the ChaCha20-Poly1305 AEAD written from scratch to RFC 8439 and checked against the RFC's own vectors. Secrets rest as nonce, ciphertext, and a 16-byte tag; the plaintext never sits in the vault. The key comes from the ARMv8.5 RNDR hardware RNG when the CPU has one and falls back to timer jitter otherwise, telling you which it used.

Runs untrusted code sandbox

It embeds Kindling, a small language written from scratch with a lexer, parser, compiler, stack VM, and garbage collector, sandboxed behind a capability. Resource limits stop a runaway or hostile program with a clean error instead of taking the kernel down. It sums the primes below 1000 to 76127 and confirms 561 is a Carmichael number.

Isolates in hardware EL0

Agent code runs at EL0 and simply cannot read or write the vault, the key, or kernel memory. Try and it faults, the kernel notes it and carries on, while real syscalls still work. Every syscall that takes a user pointer validates the whole range against the caller's own memory first.

Talks to the internet, on a leash net

A from-scratch virtio-net driver and a full stack through Ethernet, ARP, IPv4, ICMP, UDP, DNS, TCP, and HTTP/1.0 give an agent a real path to pull bytes off the wire, behind a capability that is off by default and revocable. Every network buffer, including the fetched body, lives in the region the wipe scrubs.

Authenticates who it talks to tls 1.3

fetch https://host/path runs a from-scratch TLS 1.3 client that verifies the certificate chain up to a trusted root, checks the CertificateVerify is bound to the leaf, and matches the host name, with Ed25519, ECDSA P-256, and RSA verification hand-written on a from-scratch big-integer core and checked against the standard vectors.

Build it, boot it

# add the bare-metal target and QEMU (macOS; Linux uses apt for qemu)
rustup target add aarch64-unknown-none
brew install qemu

# build the kernel and boot it; a cargo runner launches QEMU for you
cd kernel
cargo build --release
cargo run --release

# a two minute tour at the aurora> prompt
session start
compute 40 + 2
cap net
resolve example.com
vault put api-key s3cr3t
vault get api-key
wipe

# prove it: the QEMU boot gate and the host vector tests
./scripts/boot-test.sh
cargo test --workspace