The Algebra Behind SHP · Structured Hardening Project

The Structured Hardening Project contains quite a lot of mathematics.

Some of it looks considerably more frightening than what it actually says.

This page exists to translate the algebra into ordinary language.

The mathematics is not there to make SHP look clever. It is there to stop certification decisions becoming matters of opinion.

The formal SHP specifications remain authoritative.

The notation on this page is explanatory. It illustrates the governing mathematical ideas without replacing the normative equations or definitions in the applicable specifications.

First: what are we trying to calculate?

At its core, SHP needs to answer questions such as:

Which controls apply?
Which controls passed?
Did any Non-Negotiable Control fail?
Does the device satisfy Tier 1?
Does it satisfy Tier 2?
Does it satisfy Tier 3?
Is full certification possible?
Is bounded certification permitted?
Has drift changed the answer?
What certification claim, if any, is actually eligible?

You can answer those questions with prose.

But prose leaves room for interpretation.

Mathematics lets us say:

Given the same governed input, everybody gets the same answer.

That is the point.

The control universe

Suppose a platform has a collection of controls.

We can call that collection:

\mathcal{C}_P = \{c_1,c_2,\ldots,c_n\}

In English

𝒞ₚ simply means:

all SHP controls defined for platform P.

If we were talking about Fedora, this would mean the applicable Fedora control universe.

For Wi-Fi, it would be the Wi-Fi control universe.

For Network Gateway, it would be the Network Gateway control universe.

They are not automatically interchangeable.

See? Nothing sinister yet.

Does a control apply?

Not every control necessarily applies to every evaluated state.

So define an applicability function:

A(c) \in \{0,1\}

where:

A(c) = 1 means the control applies
A(c) = 0 means the control does not apply

In English

Before asking whether a control passed, we first ask:

Was this control actually applicable to this system?

That distinction matters.

A legitimately non-applicable control is not the same thing as a failed control.

Verification produces results

Now suppose the verifier evaluates an applicable control.

For explanatory purposes, write:

V(c) = \text{governed verification result for } c

The governing specifications define the actual result semantics.

The important point here is that SHP does not let uncertainty quietly become success.

If the verifier cannot validly establish the required state, that condition must remain visible according to the applicable rules.

In English

The verifier is not asking:

“Did somebody intend to configure this?”

It is asking:

“What state can we actually establish from the evidence?”

The controls that really count

Now we can build a set of controls that are both applicable and successfully established.

For explanatory purposes:

\mathcal{E}_P = \left\{c \in \mathcal{C}_P \mid A(c)=1 \land V(c)=\mathrm{PASS}\right\}

The vertical bar means “such that”.

The symbol ∧ means “and”.

Read it slowly

ℰₚ is the set of controls c belonging to the platform control set, such that the control applies and verification establishes a passing result.

In very ordinary English

These are the controls that actually count as satisfied.

That large scary expression is basically a filter.

Required controls for a tier

Suppose Tier T requires a set of controls:

R_T \subseteq \mathcal{C}_P

The symbol ⊆ means:

is a subset of

So:

the controls required for Tier T come from the platform’s defined control universe.

In English

Tier 2 is not “more secure because 2 is bigger than 1”.

Tier 2 means:

the particular governed control set defined for Tier 2 on that platform.

The Non-Negotiable Controls

Now define the applicable Non-Negotiable Controls for Tier T:

N_T \subseteq R_T

These are the controls that act as hard gates.

A simple explanatory NNC predicate is:

\mathrm{NNC}_T = \forall c \in N_T:\;V(c)=\mathrm{PASS}

The symbol ∀ means:

for every

Read it in English

Tier T passes its NNC gate only if every applicable Non-Negotiable Control passes.

Not most.

Not 95%.

Not “close enough”.

Every applicable one.

Why one failed NNC matters

Suppose Tier 2 has 40 controls.

Thirty-nine pass.

One fails.

If that one is an applicable NNC:

\left(\exists c \in N_T:\;V(c)=\mathrm{FAIL}\right)\Rightarrow \mathrm{NNC}_T=\mathrm{FALSE}

∃ means:

there exists

⇒ means:

implies

Translation

If even one applicable NNC fails, the NNC gate fails.

The other thirty-nine controls do not vote.

They cannot outnumber it.

They cannot compensate for it.

There is no:

“39 out of 40 is pretty bloody good.”

Not in the mathematics.

Full-tier eligibility

Now we can state the core idea behind full-tier attainment.

A useful explanatory form is:

\mathrm{FULL}_T = \mathrm{Required}_T \land \mathrm{NNC}_T \land \mathrm{Integrity}_T \land \mathrm{Threat}_T

The exact governing predicates come from the applicable specifications.

Conceptually, however, this says that full certification requires more than accumulating passing controls.

In English

For a full tier to qualify:

its required controls must satisfy the governing rules
its NNC gate must pass
required verification-integrity conditions must hold
required threat-model conditions must hold

If one of the mandatory predicates is false:

\mathrm{FULL}_T=\mathrm{FALSE}

That is why SHP certification is not a percentage score.

Finding the highest eligible full tier

Now the maths becomes useful.

Suppose the platform defines ordered tiers:

T_1 \prec T_2 \prec T_3

The ordering is platform-local.

We can ask:

What is the highest full tier whose requirements are actually satisfied?

Conceptually:

\operatorname{HEFT}=\max\left\{T \mid \mathrm{FULL}_T=\mathrm{TRUE}\right\}

HEFT means:

Highest Eligible Full Tier

Example

Suppose:

\begin{aligned}\mathrm{FULL}_1 &= \mathrm{TRUE} \\\mathrm{FULL}_2 &= \mathrm{TRUE} \\\mathrm{FULL}_3 &= \mathrm{FALSE}\end{aligned}

Then:

\operatorname{HEFT}=T_2

In English

Tier 1 works.

Tier 2 works.

Tier 3 does not.

Therefore the highest eligible full tier is Tier 2.

Nobody chooses Tier 2 because they like it better.

The result falls out of the rules.

Bounded certification is a different result

Now things get more interesting.

Some platform specifications may permit bounded certification.

That means a defined set of controls can be excluded under governed rules.

Let:

X_T = \text{bounded exclusion set for Tier }T

Then the effective bounded control set can be thought of as:

B_T = R_T \setminus X_T

∖ means:

remove these members from the set

In English

Start with the Tier T control set.

Remove only the exclusions that the governing bounded-certification rules actually permit.

What remains is the effective bounded set.

But there is a hard boundary.

You cannot exclude an NNC

The bounded exclusion set must not contain an applicable Non-Negotiable Control.

Conceptually:

X_T \cap N_T = \varnothing

∩ means:

intersection — members appearing in both sets

∅ means:

nothing

Translation

The set of excluded controls and the set of NNCs must have nothing in common.

Or even more simply:

You cannot bounded-certification your way around an NNC.

That is one of the most important equations on this page.

Bounded is not full

Even if a bounded result satisfies every permitted rule:

\mathrm{BOUNDED}_T \neq \mathrm{FULL}_T

≠ means:

is not equal to

This is not merely terminology.

It is a certification distinction.

The authorised label remains:

Tier X — Bounded Certification

The exclusions and residual risk remain part of its meaning.

Residual risk does not disappear

If controls are validly excluded, the risks associated with those exclusions do not magically vanish.

We can represent residual risk conceptually as:

\mathrm{RR}_T = f(X_T,\mathrm{Threats}_T)

In English

Residual risk is derived from things we deliberately did not require or could not include within the bounded certification.

That residual risk must remain explicit.

Bounded certification does not mean:

“Everything is fine except for some irrelevant paperwork.”

It means:

This defined subset qualified, these things were excluded, and this is the risk that remains.

Full and bounded claims can coexist mathematically

A platform may, where its governing specifications permit it, have more than one eligible certification claim.

For example:

\mathrm{EligibleClaims}=\{\mathrm{FULL}_1,\mathrm{BOUNDED}_2\}

SHP therefore requires a governed selection rule.

The formal model calls the selected result:

SEC — Selected Eligible Certification Claim

Conceptually:

\operatorname{SEC}=\operatorname{Select}(\mathrm{EligibleClaims},\mathrm{governed\ ordering})

In English

There may be several mathematically eligible statements we could make.

The governing rules determine which certification claim is selected.

The operator does not simply choose whichever one looks best.

Eligibility is still not issuance

This distinction is subtle but important.

Suppose the maths says:

\mathrm{Eligible}=\mathrm{TRUE}

That still does not mean:

\mathrm{Issued}=\mathrm{TRUE}

Those are different events.

In English

The mathematics can say:

This evaluated state qualifies for certification.

It cannot sign the certificate.

Issuance still belongs to the SHP certification and trust architecture.

Verification is not certification.

Eligibility is not issuance.

Drift changes the input

Suppose a device was certified in state:

S(t_0)=S_0

Later:

S(t_1)=S_1,\qquad S_1\neq S_0

Now the previous calculation may no longer describe the current state.

Conceptually:

\operatorname{MaterialDrift}(S_0\rightarrow S_1)\Rightarrow \operatorname{Reclassify}(S_1)

Translation

The certificate described the evaluated state.

The state changed.

So the mathematics must be applied to the new state according to the drift rules.

Certification does not cling to the device because it once passed.

Automatic downgrade

Suppose the original state qualified for Tier 3:

\operatorname{HEFT}(t_0)=T_3

After drift:

\begin{aligned}\mathrm{FULL}_3(t_1)&=\mathrm{FALSE} \\\mathrm{FULL}_2(t_1)&=\mathrm{TRUE}\end{aligned}

Then:

\operatorname{HEFT}(t_1)=T_2

In English

The system used to qualify for Tier 3.

It no longer does.

It still qualifies for Tier 2.

Therefore the highest eligible full tier is now Tier 2.

No committee meeting is mathematically necessary.

Expiry is even simpler

Let the certificate validity interval be:

t_{\mathrm{issue}} \le t < t_{\mathrm{expiry}}

Within that interval, the certificate may be active if all other lifecycle conditions hold.

Once:

t \ge t_{\mathrm{expiry}}

the result is:

Expired — Not Certified

Not:

“Probably still fine.”

Not:

“Certified, but old.”

Expired.

Not Certified.

Revocation is similarly uncompromising

If the applicable revocation predicate becomes true:

\mathrm{Revoked}=\mathrm{TRUE}\Rightarrow\mathrm{Status}=\text{Revoked --- Not Certified}

Again, this is deliberately mechanical.

Certification lifecycle is not a matter of sentiment.

So what does all this algebra actually buy us?

It gives SHP several useful properties.

Two evaluators should reach the same answer

If they have:

the same governed inputs
the same specification versions
the same verification results
the same platform mathematics
the same tier rules

then they should calculate the same certification-relevant result.

An NNC cannot be argued away

Its gate semantics are part of the mathematics.

A tier cannot be awarded because somebody feels generous

Eligibility follows predicates.

Bounded certification cannot masquerade as full certification

They are mathematically and semantically distinct.

Drift has consequences

When the evaluated state changes materially, the old calculation cannot simply be assumed to remain valid.

Historical meaning survives

A certification remains interpretable against the rules and versions under which it was produced.

The whole thing in one picture

The intimidating version:

S \rightarrow E \rightarrow V \rightarrow C \rightarrow \mathrm{NNC} \rightarrow T \rightarrow \mathrm{EligibleClaims} \rightarrow \operatorname{SEC} \rightarrow \mathrm{Eligibility}

The ordinary-English version:

Look at the system. Gather evidence. Verify the controls. Enforce the hard gates. Work out which tier rules pass. Determine which certification claims are allowed. Select the governed result. Then decide whether it is eligible for certification.

That’s it.

A lot of the formal mathematics is simply the rigorous version of that sentence.

Why bother writing it mathematically?

Because without the mathematics, statements such as these become dangerously easy:

“It mostly passed.”

“That failed control isn’t really important.”

“We can probably still call it Tier 2.”

“It’s technically bounded, but let’s just display Tier 2.”

“The configuration changed, but not enough to matter.”

SHP is designed so that these decisions do not depend on somebody’s mood.

The mathematics exists to remove ambiguity from certification.

That is the entire trick.

See? Simple.

The symbols can look formidable.

The ideas are not.

Sets tell us which controls belong together.

Predicates answer yes-or-no questions.

Hard gates prevent exceptions.

Ordering tells us which tier is highest.

Functions turn governed inputs into governed outputs.

And the specifications define exactly which of those things apply.

The formal mathematics remains in the SHP specification corpus.

This page just removes its scary hat.

Read the SHP Tier Mathematics Specification →

Understand SHP Tiers →

How SHP Verification Works →

Understand SHP Certification →