mirror of
https://github.com/hanzoai/papers.git
synced 2026-10-22 17:20:17 +00:00
76 lines
3.2 KiB
TeX
76 lines
3.2 KiB
TeX
\section{Post-Quantum Security}
|
|
|
|
|
|
The Hanzo ecosystem has achieved comprehensive post-quantum (PQ)
|
|
coverage across all cryptographic layers. All previously planned
|
|
mitigations are now deployed.
|
|
|
|
\subsection{PQ Scorecard}
|
|
|
|
\begin{table}[H]
|
|
\centering
|
|
\begin{tabular}{@{}llll@{}}
|
|
\toprule
|
|
\textbf{Layer} & \textbf{Algorithm} & \textbf{PQ Status} & \textbf{Status} \\
|
|
\midrule
|
|
Disk encryption & AES-256 (sqlcipher) & Safe (128-bit PQ) & Deployed \\
|
|
HKDF derivation & HKDF-SHA-256 & Safe (128-bit PQ) & Deployed \\
|
|
Field encryption & AES-256-GCM & Safe (128-bit PQ) & Deployed \\
|
|
S3 backup & age ML-KEM-768+X25519 (\texttt{age1pq}) & Safe (FIPS 203) & Deployed \\
|
|
TLS & X25519MLKEM768 (first curve) & Safe (hybrid PQ) & Deployed \\
|
|
JWT signing & ML-DSA-65 (FIPS 204) & Safe (Module-LWE+SIS)& Deployed \\
|
|
JWKS validation & ML-DSA-65 & Safe & Deployed \\
|
|
MPC transport & Hybrid KEM (X25519+ML-KEM-768) & Safe & Deployed \\
|
|
MPC key shares & PQ KEM encryption & Safe & Deployed \\
|
|
Master keys & Cloud HSM (FIPS 140-2 L3) & Hardware isolation & Deployed \\
|
|
Chain signing & secp256k1 ECDSA & \textbf{Not PQ-safe} & EVM constraint \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\caption{Complete post-quantum scorecard. All layers PQ-safe except EVM chain signing.}
|
|
\label{tab:pq-scorecard}
|
|
\end{table}
|
|
|
|
\subsection{S3 Backup Encryption (Deployed)}
|
|
|
|
All age encryption uses ML-KEM-768 + X25519 hybrid recipients
|
|
(\texttt{age1pq} prefix). The file key is derived from both shared
|
|
secrets: $\text{file\_key} = \text{HKDF-SHA256}(ss_1 \| ss_2,
|
|
\texttt{"age-hybrid-v1"})$. Label enforcement prevents downgrade to
|
|
classical-only recipients.
|
|
|
|
\subsection{TLS Post-Quantum (Deployed)}
|
|
|
|
All TLS 1.3 connections negotiate X25519MLKEM768 as the first curve.
|
|
This provides PQ protection for all data in transit, including S3
|
|
uploads and inter-service communication.
|
|
|
|
\subsection{JWT Signing with ML-DSA-65 (Deployed)}
|
|
|
|
Hanzo IAM issues JWT tokens signed with ML-DSA-65 (FIPS~204). The
|
|
JWKS endpoint exposes the ML-DSA-65 public key. All services validate
|
|
JWTs using the PQ-safe signature. EUF-CMA security under Module-LWE
|
|
and Module-SIS hardness assumptions.
|
|
|
|
\subsection{MPC Transport and Key Shares (Deployed)}
|
|
|
|
MPC node-to-node communication uses hybrid KEM (X25519 + ML-KEM-768).
|
|
MPC key shares at rest are encrypted with PQ KEM encryption.
|
|
|
|
\subsection{Cloud HSM for Master Keys (Deployed)}
|
|
|
|
Master encryption keys are stored in Cloud HSM (GCP Cloud KMS,
|
|
FIPS~140-2 Level~3 Cavium HSMs). The master key never leaves the HSM:
|
|
wrap, unwrap, and sign operations execute inside the HSM. Three
|
|
keyrings per ecosystem (devnet, testnet, mainnet), 12 keys total.
|
|
Mainnet uses HSM protection level.
|
|
|
|
\subsection{Harvest-Now-Decrypt-Later: Closed}
|
|
|
|
The combination of ML-KEM-768 hybrid encryption (S3), X25519MLKEM768
|
|
TLS (transit), ML-DSA-65 JWT signing (auth), PQ KEM for MPC, and
|
|
Cloud HSM for master keys closes the HNDL attack vector completely.
|
|
|
|
% ============================================================================
|
|
% 12. REFERENCES
|
|
% ============================================================================
|