mirror of
https://github.com/hanzoai/papers.git
synced 2026-10-29 07:34:31 +00:00
62 lines
2.8 KiB
TeX
62 lines
2.8 KiB
TeX
\section{Lux Network Integration}
|
|
|
|
\label{sec:lux}
|
|
% ============================================================================
|
|
|
|
Base integrates with the Lux Network at three chain layers, each providing a
|
|
distinct sovereignty primitive~\cite{luxwhitepaper, luxtrust, luxapp}.
|
|
|
|
\subsection{K-Chain: Key Policy}
|
|
|
|
The Lux K-Chain (Key Chain) manages cryptographic key policies. Base registers
|
|
its master key with the K-Chain, enabling:
|
|
|
|
\begin{itemize}[leftmargin=1.1em]
|
|
\item \textbf{Key rotation}: The K-Chain enforces rotation schedules. Base
|
|
re-encrypts field-level DEKs when the KEK rotates, without re-encrypting
|
|
the underlying data (envelope encryption).
|
|
\item \textbf{Key escrow}: A user can designate a recovery agent on the
|
|
K-Chain. If the user loses their master key, the recovery agent can
|
|
authorize re-derivation via threshold signature.
|
|
\item \textbf{Key revocation}: Compromised keys are revoked on-chain.
|
|
All Base instances observing the K-Chain stop accepting operations signed
|
|
by the revoked key within one block (sub-second).
|
|
\end{itemize}
|
|
|
|
\subsection{I-Chain: Identity}
|
|
|
|
The Lux I-Chain (Identity Chain) provides decentralized identifiers (DIDs)
|
|
and verifiable credentials. Base uses I-Chain identities for:
|
|
|
|
\begin{itemize}[leftmargin=1.1em]
|
|
\item \textbf{User authentication}: Base accepts I-Chain DIDs as a first-class
|
|
auth method alongside Hanzo IAM OIDC tokens. A user with an I-Chain DID
|
|
can authenticate to any Base instance without a centralized identity
|
|
provider.
|
|
\item \textbf{Collection ownership}: Collections can be bound to an I-Chain
|
|
DID rather than a Hanzo org. This enables personal data stores that are
|
|
not scoped to any organization.
|
|
\item \textbf{Credential verification}: Access rules can reference verifiable
|
|
credentials issued on I-Chain (e.g., ``only users with a verified
|
|
healthcare credential can access this collection'').
|
|
\end{itemize}
|
|
|
|
\subsection{T-Chain: Threshold Controls}
|
|
|
|
The Lux T-Chain (Threshold Chain) implements threshold cryptography for
|
|
multi-party authorization. Base uses T-Chain for:
|
|
|
|
\begin{itemize}[leftmargin=1.1em]
|
|
\item \textbf{Threshold write attestation}: For collections requiring
|
|
multi-party writes (e.g., financial records, legal documents), T-Chain
|
|
enforces $k$-of-$n$ signature requirements before the write is committed.
|
|
\item \textbf{Threshold decryption}: Encrypted fields can be configured to
|
|
require $k$-of-$n$ T-Chain participants to authorize decryption, preventing
|
|
any single party from accessing the plaintext.
|
|
\item \textbf{Threshold key recovery}: Master key recovery requires
|
|
$k$-of-$n$ designated recovery agents to cooperate, preventing both
|
|
single-point-of-failure and unilateral recovery.
|
|
\end{itemize}
|
|
|
|
% ============================================================================
|