papers/lux-ats-architecture/sections/09-security-analysis.tex

\section{Security Analysis}
\label{sec:security}

\subsection{Threat Model}

We consider the following adversaries:

\begin{enumerate}[nosep]
  \item \textbf{External attacker}: Attempts to steal assets by compromising platform infrastructure.
  \item \textbf{Malicious insider}: Platform employee attempts unauthorized transfers.
  \item \textbf{Compromised HSM}: Platform's HSM is fully compromised, exposing the platform key share.
  \item \textbf{Regulatory seizure}: Government orders asset freeze or forfeiture.
  \item \textbf{Quantum adversary}: Future attacker with access to a cryptographically relevant quantum computer.
\end{enumerate}

\subsection{Mitigation}

\begin{table}[H]
\centering
\caption{Threat mitigation through non-custodial MPC.}
\label{tab:threats}
\begin{tabular}{lp{7cm}}
\toprule
\textbf{Threat} & \textbf{Mitigation} \\
\midrule
External attacker & Platform key share alone insufficient; attacker must also compromise investor device \\
Malicious insider & Same as external attacker; no single insider has access to 2 shares \\
Compromised HSM & Investor retains independent share; recovery custodian can facilitate key rotation \\
Regulatory seizure & Platform can freeze by withholding its share; no need to seize keys \\
Quantum adversary & Lux post-quantum precompiles enable migration to PQ-safe threshold schemes \cite{lux-mchain-mpc} \\
\bottomrule
\end{tabular}
\end{table}

\subsection{Operational Security}

\begin{itemize}[nosep]
  \item MPC key shares are generated in a distributed ceremony; no single party ever sees the full private key.
  \item The platform's share is stored in an HSM with FIPS 140-2 Level 3 certification.
  \item Key rotation occurs monthly via the \texttt{signer\_rotate} cron, using proactive secret sharing to rotate shares without changing the public key.
  \item All MPC signing sessions are logged immutably in the \texttt{mpc\_requests} and \texttt{mpc\_signatures} collections.
\end{itemize}