mirror of
https://github.com/lux-apps/papers.git
synced 2026-11-03 05:07:46 +00:00
zeekay
4a753bb639
Restructured from flat .tex/.pdf files into per-paper subdirectories. Added Antje Worring as co-author on all papers. Synced PDFs to pdfs/ for download site.
61 lines
2.0 KiB
TeX
61 lines
2.0 KiB
TeX
\section{Contrast with Regulated Model}
|
|
|
|
\label{sec:contrast}
|
|
|
|
The regulated custody model (deployed by a regulated financial services provider\ for the the regulated ATS)
|
|
and the sovereign model (deployed on Lux Network) use identical cryptographic
|
|
primitives but make opposite trust assumptions.
|
|
|
|
\begin{table}[h]
|
|
\centering
|
|
\small
|
|
\begin{tabular}{@{}p{3.2cm}p{5cm}p{5cm}@{}}
|
|
\toprule
|
|
\textbf{Property} & \textbf{Regulated (Liquidity)} & \textbf{Sovereign (Lux)} \\
|
|
\midrule
|
|
Data encryption &
|
|
AES-256-GCM, per-org DEK from HMAC-SHA256 &
|
|
AES-256-GCM, per-vault DEK from ML-KEM-1024 \\[4pt]
|
|
Master key holder &
|
|
Operator (Google Cloud KMS, HSM-backed) &
|
|
User (Argon2id from passphrase) \\[4pt]
|
|
Can operator decrypt? &
|
|
Yes (required by SEC 17a-4) &
|
|
No (by design) \\[4pt]
|
|
Key encapsulation &
|
|
Not used (HMAC derivation) &
|
|
ML-KEM-1024 (FIPS 203) \\[4pt]
|
|
Signatures &
|
|
HMAC-SHA256 (migrating to ML-DSA-87) &
|
|
ML-DSA-87 (FIPS 204) \\[4pt]
|
|
Threshold signing &
|
|
CGGMP21/FROST, operator holds 1 shard &
|
|
CGGMP21/FROST, operator holds 0 shards \\[4pt]
|
|
Recovery &
|
|
Operator cold storage + KMS &
|
|
Social recovery ($t$-of-$n$ shares) \\[4pt]
|
|
Data loss on key loss? &
|
|
No (operator can re-derive DEK) &
|
|
Yes (if $< t$ recovery parties available) \\[4pt]
|
|
Regulatory compliance &
|
|
SEC 17a-4, FINRA 4511, BSA &
|
|
User responsibility \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\caption{Full comparison of regulated and sovereign key architectures.}
|
|
\label{tab:full-comparison}
|
|
\end{table}
|
|
|
|
The choice between models is a policy decision, not a cryptographic one.
|
|
The same \texttt{luxfi/crypto} library implements both. The difference
|
|
is in key hierarchy: who holds the root, and whether the provider can
|
|
derive decryption keys.
|
|
|
|
\begin{invariant}[Model Exclusivity]
|
|
A deployment is either regulated or sovereign. There is no hybrid where
|
|
the operator ``sometimes'' can decrypt. The trust model is determined at
|
|
deployment time by key hierarchy configuration.
|
|
\end{invariant}
|
|
|
|
% ======================================================================
|