papers/lux-threshold-mpc/sections/02-system-model-and-definitions.tex

\section{System Model and Definitions}

\label{sec:model}
% ============================================================

\begin{definition}[Threshold Signature Scheme]
\label{def:tss}
A $(t,n)$-threshold signature scheme $\mathsf{TSS}$ consists of four algorithms:
\begin{itemize}[nosep]
  \item $\mathsf{DKG}(1^\lambda, t, n) \to (\mathsf{pk}, \{\mathsf{sk}_i\}_{i=1}^n)$:
    Distributed key generation with no trusted dealer.
  \item $\mathsf{Sign}(m, S, \{\mathsf{sk}_i\}_{i \in S}) \to \sigma$: Threshold
    signing with $|S| \geq t$.
  \item $\mathsf{Verify}(m, \sigma, \mathsf{pk}) \to \{0,1\}$: Standard single-key
    verification.
  \item $\mathsf{Refresh}(\{\mathsf{sk}_i\}_{i=1}^n) \to \{\mathsf{sk}'_i\}_{i=1}^n$:
    Proactive share refresh preserving $\mathsf{pk}$.
\end{itemize}
\end{definition}

\begin{definition}[Unforgeability under $t{-}1$ Corruption]
\label{def:uf}
$\mathsf{TSS}$ is unforgeable under static $t{-}1$ corruption if for all PPT
adversaries $\mathcal{A}$ controlling at most $t-1$ parties:
\[
  \Pr\!\left[
    \mathsf{Verify}(m^*, \sigma^*, \mathsf{pk}) = 1
    \;\middle|\;
    \begin{array}{l}
      (\mathsf{pk}, \{\mathsf{sk}_i\}) \gets \mathsf{DKG}(1^\lambda, t, n) \\
      (m^*, \sigma^*) \gets \mathcal{A}^{\mathsf{Sign}(\cdot)}(\mathsf{pk}, \{\mathsf{sk}_i\}_{i \in C})
    \end{array}
  \right] \leq \mathsf{negl}(\lambda)
\]
where $|C| \leq t-1$ and $m^*$ was not queried to $\mathsf{Sign}$.
\end{definition}

\begin{definition}[Identifiable Abort]
\label{def:id-abort}
$\mathsf{TSS}$ satisfies identifiable abort if whenever $\mathsf{Sign}$ fails to
produce a valid signature, the honest parties can identify at least one malicious
party from the protocol transcript with overwhelming probability.
\end{definition}

\subsection{Adversary Model}

We consider a static adversary $\mathcal{A}$ that corrupts up to $t-1$ of $n$
parties before the protocol begins. Corrupted parties may deviate arbitrarily from the
protocol (Byzantine faults). Communication is authenticated: $\mathcal{A}$ can delay
but not forge messages between honest parties. We model hash functions as random
oracles.

\subsection{Chain Coverage Model}

Let $\mathcal{C}_{\text{FROST}}$ and $\mathcal{C}_{\text{ECDSA}}$ partition the set
of supported blockchains by their native signature verification:

\begin{align*}
  \mathcal{C}_{\text{FROST}} &= \{\text{Ed25519 chains}\} \cup \{\text{BIP-340 chains}\} \\
  \mathcal{C}_{\text{ECDSA}} &= \{\text{secp256k1 chains}\}
\end{align*}

For any chain $c \in \mathcal{C}_{\text{FROST}} \cup \mathcal{C}_{\text{ECDSA}}$,
Lux Teleport holds assets under a threshold public key $\mathsf{pk}_c$ such that
on-chain verification uses the chain's native $\mathsf{Verify}$ function---no custom
verifier contracts, no multisig wrappers.

% ============================================================