papers/lux-threshold-ux/sections/04-social-recovery.tex

%% ===================================================================
%% LP-134 canonical naming (2025-12-15):
%% Per LP-134 (Lux Chain Topology), T-Chain has been split into:
%%   M-Chain — MPC ceremonies for bridge custody of EXTERNAL wallets
%%             (CGGMP21, FROST, Pulsar-general)
%%   F-Chain — FHE compute + TFHE bootstrap-key generation (encrypted EVM)
%% The legacy name "T-Chain" is retained ONLY for `teleportvm` (LP-6332).
%% Where this paper says "T-Chain MPC" / "T-Chain threshold governance" /
%% "T-Chain TFHE" / "T-Chain custody", read as M-Chain (MPC) or F-Chain (FHE).
%% ===================================================================

\section{Social Recovery}
\label{sec:recovery}

Seed phrases are the original sin of cryptocurrency UX. A 24-word mnemonic
is a single point of failure that users are told to write on paper and store
in a safe. This is not a product experience. It is an abdication of design
responsibility.

Social recovery replaces seed phrases with threshold key recovery through
trusted contacts (guardians).

\subsection{Guardian Model}

\begin{definition}[Guardian Set]
A guardian set $\mathcal{G} = (t, n, \{G_1, \ldots, G_n\})$ is a set of
$n$ contacts, any $t$ of whom can cooperate to recover the user's capsule
access key. Each guardian $G_i$ holds an encrypted key share $s_i$ stored
in their own capsule.
\end{definition}

The guardian selection UX presents this as: ``Choose 5 trusted contacts.
If you ever lose access to your account, any 3 of them can help you
recover it.'' The user selects contacts from their address book. The
system:

\begin{enumerate}
    \item Generates a $(t, n)$ Shamir sharing of the capsule recovery key.
    \item Encrypts each share $s_i$ under guardian $G_i$'s public key.
    \item Stores each encrypted share in $G_i$'s capsule as a ``recovery
    share'' object (the guardian is notified: ``[User] has named you as
    a recovery contact'').
    \item Records the guardian set commitment (hash of the guardian DIDs
    and threshold) on the I-Chain.
\end{enumerate}

\subsection{Recovery Protocol}

When a user needs to recover (lost device, forgotten passphrase), the
recovery protocol proceeds:

\begin{enumerate}
    \item User authenticates via an alternate channel (email, phone, in-person
    verification with a guardian).
    \item User requests recovery through the Lux client, which contacts all
    $n$ guardians.
    \item Each guardian receives: ``[User] is requesting account recovery.
    Do you want to help? [Confirm] [Deny].'' The guardian may additionally
    verify the request out-of-band (phone call, video chat).
    \item When a guardian confirms, they authorize their capsule to release
    the encrypted share to the T-Chain recovery coordinator.
    \item When $t$ shares are collected, the T-Chain coordinates threshold
    reconstruction via a secure MPC protocol that reveals the recovery key
    only to the user's new device.
    \item The user's capsule is re-keyed: a new primary key is generated,
    the capsule is re-encrypted, and the guardian shares are refreshed
    (proactive secret sharing \cite{herzberg1995proactive}).
\end{enumerate}

\begin{theorem}[Recovery Security]
Under the $(t, n)$ guardian model, an adversary must compromise at least
$t$ guardians to recover a user's capsule key. If guardians are selected
from independent social circles (family, work, friends), the probability
of $t$ simultaneous compromises is:
\begin{equation}
    \Pr[\text{adversarial recovery}] \leq \binom{n}{t} \cdot p^t
\end{equation}
where $p$ is the per-guardian compromise probability. For $t = 3$, $n = 5$,
and $p = 0.01$, this yields $\Pr \leq 10^{-5}$.
\end{theorem}

\subsection{Guardian Rotation}

Guardians change over time: friends drift apart, employees leave companies,
contacts change devices. The guardian rotation protocol allows updating the
guardian set without re-sharing the original key:

\begin{enumerate}
    \item User initiates guardian rotation from the settings UI.
    \item The system performs proactive secret sharing: generating new shares
    for the updated guardian set without reconstructing the secret.
    \item Old shares held by removed guardians become cryptographically
    useless (they correspond to a deprecated polynomial).
    \item New guardians receive their shares; the I-Chain commitment is updated.
\end{enumerate}

This uses Herzberg et al.'s proactive secret sharing protocol
\cite{herzberg1995proactive}, which refreshes shares without
reconstructing the underlying secret---the recovery key is never
materialized during rotation.