papers/lux-universal-threshold-signatures/sections/07-security-analysis.tex

\section{Security Analysis}


\subsection{Threat Model}

\paragraph{Adversary Capabilities}
\begin{itemize}
\item \textbf{Byzantine Faults}: Up to $t-1$ parties may deviate arbitrarily
\item \textbf{Network Control}: Adversary controls message scheduling (but not content)
\item \textbf{Static Corruption}: Party corruption before protocol execution
\item \textbf{Adaptive Corruption}: Party corruption during execution (restricted)
\end{itemize}

\paragraph{Security Goals}
\begin{itemize}
\item \textbf{Unforgeability}: No coalition of size $\leq t$ can forge signatures
\item \textbf{Robustness}: Honest parties output valid signatures despite Byzantine faults
\item \textbf{Identifiable Abort}: Malicious parties detected and excluded
\end{itemize}

\subsection{Protocol Security}

\begin{theorem}[CMP Security]
The CMP protocol achieves $(t,n)$-threshold unforgeability under the ECDSA security assumption, DDH assumption in the Paillier group, and security of zero-knowledge proofs in the random oracle model.
\end{theorem}

\begin{theorem}[FROST Security]
FROST achieves existential unforgeability under chosen-message attack under the discrete logarithm assumption in the random oracle model, with robustness against up to $t-1$ malicious parties.
\end{theorem}

\begin{theorem}[LSS Security]
The LSS dynamic resharing protocol maintains $(t,n)$-threshold security across generations, with share forward security: compromised old shares cannot forge signatures after resharing.
\end{theorem}

\begin{theorem}[Pulsar Security]
Pulsar achieves existential unforgeability under the Module-LWE hardness assumption with parameters providing quantum security levels 1, 3, or 5 per NIST standards.
\end{theorem}

\subsection{Implementation Security}

\paragraph{Constant-Time Arithmetic} All cryptographic operations use constant-time implementations (saferith library) to prevent timing attacks.

\paragraph{Side-Channel Resistance}
\begin{itemize}
\item No secret-dependent branches
\item No secret-dependent memory access patterns
\item Blinding of intermediate values
\end{itemize}

\paragraph{Zero-Knowledge Proofs} All protocols use ZK proofs at critical steps:
\begin{itemize}
\item $\Pi_{\textsf{mod}}$: Paillier modulus is product of two primes
\item $\Pi_{\textsf{prm}}$: Correct Paillier parameter generation
\item $\Pi_{\textsf{sch}}$: Schnorr proof of knowledge
\item $\Pi_{\textsf{affg}}$: Affine operation with group commitment
\item $\Pi_{\textsf{log}}$: Discrete logarithm equality
\end{itemize}

\subsection{Security Audit Findings}

Third-party security audit (2024) identified and resolved:
\begin{enumerate}
\item \textbf{Nonce Generation}: Enhanced to hedged deterministic nonces
\item \textbf{Range Proofs}: Tightened bounds in ZK proofs
\item \textbf{Session Binding}: Strengthened session ID to prevent replay attacks
\item \textbf{Abort Handling}: Improved abort identification in CMP
\end{enumerate}

All high and medium severity issues resolved. Low severity recommendations implemented.