papers/mpc-custody/mpc-custody.tex

\documentclass[11pt,a4paper]{article}
\usepackage{../shared/luxcover}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\usepackage{amsmath,amssymb,amsfonts,amsthm}
\usepackage{hyperref}
\usepackage{booktabs}
\usepackage{enumitem}
\usepackage{algorithm}
\usepackage{algpseudocode}
\usepackage{xcolor}
\usepackage{tikz}
\usetikzlibrary{arrows.meta,positioning,shapes.geometric,fit}

\hypersetup{colorlinks=true,linkcolor=black,citecolor=blue,urlcolor=blue}

\newtheorem{theorem}{Theorem}[section]
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{corollary}[theorem]{Corollary}
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{definition}{Definition}[section]
\newtheorem{remark}{Remark}[section]

\title{Non-Custodial Securities Custody\\via Threshold Signing}

\author{
Zach Kelling\thanks{Corresponding author: [email protected]}\\
\textit{Lux Industries, Inc.}\\
\texttt{[email protected]}
}

\date{2023}

\begin{document}

\luxcoverpage

\begin{abstract}
We present a non-custodial custody architecture for digital securities
in which no single party---not the exchange operator, not the user, not
any custodian---can unilaterally move assets.  The construction uses
threshold signing with two complementary protocols: CGGMP21 (threshold
ECDSA over secp256k1) for EVM-compatible chains and FROST (threshold
Schnorr over Ed25519) for EdDSA chains.  Each user's wallet is a
$2$-of-$3$ threshold address with shares distributed across the user's
device, the exchange operator (auto-co-signs after compliance checks),
and a cold backup.  We prove three security properties:
(1)~\emph{non-custodial guarantee}---no single party can forge a
signature; (2)~\emph{liveness}---any two of three parties can sign,
so asset recovery is possible even if one party is lost;
(3)~\emph{key rotation safety}---shares can be refreshed
(reshared) without changing the on-chain address.
We describe the HSM attestation layer in which every signing share
is co-attested by a hardware security module, and prove that the
HSM attestation composes with the threshold protocol without
weakening the unforgeability guarantee.  The construction is deployed
on a regulated EVM L1 using the
\texttt{luxfi/mpc} and \texttt{luxfi/threshold} libraries.
\end{abstract}

\tableofcontents
\newpage

%% =====================================================================

\input{sections/01-introduction}
\input{sections/02-threshold-signing-protocols}
\input{sections/03-2-of-3-wallet-architecture}
\input{sections/04-hsm-attestation}
\input{sections/05-key-rotation}
\input{sections/06-settlement-flow}
\input{sections/07-integration-with-evm-precompiles}
\input{sections/08-formal-verification}
\input{sections/99-conclusion}

\end{document}