papers/mpc-custody/sections/04-hsm-attestation.tex

\section{HSM Attestation}

\label{sec:hsm}
%% =====================================================================

Every signing operation is co-attested by a hardware security module
(HSM).  The HSM does not hold a threshold share; instead, it provides
an attestation that the signing environment is uncompromised.

\begin{definition}[HSM Co-Signing]
The HSM maintains a signing key $k_{\text{HSM}}$ inside tamper-resistant
hardware.  For each threshold signing request:
\begin{enumerate}[nosep]
  \item The MPC node presents the partial signature $\sigma_i$ and
        the signing context (message hash, signer set, policy).
  \item The HSM verifies that the policy permits the operation (e.g.,
        withdrawal amount within daily limit, destination on allowlist).
  \item If the policy check passes, the HSM produces an attestation
        $\alpha_i = \mathsf{Sign}_{k_{\text{HSM}}}(\sigma_i \|
        \text{context})$.
  \item The partial signature is accepted only if $\alpha_i$ verifies.
\end{enumerate}
\end{definition}

\begin{theorem}[HSM Composition]
\label{thm:hsm-compose}
Adding HSM attestation does not weaken the threshold unforgeability
guarantee: if the threshold protocol is unforgeable under $t-1$
corruption, then the protocol with HSM attestation is also unforgeable
under $t-1$ corruption, even if the HSM key is compromised.
\end{theorem}

\begin{proof}[Proof sketch]
The HSM attestation is an additional verification layer applied after
partial signature generation.  Removing the HSM check (as would happen
if the HSM key is compromised and the adversary can forge attestations)
reduces to the base threshold protocol, which is unforgeable by
Theorem~\ref{thm:cggmp-uf}/\ref{thm:frost-uf}.  The HSM can only
\emph{add} security (by rejecting unauthorized operations) but its
compromise cannot \emph{remove} the threshold unforgeability property.
Formally: the advantage of an adversary against the HSM-augmented
protocol is at most $\epsilon_{\text{threshold}} +
\epsilon_{\text{HSM}}$, and the bound holds even when
$\epsilon_{\text{HSM}} = 1$ (complete HSM compromise).
\end{proof}

\subsection{Supported HSM Backends}

\begin{table}[h]
\centering
\begin{tabular}{llr}
\toprule
\textbf{Backend} & \textbf{Key Type} & \textbf{Attestation Latency} \\
\midrule
AWS CloudHSM & ECDSA P-256 & 3.2 ms \\
GCP Cloud HSM & ECDSA P-256 & 4.1 ms \\
Zymbit HSM6 & ECDSA secp256k1 & 1.8 ms \\
YubiHSM 2 & Ed25519 & 2.4 ms \\
\bottomrule
\end{tabular}
\caption{HSM attestation latency by backend.}
\label{tab:hsm}
\end{table}

%% =====================================================================