mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekayandHanzo Dev
70f6883235
A July commit removed eight papers on the premise "no license — DEX/non-custodial only". That premise is wrong: Lux operates an ATS, a broker-dealer, a transfer agent and a bank, and this material is resold at lux.financial. The merge that brought main in preserved the removal because the commit stated a reason, which is how a stale reason outlives the fact it rested on. Back, at the versions main carried — main never received the removal, so its copies are the later ones: the ATS architecture, the security-token standard, smart order routing, institutional custody, MPC custody, post-quantum securities, the SSB partnership and the CoinBridge brief. 83 files. Co-authored-by: Hanzo Dev <[email protected]>
44 lines
1.9 KiB
TeX
44 lines
1.9 KiB
TeX
\section{Security Analysis}
|
|
\label{sec:security}
|
|
|
|
\subsection{Threat Model}
|
|
|
|
We consider the following adversaries:
|
|
|
|
\begin{enumerate}[nosep]
|
|
\item \textbf{External attacker}: Attempts to steal assets by compromising platform infrastructure.
|
|
\item \textbf{Malicious insider}: Platform employee attempts unauthorized transfers.
|
|
\item \textbf{Compromised HSM}: Platform's HSM is fully compromised, exposing the platform key share.
|
|
\item \textbf{Regulatory seizure}: Government orders asset freeze or forfeiture.
|
|
\item \textbf{Quantum adversary}: Future attacker with access to a cryptographically relevant quantum computer.
|
|
\end{enumerate}
|
|
|
|
\subsection{Mitigation}
|
|
|
|
\begin{table}[H]
|
|
\centering
|
|
\caption{Threat mitigation through non-custodial MPC.}
|
|
\label{tab:threats}
|
|
\begin{tabular}{lp{7cm}}
|
|
\toprule
|
|
\textbf{Threat} & \textbf{Mitigation} \\
|
|
\midrule
|
|
External attacker & Platform key share alone insufficient; attacker must also compromise investor device \\
|
|
Malicious insider & Same as external attacker; no single insider has access to 2 shares \\
|
|
Compromised HSM & Investor retains independent share; recovery custodian can facilitate key rotation \\
|
|
Regulatory seizure & Platform can freeze by withholding its share; no need to seize keys \\
|
|
Quantum adversary & Lux post-quantum precompiles enable migration to PQ-safe threshold schemes \cite{lux-mchain-mpc} \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{table}
|
|
|
|
\subsection{Operational Security}
|
|
|
|
\begin{itemize}[nosep]
|
|
\item MPC key shares are generated in a distributed ceremony; no single party ever sees the full private key.
|
|
\item The platform's share is stored in an HSM with FIPS 140-2 Level 3 certification.
|
|
\item Key rotation occurs monthly via the \texttt{signer\_rotate} cron, using proactive secret sharing to rotate shares without changing the public key.
|
|
\item All MPC signing sessions are logged immutably in the \texttt{mpc\_requests} and \texttt{mpc\_signatures} collections.
|
|
\end{itemize}
|
|
|