papers/lux-evm-precompiles/sections/09-security-analysis.tex

\section{Security Analysis}
\label{sec:security}

\subsection{Input Validation}

Every precompile validates inputs before processing:
\begin{enumerate}
    \item Length checks: reject inputs that don't match expected format.
    \item Point-on-curve checks: verify elliptic curve points lie on the correct curve.
    \item Subgroup checks: verify points are in the prime-order subgroup.
    \item Range checks: verify scalar values are in $[0, p)$ or $[0, r)$ as appropriate.
\end{enumerate}

\subsection{Side-Channel Resistance}

Native precompile code uses constant-time implementations for all operations involving secret data:
\begin{itemize}
    \item BLS signing (in the validator client, not the precompile) uses constant-time scalar multiplication.
    \item Pairing computations use constant-time Miller loop implementations.
    \item ECDSA batch verification uses constant-time modular inversion.
\end{itemize}

\subsection{Known Attack Mitigations}

\begin{table}[H]
\centering
\caption{Attack vectors and mitigations.}
\label{tab:attacks}
\begin{tabular}{p{3.5cm}p{4cm}p{5cm}}
\toprule
\textbf{Attack} & \textbf{Vector} & \textbf{Mitigation} \\
\midrule
Small subgroup & Points outside $\mathbb{G}_1$, $\mathbb{G}_2$ & Mandatory subgroup check \\
Invalid curve & Points on twist & Point-on-curve validation \\
Rogue key (BLS) & Malicious key choice & Proof-of-possession requirement \\
Hash collision & Weak hash-to-curve & RFC 9380 compliant H2C \\
DoS via large input & Expensive MSM/pairing & Gas proportional to input size \\
\bottomrule
\end{tabular}
\end{table}