papers/lux-id-did-specification/sections/05-security-features.tex

\section{Security Features}


\subsection{Cryptographic Primitives}

\subsubsection{Traditional Cryptography}

\begin{itemize}
  \item \textbf{Password Hashing}: Argon2id (winner of Password Hashing Competition)
  \item \textbf{Session Tokens}: HMAC-SHA256 with 256-bit keys
  \item \textbf{JWT Signing}: RS256 (RSA-2048) or ES256 (ECDSA-P256)
  \item \textbf{Encryption}: AES-256-GCM for sensitive data at rest
\end{itemize}

\subsubsection{Post-Quantum Cryptography (v2025.10)}

To address quantum computing threats, Lux ID v2025.10 introduces:

\begin{itemize}
  \item \textbf{ML-DSA (FIPS 204, formerly CRYSTALS-Dilithium)} \cite{dilithium}: Digital signatures (NIST PQC standard)
    \begin{itemize}
      \item Public key: 1,952 bytes
      \item Signature: 3,293 bytes
      \item Security: NIST Level 3 (equivalent to AES-192)
    \end{itemize}
  \item \textbf{ML-KEM (FIPS 203, formerly CRYSTALS-Kyber)} \cite{kyber}: Key encapsulation mechanism
    \begin{itemize}
      \item Public key: 1,568 bytes
      \item Ciphertext: 1,568 bytes
      \item Security: NIST Level 3
    \end{itemize}
\end{itemize}

\textbf{Hybrid Approach}: DID Documents contain both classical (Ed25519) and post-quantum (Dilithium3) verification methods. Clients verify both signatures during a transition period.

\subsection{Multi-Factor Authentication}

\subsubsection{TOTP (Time-Based One-Time Passwords)}

RFC 6238 \cite{rfc6238} compliant implementation:
\begin{itemize}
  \item 6-digit codes, 30-second time window
  \item Compatible with Google Authenticator, Authy, 1Password
  \item QR code enrollment
\end{itemize}

\subsubsection{SMS \& Email Verification}

\begin{itemize}
  \item Pluggable providers: Twilio, SendGrid, AWS SES, custom SMTP
  \item Rate limiting: Max 5 codes per hour per user
  \item Code expiry: 10 minutes
\end{itemize}

\subsubsection{Hardware Security Keys}

Full WebAuthn/FIDO2 support:
\begin{itemize}
  \item YubiKey, Google Titan, Feitian
  \item NFC, USB-A, USB-C, Lightning
  \item Biometric authentication (fingerprint, face)
\end{itemize}

\subsection{Threat Model}

\subsubsection{Assumptions}

\begin{enumerate}
  \item Attacker has network access but not physical access to HSM
  \item Attacker has access to quantum computers (post-quantum threat)
  \item User devices may be compromised
  \item Database may be partially leaked
\end{enumerate}

\subsubsection{Security Guarantees}

\begin{itemize}
  \item \textbf{Password Compromise}: Argon2id prevents rainbow table attacks
  \item \textbf{Session Hijacking}: HTTPOnly, Secure, SameSite cookies
  \item \textbf{CSRF}: Token-based protection on all state-changing operations
  \item \textbf{XSS}: Content Security Policy (CSP), input sanitization
  \item \textbf{Phishing}: WebAuthn prevents credential phishing (origin-bound credentials)
  \item \textbf{Quantum Attacks}: Post-quantum signatures prevent future decryption
\end{itemize}

\subsubsection{Attack Surface Reduction}

\begin{itemize}
  \item Rate limiting on all authentication endpoints
  \item Account lockout after 5 failed login attempts
  \item IP-based geofencing (optional)
  \item User-Agent fingerprinting for anomaly detection
  \item Comprehensive audit logging
\end{itemize}