papers/lux-institutional-custody/sections/02-threat-model.tex

\section{Threat Model}

\label{sec:threat}
%% =====================================================================

The threat model below frames every later design decision. Each
threat is named, described, and mapped to the architectural mitigation
that contains it.

\subsection{Adversary Capabilities Considered}

\begin{enumerate}[nosep]
\item \textbf{Remote network adversary.} Has internet reach to any
endpoint marked online; can probe, fuzz, and exploit known and
zero-day software vulnerabilities on connected machines.

\item \textbf{Cloud provider compromise.} Root account takeover at
AWS, GCP, or Azure (phishing, session hijack, support social
engineering). Adversary obtains read/write access to one cloud HSM
backend, including the ability to invoke signing on cached material
or extract wrapped key material from the management plane.

\item \textbf{Single-jurisdiction seizure.} A national authority
(US, EU, SG, UK, etc.) compels disclosure or surrender of one HSM
or one operations team via legal process. The adversary obtains
authoritative signing access to one share.

\item \textbf{Insider threat, single actor.} One member of the
custody operations team attempts unauthorized signing.

\item \textbf{Insider threat, two-party collusion.} Two colluding
members of the custody operations team attempt unauthorized signing.

\item \textbf{Supply-chain HSM compromise.} An HSM vendor ships a
firmware update with an extraction backdoor (cf.\ Lockheed-style
implants, RNG biasing, hidden signing oracle).

\item \textbf{Side-channel attack on HSM.} Power analysis, timing,
EM emissions, fault injection on a co-located adversary's machine
sharing facility power or rack space.

\item \textbf{Geographic disaster.} One physical site (HQ datacenter,
DR datacenter, or vault) becomes unreachable due to fire, flood,
earthquake, war, or extended grid failure.

\item \textbf{Operational error.} A single operator mistypes an
address, executes a stale transaction, or fat-fingers an order.

\item \textbf{Quantum cryptanalysis (future).} An adversary with a
fault-tolerant quantum computer running Shor's algorithm at sufficient
qubit count to break secp256k1 ECDSA. Treated as a non-imminent
hedge rather than an active threat in 2026.

\item \textbf{Sealed-envelope theft.} An adversary obtains the
recovery passphrase shards stored in physical sealed envelopes at
geographically distinct sites.
\end{enumerate}

\subsection{Adversary Capabilities Excluded}

\begin{enumerate}[nosep]
\item \textbf{Post-finality blockchain reorganisation deeper than the
exchange's safety threshold.} Out of scope; the fund relies on
canonical Bitcoin and Ethereum finality assumptions (one hour for BTC,
two epochs for ETH).

\item \textbf{Compromise of every signing party simultaneously.} A
$t$-of-$n$ scheme provably loses to a $t$-share adversary; the design
target is $t-1$ tolerance for cold (i.e.\ tolerate two share
compromises) and $t-1$ tolerance for warm (tolerate one).

\item \textbf{Loss of all sealed-envelope shards plus all five HSMs.}
Catastrophic; mitigated by geographic distribution, not by the
threshold itself.
\end{enumerate}

\subsection{Mitigation Mapping}

\begin{table}[h]
\centering
\small
\begin{tabular}{p{6.5cm}p{8.5cm}}
\toprule
\textbf{Threat} & \textbf{Mitigation} \\
\midrule
Single HSM compromise &
3-of-5 cold; one share leak does not produce a signature \\
Cloud provider compromise &
Each cloud HSM holds at most one cold share and one warm share; a
full provider takeover loses two of nine total shares, well below
threshold of either tier \\
Single-jurisdiction seizure &
Five cold shares span three continents and four jurisdictions; warm
spans three jurisdictions \\
Insider, single actor &
3-of-5 cold and 2-of-3 warm both require three (cold) or two (warm)
distinct administrative principals \\
Insider, two-party collusion &
Cold tier still requires a third independent principal; warm tier
falls to two-party collusion and is therefore capped at 4\% AUM \\
Supply-chain HSM compromise &
Five distinct HSM product lines from four distinct vendors; one
backdoored line cannot reach threshold \\
Side-channel attack &
All Tier-1 HSMs FIPS 140-2 Level 3 minimum; Utimaco SR-Se200 carries
Level 4 physical certification; cold HSMs in dedicated rack space \\
Geographic disaster &
3-of-5 tolerates simultaneous loss of two physical sites \\
Operational error &
24-hour time-lock on all hot-tier withdrawals (cancellable);
multi-eyes approval workflow on warm; airgapped review on cold \\
Quantum cryptanalysis &
Lux Triple Consensus on M-Chain (LP-006 \cite{lp006},
LP-020 \cite{lp020}); audit log signed with ML-DSA so that 2030+
quantum-broken ECDSA cannot rewrite custody history \\
Sealed-envelope theft &
3-of-3 Shamir over passphrase shards across three jurisdictions;
theft of any two yields nothing \\
\bottomrule
\end{tabular}
\caption{Threat-to-mitigation mapping.}
\label{tab:threats}
\end{table}

\subsection{Residual Risk}

\begin{requirement}[Catastrophic Recovery Bound]
The architecture survives the loss of any two cold-tier shares plus
any single warm-tier share plus any single hot-tier share, simultaneously.
It does not survive the simultaneous loss of three or more cold shares.
The mitigation for that residual case is the sealed-envelope recovery
shards (Section~\ref{sec:dr}).
\end{requirement}

%% =====================================================================