mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekayandHanzo Dev
70f6883235
A July commit removed eight papers on the premise "no license — DEX/non-custodial only". That premise is wrong: Lux operates an ATS, a broker-dealer, a transfer agent and a bank, and this material is resold at lux.financial. The merge that brought main in preserved the removal because the commit stated a reason, which is how a stale reason outlives the fact it rested on. Back, at the versions main carried — main never received the removal, so its copies are the later ones: the ATS architecture, the security-token standard, smart order routing, institutional custody, MPC custody, post-quantum securities, the SSB partnership and the CoinBridge brief. 83 files. Co-authored-by: Hanzo Dev <[email protected]>
153 lines
7.0 KiB
TeX
153 lines
7.0 KiB
TeX
\section{HSM Selection Matrix}
|
|
|
|
\label{sec:hsm}
|
|
%% =====================================================================
|
|
|
|
The five cold-tier and three warm-tier shares require eight HSM
|
|
endpoints across at least four distinct vendor lines. This section
|
|
documents each chosen device, its certification, its public price
|
|
basis, and the reason it was selected.
|
|
|
|
\subsection{Selection Principles}
|
|
|
|
\begin{enumerate}[nosep]
|
|
\item \textbf{Vendor diversity.} No two shares of the same tier may
|
|
share a single firmware codebase. AWS CloudHSM and GCP Cloud HSM both
|
|
use Marvell LiquidSecurity firmware and therefore each tier admits at
|
|
most one Marvell-backed share.
|
|
\item \textbf{Certification floor.} FIPS 140-2 Level 3 minimum on
|
|
every signing device. FIPS 140-3 acceptable as a substitute where
|
|
the validation is current. Level 4 physical (Utimaco SR-Se200) used
|
|
in cold tier for the on-prem DR share.
|
|
\item \textbf{Operational reachability.} On-prem HSMs require redundant
|
|
power, network, and physical access control matching SOC 2 CC6.4 and
|
|
CCSS data-centre controls.
|
|
\item \textbf{Supply chain.} The fund retains acceptance authority
|
|
over firmware updates: no signer auto-updates from vendor cloud
|
|
without a documented internal review.
|
|
\end{enumerate}
|
|
|
|
\subsection{Device-by-Device Specification}
|
|
|
|
\paragraph{Thales Luna Network HSM 7 -- Share $\mathbf{c}_1$.}
|
|
Network-attached PCIe-class HSM. FIPS 140-2 Level 3 certified
|
|
(certificate \#3205) \cite{thales-luna7}. Performance: 20{,}000
|
|
ECDSA secp256k1 signatures/sec. Public list price approximately
|
|
\$15{,}000 per appliance for the base ECDSA-capable SKU; HA pair plus
|
|
PED authentication tokens add roughly \$8{,}000. Selected as the
|
|
production-grade industry baseline; widely audited and accepted by
|
|
banking compliance teams.
|
|
|
|
\paragraph{Utimaco u.trust SecurityServer SR-Se200 Gen2 -- Share $\mathbf{c}_2$.}
|
|
PCIe Gen2 HSM with FIPS 140-2 Level 3 certification and Level 4
|
|
physical security (active mesh, environmental sensors, instant zeroisation
|
|
on tamper) \cite{utimaco-secsr}. Throughput: 5{,}500 ECDSA/sec.
|
|
Price: approximately \$25{,}000 per unit; supports custom firmware
|
|
modules signed by the operator. Selected for the DR site specifically
|
|
because the Level 4 physical envelope provides resistance to
|
|
sustained physical attack (drilling, X-ray, decapping) at a level
|
|
that the Marvell and Thales L3 devices do not match.
|
|
|
|
\paragraph{AWS CloudHSM (Marvell LiquidSecurity) -- Share $\mathbf{c}_3$.}
|
|
Single-tenant cloud HSM cluster, FIPS 140-2 Level 3 certificate
|
|
\#4218 \cite{aws-cloudhsm}. Marvell LiquidSecurity firmware. Pricing
|
|
is hourly: approximately \$1.45/hour per HSM in us-east-1, two HSMs
|
|
minimum for HA, total approximately \$2{,}100/month per cluster.
|
|
Cold-tier requires multi-region (us-east-1 + eu-west-1) so two
|
|
clusters: approximately \$4{,}200/month.
|
|
|
|
\paragraph{GCP Cloud HSM (Marvell LiquidSecurity) -- Share $\mathbf{c}_4$.}
|
|
Multi-tenant cloud HSM service backed by Marvell LiquidSecurity
|
|
modules; FIPS 140-2 Level 3 attested per Google's published security
|
|
overview \cite{gcp-cloudhsm}. Pricing per signing operation:
|
|
approximately \$0.03 per 10{,}000 ops plus \$1/hour key holding.
|
|
Cold-tier signing volume is dominated by ceremony scheduling, not
|
|
ops, so the steady-state cost is the key-holding fee: approximately
|
|
\$1{,}460/month for two regions (us-central1 + europe-west1).
|
|
|
|
\paragraph{YubiHSM 2 -- Share $\mathbf{c}_5$.}
|
|
Nano-form HSM, USB-A, FIPS 140-2 Level 3 certificate \#3915
|
|
\cite{yubihsm2}. Price: approximately \$650 per unit; spare units
|
|
maintained at the vault. Selected for the airgap share specifically
|
|
because its small size and low power envelope make it amenable to
|
|
deployment in a fully offline vault, transport in tamper-evident
|
|
bags, and physical destruction at end-of-life.
|
|
|
|
\paragraph{Azure Dedicated HSM (Thales Luna 7) -- Share $\mathbf{w}_3$.}
|
|
Dedicated single-tenant Luna 7 in an Azure datacentre, managed by
|
|
the customer \cite{azure-dedicated-hsm}. FIPS 140-2 Level 3.
|
|
Pricing: approximately \$3.80/hour per device, \$2{,}750/month per
|
|
device. Selected for warm tier as the third independent cloud
|
|
jurisdiction and to provide a Thales-line presence in the warm
|
|
quorum (defence-in-depth against a Marvell-firmware-line vulnerability
|
|
affecting both AWS and GCP shares simultaneously).
|
|
|
|
\subsection{Selection Matrix}
|
|
|
|
\begin{table}[h]
|
|
\centering
|
|
\small
|
|
\begin{tabular}{llllll}
|
|
\toprule
|
|
\textbf{Device} & \textbf{Cert} & \textbf{Vendor} &
|
|
\textbf{Throughput} & \textbf{Capex} & \textbf{Opex} \\
|
|
\midrule
|
|
Thales Luna 7 & 140-2 L3 & Thales & 20k/s
|
|
& \$15k & -- \\
|
|
Utimaco SR-Se200 & 140-2 L3+L4ph & Utimaco & 5.5k/s
|
|
& \$25k & -- \\
|
|
AWS CloudHSM & 140-2 L3 & Marvell & 1k/s
|
|
& -- & \$4.2k/mo \\
|
|
GCP Cloud HSM & 140-2 L3 & Marvell & shared
|
|
& -- & \$1.5k/mo \\
|
|
YubiHSM 2 & 140-2 L3 & Yubico & 30/s
|
|
& \$650 & -- \\
|
|
Azure Dedicated HSM & 140-2 L3 & Thales & 20k/s
|
|
& -- & \$2.8k/mo \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\caption{HSM selection matrix. Capex per appliance; opex per
|
|
month per cluster. Cloud-HSM throughput differs because per-tenant
|
|
slicing is service-defined, not device-defined.}
|
|
\label{tab:hsm-matrix}
|
|
\end{table}
|
|
|
|
\subsection{What Was Excluded and Why}
|
|
|
|
\begin{itemize}[nosep]
|
|
\item \textbf{Single-vendor stack.} Excluded; one firmware vulnerability
|
|
across the entire estate is not survivable at this AUM.
|
|
\item \textbf{Software-only TEE (Intel SGX, AMD SEV-SNP).} Excluded
|
|
from the cold tier; SGX and SEV have a recurring history of
|
|
microarchitectural side-channel vulnerabilities. Acceptable as a
|
|
secondary attestation surface but not as a root signing device.
|
|
\item \textbf{Multi-tenant cloud KMS at FIPS 140-2 Level 2.} Excluded
|
|
from cold and warm tiers; admitted only at the hot tier (Tier 3) as
|
|
shares behind a 24-hour time-lock with a per-day spend cap.
|
|
\item \textbf{Smartcards as cold-share devices.} Excluded; smartcard
|
|
throughput, durability, and battery-backed RAM lifetimes do not match
|
|
multi-decade custody horizons.
|
|
\end{itemize}
|
|
|
|
\subsection{Firmware-Update Policy}
|
|
|
|
The custody operations team retains a firmware-update review queue.
|
|
A vendor-published firmware release is evaluated against three
|
|
criteria before acceptance:
|
|
|
|
\begin{enumerate}[nosep]
|
|
\item \textbf{Independent CVE review} of the release notes by the
|
|
fund's security team.
|
|
\item \textbf{Staged rollout}: deployed first to one cold share and
|
|
observed for fourteen calendar days before propagation.
|
|
\item \textbf{Cryptographic acceptance test}: a known-answer test
|
|
suite is run against the upgraded device using a published test
|
|
vector set; mismatches halt the rollout.
|
|
\end{enumerate}
|
|
|
|
This procedure intentionally accepts that the fund will run firmware
|
|
slightly behind the vendor's latest, in exchange for the time needed
|
|
to verify that an upgrade does not silently change signing behaviour.
|
|
|
|
%% =====================================================================
|