papers/lux-institutional-custody/sections/07-key-generation-ceremony.tex

\section{Key Generation Ceremony}

\label{sec:ceremony}
%% =====================================================================

The custody public key is generated once, by a witnessed distributed
key-generation (DKG) ceremony, after which the master private key
never exists in any single place. The ceremony is the act on which
all subsequent custody assertions rest, and is executed once per tier.

\subsection{Goals}

\begin{enumerate}[nosep]
\item \textbf{No-secret-aggregation.} No participant -- including the
ceremony operator -- ever sees the full private key. The DKG output
is $n$ shares, each held by a single HSM, plus a single public key.
\item \textbf{Hardware attestation.} Each share-holding HSM produces
a vendor-signed attestation binding the share to that physical
device's serial number.
\item \textbf{Witness independence.} An external auditor (KPMG,
Deloitte, Mazars, or equivalent) is physically present and signs
the ceremony transcript at completion.
\item \textbf{Replayable transcript.} The ceremony emits a
deterministic transcript; an independent auditor can replay the
ceremony from the transcript and verify it produces the published
public key.
\item \textbf{Sealed-envelope backup.} A 3-of-3 Shamir-shared
recovery passphrase is sealed in three separate envelopes at three
separate jurisdictions; the passphrase, if reassembled, can decrypt
ceremony transcript backups stored on M-Chain.
\end{enumerate}

\subsection{Pre-Ceremony Setup}

\begin{enumerate}[nosep]
\item \textbf{Site preparation.} The ceremony room is a Faraday-shielded
SCIF-style facility with no external network, no cellular coverage,
and active electromagnetic monitoring. Cameras are physically removed
or disabled. Signal jamming is active during the ceremony.
\item \textbf{Hardware procurement.} HSMs are purchased through
independent channels (no consolidated vendor account); serial numbers
are recorded and matched against vendor manufacturing records.
\item \textbf{Pre-attestation.} Every HSM is booted and produces an
identity attestation. Attestations are verified against vendor
public keys before the ceremony begins.
\item \textbf{Witness pre-brief.} The external auditor is briefed on
the protocol and signs an attendance commitment.
\end{enumerate}

\subsection{Ceremony Procedure}

\begin{algorithm}
\caption{Cold-tier key generation (CGGMP21 over secp256k1)}
\begin{algorithmic}[1]
\State Each share-holder $i \in \{1,\ldots,5\}$ HSM generates
       $sk_i \gets \mathcal{U}(\mathbb{Z}_q^*)$ inside the HSM boundary
\State Each HSM emits Pedersen commitment
       $C_i = g^{sk_i} \cdot h^{r_i}$ and broadcasts to the
       ceremony orchestrator
\State After all $C_i$ broadcast, each HSM emits zero-knowledge
       proof of knowledge of $sk_i$ for the committed value
\State Each HSM splits $sk_i$ into Feldman-VSS shares
       $\{f_{i \to j}\}_{j \neq i}$, sends share $f_{i \to j}$
       privately to HSM $j$ over the ceremony's signed bus
\State Each HSM verifies received shares against the public
       commitments; aborts on mismatch
\State Each HSM computes its final share
       $s_i = sk_i + \sum_{j \neq i} f_{j \to i}$
\State Public key $\mathrm{PK} = \prod_i g^{sk_i}$ is computed and
       broadcast
\State Each HSM emits a vendor-signed attestation binding $s_i$
       to its physical serial number
\State Witness countersigns the transcript
\end{algorithmic}
\end{algorithm}

\subsection{Hardware-Attested Share Binding}

Each HSM produces an attestation $A_i = \mathrm{Sign}_{vendor}(\{
\textit{serial}_i, \textit{firmware-hash}_i, h(s_i)\})$ where $h$ is
a domain-separated hash that does not reveal $s_i$. The attestations
are stored in the M-Chain custody ledger (LP-006 \cite{lp006}).
A future auditor verifying the custody claim verifies (a) that the
on-chain attestation chain rooted at $\mathrm{PK}$ matches the
published public key, and (b) that each $A_i$ verifies against the
vendor root certificate.

\subsection{Witness Role}

The witness (an independent audit firm) does the following:

\begin{enumerate}[nosep]
\item Physically inspects every HSM serial against the procurement
record.
\item Observes that no recording device is present in the SCIF.
\item Observes the orchestrator console end-to-end.
\item Reads aloud the published public key for video record.
\item Counter-signs the ceremony transcript with a witness-only key.
\end{enumerate}

The witness does not participate in DKG -- they observe only. The
ceremony transcript is published with the witness's signature
appended.

\subsection{Sealed-Envelope Recovery}

The ceremony emits a backup passphrase $P$ used to encrypt a
secondary copy of all five share material at the moment of generation.
$P$ is split via Shamir 3-of-3 into shards $P_1, P_2, P_3$. Each
shard is sealed in a tamper-evident envelope and stored in a separate
jurisdiction:

\begin{itemize}[nosep]
\item Envelope 1: a U.S. bank vault (e.g.\ Wells Fargo Manhattan).
\item Envelope 2: a Swiss bank vault (e.g.\ a Zurich custodian).
\item Envelope 3: a Singapore bank vault.
\end{itemize}

A 2-of-3 reconstruction is \emph{insufficient} (the envelopes are
3-of-3 by design). All three envelopes must be physically retrieved
to reconstruct $P$. This is the residual-risk recovery path, used
only if three or more cold HSMs are simultaneously unavailable.

\subsection{Per-Tier Cadence}

\begin{table}[h]
\centering
\small
\begin{tabular}{lll}
\toprule
\textbf{Tier} & \textbf{First ceremony} & \textbf{Refresh cadence} \\
\midrule
Cold (Tier 1) & Day 0 & Annual proactive refresh; full re-DKG every 5 years \\
Warm (Tier 2) & Day 0 & Quarterly proactive refresh; full re-DKG every 2 years \\
Hot (Tier 3)  & Day 0 & Monthly proactive refresh; full re-DKG annually \\
\bottomrule
\end{tabular}
\caption{Per-tier ceremony cadence.}
\label{tab:cadence}
\end{table}

A \emph{proactive refresh} runs the CGGMP21 share-refresh protocol
without changing the public key; it is operationally inexpensive
and rotates share material to defeat slow-leak adversaries. A
\emph{full re-DKG} produces a new public key and migrates assets;
it is rare and operationally expensive, run only when threat-model
inputs change materially.

\subsection{Cost}

A first cold-tier ceremony costs approximately \$200{,}000 all-in:
audit firm fees (\$120k), travel and SCIF rental (\$40k), HSM
procurement and pre-attestation (\$30k), and post-ceremony report
(\$10k). Subsequent annual proactive refreshes cost approximately
\$25{,}000 each (no third-party witness required for refreshes that
do not change the public key).

%% =====================================================================