mirror of
https://github.com/lux-apps/papers.git
synced 2026-11-03 05:07:46 +00:00
zeekayandHanzo Dev
70f6883235
A July commit removed eight papers on the premise "no license — DEX/non-custodial only". That premise is wrong: Lux operates an ATS, a broker-dealer, a transfer agent and a bank, and this material is resold at lux.financial. The merge that brought main in preserved the removal because the commit stated a reason, which is how a stale reason outlives the fact it rested on. Back, at the versions main carried — main never received the removal, so its copies are the later ones: the ATS architecture, the security-token standard, smart order routing, institutional custody, MPC custody, post-quantum securities, the SSB partnership and the CoinBridge brief. 83 files. Co-authored-by: Hanzo Dev <[email protected]>
113 lines
4.0 KiB
TeX
113 lines
4.0 KiB
TeX
\section{Disaster Recovery}
|
|
|
|
\label{sec:dr}
|
|
%% =====================================================================
|
|
|
|
The architecture distinguishes \emph{availability} loss (a share is
|
|
unreachable) from \emph{authority} loss (a share has been compromised).
|
|
Both must be recoverable; the recovery procedures differ.
|
|
|
|
\subsection{Failure Modes}
|
|
|
|
\begin{table}[h]
|
|
\centering
|
|
\small
|
|
\begin{tabular}{p{4cm}p{4cm}p{6cm}}
|
|
\toprule
|
|
\textbf{Failure} & \textbf{Type} & \textbf{Recovery} \\
|
|
\midrule
|
|
One cold share unreachable (cloud outage) &
|
|
Availability &
|
|
Use any other 3-of-4 quorum; no action required \\
|
|
Two cold shares unreachable (regional disaster) &
|
|
Availability &
|
|
Use the remaining 3-of-3 quorum; investigate root cause; consider
|
|
re-DKG \\
|
|
Three or more cold shares unreachable &
|
|
Availability &
|
|
Sealed-envelope recovery; M-Chain transcript replay; full re-DKG \\
|
|
One cold share compromised (key extracted) &
|
|
Authority &
|
|
Proactive refresh on remaining shares; full re-DKG; rotate
|
|
operational credentials \\
|
|
Two cold shares compromised &
|
|
Authority &
|
|
Emergency full re-DKG; consider tier-2 emergency drain to a new
|
|
public key \\
|
|
Cloud KMS provider compromise (hot tier) &
|
|
Authority &
|
|
24-hour time-lock buys time; pause trading; rotate hot-tier keys \\
|
|
Vault site physical compromise &
|
|
Authority &
|
|
Treat as one share authority loss; FIPS L3 device tamper response
|
|
should zeroise; re-DKG \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\caption{Failure modes and recovery.}
|
|
\label{tab:failures}
|
|
\end{table}
|
|
|
|
\subsection{Sealed-Envelope Recovery Procedure}
|
|
|
|
The sealed-envelope recovery is the architecture's residual-risk
|
|
floor. It is exercised only when three or more cold shares are
|
|
simultaneously unrecoverable. The procedure:
|
|
|
|
\begin{enumerate}[nosep]
|
|
\item Custody Lead and a second authorised principal travel to all
|
|
three vault locations (US, Switzerland, Singapore).
|
|
\item Each envelope is inspected by both principals before opening;
|
|
tamper-evident seals are photographed.
|
|
\item The three Shamir shards $P_1, P_2, P_3$ are reassembled to
|
|
recover passphrase $P$.
|
|
\item $P$ is used to decrypt the M-Chain-stored encrypted ceremony
|
|
transcript.
|
|
\item The transcript is replayed inside a freshly provisioned SCIF
|
|
on freshly procured hardware; share material is reconstructed.
|
|
\item A new ceremony then runs to migrate to a new public key; the
|
|
old key is retired and any remaining assets at the old key are
|
|
moved.
|
|
\end{enumerate}
|
|
|
|
This procedure takes approximately seven days end-to-end and is
|
|
intentionally slow.
|
|
|
|
\subsection{Quarterly Live Drill}
|
|
|
|
A live disaster-recovery drill is run quarterly. One real share is
|
|
taken offline (cycled across shares quarter-to-quarter so that every
|
|
share is exercised over a multi-quarter window) and a real signing
|
|
ceremony is completed using the remaining quorum. The drill is
|
|
recorded on M-Chain and reviewed at the next quarterly board meeting.
|
|
|
|
\subsection{Insurance Interaction}
|
|
|
|
The crime-and-specie policy distinguishes \emph{authority} loss
|
|
(insured up to policy tower) from \emph{availability} loss (not
|
|
insured but bounded by SLAs). The architecture's recovery procedures
|
|
are designed so that an availability incident never escalates to an
|
|
authority incident: the time-lock on the hot tier, the four-eyes
|
|
review on the warm tier, and the airgap on the cold tier ensure that
|
|
an attacker cannot leverage an availability incident to forge a
|
|
signature.
|
|
|
|
\subsection{Business Continuity}
|
|
|
|
In the event of a sustained availability incident on the warm tier
|
|
(e.g.\ a multi-day cloud outage at two of three providers), trading
|
|
operations fall back to one of two contingencies:
|
|
|
|
\begin{enumerate}[nosep]
|
|
\item \textbf{Tier-2 elevation of a hot share.} A hot share's
|
|
spending cap can be temporarily raised, subject to Custody Lead
|
|
approval, to maintain trading-desk liquidity for up to seventy-two
|
|
hours.
|
|
\item \textbf{Cold-tier emergency draw.} A cold ceremony can be
|
|
scheduled within twenty-four hours to refill the warm tier from
|
|
cold reserves.
|
|
\end{enumerate}
|
|
|
|
Either contingency is logged and reviewed at the next monthly review.
|
|
|
|
%% =====================================================================
|