mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekayandHanzo Dev
70f6883235
A July commit removed eight papers on the premise "no license — DEX/non-custodial only". That premise is wrong: Lux operates an ATS, a broker-dealer, a transfer agent and a bank, and this material is resold at lux.financial. The merge that brought main in preserved the removal because the commit stated a reason, which is how a stale reason outlives the fact it rested on. Back, at the versions main carried — main never received the removal, so its copies are the later ones: the ATS architecture, the security-token standard, smart order routing, institutional custody, MPC custody, post-quantum securities, the SSB partnership and the CoinBridge brief. 83 files. Co-authored-by: Hanzo Dev <[email protected]>
66 lines
2.6 KiB
TeX
66 lines
2.6 KiB
TeX
\section{HSM Attestation}
|
|
|
|
\label{sec:hsm}
|
|
%% =====================================================================
|
|
|
|
Every signing operation is co-attested by a hardware security module
|
|
(HSM). The HSM does not hold a threshold share; instead, it provides
|
|
an attestation that the signing environment is uncompromised.
|
|
|
|
\begin{definition}[HSM Co-Signing]
|
|
The HSM maintains a signing key $k_{\text{HSM}}$ inside tamper-resistant
|
|
hardware. For each threshold signing request:
|
|
\begin{enumerate}[nosep]
|
|
\item The MPC node presents the partial signature $\sigma_i$ and
|
|
the signing context (message hash, signer set, policy).
|
|
\item The HSM verifies that the policy permits the operation (e.g.,
|
|
withdrawal amount within daily limit, destination on allowlist).
|
|
\item If the policy check passes, the HSM produces an attestation
|
|
$\alpha_i = \mathsf{Sign}_{k_{\text{HSM}}}(\sigma_i \|
|
|
\text{context})$.
|
|
\item The partial signature is accepted only if $\alpha_i$ verifies.
|
|
\end{enumerate}
|
|
\end{definition}
|
|
|
|
\begin{theorem}[HSM Composition]
|
|
\label{thm:hsm-compose}
|
|
Adding HSM attestation does not weaken the threshold unforgeability
|
|
guarantee: if the threshold protocol is unforgeable under $t-1$
|
|
corruption, then the protocol with HSM attestation is also unforgeable
|
|
under $t-1$ corruption, even if the HSM key is compromised.
|
|
\end{theorem}
|
|
|
|
\begin{proof}[Proof sketch]
|
|
The HSM attestation is an additional verification layer applied after
|
|
partial signature generation. Removing the HSM check (as would happen
|
|
if the HSM key is compromised and the adversary can forge attestations)
|
|
reduces to the base threshold protocol, which is unforgeable by
|
|
Theorem~\ref{thm:cggmp-uf}/\ref{thm:frost-uf}. The HSM can only
|
|
\emph{add} security (by rejecting unauthorized operations) but its
|
|
compromise cannot \emph{remove} the threshold unforgeability property.
|
|
Formally: the advantage of an adversary against the HSM-augmented
|
|
protocol is at most $\epsilon_{\text{threshold}} +
|
|
\epsilon_{\text{HSM}}$, and the bound holds even when
|
|
$\epsilon_{\text{HSM}} = 1$ (complete HSM compromise).
|
|
\end{proof}
|
|
|
|
\subsection{Supported HSM Backends}
|
|
|
|
\begin{table}[h]
|
|
\centering
|
|
\begin{tabular}{llr}
|
|
\toprule
|
|
\textbf{Backend} & \textbf{Key Type} & \textbf{Attestation Latency} \\
|
|
\midrule
|
|
AWS CloudHSM & ECDSA P-256 & 3.2 ms \\
|
|
GCP Cloud HSM & ECDSA P-256 & 4.1 ms \\
|
|
Zymbit HSM6 & ECDSA secp256k1 & 1.8 ms \\
|
|
YubiHSM 2 & Ed25519 & 2.4 ms \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\caption{HSM attestation latency by backend.}
|
|
\label{tab:hsm}
|
|
\end{table}
|
|
|
|
%% =====================================================================
|