mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekayandHanzo Dev
70f6883235
A July commit removed eight papers on the premise "no license — DEX/non-custodial only". That premise is wrong: Lux operates an ATS, a broker-dealer, a transfer agent and a bank, and this material is resold at lux.financial. The merge that brought main in preserved the removal because the commit stated a reason, which is how a stale reason outlives the fact it rested on. Back, at the versions main carried — main never received the removal, so its copies are the later ones: the ATS architecture, the security-token standard, smart order routing, institutional custody, MPC custody, post-quantum securities, the SSB partnership and the CoinBridge brief. 83 files. Co-authored-by: Hanzo Dev <[email protected]>
49 lines
2.1 KiB
TeX
49 lines
2.1 KiB
TeX
\section{Key Rotation}
|
|
|
|
\label{sec:rotation}
|
|
%% =====================================================================
|
|
|
|
\begin{definition}[Proactive Resharing]
|
|
Given an existing $t$-of-$n$ sharing of key $x$ on polynomial $f$,
|
|
a reshare protocol produces a new $t'$-of-$n'$ sharing on a fresh
|
|
polynomial $g$ with $g(0) = f(0) = x$. The new shares are computed
|
|
by having each old signer contribute an additive share of zero
|
|
(a random polynomial $h_i$ with $h_i(0) = 0$). The new shares are
|
|
$g(j) = \sum_{i \in S} \lambda_i f(i) + \sum_{i \in S} h_i(j)$ for
|
|
each new party $j$.
|
|
\end{definition}
|
|
|
|
\begin{theorem}[Reshare Safety]
|
|
\label{thm:reshare}
|
|
Proactive resharing satisfies:
|
|
\begin{enumerate}[nosep]
|
|
\item \textbf{Public key preservation.} The aggregate public key
|
|
$X = x \cdot G$ is unchanged after reshare.
|
|
\item \textbf{Old share invalidation.} Old shares lie on polynomial
|
|
$f$; new shares lie on polynomial $g \neq f$. Old shares
|
|
cannot be combined with the new protocol state.
|
|
\item \textbf{No key reconstruction.} The secret $x$ is never
|
|
materialized during the reshare. Each party sees only its
|
|
own old share plus received shares-of-zero.
|
|
\end{enumerate}
|
|
\end{theorem}
|
|
|
|
\begin{proof}
|
|
(1) follows because $g(0) = f(0) = x$, so $x \cdot G$ is unchanged.
|
|
(2) follows because $g$ is a uniformly random polynomial conditioned on
|
|
$g(0) = x$, so the evaluations $g(j)$ are independent of $f(i)$ for
|
|
$j \neq i$. Mixing old and new shares produces interpolation over
|
|
inconsistent polynomials, which yields an incorrect secret.
|
|
(3) follows because each old signer generates their share-of-zero
|
|
locally (using fresh randomness), and the zero-secret polynomial
|
|
$h_i$ has $h_i(0) = 0$. The sum $\sum h_i(j)$ re-randomizes the
|
|
polynomial without any party knowing the full randomness.
|
|
\end{proof}
|
|
|
|
Key rotation is performed periodically (default: every 7 days) to
|
|
limit the exposure window. An attacker must compromise $t$ shares
|
|
within a single rotation epoch; shares from different epochs are
|
|
incompatible.
|
|
|
|
%% =====================================================================
|