mirror of https://github.com/luxfi/security.git synced 2026-10-30 15:17:20 +00:00

Files

T

zooqueen a415cfa425 security: canonical home for the high-assurance framework + posture

Establish luxfi/security as the discoverable security home (relocated from
luxfi/proofs, which is for the mathematical proofs themselves):

  framework/ASSURANCE.tex     the normative standard + assurance vocabulary
  framework/check.sh          the one runnable gate (any crypto repo)
  framework/checks/           circular-proof / proof-by-rename / fail-open /
                              axiom-budget / claims-vs-reality detectors
  framework/redteam/          per-family red-team checklists (lattice/hash/STARK)
  framework/REVIEW-GUIDE.tex  external cryptographer's entry point

LLM.md is now a real security-home index: the framework, the per-repo .assurance
trust surfaces + review packages, the honest posture (review-ready, NOT
externally audited), the shared security invariants (KMS-only secrets,
fail-closed novel-crypto verifiers, no secret reconstruction, interop-tested
byte-equality), and pointers to luxfi/compliance, luxfi/proofs, luxfi/kms.

2026-06-21 14:14:19 -07:00

3.5 KiB

Raw Permalink Blame History

Lux Security — canonical security home

Org: luxfi · Ecosystem: lux · Path: /Users/a/work/lux/luxfi/security Origin: https://github.com/luxfi/security.git

This repo is the discoverable home for Lux's security framework and shared security posture. If you are building, reviewing, or auditing any Lux cryptographic primitive, start here. (CLAUDE.md is a symlink to this file.)

The high-assurance framework (`framework/`)

The canonical, runnable assurance gate + standard that every Lux crypto repo is held to. It exists because a 2026-06 audit found the same proof cheats across three independent PQ primitives — framework gaps, not one-off bugs.

framework/ASSURANCE.tex — the normative standard + the assurance vocabulary (machine-checked / sound-by-reduction / interop-tested / asserted-axiom / fail-closed-pending-review / open-research).
framework/check.sh <repo> — the one gate. Run it over any crypto repo (default: pulsar/corona/magnetar/p3q/consensus). It mechanically blocks the shipped-before cheat classes:
- checks/circular-proof.sh — a theorem discharged by an axiom that restates it, or a Lean body that is := True/trivial/sorry.
- checks/proof-by-rename.sh — a constant-time/no-secret property "enforced" by an identifier grep; a CLOSED blocker whose prose admits the secret persists.
- checks/fail-open.sh — a verifier that always accepts.
- checks/axiom-budget.sh — sorry/admit/axiom drift above the repo's declared .assurance/budget.txt.
- checks/claims-vs-reality.sh — PROOF-CLAIMS prose that contradicts the artifacts.
framework/redteam/{lattice,hash-based,stark}.tex — per-family adversarial review checklists (apply the right threat model to the right primitive).
framework/REVIEW-GUIDE.tex — the external cryptographer's entry point: what to review per primitive, repro commands, the open assumptions, the five questions we most want answered.

Each crypto repo carries a .assurance/ directory (the written-down trust surface: budget.txt + reviewed-axioms.txt) that the gate enforces, and a review package (pulsar/audit/pulsar-v1/, corona/AUDIT-2026-06.md, magnetar/BLOCKERS.md, …).

Assurance posture (honest)

Review-ready, NOT externally audited / production-certified. The PQ threshold stack (Pulsar / Corona / Magnetar) is no-leak in code, the consensus threshold is the STARK-QC certification path (not impossible threshold signing), and the framework gate passes — but external cryptographic sign-off is the gate not yet passed. See framework/REVIEW-GUIDE.tex.

Shared security invariants (apply everywhere)

Secrets live in KMS only (~/work/lux/kms, MPC backend) — never in code, config, logs, or plaintext storage.
Novel cryptography ships behind a registered verifier whose default fails closed (one pattern: pulsar/ref/go/pkg/pulsar/proof.go).
A threshold scheme never reconstructs or broadcasts secret-dependent material whose aggregate reveals the joint key.
Output byte-equality is interop-tested against ≥2 independent verifiers.

luxfi/compliance — global compliance / regulatory support (FIPS traceability, NIST MPTC status, the assurance→regulatory mapping).
luxfi/proofs — the machine-checked mathematical proofs (EasyCrypt/Lean/LaTeX).
luxfi/audits — external/third-party audit reports.
luxfi/kms — the secret store (MPC threshold KMS).

Sibling repos

See /Users/a/work/lux/luxfi/LLM.md for the full org inventory.

3.5 KiB Raw Permalink Blame History