Skip to content

Commit b473204

Browse files
amir-hameed-miramir-hameed-mir
committed
Updated Security Section
Added the reference to DID-TM which is threat modeling specification
1 parent bb0c2f5 commit b473204

1 file changed

Lines changed: 107 additions & 82 deletions

File tree

‎index.html‎

Lines changed: 107 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -1184,98 +1184,123 @@ <h3>7.4 fROST Threshold Signatures</h3>
11841184
</section>
11851185
</section>
11861186

1187-
<!-- ── Security ── -->
1188-
<section id="security-considerations">
1189-
<h2>8. Security Considerations</h2>
1187+
<!-- ── Security ── -->
1188+
<section id="security-considerations">
1189+
<h2>8. Security Considerations</h2>
11901190

1191-
<h3>8.1 Guardian Collusion (Type A)</h3>
1192-
<p><strong>Threat:</strong> A threshold of guardians collude to reconstruct the user's private key.</p>
1193-
<p><strong>Mitigation:</strong> Feldman VSS with Pedersen commitments ensures shares are individually verifiable. Guardians SHOULD be selected from diverse trust domains, and threshold SHOULD be ≥ 3-of-5.</p>
1194-
1195-
<h3>8.2 Time-Lock Bypass (Type B)</h3>
1196-
<p><strong>Threat:</strong> An attacker compromises the dead man's switch to release inheritance keys prematurely.</p>
1197-
<p><strong>Mitigation:</strong> VDFs provide computational asymmetry that cannot be parallelized, making premature release computationally infeasible within the specified time window.</p>
1198-
1199-
<h3>8.3 Provider State Drift (Type C)</h3>
1200-
<p><strong>Threat:</strong> MPC providers update shares independently, causing key desynchronization.</p>
1201-
<p><strong>Mitigation:</strong> Proactive Secret Sharing with verifiable refresh transcripts (§7.1.4) ensures consistency. The catch-up protocol (§5.4.3) handles epoch lag.</p>
1191+
<div class="callout note">
1192+
<div class="callout-label">Normative Reference</div>
1193+
<p>This section provides a summary of key security considerations. For complete threat taxonomy, detailed attack catalog, and comprehensive countermeasures, refer to the <strong>DID Threat Model Specification (DID-TM)</strong> [DID-TM], which formalizes the threats introduced here and provides CVSS-DID scoring, attack trees, and normative requirements traceable to each threat.</p>
1194+
</div>
12021195

1203-
<h3>8.4 Recovery-Loop Prevention</h3>
1204-
<p><strong>Threat:</strong> Circular recovery dependencies make recovery impossible.</p>
1205-
<p><strong>Mitigation:</strong> Implementations MUST validate that the dependency graph of recovery methods is acyclic at publication time, at recovery initiation, and during periodic health checks.</p>
1196+
<h3>8.1 Guardian Collusion (Type A)</h3>
1197+
<p><strong>Threat:</strong> A threshold of guardians collude to reconstruct the user's private key.</p>
1198+
<p><strong>Mitigation:</strong> Feldman VSS with Pedersen commitments ensures shares are individually verifiable. Guardians SHOULD be selected from diverse trust domains, and threshold SHOULD be ≥ 3-of-5.</p>
1199+
<p><strong>DID-TM Mapping:</strong> This threat is classified as <span class="tc tc-e">E — Privilege Escalation</span> and <span class="tc tc-k">K (K2 — Share Lifecycle Failure)</span>. Full analysis in <strong>DID-TM-ATK-400</strong> (Guardian Collusion at Threshold). Normative mitigations: REQ-400, REQ-401, REQ-402, REQ-403.</p>
1200+
1201+
<h3>8.2 Time-Lock Bypass (Type B)</h3>
1202+
<p><strong>Threat:</strong> An attacker compromises the dead man's switch to release inheritance keys prematurely.</p>
1203+
<p><strong>Mitigation:</strong> VDFs provide computational asymmetry that cannot be parallelized, making premature release computationally infeasible within the specified time window.</p>
1204+
<p><strong>DID-TM Mapping:</strong> This threat is classified as <span class="tc tc-k">K (K3 — Time-Lock Integrity Failure)</span>. Full analysis in <strong>DID-TM-ATK-402</strong> (VDF Difficulty Miscalibration) and <strong>DID-TM-ATK-431</strong> (Wesolowski Proof Forgery). Normative mitigations: REQ-408, REQ-409, REQ-410, REQ-411, REQ-442, REQ-443, REQ-444.</p>
1205+
1206+
<h3>8.3 Provider State Drift (Type C)</h3>
1207+
<p><strong>Threat:</strong> MPC providers update shares independently, causing key desynchronization.</p>
1208+
<p><strong>Mitigation:</strong> Proactive Secret Sharing with verifiable refresh transcripts (§7.1.4) ensures consistency. The catch-up protocol (§5.4.3) handles epoch lag.</p>
1209+
<p><strong>DID-TM Mapping:</strong> This threat is classified as <span class="tc tc-k">K (K2 — Share Lifecycle Failure)</span> and <span class="tc tc-d">D — Denial of Service</span>. Full analysis in <strong>DID-TM-ATK-401</strong> (MPC Epoch Share Drift). Normative mitigations: REQ-404, REQ-405, REQ-406, REQ-407.</p>
1210+
1211+
<h3>8.4 Recovery-Loop Prevention</h3>
1212+
<p><strong>Threat:</strong> Circular recovery dependencies make recovery impossible.</p>
1213+
<p><strong>Mitigation:</strong> Implementations MUST validate that the dependency graph of recovery methods is acyclic at publication time, at recovery initiation, and during periodic health checks.</p>
1214+
<p><strong>DID-TM Mapping:</strong> This threat is classified as <span class="tc tc-d">D — Denial of Service</span> and <span class="tc tc-k">K (K6 — Inheritance and Recovery Chain Failure)</span>. Full analysis in <strong>DID-TM-ATK-404</strong> (Recovery Loop Deadlock). Normative mitigations: REQ-415, REQ-416, REQ-417.</p>
1215+
1216+
<div class="math-block">
1217+
function checkAcyclic(did, visited = new Set()):
1218+
if visited.has(did): return false
1219+
visited.add(did)
1220+
for each recoveryMethod in resolve(did).recovery:
1221+
for each guardian in recoveryMethod.guardians:
1222+
if guardian.id is DID:
1223+
if not checkAcyclic(guardian.id, visited):
1224+
return false
1225+
visited.delete(did)
1226+
return true
1227+
</div>
12061228

1207-
<div class="math-block">
1208-
function checkAcyclic(did, visited = new Set()):
1209-
if visited.has(did): return false
1210-
visited.add(did)
1211-
for each recoveryMethod in resolve(did).recovery:
1212-
for each guardian in recoveryMethod.guardians:
1213-
if guardian.id is DID:
1214-
if not checkAcyclic(guardian.id, visited):
1215-
return false
1216-
visited.delete(did)
1217-
return true
1229+
<div class="diagram-container">
1230+
<div class="diagram-title">Figure 4 — Recovery-Loop Detection</div>
1231+
<div class="mermaid">
1232+
graph TD
1233+
subgraph bad["Graph 1: Loop Detected ✗"]
1234+
A1[did:example:123] -->|recovery| B1[did:guardian:abc]
1235+
B1 -->|controller| A1
1236+
end
1237+
1238+
subgraph good["Graph 2: Valid Tree ✓"]
1239+
A2[did:example:456] -->|recovery| C2[did:guardian:def]
1240+
A2 -->|recovery| D2[did:guardian:ghi]
1241+
end
1242+
1243+
style A1 fill:#fee2e2,stroke:#ef4444,stroke-width:3px
1244+
style B1 fill:#fee2e2,stroke:#ef4444
1245+
style A2 fill:#dcfce7,stroke:#22c55e,stroke-width:3px
1246+
style C2 fill:#dcfce7,stroke:#22c55e
1247+
style D2 fill:#dcfce7,stroke:#22c55e
12181248
</div>
1249+
</div>
12191250

1220-
<div class="diagram-container">
1221-
<div class="diagram-title">Figure 4 — Recovery-Loop Detection</div>
1222-
<div class="mermaid">
1223-
graph TD
1224-
subgraph bad["Graph 1: Loop Detected ✗"]
1225-
A1[did:example:123] -->|recovery| B1[did:guardian:abc]
1226-
B1 -->|controller| A1
1227-
end
1228-
1229-
subgraph good["Graph 2: Valid Tree ✓"]
1230-
A2[did:example:456] -->|recovery| C2[did:guardian:def]
1231-
A2 -->|recovery| D2[did:guardian:ghi]
1232-
end
1233-
1234-
style A1 fill:#fee2e2,stroke:#ef4444,stroke-width:3px
1235-
style B1 fill:#fee2e2,stroke:#ef4444
1236-
style A2 fill:#dcfce7,stroke:#22c55e,stroke-width:3px
1237-
style C2 fill:#dcfce7,stroke:#22c55e
1238-
style D2 fill:#dcfce7,stroke:#22c55e
1239-
</div>
1240-
</div>
1251+
<h3>8.5 Key Wrapping Security</h3>
1252+
<p><strong>Threat:</strong> Weak encryption of seed lockboxes.</p>
1253+
<p><strong>Mitigation:</strong> All encrypted payloads MUST use AEAD with ≥ 256-bit keys. XChaCha20-Poly1305 or AES-256-GCM are REQUIRED. The algorithm MUST be explicitly named in the DID Document.</p>
1254+
<p><strong>DID-TM Mapping:</strong> This threat is classified under <span class="tc tc-i">I — Information Disclosure</span> and <span class="tc tc-k">K (K1 — Key Ceremony Failure)</span>. Refer to DID-TM §22 (Side-Channel and Implementation Threats) for cryptographic implementation requirements. Normative mitigations: REQ-460, REQ-461.</p>
1255+
1256+
<h3>8.6 Quantum Computing Resistance</h3>
1257+
<p>Current algorithms are secure against classical computers. Implementations SHOULD plan transition paths:</p>
1258+
<ul>
1259+
<li><strong>Type A:</strong> Consider lattice-based VSS for post-quantum security.</li>
1260+
<li><strong>Type B:</strong> Use hash-based signatures for seed commitment.</li>
1261+
<li><strong>Type C:</strong> Transition to threshold lattice signatures when standardized.</li>
1262+
</ul>
1263+
<p><strong>DID-TM Mapping:</strong> This threat is classified as <span class="tc tc-k">K (K5 — Post-Quantum Migration Failure)</span>. Full analysis in DID-TM §23 (Post-Quantum Threat Model), including Harvest-Now Decrypt-Later attacks and migration dependency analysis. Normative mitigations: REQ-470, REQ-471.</p>
1264+
</section>
1265+
1266+
<!-- ── Privacy ── -->
1267+
<section id="privacy-considerations">
1268+
<h2>9. Privacy Considerations</h2>
1269+
1270+
<div class="callout note">
1271+
<div class="callout-label">Normative Reference</div>
1272+
<p>For complete privacy threat analysis, refer to <strong>DID-TM §6 (LINDDUN-DID Privacy Threat Mapping)</strong> and <strong>DID-TM §25 (Normative Privacy Requirements)</strong>, which provide structured mapping of linkability, identifiability, detectability, and other privacy threats with traceable controls.</p>
1273+
</div>
12411274

1242-
<h3>8.5 Key Wrapping Security</h3>
1243-
<p><strong>Threat:</strong> Weak encryption of seed lockboxes.</p>
1244-
<p><strong>Mitigation:</strong> All encrypted payloads MUST use AEAD with ≥ 256-bit keys. XChaCha20-Poly1305 or AES-256-GCM are REQUIRED. The algorithm MUST be explicitly named in the DID Document.</p>
1275+
<h3>9.1 Metadata Leakage</h3>
1276+
<p>Recovery methods may expose social graph (guardian identities), security posture (threshold values), and activity patterns. Mitigations include encrypted DID Document entries, guardian anonymity via onion services, and minimum-disclosure design.</p>
1277+
<p><strong>DID-TM Mapping:</strong> This threat falls under <span class="tc tc-i">I — Information Disclosure</span> and LINDDUN-DID's <strong>Linkability</strong> and <strong>Detectability</strong> categories. Refer to DID-TM-ATK-501 (Cross-DID Correlation via Resolver Logs) and PRI-301 (hashed guardian identifiers).</p>
12451278

1246-
<h3>8.6 Quantum Computing Resistance</h3>
1247-
<p>Current algorithms are secure against classical computers. Implementations SHOULD plan transition paths:</p>
1248-
<ul>
1249-
<li><strong>Type A:</strong> Consider lattice-based VSS for post-quantum security.</li>
1250-
<li><strong>Type B:</strong> Use hash-based signatures for seed commitment.</li>
1251-
<li><strong>Type C:</strong> Transition to threshold lattice signatures when standardized.</li>
1252-
</ul>
1253-
</section>
1279+
<h3>9.2 Guardian Privacy</h3>
1280+
<p>Instead of full DIDs, implementations SHOULD publish salted hashes:</p>
1281+
<pre><code class="language-json">"recoveryGuardians": [
1282+
{
1283+
"id": "urn:hash:sha256:3a7b...c9f2",
1284+
"salt": "0x4d8e...f2a3",
1285+
"guardianEndpoint": "http://guardian1.onion/recover",
1286+
"commitmentIndex": 0
1287+
}
1288+
]</code></pre>
1289+
<p><strong>DID-TM Mapping:</strong> This mitigation corresponds to DID-TM <strong>PRI-301</strong> (Recovery method representations MUST use hashed or pseudonymous guardian identifiers).</p>
12541290

1255-
<!-- ── Privacy ── -->
1256-
<section id="privacy-considerations">
1257-
<h2>9. Privacy Considerations</h2>
1258-
1259-
<h3>9.1 Metadata Leakage</h3>
1260-
<p>Recovery methods may expose social graph (guardian identities), security posture (threshold values), and activity patterns. Mitigations include encrypted DID Document entries, guardian anonymity via onion services, and minimum-disclosure design.</p>
1261-
1262-
<h3>9.2 Guardian Privacy</h3>
1263-
<p>Instead of full DIDs, implementations SHOULD publish salted hashes:</p>
1264-
<pre><code class="language-json">"recoveryGuardians": [
1265-
{
1266-
"id": "urn:hash:sha256:3a7b...c9f2",
1267-
"salt": "0x4d8e...f2a3",
1268-
"guardianEndpoint": "http://guardian1.onion/recover",
1269-
"commitmentIndex": 0
1270-
}
1271-
]</code></pre>
1291+
<h3>9.3 Correlation Risk</h3>
1292+
<p>The same recovery method across multiple DIDs could correlate them. DID controllers SHOULD use different guardian sets, salt values, and encryption keys per DID.</p>
1293+
<p><strong>DID-TM Mapping:</strong> This threat is addressed by DID-TM <strong>PRI-200</strong> (pairwise DIDs) and <strong>PRI-201</strong> (ZKP unlinkability). Refer to DID-TM §25.2 for complete unlinkability requirements.</p>
12721294

1273-
<h3>9.3 Correlation Risk</h3>
1274-
<p>The same recovery method across multiple DIDs could correlate them. DID controllers SHOULD use different guardian sets, salt values, and encryption keys per DID.</p>
1295+
<h3>9.4 Beneficiary Privacy</h3>
1296+
<p>Beneficiaries SHOULD use single-use derived keys specific to each inheritance relationship, not linked to their primary identity.</p>
1297+
<p><strong>DID-TM Mapping:</strong> This aligns with DID-TM <strong>PRI-102</strong> (data minimization) and <strong>PRI-302</strong> (single-use credentials for sensitive attributes).</p>
12751298

1276-
<h3>9.4 Beneficiary Privacy</h3>
1277-
<p>Beneficiaries SHOULD use single-use derived keys specific to each inheritance relationship, not linked to their primary identity.</p>
1278-
</section>
1299+
<div class="callout note">
1300+
<div class="callout-label">Complete Reference</div>
1301+
<p>For comprehensive coverage, including the full STRIDE-DID taxonomy, the novel K-Class (Key Lifecycle Failure), the complete attack catalog (50+ attacks with CVSS-DID scoring), and all normative security/privacy requirements with traceability matrices, see the <strong><a href="https://github.com/sirraya-labs/did-tm">DID Threat Model Specification (DID-TM)</a></strong>.</p>
1302+
</div>
1303+
</section>
12791304

12801305
<!-- ── Interoperability ── -->
12811306
<section id="interoperability">

0 commit comments

Comments
 (0)