From 054129a22cdb520272dd7e2b46264baa79d58a15 Mon Sep 17 00:00:00 2001 From: Othryades Date: Tue, 25 Aug 2026 12:57:05 +0000 Subject: [PATCH 1/5] docs(stack): add cryptographic primitives section to security page Signed-off-by: Othryades --- docs/stack/evaluate/security.mdx | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/docs/stack/evaluate/security.mdx b/docs/stack/evaluate/security.mdx index 432dc59643..a945debe14 100644 --- a/docs/stack/evaluate/security.mdx +++ b/docs/stack/evaluate/security.mdx @@ -70,6 +70,22 @@ response, or control upgrade authority depending on the deployment. For upgrade mechanics, see the [OpenZeppelin Transparent Upgradeable Proxy pattern](../../protocol/architecture/smart-contracts.mdx#contract-versioning). +## Cryptographic primitives + +The Lineth stack relies on the following cryptographic primitives. Where a primitive +corresponds to a published standard, the table flags it. + +| Primitive | Where the stack uses it | Standard | +| --- | --- | --- | +| ECDSA over secp256k1 | Transaction signing and validator signing | Ethereum-standard curve. Not a NIST-approved curve. | +| ECDSA over secp256r1 (P-256) | Available to smart contracts through the `P256VERIFY` precompile ([RIP-7212](https://github.com/ethereum/RIPs/blob/master/RIPS/rip-7212.md)) | Curve approved under [FIPS 186-5](https://csrc.nist.gov/pubs/fips/186-5/final) | +| Keccak-256 | EVM hashing, state commitments, and role identifiers | Based on the Keccak permutation standardized in [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) (SHA-3 family). Ethereum uses the pre-standardization Keccak-256 padding, not the FIPS 202 SHA3-256 output. | +| TLS | Service-to-service and RPC endpoints | Standard TLS. Configuration is per deployment. | +| Key custody | Remote signing through [Web3Signer](../../protocol/architecture/index.mdx#web3signer), with optional AWS KMS-backed secp256k1 signing | AWS KMS uses FIPS 140-2 and FIPS 140-3 validated HSMs (validations held by AWS). Key custody is a deployment choice. | + +All signing and hashing go through established libraries (Besu, web3j, Tuweni, +BouncyCastle) or AWS KMS. The stack does not implement custom cryptographic primitives. + ## Available evidence The following public materials are the available assurance evidence for the Lineth stack: From bdd70b8a373232acd881ee10ae03ef97f3f582bf Mon Sep 17 00:00:00 2001 From: Othryades Date: Tue, 25 Aug 2026 13:08:50 +0000 Subject: [PATCH 2/5] docs(stack): drop NIST-approval note from secp256k1 row Signed-off-by: Othryades --- docs/stack/evaluate/security.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/stack/evaluate/security.mdx b/docs/stack/evaluate/security.mdx index a945debe14..05e84673a7 100644 --- a/docs/stack/evaluate/security.mdx +++ b/docs/stack/evaluate/security.mdx @@ -77,7 +77,7 @@ corresponds to a published standard, the table flags it. | Primitive | Where the stack uses it | Standard | | --- | --- | --- | -| ECDSA over secp256k1 | Transaction signing and validator signing | Ethereum-standard curve. Not a NIST-approved curve. | +| ECDSA over secp256k1 | Transaction signing and validator signing | Ethereum-standard curve. | | ECDSA over secp256r1 (P-256) | Available to smart contracts through the `P256VERIFY` precompile ([RIP-7212](https://github.com/ethereum/RIPs/blob/master/RIPS/rip-7212.md)) | Curve approved under [FIPS 186-5](https://csrc.nist.gov/pubs/fips/186-5/final) | | Keccak-256 | EVM hashing, state commitments, and role identifiers | Based on the Keccak permutation standardized in [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) (SHA-3 family). Ethereum uses the pre-standardization Keccak-256 padding, not the FIPS 202 SHA3-256 output. | | TLS | Service-to-service and RPC endpoints | Standard TLS. Configuration is per deployment. | From eeb57023a819021fb3dea7e70d453c8fa40fb905 Mon Sep 17 00:00:00 2001 From: Othryades <17912603+Othryades@users.noreply.github.com> Date: Tue, 25 Aug 2026 19:25:55 +0300 Subject: [PATCH 3/5] Update docs/stack/evaluate/security.mdx Co-authored-by: Alexandra Carrillo <12214231+alexandratran@users.noreply.github.com> --- docs/stack/evaluate/security.mdx | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/docs/stack/evaluate/security.mdx b/docs/stack/evaluate/security.mdx index 05e84673a7..d0af1dcb77 100644 --- a/docs/stack/evaluate/security.mdx +++ b/docs/stack/evaluate/security.mdx @@ -72,8 +72,7 @@ mechanics, see the ## Cryptographic primitives -The Lineth stack relies on the following cryptographic primitives. Where a primitive -corresponds to a published standard, the table flags it. +The following table outlines the cryptographic primitives Lineth relies on, where they are used in the stack, and what standards they correspond to. | Primitive | Where the stack uses it | Standard | | --- | --- | --- | From ba9d30e5cc598b112d75cfea074e549caf89ed17 Mon Sep 17 00:00:00 2001 From: Othryades Date: Tue, 25 Aug 2026 19:58:53 +0000 Subject: [PATCH 4/5] docs(stack): fix library list serial comma Signed-off-by: Othryades --- docs/stack/evaluate/security.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/stack/evaluate/security.mdx b/docs/stack/evaluate/security.mdx index d0af1dcb77..c2fb205a14 100644 --- a/docs/stack/evaluate/security.mdx +++ b/docs/stack/evaluate/security.mdx @@ -82,7 +82,7 @@ The following table outlines the cryptographic primitives Lineth relies on, wher | TLS | Service-to-service and RPC endpoints | Standard TLS. Configuration is per deployment. | | Key custody | Remote signing through [Web3Signer](../../protocol/architecture/index.mdx#web3signer), with optional AWS KMS-backed secp256k1 signing | AWS KMS uses FIPS 140-2 and FIPS 140-3 validated HSMs (validations held by AWS). Key custody is a deployment choice. | -All signing and hashing go through established libraries (Besu, web3j, Tuweni, +All signing and hashing go through established libraries (Besu, web3j, Tuweni, and BouncyCastle) or AWS KMS. The stack does not implement custom cryptographic primitives. ## Available evidence From 286959cafc1adf859f6d9e874e68d0b7222a4325 Mon Sep 17 00:00:00 2001 From: Othryades Date: Tue, 25 Aug 2026 21:59:36 +0000 Subject: [PATCH 5/5] docs(stack): drop overbroad no-custom-crypto claim per crypto review Signed-off-by: Othryades --- docs/stack/evaluate/security.mdx | 3 --- 1 file changed, 3 deletions(-) diff --git a/docs/stack/evaluate/security.mdx b/docs/stack/evaluate/security.mdx index c2fb205a14..447c9f0191 100644 --- a/docs/stack/evaluate/security.mdx +++ b/docs/stack/evaluate/security.mdx @@ -82,9 +82,6 @@ The following table outlines the cryptographic primitives Lineth relies on, wher | TLS | Service-to-service and RPC endpoints | Standard TLS. Configuration is per deployment. | | Key custody | Remote signing through [Web3Signer](../../protocol/architecture/index.mdx#web3signer), with optional AWS KMS-backed secp256k1 signing | AWS KMS uses FIPS 140-2 and FIPS 140-3 validated HSMs (validations held by AWS). Key custody is a deployment choice. | -All signing and hashing go through established libraries (Besu, web3j, Tuweni, and -BouncyCastle) or AWS KMS. The stack does not implement custom cryptographic primitives. - ## Available evidence The following public materials are the available assurance evidence for the Lineth stack: