Guardian loss walkthrough

Rules 1 and 2 stop a thief from using stolen guardian vouches. This file checks the other side: can an honest owner still unfreeze when guardians go missing?

Setup: a key names 3 outside guardians when it is created, and the quorum is 2. Both co-signers have revoked each other, so the key is frozen.

1. One guardian lost, two reachable: the two reachable guardians vouch for the owner's new key, which meets the quorum. The public delay runs for N positions. Nobody disowns a vouch and no co-signer vetoes, so the unfreeze goes through.
2. Two guardians lost: only one vouch is possible, which is below the quorum. The key stays frozen, the same way it does when all co-signers are lost. Rule 1 gives no fallback here.
3. A lost guardian's key is later stolen: the thief can issue a vouch in that guardian's name. The real guardian is not around to disown it, so rule 2's disown check does not protect this slot. The thief still needs a second vouch to reach the quorum, and any original co-signer can veto during the delay.
4. A co-signer vetoes out of spite: under rule 1, any single original co-signer can veto, so a co-signer who revoked the other can block every honest unfreeze. That leaves the key frozen for good.

Open gaps:

• The guardian list is fixed when the key is created, so the guardian set only gets weaker as guardians are lost. There is no way to replace a lost guardian.
• A lost guardian is a weak slot: a vouch issued in their name can't be disowned, because nobody is there to do it.
• The veto lets one co-signer hold the key frozen indefinitely.

A next rule could let the reachable guardians replace a lost one, using the same quorum and public delay as an unfreeze. It could also make a veto expire unless the co-signer who issued it renews it during a later delay.

Mutual-revocation timeline: one key through rules 1 and 2

This walks one key, position by position, from mutual revocation to a working replacement key. It checks whether rules 1 and 2 work together when the owner is honest and a thief is also active.

Setup

• Key K has co-signers A and B, and outside guardians G1, G2 and G3, named when K was created. The quorum is 2 of 3. The public delay is N = 5.
• The thief holds K and B's signing key. A is honest.

Timeline

What this shows

1. Rule 2 stops the stolen vouch. The thief's G1 vouch names K', and it can never be combined with G2 and G3's vouches for K''. A stolen vouch cannot be counted toward a different replacement key.
2. Rule 1 lets the thief stall. B is an "original co-signer", so the thief's veto at position 4 is valid. Each new honest attempt can be vetoed again. This is the same spite-veto gap that guardian-loss-walkthrough.md found, but here the thief is the one using it.
3. Order matters. If G1 had not disowned the vouch and G2 had vouched for K' instead, the thief would have had a quorum for K'. A could then use the same veto to stop it. The two vetoes cancel each other out, so the key stays frozen.

Open question for the next rule

Whenever a co-signer is stolen, the veto is symmetric: either side can block the other indefinitely. Two possible fixes:

• Veto costs a guardian's vouch. A veto only counts if at least one named guardian co-signs it. The thief then has to steal a second guardian key, not just B, to stall.
• Veto names its alternative. A veto must name a competing replacement key that already has at least one guardian vouch. If no such key exists, the veto lapses at the end of the delay.

Both make the veto cost the thief something it does not already hold.

Stolen vouch walkthrough (cycle 58)

Direction: who outside a key's co-signers can unfreeze a mutually-revoked key, and can their vouch be required without a stolen vouch unfreezing a stolen key?

Setup

• Key K has co-signers A, B, C. Outside guardians G1, G2, G3 were named when K was created (rule 1). Quorum is 2 of 3.
• A thief steals K and co-signer A. A and B revoke each other, so K freezes.

Attack 1: thief steals one guardian's vouch (G1)

1. The thief wants K unfrozen onto replacement key T (the thief's own key).
2. Under rule 2, a vouch names its replacement key. G1's stolen signing material can produce a vouch for T, but the thief still needs a second guardian.
3. Without G2 or G3, there is no quorum. Blocked by quorum (rule 1).

Attack 2: thief steals two guardian vouches (G1, G2)

1. Quorum is met for T, and rule 1's public delay of N positions starts.
2. The unfreeze request is public, so G1 or G2 sees a vouch issued in their name for a key they never approved.
3. Either one disowns it during the delay. Cancelled by rule 2.
4. Backup: any original co-signer (B or C) can also veto during the delay (rule 1).

Attack 3: thief replays an honest vouch

1. The honest owner gets G1 and G2 to vouch for replacement key R.
2. The thief copies those vouches and tries to point them at T.
3. The vouches name R, not T. Useless for T (rule 2).

Remaining gap

If the thief controls a guardian quorum and every guardian whose vouch was stolen stays silent for N positions and no original co-signer vetoes, the unfreeze goes through. The rules turn a silent theft into one that has to stay unnoticed for the whole delay by several separate people. They do not make the theft impossible. N is the knob: a longer delay is safer, but the honest owner waits longer.