xTrade: Trade Finance Document Protection

Executive Summary

xTrade splits trade finance documents via XorIDA and routes shares through independent bank channels via xLink. No intermediary sees complete documents. Threshold authorization gates document release at each lifecycle stage. Cryptographic settlement proofs anchor every transition.

A letter of credit processed through xTrade travels through 5-7 intermediary banks — each receives one share, enough to verify their role in the transaction but not enough to reconstruct the full document. When the document moves from issuance to advising to negotiation, each bank must contribute its share to satisfy the threshold requirement before the next stage unlocks.

xFormat provides the universal binary envelope. Every bank can validate shares without seeing plaintext. HMAC-SHA256 integrity tags detect tampering during multi-bank transit. Settlement proofs provide cryptographic anchoring at lifecycle gates — when a letter of credit progresses from advising to negotiation, the advising bank generates a proof that anchors the document state. This creates a tamper-evident chain that proves the document's journey through the trade finance workflow.

Production-grade implementation: 506 lines of code for split/reconstruct operations, 120+ tests across 3 test files, per-share HMAC-SHA256 integrity verification. Meets SEC 17a-4 compliance requirements with 15-year retention and non-repudiation guarantees.

The Problem

Trade finance documents transit through multiple banks and intermediaries, each of which sees the complete document. A single letter of credit may pass through 5-7 intermediary banks, each holding a complete copy.

$8.8 trillion in global trade flows through these documents annually. Digitization efforts have reduced paper but replicated the same centralized exposure in digital form. Each intermediary's database is a breach target containing high-value trade documents. Trade-based money laundering exploits this opacity.

Existing solutions focus on encryption at rest or encrypted channels — but every intermediary still decrypts and processes complete documents. The fundamental architecture requires complete document visibility at every hop.

The Old Way

Real-World Use Cases

Solution Architecture

xTrade combines xFormat (binary envelope), XorIDA split-channel, xLink DID identity, and threshold authorization for end-to-end trade finance document protection.

The New Way

Processing Flow

xFormat: Universal Binary Envelope

xFormat is the universal binary envelope for XorIDA shares. Every intermediary bank can validate shares without seeing plaintext. Ensures interoperability across banks and counterparties.

Trade finance documents are serialized in xFormat before XorIDA splitting. Each share includes a version header, share index, threshold parameters, and HMAC-SHA256 integrity tag. Banks validate shares using the HMAC tag — tampering during transit is immediately detected.

IDA5 magic bytes (0x49444135) prefix every xFormat envelope. This enables banks to identify XorIDA-protected documents without prior coordination. The envelope includes metadata fields for document type, lifecycle stage, and threshold configuration — all visible to intermediaries without decrypting the share.

// IDA5 magic (4 bytes) + version (1 byte)
0x49444135 + 0x01

// Threshold params: K-of-N
K: 2, N: 3

// Share index (1-based)
shareIndex: 1

// HMAC-SHA256 integrity tag (32 bytes)
hmac: <32-byte tag>

// Encrypted share payload
data: <encrypted bytes>

Lifecycle Gates & Threshold Authorization

Trade finance documents move through distinct lifecycle stages: issuance, advising, negotiation, acceptance, payment. Each stage is gated by threshold authorization — K banks must contribute shares before the document progresses.

When a letter of credit moves from advising to negotiation, the advising bank, confirming bank, and beneficiary must all contribute their shares. The threshold requirement (e.g., 2-of-3) ensures no single party can unilaterally advance the document. This creates cryptographic multi-party authorization at every lifecycle transition.

Settlement Proofs & Cryptographic Anchoring

Settlement proofs provide cryptographic anchoring at each lifecycle stage. When a letter of credit moves from issuance to advising to negotiation, each bank generates a proof that anchors the document state. This creates a tamper-evident chain that proves the document's journey through the trade finance workflow.

Each settlement proof includes: previous lifecycle stage hash, current lifecycle stage, threshold configuration, contributing party DIDs, and timestamp. The proof is signed by all K contributing parties using Ed25519 signatures. This creates a non-repudiable record of document progression.

Settlement proofs meet SEC 17a-4 compliance requirements: 15-year retention, WORM storage (write-once-read-many), and cryptographic non-repudiation. Regulators can verify document lineage without accessing plaintext trade data.

interface SettlementProof {
  prevStageHash: Uint8Array;    // Previous lifecycle stage
  currentStage: 'issuance' | 'advising' | 'negotiation' | ...;
  threshold: { k: number; n: number };
  contributingParties: DID[];  // All K parties
  timestamp: number;
  signatures: Uint8Array[];    // Ed25519 sigs from all K
}

Implementation Details

xTrade is built on a production-grade TypeScript implementation with comprehensive test coverage and cryptographic integrity guarantees.

Core Statistics

The implementation includes split/reconstruct operations for trade finance documents with per-share HMAC-SHA256 integrity verification. Every share is cryptographically anchored to prevent tampering during multi-bank transit.

Security Features

Integration Patterns

import { TradeDoc } from '@private.me/tradesplit';

// Create LC document with threshold config
const doc = await TradeDoc.create({
  type: 'letter-of-credit',
  parties: [issuingBank, advisingBank, beneficiary],
  threshold: { k: 2, n: 3 }
});

// Issue LC with document data
await doc.issue(lcData);

// Advance to next lifecycle stage (requires K shares)
await doc.advise([share1, share2]);

// Generate settlement proof at lifecycle gate
const proof = await doc.generateSettlementProof();

Security Properties

Compliance & Regulatory

xTrade meets SEC 17a-4, FINRA Rule 4511, and SOX internal control requirements for trade finance document retention and non-repudiation.

SEC 17a-4 Compliance

Settlement proofs provide 15-year retention with WORM storage (write-once-read-many). Each proof includes cryptographic signatures from all K contributing parties — meeting non-repudiation requirements. Regulators can verify document lineage without accessing plaintext trade data.

FINRA Rule 4511

xTrade generates tamper-evident audit trails for all trade finance transactions. Settlement proofs anchor each lifecycle transition — creating a cryptographic chain that proves document progression through advising, negotiation, acceptance, and payment stages.

SOX Internal Controls

Threshold authorization gates enforce separation of duties. No single bank can unilaterally advance a document through lifecycle stages. K parties must contribute shares before progression — mapping to SOX Section 404 internal control requirements.

Performance Benchmarks

xTrade processes trade finance documents in sub-millisecond times for typical payloads. Letter of credit documents (10-50KB) split in under 5ms.

Settlement proof generation adds ~2ms per lifecycle transition. Ed25519 signature verification runs at ~0.5ms per party. Total overhead for a 3-party LC with 2-of-3 threshold: <10ms end-to-end.

Honest Limitations

xTrade protects documents in transit and at rest across banks. It does not protect against insider threats within a single bank, nor does it prevent colluding banks from reconstructing documents.

What xTrade Does NOT Solve

• Insider threats: A rogue employee at a bank with share access can still leak that share. xTrade splits documents across banks but cannot prevent leakage within a bank.
• Collusion attacks: If K banks collude, they can reconstruct the complete document. Choose threshold K carefully based on trust assumptions.
• Metadata leakage: Document type, lifecycle stage, and threshold configuration are visible in xFormat envelopes. xTrade does not hide metadata.
• Network timing attacks: An observer who monitors all bank communication channels may infer document structure from message timing patterns.

Full API Surface

Codebase Statistics

Verifiable Data Protection

Every operation in this ACI produces a verifiable audit trail via xProve. HMAC-chained integrity proofs let auditors confirm that data was split, stored, and reconstructed correctly — without accessing the data itself.

Ready to deploy xTrade?

Talk to Sol, our AI sales engineer, or book a live demo with our team.