papers/lux-nist-mptc-submission/spec/parameter-sets.tex

\documentclass[11pt,a4paper]{article}
\usepackage{../../shared/luxcover}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\usepackage{amsmath,amssymb,amsfonts}
\usepackage{graphicx}
\usepackage{hyperref}
\usepackage{booktabs}
\usepackage{enumitem}
\usepackage{xcolor}

\hypersetup{colorlinks=true,linkcolor=black,citecolor=blue,urlcolor=blue}

\title{Lux MPTC Parameter Sets}
\author{
Zach Kelling\\
\textit{Lux Industries, Inc.}\\
\texttt{[email protected]}
}
\date{2026-03-03}

\begin{document}

\luxcoverpage

\section*{Abstract}

\noindent We present Lux, a hybrid post-quantum consensus architecture for DAG-native chains. Lux separates fast operational finality from durable post-quantum finality. Validators emit Photons over a Nebula DAG substrate; classical BLS aggregates form Beams for low-latency confirmation, while ML-DSA attestations and Pulsar lattice-threshold Pulses provide post-quantum finality over Nebula roots. Prism binds all certificate lanes to the same transcript, and Quasar reaches Horizon finality when the bound lanes verify.

\textbf{This document.} Concrete parameter sets and security-bit estimates for Pulsar (Module-LWE), ML-DSA-65, BLS12-381, and Lens (curve threshold over Ed25519 / secp256k1 / Ristretto255). Parameters mirror the canonical \texttt{pulsar/sign/config.go}, FIPS 204 (ML-DSA), and standard curve-parameter sources; security-bit estimates are taken from the canonical proof bucket.

\section{Pulsar parameters}

\subsection{Ring and modulus}

\begin{tabular}{@{}p{0.32\textwidth}p{0.62\textwidth}@{}}
  \toprule
  \textbf{Parameter} & \textbf{Value} \\
  \midrule
  Ring & $R_q = \mathbb{Z}_q[X]/(X^{256}+1)$ (cyclotomic, degree 256) \\
  Modulus $q$ & \texttt{0x1000000004A01} (48-bit NTT-friendly prime) \\
  Polynomial degree $\varphi$ & 256 \\
  Matrix dimensions $(M, N_{\mathrm{vec}})$ & $(8, 7)$ \\
  $\bar{D}$ (round-1 expansion) & 48 \\
  Discrete-Gaussian std-dev $\sigma_E$ & per \texttt{pulsar/sign/config.go} \\
  $\sigma^*, \sigma_u$ & per \texttt{pulsar/sign/config.go} \\
  $L_2$ acceptance bound $B$ & per \texttt{pulsar/sign/config.go} \\
  Hash suite (default) & \texttt{Pulsar-SHA3} (FIPS 202 / SP 800-185 derived) \\
  Hash suite (alternative) & \texttt{Pulsar-BLAKE3} (non-normative) \\
  \bottomrule
\end{tabular}

The exact constants are derived deterministically by $\mathsf{Pulsar.Setup}(1^\lambda)$; see \texttt{pulsar/sign/config.go}. Bumping to a different ring degree or modulus would force KAT regeneration.

\subsection{Threshold parameters}

Pulsar supports any $(t, n)$ with $t \geq 2$ and $n \geq t$. Production deployments on Lux mainnet use $(t, n) = (15, 21)$ (i.e., $\lceil 2 \cdot 21 / 3 \rceil + 1 = 15$). Larger deployments are gated on grouped Pulsar (Section "Grouped Pulsar" of \cite{luxquasarhorizon}); recommended $(t_g, k)$ per group: $(15, 21)$ for $G \in \{1, 2, 4, 8\}$.

\subsection{Security bits}

\begin{tabular}{@{}p{0.40\textwidth}p{0.55\textwidth}@{}}
  \toprule
  \textbf{Threat model} & \textbf{Security bits} \\
  \midrule
  Classical adversary on Module-LWE / Module-SIS & $\geq 2^{142}$ \\
  Quantum adversary, BDGL sieving + Grover speedup & $\geq 2^{130}$ \\
  Hash collision (TupleHash256, SHA3-256 family) & $\geq 2^{128}$ \\
  \bottomrule
\end{tabular}

Source: \texttt{quasar-cert-soundness.tex} App.~E (Albrecht-estimator + BDGL2016 sieving + Laarhoven 2015 sieving angular LSH analysis).

\subsection{Wire size}

\begin{tabular}{@{}lr@{}}
  \toprule
  \textbf{Object} & \textbf{Size} \\
  \midrule
  GroupKey ($\mathbf{A}$, $\tilde{\mathbf{b}}$ bytes) & $\sim 16$ KB \\
  Single Pulsar share & $\sim 4.4$ KB \\
  Pulsar threshold signature ($\sigma$) & $\sim 33$ KB \\
  Activation certificate (Pulse + reshare transcript) & $\sim 33.3$ KB \\
  \bottomrule
\end{tabular}

\section{ML-DSA parameters}

ML-DSA-65 (FIPS 204 \cite{fips204}). Per-validator independent keypair. Three parameter sets are standardized:

\begin{tabular}{@{}lrrrr@{}}
  \toprule
  \textbf{Parameter set} & \textbf{Public-key (B)} & \textbf{Secret-key (B)} & \textbf{Signature (B)} & \textbf{Security bits} \\
  \midrule
  ML-DSA-44 & 1312 & 2528 & 2420 & $\geq 2^{128}$ classical, $\geq 2^{116}$ quantum \\
  \textbf{ML-DSA-65} & \textbf{1952} & \textbf{4032} & \textbf{3309} & \textbf{$\geq 2^{192}$ classical, $\geq 2^{180}$ quantum} \\
  ML-DSA-87 & 2592 & 4896 & 4595 & $\geq 2^{256}$ classical, $\geq 2^{244}$ quantum \\
  \bottomrule
\end{tabular}

Lux production uses ML-DSA-65 in the Quasar Horizon ML-DSA cert set lane and in Warp 2.0 envelopes. Context strings are bound per FIPS 204 (Section "Domain Separation Registry").

\section{BLS12-381 parameters}

BLS aggregate signature \cite{lp075}. Standard BLS12-381 curve parameters:

\begin{tabular}{@{}p{0.40\textwidth}p{0.55\textwidth}@{}}
  \toprule
  \textbf{Parameter} & \textbf{Value} \\
  \midrule
  Curve & BLS12-381 \\
  Public-key size & 48 B \\
  Aggregate signature size & 96 B \\
  Single-signer signature size & 96 B \\
  Hash-to-curve & \texttt{BLS\_SIG\_BLS12381G2\_XMD:SHA-256\_SSWU\_RO\_NUL\_} \\
  Classical security & $\geq 2^{120}$ (co-CDH) \\
  Quantum security & broken in polynomial time by Shor \\
  \bottomrule
\end{tabular}

The classical-only nature is the structural reason BLS provides no PQ contribution to a multi-lane cert (\texttt{proofs/pq-finality-no-bls.tex}).

\section{Lens parameters}

Lens (FROST 2-round Schnorr threshold) over three groups:

\begin{tabular}{@{}lrrrr@{}}
  \toprule
  \textbf{Group} & \textbf{Public-key (B)} & \textbf{Single-signer sig (B)} & \textbf{Aggregate sig (B)} & \textbf{Classical sec.} \\
  \midrule
  Ed25519        & 32 & 64 & 64 & $\geq 2^{128}$ \\
  secp256k1      & 33 (compressed) & 64 & 64 & $\geq 2^{128}$ \\
  Ristretto255   & 32 & 64 & 64 & $\geq 2^{128}$ \\
  \bottomrule
\end{tabular}

All three are quantum-broken in polynomial time by Shor; Lens is classical, used for control-plane operations and cross-rail compatibility, not for the PQ floor.

\section{Hash suite parameters}

\subsection{Pulsar-SHA3 (production default)}

Per FIPS 202 / NIST SP 800-185:

\begin{tabular}{@{}p{0.40\textwidth}p{0.55\textwidth}@{}}
  \toprule
  \textbf{Function} & \textbf{Construction} \\
  \midrule
  $H_c(\tau)$ (challenge hash, 32 B output) & cSHAKE256 with personalization \texttt{"PULSAR-HC-v1"} \\
  $H_u(\tau, n)$ (XOF, $n$ bytes) & cSHAKE256 with personalization \texttt{"PULSAR-HU-v1"} \\
  $H_T(\tau_1, \ldots, \tau_k)$ (transcript hash, 32 B) & TupleHash256 with personalization \texttt{"PULSAR-TRANSCRIPT-v1"} \\
  $\mathsf{PRF}(K, m, n)$ & KMAC256 with personalization \texttt{"PULSAR-PRF-v1"} \\
  $\mathsf{MAC}(K, m, n)$ & KMAC256 with personalization \texttt{"PULSAR-MAC-v1"} \\
  $\mathsf{Pairwise}(\kappa, \mathsf{ctx}, n)$ & KMAC256 with personalization \texttt{"PULSAR-PAIRWISE-v1"} \\
  \bottomrule
\end{tabular}

Definition \texttt{def:pulsar-sha3} of \texttt{proofs/definitions/transcript-binding.tex}. The suite identifier $\mathsf{HashSuiteID} = \text{``Pulsar-SHA3''}$ is bound into every transcript.

\subsection{Pulsar-BLAKE3 (alternative, non-normative)}

Same construction with BLAKE3 personalization. Faster on workloads where BLAKE3 outperforms SHA3 (typically by $\sim 10\times$ on commodity x86 with AVX-512). Production deployments MUST use Pulsar-SHA3.

\section{Threshold parameters for Lux mainnet}

\begin{tabular}{@{}p{0.40\textwidth}p{0.55\textwidth}@{}}
  \toprule
  \textbf{Parameter} & \textbf{Lux mainnet value} \\
  \midrule
  Validator count $n$ & 21 \\
  Threshold $t$ & 15 ($= \lceil 2n/3 \rceil + 1$) \\
  Group count $G$ & 1 (no grouping) \\
  Bundle interval & $\sim 3$ s \\
  Block interval & $\sim 500$ ms \\
  Bundles per epoch & $\sim 200$ \\
  Epochs per Reanchor (default) & $\sim 4$ epochs (governance-tunable) \\
  Snapshot retention window & 8 generations \\
  \bottomrule
\end{tabular}

These values are deployment configuration, not protocol-level constants. A different chain may run different values; the protocol is parametric in $n$, $t$, $G$, and bundle interval.

\section{Wire-size limits}

To prevent attacker-controlled length-prefix DoS (Section "Fuzz-Discovered Vulnerability" of \cite{luxwarpv2}):

\begin{tabular}{@{}lr@{}}
  \toprule
  \textbf{Limit} & \textbf{Value} \\
  \midrule
  $\mathsf{MaxPulseWireSize}$ & 64 KB \\
  $\mathsf{MaxPulseFrameSize}$ (per C / Z / $\Delta$ lane) & 32 KB \\
  $\mathsf{MaxLatticeUintSliceLen}$ (per inner-frame uint64 slice) & 4096 \\
  $\mathsf{MaxEnvelopeV2Size}$ & $4 \times \mathsf{MaxMessageSize}$ \\
  $\mathsf{MaxMessageSize}$ (Warp 1.x cap) & 256 KB \\
  \bottomrule
\end{tabular}

\section{Summary security table}

\begin{tabular}{@{}lll@{}}
  \toprule
  \textbf{Lane} & \textbf{Classical security} & \textbf{Quantum security} \\
  \midrule
  Beam (BLS12-381 aggregate) & $\geq 2^{120}$ & broken (Shor) \\
  ML-DSA-65 cert set (FIPS 204) & $\geq 2^{192}$ & $\geq 2^{180}$ \\
  Pulsar Pulse (Module-LWE/MSIS) & $\geq 2^{142}$ & $\geq 2^{130}$ \\
  Lens (Ed25519 / secp256k1 / Ristretto255) & $\geq 2^{128}$ & broken (Shor) \\
  Z-Chain Groth16 wrapper & $\geq 2^{120}$ (BLS12-381 pairing) & broken (Shor) --- classical only \\
  Hash suite (TupleHash256 / SHA3-256) & $\geq 2^{128}$ collision & $\geq 2^{85}$ Grover (square-root) \\
  \bottomrule
\end{tabular}

The PQ root of trust is the conjunction of the ML-DSA and Pulsar reductions. The other lanes are classical and contribute to the classical fast-path / accountability / compression surface.

\bibliographystyle{plain}
\bibliography{../references}

\end{document}