papers/lux-universal-threshold-signatures/sections/05-post-quantum-security.tex

\section{Post-Quantum Security}


\subsection{Pulsar Lattice-Based Signatures}

Pulsar provides quantum-resistant threshold signatures using Module-LWE hardness assumptions.

\paragraph{Security Levels}
\begin{itemize}
\item \textbf{Level 1}: 128-bit quantum security (NIST Category 1)
\item \textbf{Level 3}: 192-bit quantum security (NIST Category 3)
\item \textbf{Level 5}: 256-bit quantum security (NIST Category 5)
\end{itemize}

\paragraph{Key Generation} Distributed sampling of lattice shares:
\begin{algorithmic}[1]
\State Sample $\mathbf{A} \xleftarrow{R} R_q^{k \times l}$ (public randomness)
\State Each party $i$ samples $\mathbf{s}_i \leftarrow \chi_\eta$ (secret share)
\State Compute $\mathbf{t}_i = \mathbf{A} \mathbf{s}_i + \mathbf{e}_i$ where $\mathbf{e}_i \leftarrow \chi_\eta$
\State Public key: $\mathbf{t} = \sum_i \mathbf{t}_i$
\end{algorithmic}

\paragraph{Signing} Fiat-Shamir with aborts:
\begin{algorithmic}[1]
\State Each party samples $\mathbf{y}_i \leftarrow \chi_\gamma$
\State Compute commitment $\mathbf{w}_i = \mathbf{A} \mathbf{y}_i$
\State Aggregate: $\mathbf{w} = \sum_i \mathbf{w}_i$
\State Challenge: $c = H(\mathbf{w}, m) \in \mathcal{C}$
\State Response: $\mathbf{z}_i = \mathbf{y}_i + c \mathbf{s}_i$
\If{$||\mathbf{z}_i|| > B$} \textbf{abort} and restart
\EndIf
\State Aggregate: $\mathbf{z} = \sum_i \mathbf{z}_i$
\State Signature: $(\mathbf{w}, \mathbf{z})$
\end{algorithmic}

\paragraph{Share Refresh} Proactive security via share randomization:
\begin{algorithmic}[1]
\State Each party samples $\Delta \mathbf{s}_i \leftarrow \chi_\eta$
\State Update share: $\mathbf{s}_i' = \mathbf{s}_i + \Delta \mathbf{s}_i$
\State Broadcast $\Delta \mathbf{t}_i = \mathbf{A} \Delta \mathbf{s}_i + \mathbf{e}_i$
\State Verify $\sum_i \Delta \mathbf{t}_i = \mathbf{0}$ (public key unchanged)

\end{algorithmic}

\paragraph{Chain Integration} Pulsar signatures can be verified on-chain via:
\begin{itemize}
\item Smart contract verification (Ethereum, Cardano)
\item Native verification opcodes (future Bitcoin soft fork)
\item Off-chain verification with on-chain anchoring
\end{itemize}

\subsection{Performance Comparison}

\begin{table}[h]
\centering
\small
\begin{tabular}{@{}lccc@{}}
\toprule
\textbf{Scheme} & \textbf{Keygen} & \textbf{Sign} & \textbf{Verify} \\
\midrule
ECDSA (CMP) & 12ms & 15ms & 2ms \\
EdDSA (FROST) & 10ms & 8ms & 2ms \\
Schnorr (FROST) & 10ms & 8ms & 2ms \\
Corona-128 & 45ms & 120ms & 35ms \\
Corona-192 & 68ms & 180ms & 52ms \\
Corona-256 & 95ms & 240ms & 70ms \\
\bottomrule
\end{tabular}

\label{tab:pq_performance}
\end{table}