papers/lp-020-quasar-consensus/lp-020-quasar-consensus.tex

\documentclass[11pt,a4paper]{article}
\usepackage{../shared/luxcover}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\usepackage{amsmath,amssymb,amsfonts,amsthm}
\usepackage{graphicx}
\usepackage{hyperref}
\usepackage{booktabs}
\usepackage{algorithm}
\usepackage{algpseudocode}
\usepackage{enumitem}
\usepackage{xcolor}

\hypersetup{colorlinks=true,linkcolor=black,citecolor=blue,urlcolor=blue}

\newtheorem{theorem}{Theorem}[section]
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{corollary}[theorem]{Corollary}
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{definition}{Definition}[section]
\newtheorem{remark}{Remark}[section]

\title{LP-020: Quasar 3.0 Consensus\\[4pt]
\large Three-Lane Post-Quantum Certificates\\
over the P/Q/Z/A/B/M/F Chain Pipeline}

\author{
Lux Research\thanks{Corresponding author: [email protected]}\\
\textit{Lux Industries, Inc.}\\
\texttt{[email protected]}
}

\date{Spec freeze: 15 December 2025\quad|\quad
Final review: 20 December 2025\quad|\quad
Activation: 25 December 2025}

\begin{document}

\luxcoverpage

\begin{abstract}
\noindent Lux is not merely adding post-quantum signatures to a chain; it defines a hybrid finality architecture for DAG-native consensus, with protocol-agnostic threshold lifecycle, post-quantum threshold sealing, and cross-chain propagation of Horizon finality.

We present Quasar 3.0, the post-quantum Byzantine fault tolerant consensus
protocol activated on the Lux primary network on 25 December 2025. Quasar 3.0
finalizes a block by producing a single \emph{QuasarCert} that aggregates
three independent verification \emph{lanes}: a BLS12-381 aggregate signature
(classical fast path, discrete logarithm), a Corona two-round Module-LWE
threshold signature (Q-Chain ceremony root), and a Z-Chain Groth16 proof that
rolls up $N$ ML-DSA-65 validator signatures into a single 192-byte SNARK plus
a 32-byte public-inputs hash. The third lane is \emph{not} a raw per-validator
ML-DSA list; it is a Z-Chain proof artifact, allowing the per-block on-chain
cost of post-quantum identity binding to drop from $N \times 3{,}309$ bytes
to $192 + 32$ bytes regardless of validator count. Every QuasarCert is bound
to a \emph{certificate subject} that hashes the chain id, epoch, round, mode,
and the seven chain-specific roots
($P_\text{val} \mathbin\| Q_\text{cer} \mathbin\| Z_\text{vk} \mathbin\|
A_\text{att} \mathbin\| B_\text{br} \mathbin\| M_\text{mpc} \mathbin\|
F_\text{fhe}$) together with the parent block hash, parent state root,
parent execution root, gas limit, and base fee, making cross-epoch and
cross-chain replay structurally impossible. The three lanes are verified
independently by the QuasarGPU substrate (LP-132): BLS aggregate verify
(${\sim}875\,\mu$s for $n{=}100$ on CPU), Corona batch verify ($O(1)$
amortized after DKG), and a single Groth16 pairing check (200--500\,$\mu$s
GPU batched). On a 21-validator mainnet board, full three-lane GPU
verification runs in 0.5--1.5\,ms; the network targets a 500\,ms block time
and sustained $\geq$100K TPS per chain. An adversary must simultaneously
break the discrete logarithm on BLS12-381, Module-LWE for Corona, and
Module-LWE/MSIS for ML-DSA to forge a QuasarCert; breaking any one or any
two leaves the remaining lane intact.

\textbf{Released refinement (\texttt{consensus v1.26.0}).} The
implementation refines this three-lane certificate into a typed
\emph{compact-certificate} envelope (\S\ref{sec:compact-cert}) over four
evidence kinds --- Beam-BLS, a Pulsar threshold ML-DSA seal (byte-equal to
FIPS-204), a Corona Module-LWE (Ringtail/Raccoon) threshold seal, and a P3Q
ML-DSA rollup. The
Pulsar threshold leg compresses the entire quorum to a \emph{single}
FIPS-204 signature, so the per-validator ML-DSA rollup of \S\ref{sec:lane3}
is retained only as a \emph{fallback} kind; the strict posture is the
dual-lattice AND $\mathrm{Beam} \wedge \mathrm{Pulsar} \wedge \mathrm{Corona}$,
with one group-key-per-era (\texttt{KeyEra}) shared across the threshold
lanes. The envelope is $O(1)$ in validator count --- a measured $957\times$
reduction at $N{=}1000$.
\end{abstract}

\tableofcontents
\newpage

%% ============================================================================

\input{sections/01-introduction}
\input{sections/02-system-model}
\input{sections/03-protocol}
\input{sections/04-cryptographic-layers}
\input{sections/05-chain-separation-for-threshold-cryptogra}
\input{sections/06-quasarcert-formal-definition}
\input{sections/06b-compact-cert-evidence-layer}  % Released compact-cert envelope: 4 evidence kinds, KeyEra, policy table (consensus v1.26.0)
\input{sections/07-security-analysis}
\input{sections/08-performance}
\input{sections/09-implementation}
\input{sections/10-formal-verification}
\input{sections/11-related-work}
\input{sections/13-why-not-threshold-ml-dsa-or-threshold-fa}
\input{sections/14-activation-roadmap}
\input{sections/15-future-work}
\input{sections/99-conclusion}

\appendix
\section*{Reproducibility}
\textbf{Source code.} \texttt{github.com/luxfi/consensus} (tag \texttt{v1.29.1}); compact-cert evidence layer at \texttt{protocol/quasar/}; Pulsar (dealerless threshold ML-DSA) at \texttt{github.com/luxfi/pulsar} \texttt{v1.7.1}; Corona at \texttt{github.com/luxfi/corona} \texttt{v0.10.x}; shared Module-LWE base at \texttt{github.com/luxfi/mlwe}; wire protocol at \texttt{github.com/luxfi/zap}.\\
\textbf{Build.} \texttt{GOWORK=off go build ./protocol/quasar/...} and \texttt{CGO\_ENABLED=0 GOWORK=off go test ./protocol/quasar/...} at \texttt{v1.29.1}. The compact-cert proofs are \texttt{TestCompact\_*} (incl.\ \texttt{TestCompact\_O1NotON\_For1000Validators} and \texttt{TestCompact\_StrictQuasar\_AllThreeLegsVerify}).\\
\textbf{Hardware tested.} TBD (commodity x86\_64 Linux validators).\\
\textbf{Standards referenced.} FIPS 204 (ML-DSA-65), FIPS 206 (draft, threshold context), BLS12-381 (IETF draft), NIST IR 8214C (MPTC).\\
\textbf{Contact.} [email protected].

\end{document}