papers/lp-020-quasar-consensus/sections/02-system-model.tex

\section{System Model}

\label{sec:model}
%% ============================================================================

\begin{definition}[Network]
A set $\mathcal{V}$ of $n$ validators, of which at most $f < n/3$ are
Byzantine. Communication is point-to-point authenticated. The network is
partially synchronous: there exists an unknown Global Stabilization Time
(GST) after which all messages between correct validators are delivered
within a known bound $\Delta$.
\end{definition}

\begin{definition}[Cryptographic Configuration]
\label{def:keys}
Each validator $v_i \in \mathcal{V}$ holds:
\begin{itemize}[leftmargin=2em]
\item A BLS12-381 secret key $\mathit{sk}_i^{\mathrm{BLS}}$ with public
      key $\mathit{pk}_i^{\mathrm{BLS}} \in \mathbb{G}_2$ and a
      proof-of-possession (PoP) registered on P-Chain.
\item A share $\mathit{sk}_i^{\mathrm{RT}}$ of the Corona threshold key
      with combined public key $\mathit{pk}^{\mathrm{RT}}$ rooted on
      Q-Chain (threshold $t = \lfloor 2n/3 \rfloor + 1$).
\item An ML-DSA-65 secret key $\mathit{sk}_i^{\mathrm{ML}}$ with public
      key $\mathit{pk}_i^{\mathrm{ML}}$ registered on P-Chain.
\end{itemize}
\end{definition}

\begin{definition}[Chain Roots]
\label{def:roots}
At each consensus round, the canonical seven chain roots are observable
by every validator:
\[
\boldsymbol{\rho} \;\stackrel{\text{def}}{=}\;
\bigl(P_\text{val},\, Q_\text{cer},\, Z_\text{vk},\, A_\text{att},\,
B_\text{br},\, M_\text{mpc},\, F_\text{fhe}\bigr)
\]
where:
\begin{itemize}[leftmargin=2em,nosep]
\item $P_\text{val} = \mathsf{pchain\_validator\_root}$ binds the active
      validator set, stake, and PoP table.
\item $Q_\text{cer} = \mathsf{qchain\_ceremony\_root}$ binds the latest
      Corona DKG transcript and combined public key.
\item $Z_\text{vk} = \mathsf{zchain\_vk\_root}$ binds the Groth16
      verifying-key registry for the ML-DSA verification circuit and the
      Z-Chain rollup state.
\item $A_\text{att} = \mathsf{achain\_attestation\_root}$ binds unified
      attestations (genesis records, oracle commits, off-chain proofs).
\item $B_\text{br} = \mathsf{bchain\_bridge\_root}$ binds the bridge
      message log.
\item $M_\text{mpc} = \mathsf{mchain\_mpc\_root}$ binds the MPC ceremony
      log (CGGMP21, FROST, Corona-general).
\item $F_\text{fhe} = \mathsf{fchain\_fhe\_root}$ binds the FHE compute
      log (TFHE, encrypted EVM).
\end{itemize}
\end{definition}

\begin{definition}[Certificate Subject]
\label{def:subject}
For chain id $c$, epoch $e$, round $r$, mode $\mu$, parent block hash
$h_{\text{parent}}$, parent state root $s$, parent execution root $x$,
gas limit $g$, and base fee $b$:
\[
\mathsf{cert\_subject} \;=\; \mathsf{keccak}_{256}\!\bigl(
c \,\|\, e \,\|\, r \,\|\, \mu \,\|\,
P_\text{val} \,\|\, Q_\text{cer} \,\|\, Z_\text{vk} \,\|\,
A_\text{att} \,\|\, B_\text{br} \,\|\, M_\text{mpc} \,\|\,
F_\text{fhe} \,\|\, h_{\text{parent}} \,\|\, s \,\|\, x \,\|\,
g \,\|\, b \bigr).
\]
The Quasar 3.0 protocol requires \emph{all three lanes to sign exactly this
32-byte digest} for a given block.
\end{definition}

\begin{definition}[Consensus Modes]
\label{def:modes}
Quasar 3.0 supports four operational modes selectable at network genesis or
per-chain:
\begin{enumerate}[leftmargin=2em]
\item \textbf{BLS-only} ($\mu = 0$): classical aggregate signatures only;
      used for non-financial chains where post-quantum guarantees are not
      required.
\item \textbf{BLS + Corona} ($\mu = 1$): dual lane; Q-Chain ceremony
      provides post-quantum threshold finality without ML-DSA identity
      binding.
\item \textbf{BLS + MLDSAGroth16} ($\mu = 2$): dual lane; Z-Chain rollup
      provides post-quantum identity binding without a separate Corona
      ceremony.
\item \textbf{Quantum} ($\mu = 3$): all three lanes (BLS + Corona +
      MLDSAGroth16). \emph{This is the mode activated on the Lux primary
      network on 25 December 2025 and analyzed in this paper.}
\end{enumerate}
\end{definition}

The mode byte $\mu$ enters \texttt{cert\_subject}, so a Mode-3 certificate
cannot be replayed as a Mode-1 certificate even if the lower-mode quorum
is also satisfied.

The reference implementation entry point is
\texttt{TripleSignRound1} in
\texttt{consensus/protocol/quasar/quasar.go}, which dispatches BLS,
Corona, and ML-DSA signing concurrently via goroutines under the
QuasarGPU adapter (LP-132~\cite{lp132-quasargpu}). At the wire-policy
layer (\texttt{consensus/pkg/wire/policies.go}) the currently
implemented post-quantum policy is \texttt{PolicyQuantum}
(BLS\,+\,Corona, with Corona toggleable via
\texttt{NewQuantumPolicyWithOptions}); modes 0 (\textsc{BLS-only}) and
2 (\textsc{BLS+MLDSAGroth16}) above are specified by this LP for
future activation but are not selected by a distinct wire policy in
the current code.


%% ============================================================================