mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zooqueen
5225fa3df0
lp-073-pulsar (the dedicated Pulsar paper): - Add §3.8 "Byte-equal threshold ML-DSA (BCC/CEF)": boundary clearance (offline, message-independent), NonceCert (W1+ClearanceQC only, never full w), Ringtail-style 2-round online signing, public hint recovery (FindHint over w'=A·z−c·t1·2^d), Thm 3.1 BCC/CEF byte-equality, mode restriction (65/87 only), the V13 finding, honest status. - Abstract: reframe from "Corona-family" to the shared two-round Module-LWE kernel + Pulsar's byte-equal-ML-DSA target via BCC/CEF; add review-ready status. - §5 security: point Lean ref at Crypto.Pulsar.pulsar_pq_unforgeability (was Corona.lean/corona_pq_unforgeability — a conflation); add the byte-equal-mode proof posture + honest status. - Reproducibility appendix: replace the v0.3 algebraic-aggregate "production path" (which leaked c·s2/c·t0, V13) with the no-leak BCC/CEF path + the superseded-V13 note + honest status. - references.bib: fix lp073 (was titled "Corona ... Threshold Signatures" — misattribution) → Pulsar; add lp4450 canonical entry. lp-020-quasar-consensus (§13 reconciliation — SUPERSEDED): - §13 rewritten: "Why Not Threshold ML-DSA" → "Threshold ML-DSA via Pulsar; Why Not Threshold FALCON". Threshold ML-DSA IS achieved via Pulsar BCC/CEF (byte-equal FIPS 204); the two classical obstacles (combined-z rejection, hint computation) are dissolved by offline boundary clearance + public UseHint. FALCON subsection kept (distributed trapdoor Gaussian sampling is still open). V13 finding documented; honest review-ready status; rollup is now framed as a complementary accountability lane, not a threshold substitute. - §1/§4/§11 reconciled to match (no longer claim threshold ML-DSA "cannot be deployed"); §99 adds lp4450/lp073 bibitems. Corona = Module-LWE/Ringtail-derived sibling facts preserved throughout. PDFs rebuilt (latexmk/pdflatex+bibtex), exit 0, no errors.
50 lines
2.4 KiB
TeX
50 lines
2.4 KiB
TeX
\section{Related Work}
|
|
|
|
\label{sec:related}
|
|
%% ============================================================================
|
|
|
|
\paragraph{Classical BFT.}
|
|
PBFT~\cite{castro1999practical} introduced practical Byzantine fault
|
|
tolerance with $O(n^2)$ message complexity. HotStuff~\cite{yin2019hotstuff}
|
|
reduced this to $O(n)$ with a leader-based pipelining approach. Quasar
|
|
3.0 inherits HotStuff's linear message complexity but replaces the
|
|
single-signature finality artifact with a three-lane QuasarCert that
|
|
binds seven chain roots into the certificate subject.
|
|
|
|
\paragraph{Probabilistic consensus.}
|
|
The Snow protocol family~\cite{rocket2019scalable} uses repeated
|
|
subsampled voting with metastable convergence. Quasar's Wave phase uses
|
|
FPC, a related mechanism with PRF-based adaptive thresholds that
|
|
provides deterministic threshold selection per round, eliminating the
|
|
need for common randomness beacons.
|
|
|
|
\paragraph{Post-quantum blockchain.}
|
|
Prior work on post-quantum blockchains has focused on replacing
|
|
individual signature schemes (e.g., XMSS for transaction signing).
|
|
Quasar 3.0 is the first deployed protocol to bind \emph{three}
|
|
algebraically independent finality lanes into a single certificate, with
|
|
the third lane delivered as a Z-Chain Groth16 rollup of FIPS-204 ML-DSA
|
|
signatures.
|
|
|
|
\paragraph{Threshold lattice signatures.}
|
|
FIPS~204 specifies ML-DSA for single-signer use only, but a byte-equal
|
|
\emph{threshold} ML-DSA is nonetheless achievable: \textbf{Pulsar}
|
|
(LP-4450~\cite{lp4450}) is a Module-LWE threshold whose combined output
|
|
verifies under unmodified FIPS~204 ML-DSA-65/87, via boundary-cleared
|
|
nonce transcripts and public-data hint recovery (BCC/CEF). Corona
|
|
\cite{corona} is the sibling Module-LWE leg --- the Ringtail-derived
|
|
two-round scheme optimized for permissionless DKG --- composed alongside
|
|
Pulsar for intra-lattice diversity. Section~\ref{sec:why-not-threshold}
|
|
gives the BCC/CEF construction, its honest review-ready status, and the
|
|
relationship to the Z-Chain accountability rollup.
|
|
|
|
\paragraph{ZK aggregation of post-quantum signatures.}
|
|
Recent proposals aggregate ML-DSA or ML-DSA signatures via Halo~2 or
|
|
Plonky2 SNARKs. Quasar 3.0 uses Groth16 because its proof size (192 B)
|
|
and verification cost (3 pairings) are constant in $N$ and amenable to
|
|
GPU batching at scale; the trusted-setup cost is amortized by the
|
|
ceremony recorded in $Z_\text{vk}$.
|
|
|
|
|
|
%% ============================================================================
|