papers/lp-073-pulsar/sections/10-grouped.tex

%% ====================================================================
\section{Grouped Pulsar Certificates}
\label{sec:grouped}
%% ====================================================================

A single global threshold key over thousands of validators is
operationally brittle: every rotation requires every validator to
participate in JVSS broadcasts, Pedersen-commit verification, and
activation. Pulsar supports \emph{grouped} certificates as the
deployment shape for large validator sets.

\subsection{Construction}

Validators are partitioned into $G$ groups of (approximate) size
$k = N / G$. Each group has its own GroupKey lineage, its own
KeyEraID, its own resharing schedule. A Pulsar bundle certificate at
the consensus layer is a quorum of group certificates:

\[
  \mathsf{HorizonCert}.\mathsf{Pulsar} = \bigl\{ (\mathsf{group}_j, \sigma_{\mathrm{Pulsar},j}) \,:\, j \in \mathsf{quorum}(G) \bigr\}
\]

with $|\mathsf{quorum}(G)| \geq \lfloor 2G/3 \rfloor + 1$ for the
standard Byzantine bound, or a tighter quorum if individual groups are
known to be more reliable.

\subsection{What this buys}

\paragraph{Local resharing.}
A group rotates its shares only when its own validators rotate; cross-
group churn does not force every group to reshare. JVSS bandwidth
scales as $\mathcal{O}(k^2)$ per rotation rather than
$\mathcal{O}(N^2)$.

\paragraph{Independent failure domains.}
A failed activation in group $j$ does not block other groups. The chain
emits a Pulsar quorum-of-groups certificate from the surviving groups;
group $j$ rolls back independently.

\paragraph{Compact bundle pulses.}
Each group emits one Pulsar pulse (size on the order of the
$13.4\,\mathrm{KB}$ Pulsar signature \cite{pulsar}). $G$
groups produce $G$ pulses; aggregating across groups via Merkle is
straightforward. Total bundle-cert overhead is $\mathcal{O}(G)$, not
$\mathcal{O}(N)$.

\subsection{Open systems-research questions}

Grouped Pulsar is \emph{the} place where dynamic-PQ-threshold consensus
becomes a research contribution rather than an engineering exercise.
The open questions:

\begin{enumerate}[leftmargin=2em,nosep]
  \item Given validator corruption fraction $f$, and group assignment
        process $\mathcal{G}$, what is the probability that the
        adversary controls enough \emph{groups} to forge conflicting
        Horizon certificates? (Hypergeometric vs.\ binomial; balanced
        vs.\ adversarial assignment.)
  \item How should group assignment respond to validator churn while
        preserving in-group share integrity?
  \item How does group resharing interact with epoch transitions?
        (Per-group epochs vs.\ chain-global epochs; leader staleness.)
  \item How many group certificates are required for a Horizon
        finality boundary at a given safety target?
  \item What is the bandwidth/latency curve of Pulsar pulses as a
        function of group size $k$ and group count $G$, under
        wide-area churn?
\end{enumerate}

These questions connect cryptographic threshold assumptions to
consensus-level quorum assumptions, and are the natural follow-on
formal-systems paper to this one.

\subsection{Comparison to Threshold Raccoon and Hermine}

Threshold Raccoon \cite{thresholdraccoon} reports practical thresholds
up to $1024$ signers with $\sim 13\,\mathrm{KiB}$ signatures and
$\sim 40\,\mathrm{KiB}$ communication per user. Hermine \cite{hermine}
provides DKG, identifiable aborts, and proactive refresh in a single
package. Both target the cryptographic primitive layer.

Grouped Pulsar is orthogonal: it composes the underlying lattice
threshold scheme into a deployment shape that scales across
\emph{permissionless validator sets} where committee membership is not
fixed at protocol design time. The contribution is the
\emph{system-level} composition, not the lattice cryptography itself.