mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
663cc83ca3
Companion LaTeX papers to luxfi/LPs: - lp-200-zap-stack: full ZAP-as-substrate paper (10-layer model, deco- mplected concerns, performance). - lp-200-lux-vs-avalanche-diff: code-translation appendix. - lp-203-gpu-native-verify, lp-205-pipelined-quasar, lp-208-dag-mempool, lp-209-mysticeti-ordering, lp-210-block-stm, lp-211-cross-shard-atomic, lp-217-cert-profile-modes, lp-218-zap-p3q-pq-rollup, lp-220-p3q-corona-magnetar, lp-221-stark-fri-verifier, lp-300-schema-registry. Pitch / outreach decks (luxcover.sty templated): - blackrock-nahmii-pitch, corporate-dao-stack-analysis, nahmii-patent-acquisition, pq-patent-family-future-infringers, lux-substrate-platform-pitch, w3a-foundation-membership, multi-validator-scale, vfs-archive-cost-study. Edits aligning to LP-217 / LP-200: - lp-020-quasar-consensus 02-system-model + 08-performance. - lp-073-pulsar 11-quasar. - lp-103-omnichain-explorer 03-chain-support. - lp-104-graph-engine. - lp-201-zap-universal-wire/wire-inventory.csv. - lp-306-lx-social-dex sections/02. - lux-adoption-roadmap, lux-chain-architecture, lux-consensus-engines/08-composition, lux-crypto-agility, lux-evm-precompile-engineering/02, lux-fhe-smart-contracts/05, lux-quasar-composition/04+06+10, lux-reproducible-builds. - INDEX.md cross-links the new papers.
64 lines
2.8 KiB
TeX
64 lines
2.8 KiB
TeX
\section{Security Considerations}
|
|
|
|
\subsection{Threat model}
|
|
|
|
Each layer's threat model is its own; the ZAP Stack does not
|
|
introduce a new aggregate threat model. The composition is
|
|
load-bearing only insofar as no layer's invariants are violated by
|
|
the layer's interaction with its neighbors.
|
|
|
|
\paragraph{Layer~0 (frame).} The wire frame is a magic byte plus a
|
|
length-prefixed object. A malformed frame is rejected before parsing.
|
|
Tests for the parser are in \texttt{luxfi/zap}; rejecting bad-magic
|
|
inputs is the first invariant
|
|
(\texttt{/tmp/zap-vs-codec/claim1\_reject\_bad\_magic\_test.go}).
|
|
|
|
\paragraph{Layer~3 (identity).} \texttt{sha256.Sum256(buf)} is
|
|
collision-resistant under the standard SHA-2 assumptions. The
|
|
identity is over the canonical byte stream; there is no second
|
|
canonical form.
|
|
|
|
\paragraph{Layer~4 (transcript).} TupleHash256 with NIST SP 800-185
|
|
framing is collision-resistant under cSHAKE256. The framing is
|
|
unambiguous: typed field separators prevent length-extension and
|
|
type-confusion attacks on the digest.
|
|
|
|
\paragraph{Layer~5 (signature).} \texttt{ecdsa(sha256(unsigned\_bytes))}
|
|
is a standard ECDSA construction. The signed window is precisely the
|
|
unsigned-bytes portion of the envelope; the credentials window is
|
|
appended after signing and does not feed back into the signature
|
|
domain.
|
|
|
|
\paragraph{Layer~9 (consensus cert).} The QuasarCert (LP-182) composes
|
|
legs as opaque byte strings; each leg is verified independently. The
|
|
security of the composition is the maximum of the leg securities --
|
|
a relying party at PQ-strict (BLS + Pulsar + Corona) survives any
|
|
single-leg break.
|
|
|
|
\subsection{What does NOT change with ZAP-native}
|
|
|
|
The cryptographic primitives are unchanged. ZAP-native changes how
|
|
bytes flow between layers; it does not change the underlying ECDSA,
|
|
BLS, ML-DSA, Corona, or SLH-DSA constructions. Any security claim
|
|
proven against the legacy stack is preserved by the ZAP Stack iff
|
|
that claim holds against the same primitive consumed via offset-read
|
|
instead of via reflective marshal -- which is to say, always, because
|
|
the bytes are identical.
|
|
|
|
\subsection{Side channels}
|
|
|
|
The offset-read pattern uses constant-position field access; there
|
|
is no data-dependent branching in the parser. The signature verifier
|
|
operates on the byte window; it does not allocate fresh structs that
|
|
the GC could observe. The reduction in allocations (Table~\ref{tab:perops},
|
|
``2 allocs $\to$ 1 alloc'') closes a side channel that the legacy
|
|
\texttt{codec.Manager} held open: the codec registry lookup was
|
|
data-dependent in the type tag.
|
|
|
|
\section{Backwards Compatibility}
|
|
|
|
None. The activation marker is at the genesis of the new final Lux
|
|
network: unix \texttt{1766708400}. The pre-Quasar Edition Lux network
|
|
(2020--2025) is a separate network operating a different stack. There
|
|
is no replay, no flag day, no migration path.
|