papers/lux-capsule-architecture/sections/06-the-post-quantum-security-stack.tex

\section{The Post-Quantum Security Stack}
\label{sec:pq}
% ============================================================================

The Capsule security stack is tiered by application class, with increasing
cryptographic complexity as trust requirements grow.

\subsection{Tier 1: Default (Class I)}

All capsules use this tier. It protects vault data and sync traffic.

\begin{itemize}[nosep]
  \item \textbf{Vault encryption}: AES-256-CBC (SQLCipher) with HMAC-SHA512
        page authentication.
  \item \textbf{Key encapsulation}: ML-KEM-768 (NIST FIPS 203) for wrapping
        vault keys, providing IND-CCA2 security against quantum adversaries.
  \item \textbf{Signatures}: Ed25519 for real-time operations (performance),
        ML-DSA-65 (FIPS 204) for policy transactions on-chain (quantum
        resistance).
  \item \textbf{Sync encryption}: AES-256-GCM for operation payloads in transit.
  \item \textbf{Key derivation}: HKDF-SHA256 from root key material.
\end{itemize}

\begin{theorem}[Tier 1 IND-CPA Security]\label{thm:tier1}
Under the Module-LWE assumption with parameters $(n=768, q=3329, \eta=2)$
and the assumption that AES-256 is a secure pseudorandom permutation, a
Tier~1 capsule vault is IND-CPA secure against a quantum polynomial-time
adversary with access to encrypted vault snapshots and sync traffic.
\end{theorem}

\begin{proof}[Proof sketch]
The vault key $k_{\mathsf{enc}}$ is wrapped under ML-KEM-768, which is
IND-CCA2 secure under Module-LWE~\cite{lux-pq-crypto}. An adversary with
access to the ciphertext vault file and encrypted sync operations sees only
AES-256-CBC ciphertext (vault) and AES-256-GCM ciphertext (sync). Without
$k_{\mathsf{enc}}$ or $k_{\mathsf{sync}}$ (both derived from $k_{\mathsf{root}}$
and protected by ML-KEM), the adversary cannot distinguish vault contents from
random, giving IND-CPA. The HMAC-SHA512 page authentication additionally provides
integrity (IND-CCA under the encrypt-then-MAC composition theorem).
\end{proof}

\subsection{Tier 2: Threshold Control (Class II)}

Adds threshold cryptographic protocols for multi-party authorization.

\begin{itemize}[nosep]
  \item \textbf{Secret sharing}: Feldman VSS over a prime-order group for
        verifiable share distribution.
  \item \textbf{Threshold signatures}: FROST (EdDSA), CGG21 (ECDSA), Pulsar
        (post-quantum) as specified in~\cite{lux-mchain-mpc}.
  \item \textbf{Time-locks}: Verifiable delay functions (VDFs) for time-bounded
        secret reveals.
\end{itemize}

\subsection{Tier 3: Confidential Compute (Class III)}

Adds homomorphic encryption for computation on encrypted data.

\begin{itemize}[nosep]
  \item \textbf{Boolean circuits}: TFHE with bootstrapping for arbitrary boolean
        function evaluation~\cite{lux-tfhe}.
  \item \textbf{Approximate arithmetic}: CKKS for floating-point operations
        (ML inference, statistical aggregation).
  \item \textbf{Hybrid FHE-MPC}: Combine FHE evaluation with MPC for
        multi-input confidential computation, as described
        in~\cite{lux-fhe-mpc-hybrid}.
  \item \textbf{TEE fallback}: Intel TDX or ARM CCA for workloads where FHE
        latency is prohibitive, with remote attestation verified on-chain.
\end{itemize}

\begin{table}[H]
\centering
\caption{Post-quantum security tiers.}
\label{tab:pq}
\begin{tabular}{@{}llll@{}}
\toprule
\textbf{Tier} & \textbf{Primitives} & \textbf{PQ Safe} & \textbf{Overhead} \\
\midrule
1 (Default) & AES-256, ML-KEM, ML-DSA & Yes & Negligible \\
2 (Threshold) & + Feldman VSS, FROST, Pulsar & Yes & Seconds \\
3 (Confidential) & + TFHE, CKKS & Yes (FHE) & 10--1000$\times$ \\
\bottomrule
\end{tabular}
\end{table}

% ============================================================================