papers/lux-fhe-runtime/sections/09-security.tex

\section{Security}
\label{sec:fhe-security}

\subsection{Cryptographic posture}

Lux FHE security rests on the LWE / RLWE assumptions. Concrete
parameter security is reported in
\texttt{proofs/fhe/parameter-security.tex}
(Theorem~\ref{thm:lwe-parameter-security}): every shipped parameter
set ($\mathsf{PN10QP27}$, $\mathsf{PN11QP54}$, $\mathsf{PN9QP28\_STD128}$)
exceeds 128-bit classical and 128-bit quantum security under the
Albrecht estimator with the BKZ block-size cost model and the BDGL
sieving cost.

Encrypt-evaluate-decrypt correctness is established in
\texttt{proofs/fhe/correctness.tex}
(Theorem~\ref{thm:fhe-correctness}): for circuits within the
parameter set's bootstrap depth, the decryption agrees with the
plaintext circuit evaluation except with negligible probability over
the noise distribution. Per-gate decoding success follows from the
Albrecht parameter selection.

\subsection{Post-quantum posture}

LWE / RLWE are post-quantum-hard under current cryptanalysis. Lux
does not weaken parameters for performance --- the CPU fallback uses
identical parameters to the GPU backends. The dual-runtime
equivalence theorem
(\texttt{proofs/fhe/dual-runtime-equivalence.tex},
Theorem~\ref{thm:fhe-dual-runtime-equivalence}) ensures that whichever
backend the operator selects, the underlying LWE-hardness assumption
applies unchanged. There is no PQ rollback path; every FHE call is
PQ-rooted.

\subsection{Key custody}

FHE secret keys (and threshold shares of them) live in TEE-protected
key holders (LP-065). The C++ runtime does not decrypt --- it only
evaluates. Decryption goes through the threshold MPC ceremony
(LP-019, LP-076). The runtime never sees plaintext during evaluation,
and never sees an unprotected secret key.

\subsection{Side-channel posture}

The C++ CPU oracle runs FHE gates in constant time per bootstrap.
SIMT divergence on GPU backends is bounded to ciphertext metadata,
not plaintext bits --- the GPU dispatch decisions depend only on
publicly visible ciphertext sizes and counts, never on encrypted
content. The constant-time discipline matches LP-013 \S Security
\emph{Side-channel discipline} for the F-Chain TFHE kernels.

\subsection{Consensus-level replay protection}

$\mathsf{nebula\_fhe\_root}$ binds every contributing sub-root (bootstrap-key,
key-switch-key, public params, active circuit DAG, finalized
evaluations) into the QuasarRoundDescriptor. Cross-epoch replay
fails Prism's transcript-equality check. Theorem~\ref{thm:fhe-nebula-binding}
(\texttt{proofs/fhe/nebula-binding.tex}) reduces a forged binding
to a hash collision plus a Pulsar SUF-CMA forgery.

\subsection{Threat model}

The threat model considered:

\begin{itemize}
\item \textbf{Network adversary} (sees ciphertexts, controls
delivery). Defeated by IND-CPA security of the underlying RLWE
encryption and the constant-time discipline.
\item \textbf{Compromised single party} (one share of the threshold
key holder). Defeated by the Pulsar threshold structure under
LSS lifecycle management (LP-077) --- $t-1$ corruptions are
tolerated.
\item \textbf{Compromised GPU host} (sees ciphertexts and
evaluation keys, but not plaintexts and not secret keys). Defeated
by the LWE / RLWE assumption: ciphertexts are
indistinguishable from random under public parameters, evaluation
keys do not leak the secret key.
\item \textbf{Quantum adversary}. Defeated by LWE / RLWE assumed
post-quantum hardness (parameter target $\geq 128$ quantum bits).
\item \textbf{Cross-epoch replay}. Defeated by the
$\mathsf{nebula\_fhe\_root}$ transcript binding plus Prism's
transcript-equality check.
\end{itemize}

The threat model explicitly excludes:

\begin{itemize}
\item \textbf{Plaintext-leaking key holder}. If the threshold MPC
holder discloses plaintext after legitimate decryption, that is an
operator-level breach, not an FHE-level one.
\item \textbf{Compromised TEE}. Lux FHE assumes the TEE-protected
key holders (LP-065) operate within their stated guarantees;
TEE compromise is out of scope.
\item \textbf{Mathematical breakthroughs that invalidate LWE/RLWE.}
A polynomial-time algorithm for LWE breaks every FHE scheme; the
cryptographic assumption is the assumption.
\end{itemize}

\subsection{Disclosure}

Vulnerability reports go to \texttt{[email protected]} (PGP key
on the Lux website). The disclosure timeline mirrors the rest of
the Lux stack: 90 days for unpatched issues, with shorter windows
for issues that compromise active deployments.