papers/lux-gchain-graphql/sections/08-security-analysis.tex

\section{Security Analysis}


\subsection{Quantum-Safe Authentication}

G-Chain uses dual-certificate signatures for query authentication:

\begin{itemize}
\item \textbf{BLS12-381}: Classical 128-bit security, 96-byte signatures
\item \textbf{Pulsar}: Lattice-based post-quantum, 1,024-byte signatures
\item \textbf{Transition}: Hybrid mode (2025-2027), pure Pulsar (2027+)
\end{itemize}

\subsection{Query DoS Protection}

\textbf{Gas Metering:}
\begin{itemize}
\item Base query: 10,000 gas
\item Per node loaded: +100 gas
\item Per edge traversed: +50 gas
\item Per aggregation: +500 gas
\item Maximum query gas: 10M gas per query
\end{itemize}

\textbf{Rate Limiting:}
\begin{itemize}
\item Free tier: 100 queries/hour
\item Paid tier: 10,000 queries/hour with LUX payment
\item Enterprise: Unlimited with node hosting
\end{itemize}

\subsection{State Consistency}

\begin{algorithm}[H]
\caption{Deterministic State Commitment}
\begin{algorithmic}[1]
\Function{CommitState}{$block$}
    \State Process all transactions in $block$
    \State Update GraphDB with new nodes/edges
    \State Flush BadgerDB memtable
    \State Compact LSM tree deterministically
    \State $stateRoot \gets$ verkle.ComputeRoot()
    \State Sign $stateRoot$ with validator key
    \State Broadcast commitment to consensus
    \State \Return $stateRoot$
\EndFunction
\end{algorithmic}
\end{algorithm}