papers/lux-hybrid-pq-architecture/sections/02-threat-model.tex

\section{Threat Model}

\label{sec:threat-model}

\subsection{Adversary Classes}

We consider three adversary classes, ordered by increasing capability:

\begin{definition}[Classical adversary]
\label{def:classical}
A probabilistic polynomial-time (PPT) adversary with access to classical computation
only. Cannot break co-CDH on BLS12-381 or Module-LWE with standard parameters.
\end{definition}

\begin{definition}[Quantum adversary]
\label{def:quantum}
An adversary with access to a fault-tolerant quantum computer running $\geq 4{,}000$
logical qubits. Can execute Shor's algorithm to solve discrete logarithms on elliptic
curves in polynomial time. Cannot break Module-LWE (no known quantum speedup beyond
Grover's square root on search, which is addressed by parameter selection).
\end{definition}

\begin{definition}[Transitional adversary]
\label{def:transitional}
An adversary that may or may not have quantum capability, but is actively performing
\emph{harvest-now-decrypt-later} (HNDL) attacks: recording ciphertexts and signed
messages today for retrospective analysis when quantum computers become available.
\end{definition}

\subsection{Harvest-Now-Decrypt-Later}

Blockchain is uniquely vulnerable to HNDL because:

\begin{enumerate}[leftmargin=2em]
  \item \textbf{Public keys are exposed in the mempool.} Every transaction broadcast
        reveals the sender's public key before confirmation. An adversary recording
        mempool traffic accumulates a database of public keys paired with signed
        transactions.
  \item \textbf{Validator public keys are static.} BLS public keys used for consensus
        are published in the validator set and do not rotate. A future quantum computer
        can forge validator signatures for any historical epoch.
  \item \textbf{Chain history is immutable and public.} Unlike TLS sessions that
        are ephemeral, every signature ever produced on a blockchain is permanently
        recorded and publicly accessible.
  \item \textbf{Economic incentives are persistent.} Assets secured by ECDSA/BLS
        signatures retain value indefinitely, making decade-old keys worth attacking.
\end{enumerate}

\subsection{Shor's Algorithm: Concrete Impact}

\begin{table}[ht]
\centering
\caption{Impact of Shor's algorithm on blockchain cryptographic primitives.}
\label{tab:shor-impact}
\begin{tabular}{lllc}
\toprule
\textbf{Primitive} & \textbf{Use} & \textbf{Attack} & \textbf{Broken?} \\
\midrule
ECDSA (secp256k1) & Transaction signing & DLP on curve & Yes \\
BLS12-381 & Consensus signatures & DLP on $\mathbb{G}_1$, $\mathbb{G}_2$ & Yes \\
EdDSA (Ed25519) & Bridge/MPC signing & DLP on twisted Edwards & Yes \\
ECDH (Curve25519) & Key exchange & DLP on Montgomery & Yes \\
SHA-256 & Merkle trees, addresses & Grover ($2^{128}$ search) & No$^*$ \\
Keccak-256 & EVM hashing & Grover ($2^{128}$ search) & No$^*$ \\
\bottomrule
\end{tabular}
\vspace{0.3em}
\footnotesize{$^*$Grover's algorithm reduces security from $2^{256}$ to $2^{128}$,
which remains computationally infeasible.}
\end{table}

\subsection{Grover's Algorithm: Hash Function Impact}

Grover's algorithm provides a quadratic speedup for unstructured search, reducing
the security of an $n$-bit hash function to $n/2$ bits. For SHA-256 and Keccak-256,
this means $128$-bit quantum security---adequate by all current standards. Blockchain
Merkle trees, address derivation, and proof-of-work (where applicable) remain secure
against quantum adversaries with current hash function parameters.

The critical distinction: Shor's algorithm is \emph{exponential} speedup (rendering
DLP-based schemes completely broken), while Grover's is \emph{quadratic} (manageable
by doubling key lengths). Hybrid deployment addresses the former; hash function
parameters address the latter.

%% ========================================================================
%%  3. DUAL-SIGNATURE CONSTRUCTION
%% ========================================================================