mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
98343d238e
Quasar Horizon (consensus composition over Pulsar / ML-DSA / BLS lanes
under Prism + LSS lifecycle), Warp 2.0 (Pulse-backed cross-chain envelope
with forward-only v1->v2 migration and lattigo ReadUint64Slice DoS fix),
benchmark report (microbench, reshare, activation, Warp 2.0 verify, Prism
composition, GPU headroom, cross-WAN latency), and NIST IR 8214C-style
submission package (spec, parameter sets, domain separation, serialization,
reference-impl pointers, evaluation report, security analysis, side-channel
considerations).
All four deliverables compile cleanly via pdflatex+bibtex and reference
the canonical proof bucket files at proofs/{definitions,pulsar,lss,quasar}.
No duplication of proof bodies; cite by file path.
114 lines
4.4 KiB
TeX
114 lines
4.4 KiB
TeX
\section{Implementation}
|
|
|
|
\label{sec:implementation}
|
|
|
|
\subsection{Precompile Addresses}
|
|
|
|
The hybrid primitives are deployed as native EVM precompiles on the Lux C-Chain,
|
|
activated at genesis.
|
|
|
|
\begin{table}[ht]
|
|
\centering
|
|
\caption{Lux hybrid cryptography precompile addresses.}
|
|
\label{tab:precompiles}
|
|
\begin{tabular}{llr}
|
|
\toprule
|
|
\textbf{Address} & \textbf{Primitive} & \textbf{Gas Cost} \\
|
|
\midrule
|
|
\texttt{0x0600...01} & BLS12-381 sign & 45{,}000 \\
|
|
\texttt{0x0600...02} & BLS12-381 verify & 55{,}000 \\
|
|
\texttt{0x0600...03} & BLS12-381 aggregate & 12{,}000 \\
|
|
\texttt{0x0600...10} & ML-DSA-65 keygen & 120{,}000 \\
|
|
\texttt{0x0600...11} & ML-DSA-65 sign & 95{,}000 \\
|
|
\texttt{0x0600...12} & ML-DSA-65 verify & 80{,}000 \\
|
|
\texttt{0x0600...20} & ML-KEM-768 keygen & 65{,}000 \\
|
|
\texttt{0x0600...21} & ML-KEM-768 encapsulate & 50{,}000 \\
|
|
\texttt{0x0600...22} & ML-KEM-768 decapsulate & 50{,}000 \\
|
|
\texttt{0x0600...30} & Hybrid sign (BLS + ML-DSA) & 150{,}000 \\
|
|
\texttt{0x0600...31} & Hybrid verify (BLS + ML-DSA) & 145{,}000 \\
|
|
\texttt{0x0600...40} & Hybrid KEM (X25519 + ML-KEM) & 120{,}000 \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{table}
|
|
|
|
\subsection{Benchmarks}
|
|
|
|
All measurements on AMD EPYC 7763 (single core, 2.45 GHz), Go~1.22 with SIMD-optimized
|
|
NTT from the \texttt{luxfi/lattice} library.
|
|
|
|
\begin{table}[ht]
|
|
\centering
|
|
\caption{Cryptographic operation benchmarks.}
|
|
\label{tab:benchmarks}
|
|
\begin{tabular}{lrr}
|
|
\toprule
|
|
\textbf{Operation} & \textbf{Latency} & \textbf{Output Size} \\
|
|
\midrule
|
|
BLS keygen & 10\,$\mu$s & 48\,B (pk) \\
|
|
BLS sign & 28\,$\mu$s & 96\,B \\
|
|
BLS verify & 1.2\,ms & --- \\
|
|
BLS aggregate ($n = 100$) & 42\,$\mu$s & 48\,B \\
|
|
\midrule
|
|
ML-DSA-65 keygen & 678\,$\mu$s & 1{,}952\,B (pk) \\
|
|
ML-DSA-65 sign & 1.4\,ms & 3{,}309\,B \\
|
|
ML-DSA-65 verify & 620\,$\mu$s & --- \\
|
|
\midrule
|
|
ML-KEM-768 keygen & 182\,$\mu$s & 1{,}184\,B (pk) \\
|
|
ML-KEM-768 encapsulate & 215\,$\mu$s & 1{,}088\,B (ct) \\
|
|
ML-KEM-768 decapsulate & 198\,$\mu$s & 32\,B (ss) \\
|
|
\midrule
|
|
Hybrid sign (BLS + ML-DSA) & 1.43\,ms & 3{,}405\,B \\
|
|
Hybrid verify (BLS + ML-DSA) & 1.82\,ms & --- \\
|
|
Hybrid KEM (X25519 + ML-KEM) & 415\,$\mu$s & 1{,}120\,B (ct) \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{table}
|
|
|
|
\subsection{BLS Same-Message Aggregate Verification}
|
|
|
|
The Quasar consensus path verifies $n$ BLS signatures over the same
|
|
32-byte certificate subject (a leader-broadcast pattern). cevm v0.45
|
|
introduced a same-message batched aggregate verifier; cevm v0.47.1
|
|
(commit \texttt{6bf0e232}) added a 2-way set-associative 4096-slot
|
|
pubkey-decompression cache (FNV1a-64 hash, 48-byte memcmp guard).
|
|
At $n{=}1024$ same-message verify lifts from $9.24\times$ to
|
|
$\mathbf{16.51\times}$ versus the flat host-blst baseline (LP-137
|
|
Phase-3 roll-up; the $\geq 10\times$ target is exceeded by 65\%).
|
|
Pairing math itself remains the canonical
|
|
\texttt{luxcpp/crypto/bls} c-abi body; the batching plus pubkey-cache
|
|
amortization is what produces the published number. Production
|
|
binaries link zero blst symbols (cevm v0.46.0 onward, CI-asserted).
|
|
|
|
\subsection{Signature Size Analysis}
|
|
|
|
The dominant cost of hybrid signatures is size, not computation. A pure BLS consensus
|
|
signature is 48 bytes (aggregated). The hybrid construction adds ML-DSA overhead:
|
|
|
|
\begin{itemize}[leftmargin=2em]
|
|
\item Per-block: 48\,B (BLS aggregate only). No ML-DSA per block.
|
|
\item Per-epoch ($E = 100$ blocks): 48\,B (BLS) + $\sim$200\,B (STARK-compressed
|
|
ML-DSA proof) = 248\,B total.
|
|
\item Annual storage at 1{,}000 epochs/day: $248 \times 1{,}000 \times 365 \approx
|
|
90$\,MB/year for epoch proofs. Negligible.
|
|
\end{itemize}
|
|
|
|
\subsection{Migration Path}
|
|
|
|
The hybrid architecture supports a three-phase migration:
|
|
|
|
\begin{enumerate}[leftmargin=2em]
|
|
\item \textbf{Phase 1 (current)}: Validators generate both BLS and ML-DSA key pairs.
|
|
Both are registered in the validator set. Blocks require BLS aggregate only;
|
|
ML-DSA signatures are collected but not enforced.
|
|
\item \textbf{Phase 2 (enforcement)}: Epoch finality requires both BLS aggregate
|
|
and STARK-compressed ML-DSA proof. Blocks still finalized by BLS alone
|
|
for speed.
|
|
\item \textbf{Phase 3 (post-transition)}: If BLS is demonstrably broken, drop BLS
|
|
and rely on ML-DSA/Corona only. The protocol supports this gracefully because
|
|
the ML-DSA infrastructure is already deployed and tested.
|
|
\end{enumerate}
|
|
|
|
%% ========================================================================
|
|
%% 7. RELATED WORK
|
|
%% ========================================================================
|