papers/lux-master-security-model/sections/03-cryptographic-assumptions.tex

\section{Cryptographic Assumptions}

\label{sec:assumptions}

The Lux Network relies on three independent families of cryptographic assumptions:

\subsection{Family 1: Discrete Logarithm (BLS12-381)}

\begin{itemize}[leftmargin=2em]
  \item \textbf{Assumption}: The co-CDH problem is hard in the bilinear groups of
        BLS12-381.
  \item \textbf{Used by}: BLS aggregate signatures (consensus layer), ECDSA
        (transaction signing), ECDH (P2P key exchange).
  \item \textbf{Status}: \textbf{[Assumed]} Decades of cryptanalysis, no known
        classical attacks. Broken by Shor's algorithm on quantum computers.
  \item \textbf{Quantum resistance}: None.
\end{itemize}

\subsection{Family 2: Lattice (ML-DSA, Pulsar)}

\begin{itemize}[leftmargin=2em]
  \item \textbf{Assumption}: The Module-LWE problem is hard with parameters $N = 256$,
        $k = 4$, $q = 8380417$ (ML-DSA-65) or $N = 256$, $M = 8$,
        $q = 2^{48} + 2561$ (Pulsar).
  \item \textbf{Used by}: ML-DSA-65 post-quantum signatures (epoch finality),
        Pulsar threshold signatures (anonymous validator participation), ML-KEM
        (hybrid key exchange).
  \item \textbf{Status}: \textbf{[Assumed]} NIST standardized (FIPS 204) after
        extensive review. No known polynomial quantum speedup beyond Grover on
        search. $>$128-bit classical security, $>$100-bit quantum security.
  \item \textbf{Quantum resistance}: Believed quantum-resistant. Lattice
        cryptanalysis is an active research area.
\end{itemize}

\subsection{Family 3: Hash Functions (STARK)}

\begin{itemize}[leftmargin=2em]
  \item \textbf{Assumption}: SHA-256 and Keccak-256 are collision-resistant with
        $>$128-bit classical security and $>$85-bit quantum security.
  \item \textbf{Used by}: STARK proof system (epoch ML-DSA signature compression),
        Merkle trees (state commitment), address derivation.
  \item \textbf{Status}: \textbf{[Assumed]} SHA-256 and Keccak-256 have no known
        practical collision attacks. Grover's algorithm reduces collision resistance
        to $\sim 2^{85}$, which remains infeasible.
  \item \textbf{Quantum resistance}: Partially resistant. Preimage resistance remains
        at $2^{128}$. Collision resistance reduced to $2^{85}$.
\end{itemize}

\subsection{Defense in Depth: Any 2 of 3 Suffice}

\begin{theorem}[Two-of-three security]
\label{thm:two-of-three}
The Lux Network maintains safety and liveness if at least two of the three
cryptographic assumption families hold.
\end{theorem}

\begin{proof}[Proof sketch]
We enumerate the three single-failure scenarios:

\textbf{Case 1: Discrete log breaks (quantum adversary).} BLS signatures are forged.
Classical consensus via BLS is compromised. However, epoch finality via
STARK-compressed ML-DSA (Family~2) remains valid, and state commitments via hash
Merkle trees (Family~3) remain binding. The chain can continue with ML-DSA-only
consensus (degraded throughput, epoch-level finality only).

\textbf{Case 2: Lattice assumptions break.} ML-DSA and Pulsar signatures can be
forged. Post-quantum epoch proofs are compromised. However, BLS consensus
(Family~1) continues to provide per-block finality, and STARK proofs based on
hash collision resistance (Family~3) remain valid for state commitment. The chain
continues with BLS-only consensus (classical security, no post-quantum guarantee).

\textbf{Case 3: Hash functions break.} STARK proofs are compromised (forged proofs).
Merkle state commitments can be spoofed. However, BLS consensus (Family~1) still
provides per-block finality, and ML-DSA (Family~2) still provides post-quantum
epoch signatures. The chain continues with BLS + ML-DSA consensus (no STARK
compression, larger epoch proofs).

In each case, two surviving families provide sufficient security for continued
operation, potentially with degraded performance or reduced guarantees.
\end{proof}

\begin{remark}
The scenario where \emph{all three} families fail simultaneously---discrete log,
lattice, and hash functions all broken---implies a fundamental breakthrough in
mathematics (or quantum computing far beyond current projections) that would
compromise all of modern cryptography, not just blockchain.
\end{remark}

%% ========================================================================
%%  4. PER-LAYER SECURITY GUARANTEES
%% ========================================================================