papers/lux-pq-migration/sections/04-phase-2-pq-primary-with-classical-fallba.tex

\section{Phase 2: PQ Primary with Classical Fallback}


\textbf{Status: Planned.}

Phase 2 inverts the priority: the post-quantum signature becomes the primary verification path, and the classical signature serves as a fallback for backward compatibility.

\subsection{Trigger Conditions}

Phase 2 activates when:
\begin{enumerate}[leftmargin=2em]
\item $>$90\% of validators have registered ML-DSA keys (already 100\% on Lux).
\item NIST finalizes additional PQ algorithms beyond FIPS 203/204/205.
\item Government mandates require PQ-primary deployment (NSA CNSA 2.0 timeline: 2030).
\item OR: credible evidence of CRQC development accelerating beyond current projections.
\end{enumerate}

\subsection{Changes from Phase 1}

\begin{center}
\begin{tabular}{lll}
\toprule
\textbf{Component} & \textbf{Phase 1} & \textbf{Phase 2} \\
\midrule
Per-block consensus & BLS (primary) & ML-DSA individual sigs (primary) \\
Per-block fallback & None & BLS (fallback, for old clients) \\
Per-epoch proof & STARK(ML-DSA + Pulsar) & STARK(ML-DSA + Pulsar) \\
Block header size & 144 B & $\sim$3,500 B (ML-DSA sig included) \\
Verification order & BLS first, then epoch PQ & ML-DSA first, BLS optional \\
\bottomrule
\end{tabular}
\end{center}

The block header size increase (144 B $\to$ $\sim$3,500 B) is the primary cost of Phase 2. This is mitigated by STARK aggregation at the epoch level.

\subsection{Backward Compatibility}

Old clients (Phase 1 software) continue to function by verifying the BLS fallback signature. They do not verify the ML-DSA primary signature but are not required to---the BLS signature remains valid.

\begin{property}[Backward Compatibility]
A Phase 1 client can verify all blocks produced by a Phase 2 network by checking only the BLS aggregate signature. It cannot verify post-quantum finality but can verify classical finality.
\end{property}