mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zooqueen
b7905739c2
Fix residual mislabels the citation pass missed (no-scheme-key papers): - 'Pulsar (Ring-LWE)' -> 'Pulsar (Module-LWE)' in lux-pq-migration, lux-triple-proof-consensus, lux-master-security-model, quasar-4-activation. - lp-020: reverse mislabel 'Module-LWE for Corona' -> 'Ring-LWE for Corona' (restores the BLS/Corona/Pulsar assumption-diversity point). - lp-203: '(Module-LWE NTT)' -> '(shared lattice NTT)' (Corona is Ring-LWE). - nasua's 'Pulsar lifts Ring-LWE to Module-LWE' left intact (correct rank-1->k). - LLM.md: correct lux-corona-pq description (misnamed Pulsar paper) + M/F-chain. Rebuilt all 6 affected PDFs.
42 lines
1.7 KiB
TeX
42 lines
1.7 KiB
TeX
\section{Key Management During Transition}
|
|
|
|
|
|
\subsection{Four Key Types}
|
|
|
|
During Phases 1 and 2, validators maintain four keys simultaneously:
|
|
|
|
\begin{center}
|
|
\begin{tabular}{lllll}
|
|
\toprule
|
|
\textbf{Key} & \textbf{Algorithm} & \textbf{Storage} & \textbf{Rotation} & \textbf{HSM Support} \\
|
|
\midrule
|
|
EC & secp256k1 & Keystore file & Manual & Yes (PKCS\#11) \\
|
|
BLS & BLS12-381 & Keystore file & Per-epoch capable & Yes (custom) \\
|
|
ML-DSA & ML-DSA-65 & Keystore file & Per-epoch capable & Planned (FIPS 140-3) \\
|
|
Pulsar & Module-LWE & DKG shares & Per-epoch (automatic) & N/A (distributed) \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{center}
|
|
|
|
\subsection{Key Hierarchy}
|
|
|
|
\begin{enumerate}[leftmargin=2em]
|
|
\item The \textbf{ML-DSA key} is the validator's long-term identity. It certifies all other keys.
|
|
\item The \textbf{BLS key} is certified by the ML-DSA key at registration. Rotation requires a new ML-DSA certificate.
|
|
\item The \textbf{EC key} derives the validator's EVM address. It is bound to the ML-DSA key via a registration transaction.
|
|
\item The \textbf{Pulsar key} is generated via DKG and rotated automatically each epoch. It is ephemeral.
|
|
\end{enumerate}
|
|
|
|
\subsection{Validator Upgrade Path}
|
|
|
|
Existing validators upgrade through three steps:
|
|
|
|
\begin{enumerate}[leftmargin=2em]
|
|
\item \textbf{Generate ML-DSA key pair.} Offline, on validator hardware.
|
|
\item \textbf{Register ML-DSA public key.} P-Chain transaction signed by the existing EC key, binding the ML-DSA key to the validator's identity.
|
|
\item \textbf{Upgrade node software.} The new node software signs blocks with both BLS and ML-DSA keys. No downtime required---the upgrade is a rolling restart.
|
|
\end{enumerate}
|
|
|
|
The entire process takes $<$5 minutes per validator and requires no coordination between validators.
|
|
|