papers/lux-quasar-benchmarks/sections/07-benchmark-5-post-quantum-readiness.tex

\section{Benchmark 5: Post-Quantum Readiness}

\label{sec:pq}
%% ============================================================================

We evaluate the computational overhead of replacing classical signatures (Ed25519, BLS)
with ML-DSA (FIPS~204~\cite{fips204}), the NIST-standardized post-quantum digital
signature scheme.

\subsection{Signature Primitive Benchmarks}

All measurements on a single AMD EPYC 9454 core, median of 100{,}000 iterations:

\begin{table}[h]
\centering
\small
\begin{tabular}{@{}lrrrr@{}}
\toprule
\textbf{Scheme} & \textbf{Sign ($\mu$s)} & \textbf{Verify ($\mu$s)} & \textbf{Pub Key (B)} & \textbf{Sig (B)} \\
\midrule
Ed25519            & 25.2   & 34.4  & 32      & 64 \\
BLS12-381          & 310.0  & 840.0 & 48      & 96 \\
BLS12-381 (agg.)   & 310.0  & 1.8$^*$   & 48  & 96 \\
ML-DSA-44          & 69.2   & 30.3  & 1{,}312 & 2{,}420 \\
ML-DSA-65          & 112.0  & 47.9  & 1{,}952 & 3{,}309 \\
Pulsar (share)   & 48.0   & 7.0   & 1{,}024 & 1{,}024 \\
\bottomrule
\end{tabular}
\caption{Cryptographic primitive performance. $^*$BLS aggregate verification amortizes
to $\sim$1.8\,$\mu$s per signer when verifying a single aggregate signature over $n$
public keys.}
\label{tab:crypto}
\end{table}

\textbf{Key finding}: ML-DSA-65 verification (47.9\,$\mu$s) is faster than Ed25519
verification (34.4\,$\mu$s) by only 39\% overhead, and faster than individual BLS
verification (840\,$\mu$s) by 17.5$\times$. The post-quantum verification tax is
minimal. The cost is in signature and key sizes, not computation.

\subsection{Bandwidth Overhead}

\begin{table}[h]
\centering
\begin{tabular}{@{}lrr@{}}
\toprule
\textbf{Certificate Type} & \textbf{Size @ $n=21$} & \textbf{Size @ $n=100$} \\
\midrule
BLS aggregate only         & 144\,B               & 144\,B \\
Ed25519 multi-sig          & 1{,}344\,B           & 6{,}400\,B \\
ML-DSA-65 multi-sig        & 69{,}489\,B          & 330{,}900\,B \\
Pulsar threshold         & 1{,}024\,B           & 1{,}024\,B \\
\textbf{Quasar dual-cert}  & \textbf{1{,}168\,B}  & \textbf{1{,}168\,B} \\
\bottomrule
\end{tabular}
\caption{Certificate size comparison. Quasar's dual-certificate is constant-size
because both BLS aggregation and Pulsar threshold combination produce fixed-size
outputs regardless of signer count.}
\label{tab:cert-size}
\end{table}

Quasar's dual-certificate (1{,}168\,B) is 282$\times$ smaller than a naive ML-DSA-65
multi-signature at $n=100$. This is the key engineering advantage of threshold
cryptography over multi-signature schemes for post-quantum consensus.

\subsection{Upgrade Path Analysis}

\begin{table}[h]
\centering
\small
\begin{tabular}{@{}llll@{}}
\toprule
\textbf{Protocol} & \textbf{Current Sigs} & \textbf{PQ Upgrade Path} & \textbf{Difficulty} \\
\midrule
\textbf{Quasar}   & BLS + Pulsar & Already PQ-secure           & N/A (done) \\
Tendermint        & Ed25519        & Replace with ML-DSA-65       & Hard fork \\
HotStuff          & Ed25519        & Replace with ML-DSA-65       & Hard fork \\
Narwhal+Tusk      & Ed25519        & Replace with ML-DSA-65       & Hard fork \\
Casper FFG        & BLS12-381      & No production PQ BLS scheme  & Research \\
Tower BFT         & Ed25519        & Replace with ML-DSA-65       & Hard fork \\
Snow              & Ed25519/BLS    & Replace with ML-DSA-65       & Hard fork \\
\bottomrule
\end{tabular}
\caption{Post-quantum upgrade readiness. Quasar is the only production protocol with
post-quantum finality today.}
\label{tab:pq-readiness}
\end{table}

Ethereum faces the hardest upgrade path: Casper FFG relies on BLS12-381 signature
aggregation, and no post-quantum BLS equivalent exists. A PQ Ethereum would require
fundamental redesign of the finality gadget---an open research problem as of
2025~\cite{ethereum-pq}.

%% ============================================================================