papers/lux-quasar-composition/sections/01-introduction.tex

\section{Introduction}
\label{sec:intro}

\subsection{The composition problem}

Post-quantum (PQ) deployment for blockchain finality is an exercise in
restraint. The temptation to ``add a PQ signature'' to an existing
classical finality protocol produces certificates that are larger,
slower, and only as strong as the weakest leg. The opposite temptation
--- to replace all classical primitives with PQ primitives in a single
swap --- discards a decade of operational experience with BLS12-381
aggregation and produces a chain whose verification cost rises by an
order of magnitude before the migration is justified by an actual
quantum threat.

The Lux Network resolves this tension by treating per-round finality as
the \emph{composition} of independent cryptographic legs, each backed
by a distinct hardness assumption, each independently verifiable, and
each scoped to a single concern. The composition object is the
\emph{QuasarCert}: a per-round wire-format certificate that carries up
to five legs --- a BLS12-381 aggregate, a Pulsar threshold ML-DSA-65
signature, a Corona threshold M-LWE signature, a Magnetar threshold
SLH-DSA signature, and a Z-Chain Groth16 rollup of per-validator
ML-DSA-65 identity signatures --- combined under a strict
``conjunctive'' verifier: every populated leg must verify, and the set
of populated legs must match the configured cert profile exactly.

Three cert profiles are defined: \textbf{Pulsar} (BLS + Pulsar; PQ
floor), \textbf{Aurora} (BLS + Pulsar + Corona; intra-lattice
diversity), and \textbf{Polaris} (BLS + Pulsar + Corona + Magnetar;
cross-family). Each profile is independently selectable per Lux chain.
The Pulsar profile is the current production posture on Lux primary
network's Q-Chain finality; Aurora and Polaris are operationally ready
constructions whose deployment is gated on independent audit of the
non-Pulsar primitives (Section~\ref{sec:production}).

\subsection{What this paper is, and what it is not}

This paper is the \emph{umbrella} specification for Quasar finality. It
complements but does not duplicate the per-primitive papers:

\begin{itemize}[leftmargin=2em,nosep]
\item LP-020~\cite{lp020} defines the Quasar consensus protocol
      (validator set, round structure, Horizon finality), the original
      three-lane wire format, and the soundness theorem for the
      BLS+Pulsar+Z-Chain composition.
\item LP-073 / Pulsar~\cite{lp073,pulsar} defines the threshold
      ML-DSA-65 primitive on its own terms (DKG, Sign1/Sign2/Combine,
      resharing, key-era lifecycle).
\item LP-073-Corona / Corona~\cite{ringtail,corona}
      defines the threshold Module-LWE primitive (Lux production fork of
      Boschini et al.~ePrint 2024/1113).
\item Magnetar~\cite{magnetar} defines the threshold SLH-DSA
      primitive (v0.1 reveal-and-aggregate, byte-equal to FIPS 205).
\item The Lean-mechanized soundness proof~\cite{quasarcertsoundness}
      and the BLS-removal analysis~\cite{pqfinalitynobls} are the
      primary formal artifacts.
\end{itemize}

The umbrella paper's job is to specify the \emph{wire-level composition}
that binds these primitives together, prove the \emph{cross-primitive
composition theorems}, and document the \emph{production deployment
topology}. It deliberately does not re-derive primitive-level
soundness; for those, the reader is referred to the source papers.

\subsection{Decomplecting finality}

Quasar's design follows a strict orthogonality discipline. Each primitive
lives in its own repository (Section~\ref{sec:impl}) and has its own
verifier; the QuasarCert is a passive container whose verification rule
is the conjunction of leg-local verifiers; the cert profile is a
single configuration value (\texttt{FinalitySchemeID}) that selects
which legs are populated; the consensus engine treats the entire
QuasarCert as a black box --- finality is reached when the cert
verifies, and the engine does not look inside it.

This is the only way to build a PQ stack that survives the
migration era. A primitive that fails (because of a cryptanalytic
break, a side-channel leak, or a NIST standardization change) must be
swappable without rebuilding the consensus engine, without changing
the wire format on the other legs, and without coupling state to the
deprecated primitive. The QuasarCert achieves this by making the
populated-leg set a runtime predicate over the cert bytes, not a
compile-time property of the consensus state machine.

\subsection{Hardness diversification, not redundancy}

The central security claim of QuasarCert is conjunctive
\emph{hardness diversification}: an adversary who forges a profile-$N$
QuasarCert must defeat the signature scheme of \emph{each} populated
leg. The Pulsar profile demands a break of BLS (co-CDH on BLS12-381,
broken in BQP by Shor~\cite{shor1994}) \emph{and} a break of threshold
ML-DSA-65 (Module-LWE/MSIS~\cite{fips204,mlwe}). The Aurora profile
demands additionally a break of Corona (M-LWE~\cite{regev2009,
ringtail}). The Polaris profile demands a break of Magnetar
(SHA3 / hash-based one-wayness via SLH-DSA~\cite{fips205}).

This is \emph{not} redundancy in the sense of running the same
operation twice. The Pulsar and Corona legs diversify \emph{within}
the lattice family --- distinct Module-LWE parameter sets and
codebases, so a parameter- or implementation-localized break need
not hit both --- while the Magnetar leg diversifies \emph{across}
families: a break against the lattice family as a whole does not
transfer to hash-based constructions. Family-disjoint hardness comes
from Magnetar, not from pairing two Module-LWE legs. The combinatorial
hardness reduction in Section~\ref{sec:composition} formalises this
claim under standard reductions.

\subsection{Roadmap}

Section~\ref{sec:prelim} fixes notation, primitive definitions, and the
hardness assumptions invoked throughout. Section~\ref{sec:wire}
specifies the QuasarCert wire format byte-for-byte against the Go
canonical at \texttt{luxfi/consensus/protocol/quasar/types.go}.
Section~\ref{sec:profiles} defines the three cert profiles and their
composition tables. Section~\ref{sec:composition} states and proves
the cross-primitive composition theorems. Section~\ref{sec:binding}
discusses how QuasarCert binds into the Lux consensus engine.
Section~\ref{sec:impl} describes the implementation, repository
layout, and pinned versions. Section~\ref{sec:eval} reports measured
cert sizes, verify times, and storage projections.
Section~\ref{sec:threat} states the threat model.
Section~\ref{sec:production} documents the production deployment
topology and the gating to Aurora and Polaris.
Section~\ref{sec:conclusion} concludes.