papers/post-quantum-securities/sections/02-post-quantum-algorithms.tex

\section{Post-Quantum Algorithms}

\label{sec:algorithms}
%% =====================================================================

\subsection{ML-KEM (FIPS 203): Key Encapsulation}

\begin{definition}[Module-Lattice-Based Key Encapsulation]
ML-KEM provides IND-CCA2 secure key encapsulation based on the
Module Learning With Errors (MLWE) problem.  It replaces ECDH for
key agreement.

\begin{itemize}[nosep]
  \item \textbf{KeyGen} $\rightarrow (pk, sk)$: generates a lattice-based
        key pair.
  \item \textbf{Encapsulate}$(pk) \rightarrow (ct, ss)$: produces a
        ciphertext $ct$ and shared secret $ss$.
  \item \textbf{Decapsulate}$(sk, ct) \rightarrow ss$: recovers the
        shared secret.
\end{itemize}
\end{definition}

ML-KEM is used on the Lux network for:
\begin{itemize}[nosep]
  \item Encrypted peer-to-peer communication between validators.
  \item Key agreement for threshold FHE key distribution.
  \item Secure channel establishment for MPC signing sessions.
\end{itemize}

\begin{table}[h]
\centering
\begin{tabular}{lrrrrr}
\toprule
\textbf{Level} & \textbf{$k$} & \textbf{PK (B)} & \textbf{SK (B)} &
\textbf{CT (B)} & \textbf{SS (B)} \\
\midrule
ML-KEM-512  (Level 1) & 2 & 800  & 1,632 & 768  & 32 \\
ML-KEM-768  (Level 3) & 3 & 1,184 & 2,400 & 1,088 & 32 \\
ML-KEM-1024 (Level 5) & 4 & 1,568 & 3,168 & 1,568 & 32 \\
\bottomrule
\end{tabular}
\caption{ML-KEM parameter sizes by security level.}
\label{tab:mlkem-sizes}
\end{table}

\subsection{ML-DSA (FIPS 204): Digital Signatures}

\begin{definition}[Module-Lattice-Based Digital Signature]
ML-DSA provides EUF-CMA secure digital signatures based on the MLWE
and Module-SIS problems.  It replaces ECDSA and Ed25519 for transaction
signing.

\begin{itemize}[nosep]
  \item \textbf{KeyGen} $\rightarrow (pk, sk)$: generates a lattice-based
        signing key pair.
  \item \textbf{Sign}$(sk, m) \rightarrow \sigma$: produces a signature
        on message $m$.
  \item \textbf{Verify}$(pk, m, \sigma) \rightarrow \{0, 1\}$: verifies
        the signature.
\end{itemize}
\end{definition}

ML-DSA is the primary post-quantum signature scheme for on-chain
operations: transaction signing, smart contract authorization, and
validator attestations.

\begin{table}[h]
\centering
\begin{tabular}{lrrrr}
\toprule
\textbf{Level} & \textbf{PK (B)} & \textbf{SK (B)} &
\textbf{Sig (B)} & \textbf{Security} \\
\midrule
ML-DSA-44 (Level 2) & 1,312  & 2,560  & 2,420  & 128-bit \\
ML-DSA-65 (Level 3) & 1,952  & 4,032  & 3,309  & 192-bit \\
ML-DSA-87 (Level 5) & 2,592  & 4,896  & 4,627  & 256-bit \\
\bottomrule
\end{tabular}
\caption{ML-DSA parameter sizes by security level.}
\label{tab:mldsa-sizes}
\end{table}

\subsection{SLH-DSA (FIPS 205): Hash-Based Signatures}

\begin{definition}[Stateless Hash-Based Digital Signature]
SLH-DSA provides EUF-CMA secure digital signatures based solely on the
security of hash functions.  Unlike ML-DSA (which relies on lattice
assumptions), SLH-DSA's security rests on the one-wayness and
collision-resistance of SHA-256 / SHAKE-256.  It serves as a
conservative fallback: even if lattice assumptions are broken by
future advances, SLH-DSA remains secure as long as hash functions
are secure.
\end{definition}

SLH-DSA is used for:
\begin{itemize}[nosep]
  \item Root of trust signatures (genesis block, validator set changes).
  \item Long-term archival signatures on regulatory records.
  \item Fallback signing if ML-DSA is ever weakened.
\end{itemize}

\begin{table}[h]
\centering
\begin{tabular}{lrrrr}
\toprule
\textbf{Variant} & \textbf{PK (B)} & \textbf{SK (B)} &
\textbf{Sig (B)} & \textbf{Note} \\
\midrule
SLH-DSA-128s & 32  & 64  & 7,856  & Small, slow \\
SLH-DSA-128f & 32  & 64  & 17,088 & Fast, large sig \\
SLH-DSA-192s & 48  & 96  & 16,224 & Small, slow \\
SLH-DSA-192f & 48  & 96  & 35,664 & Fast, large sig \\
SLH-DSA-256s & 64  & 128 & 29,792 & Small, slow \\
SLH-DSA-256f & 64  & 128 & 49,856 & Fast, large sig \\
\bottomrule
\end{tabular}
\caption{SLH-DSA parameter sizes.  The ``s'' variants minimize signature
size; the ``f'' variants minimize signing time.}
\label{tab:slhdsa-sizes}
\end{table}

%% =====================================================================