mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekayandHanzo Dev
70f6883235
A July commit removed eight papers on the premise "no license — DEX/non-custodial only". That premise is wrong: Lux operates an ATS, a broker-dealer, a transfer agent and a bank, and this material is resold at lux.financial. The merge that brought main in preserved the removal because the commit stated a reason, which is how a stale reason outlives the fact it rested on. Back, at the versions main carried — main never received the removal, so its copies are the later ones: the ATS architecture, the security-token standard, smart order routing, institutional custody, MPC custody, post-quantum securities, the SSB partnership and the CoinBridge brief. 83 files. Co-authored-by: Hanzo Dev <[email protected]>
65 lines
2.8 KiB
TeX
65 lines
2.8 KiB
TeX
\section{Hybrid Migration Path}
|
|
|
|
\label{sec:hybrid}
|
|
%% =====================================================================
|
|
|
|
Immediate full migration to post-quantum signatures is impractical:
|
|
existing wallets, hardware devices, and tooling use ECDSA. The Lux
|
|
network implements a hybrid signature scheme for the transition period.
|
|
|
|
\begin{definition}[Hybrid Signature]
|
|
A hybrid signature on message $m$ is a pair
|
|
$(\sigma_{\text{ECDSA}}, \sigma_{\text{ML-DSA}})$ where:
|
|
\begin{itemize}[nosep]
|
|
\item $\sigma_{\text{ECDSA}} = \mathsf{ECDSA.Sign}(sk_{\text{ECDSA}}, m)$
|
|
\item $\sigma_{\text{ML-DSA}} = \mathsf{ML\text{-}DSA.Sign}(sk_{\text{ML-DSA}}, m)$
|
|
\end{itemize}
|
|
The chain accepts the transaction if \emph{either} signature verifies.
|
|
\end{definition}
|
|
|
|
\begin{theorem}[Hybrid Security: Best of Both Worlds]
|
|
\label{thm:hybrid}
|
|
The hybrid signature scheme is EUF-CMA secure as long as either
|
|
ECDSA (under the ECDLP assumption) or ML-DSA (under the MLWE/MSIS
|
|
assumptions) is EUF-CMA secure.
|
|
\end{theorem}
|
|
|
|
\begin{proof}
|
|
Suppose an adversary $\mathcal{A}$ forges a hybrid signature
|
|
$(\sigma^*_{\text{ECDSA}}, \sigma^*_{\text{ML-DSA}})$ on a new message
|
|
$m^*$. For the forgery to be accepted, at least one of
|
|
$\sigma^*_{\text{ECDSA}}$ or $\sigma^*_{\text{ML-DSA}}$ must verify.
|
|
If $\sigma^*_{\text{ECDSA}}$ verifies, then $\mathcal{A}$ has forged an
|
|
ECDSA signature, contradicting the ECDLP assumption. If
|
|
$\sigma^*_{\text{ML-DSA}}$ verifies, then $\mathcal{A}$ has forged an
|
|
ML-DSA signature, contradicting the MLWE/MSIS assumptions. Therefore,
|
|
the forgery probability is at most
|
|
$\epsilon_{\text{ECDSA}} + \epsilon_{\text{ML-DSA}}$, which is
|
|
negligible as long as either $\epsilon_{\text{ECDSA}}$ or
|
|
$\epsilon_{\text{ML-DSA}}$ is negligible.
|
|
\end{proof}
|
|
|
|
\subsection{Migration Phases}
|
|
|
|
\begin{enumerate}[nosep]
|
|
\item \textbf{Phase 0 (current).} Both classical and PQ precompiles
|
|
are available. Transactions may use either. Most users
|
|
continue with ECDSA.
|
|
\item \textbf{Phase 1 (recommended).} Wallets begin generating
|
|
hybrid key pairs (one ECDSA + one ML-DSA) and attaching hybrid
|
|
signatures to transactions. Either signature is accepted.
|
|
\item \textbf{Phase 2 (transition).} The chain begins requiring
|
|
ML-DSA signatures on high-value operations (e.g., token
|
|
issuance, validator registration). ECDSA remains valid for
|
|
standard transfers.
|
|
\item \textbf{Phase 3 (post-quantum).} When CRQCs are imminent or
|
|
operational, the chain deprecates ECDSA-only transactions.
|
|
Only ML-DSA or hybrid signatures are accepted.
|
|
\end{enumerate}
|
|
|
|
The key insight is that Phase~0 is already active: the precompiles
|
|
exist at genesis. No hard fork is needed to enable post-quantum
|
|
cryptography. The migration is purely a wallet-side upgrade.
|
|
|
|
%% =====================================================================
|