papers/pq/pq.tex

% PQ -- Lux Strict Post-Quantum Cryptographic Profile
% The strict-PQ profile that pins Lux's full PQ stack under one
% genesis-pinned, fail-closed security profile.

\documentclass[11pt,a4paper]{article}

\usepackage[margin=1in]{geometry}
\usepackage{amsmath, amssymb, amsthm}
\usepackage{hyperref}
\usepackage{cite}
\usepackage{microtype}
\usepackage{xcolor}
\usepackage{booktabs}
\usepackage{enumitem}
\usepackage{cleveref}
\usepackage{tikz}
\usepackage{../shared/luxcover}

\hypersetup{
  colorlinks=true,
  linkcolor=blue!50!black,
  citecolor=blue!50!black,
  urlcolor=blue!50!black,
}

\newcommand{\PQ}{\textsf{PQ}}
\newcommand{\Rq}{R_q}

\title{PQ profile\\
       \large The Strict Post-Quantum Profile of Lux Quasar}
\author{Lux Industries Inc.}
\date{2026}

\begin{document}
\luxcoverpage
\maketitle

\begin{abstract}
\textbf{Quasar} is the Lux post-quantum cryptographic stack:
\PQ{} wallets, \PQ{} transaction authorization, \PQ{} contract
authorization, \PQ{} validator identity, \PQ{} DKG, \PQ{} finality,
\PQ{} rollup proofs, \PQ{} networking, and \PQ{} governance.
\textbf{\PQ{}} is the strict-PQ \emph{boundary} of Quasar:
the ring that excludes classical crypto and enforces SHA3\_NIST,
ML-DSA, Pulsar finality, STARK / FRI proofs, ML-KEM networking,
and fail-closed verification.

\PQ{} is not the whole stack and not a new primitive. It is
the visible boundary of the eclipse --- the ring of fire where
Quasar eclipses the legacy classical stack. Toolkits remain
configurable for forks and benchmarks; the PQ boundary
itself is fail-closed.

This specification pins the boundary rules: the canonical
\texttt{ProfileID = QUASAR\_STRICT\_PQ} byte, the field-by-field
strict-PQ posture, the proof-envelope verifier gate, the
TxAuth / contract-auth / DKG / finality / networking subprofiles,
and the genesis-pinning discipline that makes operator flags
incapable of weakening the boundary at runtime.
\end{abstract}

\tableofcontents

% =====================================================================
\section{Profile, not primitive}
\label{sec:profile}
% =====================================================================

The architectural decision is a single distinction:

\begin{quote}
\emph{Quasar is the PQ stack; \PQ{} is its strict-PQ
boundary. Pulsar, Corona, P3Q, and the FIPS PQ primitives are
toolkits.}
\end{quote}

Forks can use BLAKE3, Keccak, Groth16, PLONK, ECDSA, BLS, fake
proofs, dev receipts, unsafe bridge wrappers. None of those are
\PQ{}. \PQ{} accepts only:

\begin{itemize}[leftmargin=*, itemsep=0pt]
\item ML-DSA-65 / 87 identities (FIPS~204).
\item ML-DSA-65 / 87 transaction and contract authorization, or
Z-Chain batched authorization proofs.
\item Pulsar threshold finality (M-LWE / FIPS~204-compatible).
\item ML-KEM-768 / 1024 networking channels (FIPS~203).
\item SHA3\_NIST hashes (cSHAKE, KMAC, TupleHash, ParallelHash;
FIPS~202 + SP~800-185).
\item STARK / FRI proof policy with transparent setup; no
pairings, no KZG, no Groth16/PLONK wrappers.
\item SLH-DSA cold-root / recovery (FIPS~205).
\end{itemize}

That single distinction --- toolkit vs profile --- is the entire
\PQ{} architecture.

% =====================================================================
\section{Lineage}
\label{sec:lineage}
% =====================================================================

\begin{center}\small
\begin{tabular}{l l l l}
\toprule
name & role & status & basis \\
\midrule
\textbf{Nasua}   & academic fork of Corona / Raccoon          & archived / academic-only & Module-LWE upstream tracker \\
\textbf{Corona}  & Lux M-LWE production-hardened threshold        & enabled (non-default S-class) & forks Nasua + SHA-3 + reshare \\
\textbf{Pulsar}  & Lux M-LWE / ML-DSA threshold                   & enabled (PQ profile core) & lifts Corona to $\Rq^k$, FIPS~204 byte-equal \\
\textbf{PQ profile} & full-stack strict-PQ profile (\emph{this spec}) & \emph{the profile} that binds the production stack & no new primitive; composes the above + FIPS PQ + STARK / FRI \\
\bottomrule
\end{tabular}
\end{center}

% =====================================================================
\section{Canonical profile}
\label{sec:profile-table}
% =====================================================================

\begin{center}\small
\begin{tabular}{l l}
\toprule
field & value \\
\midrule
ProfileName              & \texttt{PROFILE\_QUASAR\_STRICT\_PQ} \\
HashSuiteID              & \texttt{SHA3\_NIST} \\
WalletSchemeID           & ML-DSA-65 \\
TxAuthSchemeID           & ML-DSA-65 \textbar{} ZCHAIN\_AUTH\_PROOF \\
ContractAuthSchemeID     & ML-DSA-65 \textbar{} ML-DSA-87 \textbar{} SLH-DSA \textbar{} ZCHAIN\_AUTH\_PROOF \\
ValidatorIdentityID      & ML-DSA-65 \\
FinalitySchemeID         & Pulsar-65 \\
HighValueFinalityID      & Pulsar-87 \\
KeyExchangeID            & ML-KEM-768 default; ML-KEM-1024 high-value \\
ProofPolicyID            & \texttt{ProofPolicySTARKFRISHA3PQ} \\
RootHashBits             & 384 minimum \\
CheckpointHashBits       & 512 \\
CommitteeSizeDefault     & 64 \\
ThresholdDefault         & 43-of-64 \\
DKGCadence               & once per epoch \\
ClassicalFallbacks       & forbidden \\
\bottomrule
\end{tabular}
\end{center}

% =====================================================================
\section{Subprofiles}
\label{sec:subprofiles}
% =====================================================================

Every subprofile inherits the strict-PQ guarantees of
\S\ref{sec:profile-table}.

\begin{center}\small
\begin{tabular}{l l}
\toprule
subprofile & scope \\
\midrule
\textbf{PQ profile-ID}  & \PQ{} identity and account layer \\
\textbf{PQ profile-TX}  & \PQ{} transaction authorization \\
\textbf{PQ profile-VM}  & \PQ{} contract authorization and precompiles \\
\textbf{PQ profile-Z}   & Z-Chain \PQ{} proof / auth rollup profile \\
\textbf{PQ profile-Q}   & Q-Chain finality-block profile \\
\textbf{PQ profile-DKG} & Pulsar epoch DKG profile \\
\textbf{PQ profile-Net} & ML-KEM secure networking profile \\
\textbf{PQ profile-Gov} & \PQ{} governance / bridge / upgrade profile \\
\bottomrule
\end{tabular}
\end{center}

% =====================================================================
\section{Component map}
\label{sec:components}
% =====================================================================

\begin{center}\small
\begin{tabular}{l l l}
\toprule
layer & \PQ{} choice & purpose \\
\midrule
hash / transcript & SHA3\_NIST: SHAKE, cSHAKE, KMAC, TupleHash, ParallelHash & domain separation, roots, transcripts \\
wallet identity & ML-DSA-65 & user account keys \\
validator identity & ML-DSA-65 & validator registration + DKG identity \\
high-value identity & ML-DSA-87 / SLH-DSA & governance, bridge, emergency, upgrade roots \\
tx auth & ML-DSA-65 direct \emph{or} Z-Chain batched auth proof & user transaction authorization \\
contract auth & \PQ{} precompile / Z-Chain auth proof & replaces ECDSA permits and \texttt{ecrecover} \\
finality & Pulsar-65 (M-LWE) & threshold ML-DSA finality certs \\
high-value finality & Pulsar-87 (M-LWE) & checkpoints, bridges, governance \\
DKG & Pulsar epoch DKG & group key for Q-Chain finality \\
proofs & STARK / FRI / SHA3 (P3Q + peers) & \PQ{} rollup proofs \\
proof backends & SP1, RISC0, P3Q, Stone, Stwo behind one ABI & benchmarkable backends \\
P2P / private channels & ML-KEM-768 / 1024 (FIPS~203) & \PQ{} key establishment \\
recovery & SLH-DSA (FIPS~205) & cold, rare, long-lived trust anchors \\
\bottomrule
\end{tabular}
\end{center}

% =====================================================================
\section{PQ profile-ID: identity and account layer}
\label{sec:pq-id}
% =====================================================================

\PQ{} accounts are not Ethereum-style 20-byte addresses. The
canonical account identity is:
\[
\textsf{AccountID} = \textsc{TupleHash256}\big(\textsc{``PQ-ACCOUNT-ID-V1''},
\textit{profile\_id}, \textit{chain\_id}, \textit{scheme\_id},
\textit{pubkey}\big)[0{:}32].
\]
For high-value accounts, the SHAKE256-384 variant binds
$\textsc{``PQ-HIGH-VALUE-ACCOUNT-V1''}$ and outputs 48 bytes.
Account records live on Z-Chain:

\begin{itemize}[leftmargin=*, itemsep=0pt]
\item \texttt{account\_id}
\item \texttt{scheme\_id} (ML-DSA-65 / 87 / SLH-DSA only)
\item \texttt{compact\_public\_key}, \texttt{expanded\_public\_key\_hash} (opt.)
\item \texttt{status} $\in \{$active, rotated, revoked, frozen$\}$
\item \texttt{valid\_from\_epoch}, \texttt{valid\_until\_epoch}
\item \texttt{rotation\_policy\_hash}, \texttt{recovery\_policy\_hash}
\end{itemize}

\textbf{PQ profile accepts} only ML-DSA-65, ML-DSA-87, SLH-DSA keys.
\textbf{PQ profile rejects} ECDSA, secp256k1-only, P-256-only WebAuthn,
and BLS account-auth keys.

% =====================================================================
\section{PQ profile-TX: PQ transaction authorization}
\label{sec:pq-tx}
% =====================================================================

Every transaction carries a self-describing auth envelope:

\begin{verbatim}
TxAuthEnvelope {
  version
  profile_id           = PROFILE_QUASAR_STRICT_PQ
  chain_id, network_id
  account_id
  nonce
  expiry_height
  auth_scheme_id       = ML_DSA_65 | ZCHAIN_AUTH_PROOF
  hash_suite_id        = SHA3_NIST
  public_key_ref
  signature_or_proof_ref
  tx_digest
}
\end{verbatim}

\noindent
The digest is \textsc{TupleHash256}(\texttt{``PQ-TX-AUTH-V1''},
profile\_id, chain\_id, network\_id, account\_id, nonce,
expiry\_height, fee\_payer, gas\_limit, max\_fee, call\_target,
call\_value, call\_data\_hash, zchain\_state\_root). Two paths
accepted: direct ML-DSA-65 signature, or a Z-Chain batched
authorization proof that lets wallets sign with ML-DSA while the
hot path stays small.

% =====================================================================
\section{PQ profile-VM: PQ contracts}
\label{sec:pq-vm}
% =====================================================================

Contracts must stop depending on \texttt{ecrecover}. \PQ{} VM
host functions:

\begin{verbatim}
pq_verify_mldsa65(pk_ref_or_pk, digest, sig) -> bool
pq_verify_mldsa87(pk_ref_or_pk, digest, sig) -> bool
pq_verify_slh_dsa(pk_ref_or_pk, digest, sig) -> bool
pq_verify_z_auth_proof(account_id, digest, tx_auth_root, proof_ref) -> bool
pq_account_id_from_pubkey(scheme_id, pubkey) -> account_id
\end{verbatim}

\noindent
Contract auth profile defaults under \PQ{}: \texttt{admin =
upgrade = ML-DSA-87 or SLH-DSA}; \texttt{pause = ML-DSA-65 multisig
or Pulsar committee}; \texttt{permit = ML-DSA-65 or
ZCHAIN\_AUTH\_PROOF}; \texttt{allow\_classical\_auth = false}.

The \texttt{PQPermit} envelope replaces ECDSA EIP-2612 permits and
carries
$\{\textit{profile\_id}, \textit{chain\_id},
\textit{verifying\_contract}, \textit{owner\_account\_id},
\textit{spender}, \textit{value}, \textit{nonce},
\textit{deadline}, \textit{auth\_scheme\_id},
\textit{hash\_suite\_id},
\textit{signature\_or\_zproof\_ref}\}$.

% =====================================================================
\section{PQ profile-Z: PQ Z-Chain profile}
\label{sec:pq-z}
% =====================================================================

Z-Chain is not a general EVM rollup in \PQ{} core. It is a
\PQ{} authorization and state-proof rollup. It proves wallet key
registration, rotation, revocation, session-key authorization,
contract-policy updates, batched transaction-signature validity,
batched \PQ{} permits, validator identity validity, committee
selection, DKG transcript-root acceptance, group public-key
binding, and epoch commitment construction.

Public roots committed by Z-Chain:

\begin{itemize}[leftmargin=*, itemsep=0pt]
\item \texttt{identity\_root}, \texttt{account\_key\_root},
\texttt{revocation\_root}, \texttt{session\_key\_root}
\item \texttt{contract\_policy\_root}, \texttt{tx\_auth\_root},
\texttt{permit\_auth\_root}
\item \texttt{validator\_registry\_root}, \texttt{stake\_weight\_root},
\texttt{committee\_root}
\item \texttt{dkg\_transcript\_root}, \texttt{group\_public\_key\_hash}
\end{itemize}

\noindent
Proof policy: \texttt{ProofPolicyID = ProofPolicySTARKFRISHA3PQ}.
Allowed proof backends: SP1\_COMPRESSED\_STARK,
RISC0\_SUCCINCT\_STARK, P3Q\_PLONKY3\_STARK\_FRI,
STONE\_CAIRO\_STARK\_CPP, STWO\_CIRCLE\_STARK. STARK / FRI is the
right proof family for \PQ{}: hash-based, transparent setup,
no pairings, no KZG, no trusted setup. SP1 and RISC0 are allowed
only along their STARK paths; their Groth16 / PLONK wrappers are
classical-SNARK fallbacks and \PQ{} rejects them.

% =====================================================================
\section{P3Q: canonical long-term proof backend}
\label{sec:p3q}
% =====================================================================

P3Q is the Lux strict-PQ Plonky3 profile / fork. P3Q permits STARK,
FRI, Merkle / hash commitments, transparent setup, STARK-native
recursion, and external SHA3 / SHAKE / cSHAKE roots. P3Q forbids
BN254, KZG, Groth16, PLONK/KZG, pairings, elliptic-curve recursion,
and trusted setup. The distinction matters because Plonky3 is a
general polynomial-IOP toolkit; \PQ{} pins a strict subset of
it rather than inheriting the whole toolkit unchecked.

Stone (Cairo CPU AIR, C++, Apache-2.0) and Stwo (Circle STARK,
Rust) are useful independent STARK backends and slot into the same
\texttt{ProofBackendID} surface alongside P3Q.

% =====================================================================
\section{PQ profile-Q: Q-Chain finality profile}
\label{sec:pq-q}
% =====================================================================

Q-Chain is the compact finality lane. Each Q-Block carries no raw
wallet keys, no raw validator keys, no raw transaction signatures,
no raw DKG messages, no full Z-Chain witness data, and no
classical fallback certs. Its transcript binds (no unbound field,
no silent fallback, no ``best effort''):

\begin{itemize}[leftmargin=*, itemsep=0pt]
\item \texttt{profile\_id}, \texttt{hash\_suite\_id},
\texttt{proof\_policy\_id}, \texttt{finality\_scheme\_id}
\item \texttt{network\_id}, \texttt{chain\_id}, \texttt{epoch},
\texttt{height}, \texttt{round\_or\_view},
\texttt{parent\_qblock\_hash}
\item \texttt{lux\_state\_root}, \texttt{zchain\_state\_root},
\texttt{tx\_auth\_root}, \texttt{payload\_root},
\texttt{da\_root}
\item \texttt{committee\_root}, \texttt{dkg\_transcript\_root},
\texttt{group\_public\_key\_hash}
\item \texttt{signer\_bitmap\_or\_weight\_commitment}
\end{itemize}

Each Q-Block carries a single Pulsar-65 threshold finality
certificate over the digest. High-value checkpoints use Pulsar-87.

% =====================================================================
\section{PQ profile-DKG: Pulsar finality}
\label{sec:pq-dkg}
% =====================================================================

\begin{center}\small
\begin{tabular}{l l}
\toprule
primitive & Pulsar \\
base & ML-DSA / FIPS~204-compatible \\
NIST target & MPTC Class N1 + N4 \\
default profile & Pulsar-65 \\
high-value profile & Pulsar-87 \\
committee size & 64 \\
threshold & 43-of-64 \\
DKG cadence & once per epoch \\
abort model & identifiable abort \\
fallback & bounded previous-epoch grace only \\
classical fallback & forbidden \\
\bottomrule
\end{tabular}
\end{center}

\noindent
Flow: (1) Z-Chain proves validator registry and committee root;
(2) committee runs Pulsar epoch DKG; (3) DKG transcript root and
group public-key hash are committed to Z-Chain; (4) Q-Chain
accepts finality blocks only under the committed group key; (5)
each Q-Block carries a Pulsar-65 threshold finality certificate.

The NIST-facing statement stays narrow: \emph{Pulsar is a threshold
ML-DSA signing and DKG system targeting NIST MPTC Class N1 + N4,
with final signatures intended to verify under unmodified FIPS~204
ML-DSA verification}. The claim is scoped to the signing primitive,
not to the chain as a whole.

% =====================================================================
\section{PQ profile-Net: PQ networking}
\label{sec:pq-net}
% =====================================================================

\begin{center}\small
\begin{tabular}{l l}
\toprule
node identity & ML-DSA-65 \\
validator identity & ML-DSA-65 \\
session KEX & ML-KEM-768 (FIPS~203) \\
validator / DKG KEX & ML-KEM-1024 preferred \\
transcript hash & SHA3\_NIST / cSHAKE \\
channel binding & KMAC / TupleHash \\
transport AEAD & FIPS-approved AEAD inside module boundary \\
\bottomrule
\end{tabular}
\end{center}

\textbf{PQ profile rejects} ECDH-only validator channels,
classical-only node identity, unauthenticated DKG transport, and
unbound session transcripts.

% =====================================================================
\section{PQ profile-Gov: governance, bridge, upgrades}
\label{sec:pq-gov}
% =====================================================================

Stronger / slower keys for rare high-value actions:

\begin{itemize}[leftmargin=*, itemsep=0pt]
\item Governance key: ML-DSA-87 or SLH-DSA.
\item Bridge admin key: ML-DSA-87 or SLH-DSA.
\item Upgrade key: SLH-DSA or ML-DSA-87 multisig.
\item Emergency pause: Pulsar committee or ML-DSA-87 multisig.
\item Checkpoint root: Pulsar-87.
\end{itemize}

\noindent
SLH-DSA (FIPS~205) is the right cold-root because it is stateless
and hash-based. A bridge is \PQ{}-grade only if \emph{both
ends} are \PQ{}; otherwise the bridge must carry
\texttt{POST\_QUANTUM\_END\_TO\_END = false} and
\texttt{QUASAR\_STRICT = false}.

% =====================================================================
\section{Proof envelope}
\label{sec:proof-envelope}
% =====================================================================

Every proof backend maps into one canonical envelope:

\begin{verbatim}
ZProofEnvelope {
  version
  profile_id, chain_id, network_id, epoch
  proof_policy_id, proof_backend_id, proof_format_id, verifier_id
  hash_suite_id, identity_scheme_id, finality_scheme_id
  public_inputs_hash, verifier_key_hash
  program_or_air_id, program_or_air_hash
  soundness_bits_claimed, hash_output_bits
  transparent_setup
  uses_pairings, uses_kzg, uses_trusted_setup,
  uses_classical_snark_wrapper
  proof_bytes
}
\end{verbatim}

\noindent
\PQ{} verifier gate: refuse the envelope unless
\texttt{profile\_id == QUASAR\_STRICT\_PQ},
\texttt{hash\_suite\_id == SHA3\_NIST},
\texttt{proof\_policy\_id == STARK\_FRI\_SHA3\_PQ},
\texttt{proof\_backend\_id} is in the allowed list,
\texttt{soundness\_bits\_claimed} $\geq 128$,
\texttt{hash\_output\_bits} $\geq 384$,
\texttt{transparent\_setup} is true,
\texttt{uses\_pairings = uses\_kzg = uses\_trusted\_setup =
uses\_classical\_snark\_wrapper = false}.

The backend cannot self-certify these flags. They are pinned by a
\texttt{VerifierManifest} signed by the chain governance:

\begin{verbatim}
VerifierManifest {
  verifier_id, backend_id, source_commit, build_profile
  verifier_key_hash, program_or_air_hash
  supports_policy_ids
  reviewed_soundness_bits
  uses_pairings, uses_kzg, uses_trusted_setup,
  uses_classical_snark_wrapper
}
\end{verbatim}

% =====================================================================
\section{Genesis profile}
\label{sec:genesis}
% =====================================================================

\PQ{} is locked at genesis. Operator flags must not override
this:

\begin{verbatim}
GenesisSecurityProfile {
  profile_id, profile_name, profile_hash
  hash_suite_id
  wallet_scheme_id, tx_auth_scheme_id, contract_auth_scheme_id
  validator_identity_id, finality_scheme_id, high_value_scheme_id
  proof_policy_id, allowed_proof_backends
  min_soundness_bits, min_hash_output_bits
  forbid_pairings, forbid_kzg, forbid_trusted_setup
  forbid_classical_snarks, forbid_classical_signatures
  forbid_bls_fallback, forbid_dev_proofs
}
\end{verbatim}

Allowed mainnet command-line shapes:

\begin{verbatim}
luxd --network lux-mainnet --role validator --datadir /var/lib/lux
zchain-prover --backend sp1 --profile pq-strict-pq
zchain-bench --all-backends --profile pq-strict-pq
\end{verbatim}

Forbidden on mainnet:

\begin{verbatim}
--hash-suite blake3
--allow-ecdsa
--allow-groth16
--allow-kzg
--allow-bls-fallback
--accept-dev-proof
--lower-threshold
\end{verbatim}

% =====================================================================
\section{What PQ profile eclipses}
\label{sec:eclipses}
% =====================================================================

\begin{center}\small
\begin{tabular}{l l}
\toprule
prior path & \PQ{} status \\
\midrule
Nasua             & archived / academic tracker only \\
Corona            & legacy production M-LWE line; optional non-NIST Class~S; \emph{not} \PQ{} default \\
Pulsar            & core \PQ{} finality primitive; M-LWE / ML-DSA-compatible; NIST-facing \\
BLS               & removed from strict finality; compatibility only outside \PQ{} \\
ECDSA             & removed from wallets / contracts in strict mode; compatibility only outside \PQ{} \\
Groth16 / PLONK / KZG & removed from strict Z-Chain; compatibility only outside \PQ{} \\
BLAKE3            & non-normative legacy / benchmark profile only \\
\bottomrule
\end{tabular}
\end{center}

\PQ{} is the ring of fire around the old stack: the eclipse
boundary where classical assumptions disappear.

% =====================================================================
\section{Implementation order}
\label{sec:impl-order}
% =====================================================================

From the current state, the implementation order is:

\begin{enumerate}[leftmargin=*, itemsep=0pt]
\item \textbf{Close F22} --- Pulsar must use SHA3\_NIST HashSuite
internally by default.
\item \textbf{Close F34} --- Q-Chain digest must bind
\texttt{hash\_suite\_id}, \texttt{sig\_scheme\_id},
\texttt{proof\_policy\_id}, \texttt{committee\_root},
\texttt{dkg\_transcript\_root}, \texttt{group\_public\_key\_hash},
and \texttt{profile\_id}.
\item Add the \PQ{} profile object; genesis-pinned,
hash-checked, zero-value-invalid.
\item Split proof IDs: \texttt{ProofPolicyID},
\texttt{ProofBackendID}, \texttt{ProofFormatID},
\texttt{VerifierID}.
\item Add \texttt{ZProofEnvelope}; one envelope for SP1, RISC0,
P3Q, Stone, Stwo.
\item Add \texttt{TxAuthEnvelope}; ML-DSA-65 direct and
\texttt{ZCHAIN\_AUTH\_PROOF} paths.
\item Add \PQ{} account registry; account keys, rotations,
revocations, sessions, contract policy.
\item Add \PQ{} VM host functions; ML-DSA / SLH-DSA verification,
Z-auth proof verification.
\item Disable classical auth in \PQ{}; \texttt{ecrecover}
/ ECDSA / BLS / KZG / Groth16 rejected.
\item Add \PQ{} status labels to RPC, explorer, metrics,
block headers.
\end{enumerate}

% =====================================================================
\section{Final definition}
\label{sec:final}
% =====================================================================

\begin{quote}
\PQ{} is Lux's strict end-to-end post-quantum cryptographic
stack. It binds ML-DSA wallets, \PQ{} transaction authorization,
\PQ{} contract authorization, Z-Chain STARK / FRI / SHA3 proofs,
Q-Chain Pulsar finality, epoch DKG, ML-KEM networking, and
SLH-DSA high-value recovery under one genesis-pinned profile.
Toolkits remain configurable for forks; \PQ{} itself is
fail-closed, SHA3\_NIST, FIPS-forward, NIST-friendly, and rejects
every classical authorization or proof path.
\end{quote}

\begin{thebibliography}{99}

\bibitem{fips202}
National Institute of Standards and Technology.
\newblock SHA-3 Standard: Permutation-Based Hash and
Extendable-Output Functions (FIPS~202).
\newblock 2015.

\bibitem{sp800-185}
National Institute of Standards and Technology.
\newblock SP~800-185: SHA-3 Derived Functions: cSHAKE, KMAC,
TupleHash, ParallelHash.
\newblock 2016.

\bibitem{fips203}
National Institute of Standards and Technology.
\newblock Module-Lattice-Based Key-Encapsulation Mechanism
Standard (FIPS~203, ML-KEM).
\newblock 2024.

\bibitem{fips204}
National Institute of Standards and Technology.
\newblock Module-Lattice-Based Digital Signature Standard
(FIPS~204, ML-DSA).
\newblock 2024.

\bibitem{fips205}
National Institute of Standards and Technology.
\newblock Stateless Hash-Based Digital Signature Standard
(FIPS~205, SLH-DSA).
\newblock 2024.

\bibitem{ir-8214c}
National Institute of Standards and Technology.
\newblock First Call for Multi-Party Threshold Schemes (NIST
IR~8214C).
\newblock 2026.

\bibitem{pulsar}
Lux Industries Inc.
\newblock Pulsar: Threshold ML-DSA over Module-LWE with FIPS~204
output interchangeability.
\newblock \texttt{github.com/luxfi/pulsar}.

\bibitem{corona}
Lux Industries Inc.
\newblock Corona: Production Module-LWE threshold signatures (legacy
non-default S-class path).
\newblock \texttt{github.com/luxfi/corona}.

\bibitem{nasua}
Lux Industries Inc.
\newblock Nasua: archived academic fork of Corona / Raccoon.
\newblock \texttt{github.com/luxfi/nasua}.

\bibitem{stark}
E.~Ben-Sasson, I.~Bentov, Y.~Horesh, M.~Riabzev.
\newblock Scalable, transparent, and post-quantum secure
computational integrity.
\newblock IACR ePrint 2018/046.

\bibitem{plonky3}
Polygon Labs et~al.
\newblock Plonky3.
\newblock \texttt{github.com/Plonky3/Plonky3}.

\end{thebibliography}

\end{document}