proofs/pq-finality-no-bls.tex

\documentclass[11pt]{article}
\usepackage[utf8]{inputenc}
\usepackage{amsmath, amssymb, amsthm}
\usepackage{booktabs}
\usepackage{hyperref}
\usepackage{graphicx}
\usepackage{geometry}
\geometry{margin=1in}

\newtheorem{theorem}{Theorem}
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{definition}[theorem]{Definition}
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{remark}[theorem]{Remark}

\title{Post-Quantum Finality for Lux Quasar \\ {\large Replacing BLS Aggregation with ML-DSA + Corona}}
\author{Lux Research \\
\textit{Lux Industries Research}}
\date{2026-04-13}

\begin{document}
\maketitle

\begin{abstract}
The current Quasar consensus certificate combines BLS12-381 aggregation with
the Corona and ML-DSA lattice threshold signatures for ``defense in
depth.'' We show
that BLS contributes no post-quantum security to the combined cert and
can be removed without loss of PQ soundness. The simplified Quasar
certificate uses only $\mathsf{ML\text{-}DSA}$ (FIPS 204, Module-LWE/MSIS)
and $\mathsf{Corona}$ (a Module-LWE threshold signature, the Lux fork of
Ringtail (Boschini et al., IACR ePrint 2024/1113; see Related Work):
module dimensions $M=8$, $N=7$ over
$R_q = \mathbb{Z}_q[X]/(X^{256}+1)$, $q = \mathtt{0x1000000004A01}$,
$\sigma_E = 6.108$, NIST Category~1) --- two independent
lattice instances, each post-quantum. The result is operationally simpler,
smaller in the common case, and provably PQ-safe under either instance
independently.

\paragraph{Naming.} ``Corona'' is the Lux first-party fork of Ringtail
(Boschini et al., IACR ePrint 2024/1113; see Related Work), the
two-round Module-LWE threshold signature;
Corona adds a permissionless leaderless DKG, verifiable resharing,
activation cert, and rollback suitable for validator rotation (LP-4440 /
\texttt{github.com/luxfi/corona}). ``Pulsar'' (LP-073 /
\texttt{github.com/luxfi/pulsar}) is a \emph{separate} Module-LWE
threshold scheme, parameterised to be byte-equal to FIPS~204 ML-DSA-65;
it is not a fork of Corona, nor is Corona a fork of it. Both are
Module-LWE --- their diversity is parameter regime and lifecycle, not
lattice family. The soundness arguments below apply to either signing
primitive.

This document specifies:
\begin{enumerate}
  \item the reduced three-layer Quasar cert: per-block committee cert,
        per-epoch Pulsar pulse, per-era Z-chain ZK proof;
  \item the security argument (forgery requires breaking both
        independent Module-LWE instances --- ML-DSA's and Corona's);
  \item concrete efficiency numbers measured on MacBook M3 / arm64;
  \item why a fixed-size committee of $k=128$ is scale-invariant from
        $N=10^3$ to $N=10^5$ validators.
\end{enumerate}
\end{abstract}

\section{Motivation}

The classical BLS12-381 pairing-based aggregate signature is broken in
polynomial time by a sufficiently large quantum computer (Shor's algorithm
on the discrete log in $\mathbb{F}_{q^{12}}$). Including BLS in a
``PQ-safe'' finality cert therefore provides only a classical speed-up;
it cannot contribute to the post-quantum security argument.

This leaves Quasar with three natural reasons to keep BLS:
\begin{enumerate}
  \item \textbf{Speed}: classical verification of a BLS aggregate is ${\sim}$1 ms.
  \item \textbf{Size}: a BLS aggregate is 48 bytes; 128 individual ML-DSA
        signatures are $128 \times 2420 = 309{,}760$ bytes.
  \item \textbf{Hedge}: if all lattice assumptions break simultaneously,
        BLS still holds until a quantum attacker materialises.
\end{enumerate}

Against these we weigh:
\begin{itemize}
  \item \textbf{False sense of security}: operators reading ``PQ cert''
        may assume the cert is PQ when in fact it is only PQ conditional
        on verifying the lattice component.
  \item \textbf{Complexity cost}: three independent crypto stacks
        (BLS pairing, plus two distinct Module-LWE instances --- ML-DSA
        and Corona) to maintain, benchmark, and audit.
  \item \textbf{PQ-first deployments}: networks that explicitly reject
        any classical primitive (regulated finance, long-archival chains)
        cannot use the BLS-inclusive cert at all.
\end{itemize}

We conclude the hedge argument does not justify the complexity and drop
BLS.

\section{Reduced Quasar Certificate}

\subsection{Per-block committee certificate (hot path)}

For each block at height $h$:
\begin{enumerate}
  \item A committee $C_h \subset \mathcal{V}$ of size $k = 128$ is sampled
        from the validator set $\mathcal{V}$ (of size $N$) via a
        post-quantum VRF:
        \[
          C_h = \textsf{Sample}_{\textsf{VRF}}\!\left(\textsf{prev\_hash} \,\|\, h; \textsf{stake}\right).
        \]
        The VRF uses a lattice-based construction (or $\mathsf{ML\text{-}DSA}$
        itself as a hash-based VRF, with unpredictability in the ROM).
  \item Each $v_i \in C_h$ signs the block header $B_h$ with its individual
        $\mathsf{ML\text{-}DSA}\text{-}65$ key:
        \[
          \sigma_i = \mathsf{ML\text{-}DSA.Sign}(sk_i, B_h).
        \]
  \item The block carries $\textsf{cert}_h = \big(C_h^{\textsf{bitmap}}, (\sigma_i)_{i \in C_h^{\textsf{signed}}}\big)$.
  \item A block is considered \emph{locally final} iff
        $|C_h^{\textsf{signed}}| \geq \lceil 2k/3 \rceil$.
\end{enumerate}

This cert is $\leq 128 \times 2420 = 309{,}760$ bytes and verifies in
$\sim 5$ ms on commodity hardware (measured below).

\subsection{Per-epoch Corona aggregate (warm path)}

An \emph{epoch} spans $E$ blocks (target: $E = 128$, one hour at 30-second
block times). At the end of each epoch, the committee that signed block
$h_{\text{end}}$ produces a $\mathsf{Corona}$ threshold signature over
the epoch tail Merkle root:
\[
  \sigma_{\text{epoch}} = \mathsf{Corona.Combine}\!\Big(\big(\mathsf{Corona.Sign}_i(r_{\text{epoch}})\big)_{i \in C_{h_{\text{end}}}^{\textsf{signed}}}\Big),
\]
where $r_{\text{epoch}}$ is the Merkle root over $\{B_h\}_{h \in \text{epoch}}$.
$\sigma_{\text{epoch}}$ is $\sim 5$--$10$ kB regardless of epoch length.

Once an epoch aggregate is available, validators may prune the individual
block certs inside the epoch; archival nodes keep them for auditability.

\subsection{Per-era Z-chain ZK proof (cold path)}

An \emph{era} spans $R$ epochs (target: $R = 168$, one week at hourly epochs).
At the end of each era, a Groth16 or PLONK proof $\pi_{\text{era}}$ is
produced on the Z-chain proving:
\[
  \pi_{\text{era}} : \exists\ (C_h, \sigma_h)_{h \in \text{era}}\ \ \text{s.t.}\ \ \bigwedge_h \mathsf{QuasarVerify}(B_h, C_h, \sigma_h) = 1.
\]
$\pi_{\text{era}}$ is $\leq 200$ bytes and verifies in $\sim 3$ ms.
Light clients sync by downloading era proofs, not block certs.

\section{Scheme-agnostic certificate and the signature registry}
\label{sec:scheme-agnostic}

The committee certificate of the previous section
is written with $\mathsf{ML\text{-}DSA}\text{-}65$ as the per-signer
primitive. In the shipped engine the primitive is \emph{not} baked into
the consensus rule: the engine defines only the \emph{quorum predicate}
(a stake-weighted $\tfrac23$ rule), and the node injects the per-signer
signature scheme as a wire-tagged parameter. This decoupling is what
makes the classical$\to$PQ migration a configuration flip rather than a
protocol change, and it is the object this section formalises.

\begin{definition}[Signature-scheme registry]
\label{def:sigscheme-registry}
A one-byte identifier $\mathsf{SigSchemeID} \in \{0,\dots,255\}$ names
the scheme that produced a signature slot of a Quasar certificate. The
registry (\texttt{config/pq\_mode.go}) is block-structured and
open-ended:
\[
\begin{array}{ll}
\texttt{0x00} & \text{none (BLS-only certs commit to no scheme)}\\
\texttt{0x10} & \mathsf{BLS12\text{-}381}\ \text{aggregate (classical, day-1)}\\
\texttt{0x20} & \text{Nasua / academic R\text{-}LWE threshold (BLAKE3 profile)}\\
\texttt{0x30} & \mathsf{Pulsar.R}\ \text{production R\text{-}LWE threshold}\\
\texttt{0x41/42/43} & \text{raw } \mathsf{ML\text{-}DSA}\text{-}44/65/87\ \text{(FIPS 204, single-party)}\\
\texttt{0x51/52/53} & \mathsf{Pulsar\text{-}M}\text{-}44/65/87\ \text{(M\text{-}LWE threshold)}\\
\end{array}
\]
$\texttt{0x52}$ ($\mathsf{Pulsar\text{-}M}\text{-}65$) is the production PQ
default. The $\texttt{0x40}$ and $\texttt{0x50}$ blocks are kept distinct
on purpose: both verify under the \emph{unmodified} FIPS 204
$\mathsf{ML\text{-}DSA.Verify}$ relation, but the producing protocol
differs (single-party vs.\ threshold), and the wire separates them so a
receiver knows which kernel emitted the bytes. New entries claim the
next free integer in their block and are pinned in a test vector before
any code references them; a retired id is never reused.
\end{definition}

\begin{definition}[Scheme-parametric quorum predicate]
\label{def:scheme-predicate}
Let $s = \mathsf{SigSchemeID}$ and let $\mathsf{Verify}_s$ be its
verification relation. A certificate
$\mathsf{cert} = (s, \mathsf{pos}, \{(\mathsf{id}_i, \sigma_i)\}_{i\in T})$
for position $\mathsf{pos}$ (chain, height, round, canonical commitment
$C$, set-root) is accepted iff
\[
  \mathsf{Prism}_s(\mathsf{cert}) \;=\;
  \Big[\ \textstyle\sum_{i\in T}\mathrm{stk}(\mathsf{id}_i)\ \ge\ \tau S\ \Big]
  \ \wedge\
  \bigwedge_{i\in T}\mathsf{Verify}_s\!\big(pk_{\mathsf{id}_i},\ \mu(\mathsf{pos},s),\ \sigma_i\big)
  \ \wedge\ \Phi_{\mathrm{set}},
\]
where $\tau \ge 2/3$, $\Phi_{\mathrm{set}}$ asserts each $\mathsf{id}_i$
is a distinct, current member of the validator set committed by
$\mathsf{pos}$'s set-root, and $\mu(\mathsf{pos},s)$ is the signed
transcript of Definition~\ref{def:transcript-binding}. The
\emph{quorum rule} --- the bracketed stake test and $\Phi_{\mathrm{set}}$
--- is independent of $s$; only the per-signer relation
$\mathsf{Verify}_s$ and the transcript tag depend on it.
\end{definition}

\begin{definition}[Scheme-bound transcript]
\label{def:transcript-binding}
The message each signer signs binds the scheme id into the domain-
separated transcript:
\[
  \mu(\mathsf{pos}, s) \;=\;
  \mathsf{H}\big(\texttt{"LUX/chain/vote/v2"} \,\|\, \mathsf{chainID}
    \,\|\, \mathsf{height} \,\|\, \mathsf{round} \,\|\, C
    \,\|\, \mathsf{parentC} \,\|\, \mathsf{setRoot}
    \,\|\, s \,\|\, \mathsf{hashSuite}\big),
\]
with $\mathsf{H}$ a domain-separated SHAKE256 sponge (FIPS 202). The
scheme id $s$ and the hash-suite id are covered bytes, not envelope
metadata.
\end{definition}

\begin{lemma}[Cross-suite confusion resistance]
\label{lem:cross-suite}
Let $s \ne s'$. An adversary who takes a certificate honestly produced
under scheme $s$ and re-labels it $s'$ (or splices a scheme-$s'$
signature into a scheme-$s$ position) produces a certificate that fails
$\mathsf{Prism}_{s'}$ except with probability at most the EUF-CMA
advantage against the underlying scheme.
\end{lemma}
\begin{proof}
$\mathsf{Prism}_{s'}$ recomputes the transcript as $\mu(\mathsf{pos}, s')$
and checks $\mathsf{Verify}_{s'}(pk_i, \mu(\mathsf{pos}, s'), \sigma_i)$.
The honest signers signed $\mu(\mathsf{pos}, s)$, and $s$ is a covered
input to $\mathsf{H}$, so $\mu(\mathsf{pos}, s') \ne \mu(\mathsf{pos}, s)$
except for a collision of $\mathsf{H}$ (negligible under FIPS 202
collision resistance). Thus $\sigma_i$ is a signature on a
\emph{different} message than the one $\mathsf{Verify}_{s'}$ checks;
producing a $\sigma_i$ that verifies on $\mu(\mathsf{pos}, s')$ under
$pk_i$ is exactly an EUF-CMA forgery against scheme $s'$. The confusion
attack therefore fails on \emph{signature verification}, not merely on a
byte-equality tag check --- the defense is cryptographic, not
syntactic.
\end{proof}

\begin{proposition}[PQ migration is a profile flip]
\label{prop:profile-flip}
Fix a validator set and stake distribution. Let
$\mathsf{Prism}_s, \mathsf{Prism}_{s'}$ be the predicates of
Definition~\ref{def:scheme-predicate} under schemes $s, s'$ (e.g.\
$s=\texttt{0x10}$ classical BLS, $s'=\texttt{0x42}$ raw
$\mathsf{ML\text{-}DSA}\text{-}65$, or $s'=\texttt{0x52}$
$\mathsf{Pulsar\text{-}M}\text{-}65$). Then the safety analysis --- the
quorum-intersection argument of Theorem~\ref{thm:soundness} and of the
no-double-finalization theorem
(\texttt{quasar-cert-soundness.tex}, \S``Finality Admission'') --- is
\emph{invariant} under the substitution $s \mapsto s'$; only the
per-signer forgery bound changes from $\epsilon_s$ to $\epsilon_{s'}$.
\end{proposition}
\begin{proof}
Both theorems use only two facts about the per-signer scheme: (i) that
$\mathsf{Prism}$ accepts iff signer stake $\ge \tau S$ over distinct
current set members --- the quorum rule, which
Definition~\ref{def:scheme-predicate} makes independent of $s$; and (ii)
that an honest validator's signature on one transcript cannot be forged,
i.e.\ $\mathsf{Verify}_s$ is EUF-CMA with advantage $\epsilon_s$. Fact
(i) is unchanged by the substitution. Fact (ii) holds for every scheme
in the registry (BLS under co-CDH; $\mathsf{ML\text{-}DSA}$ and
$\mathsf{Pulsar\text{-}M}$ under MLWE/MSIS; the threshold variants under
their SUF-CMA proofs), with the bound $\epsilon_{s'}$ substituted for
$\epsilon_s$. No other property of the primitive enters either proof.
Hence enabling the strict-PQ profile --- which pins the validator
identity/finality scheme to $\mathsf{ML\text{-}DSA}\text{-}65/87$ or
$\mathsf{Pulsar\text{-}M}\text{-}65/87$ and refuses classical schemes
--- is a re-parameterisation that preserves every safety invariant and
strictly improves the quantum-forgery bound (from the Shor-breakable
$\epsilon_{\mathrm{BLS}}$ to the lattice $\epsilon_{\mathrm{MLWE,MSIS}}$).
The flip is a \emph{value}, not a new protocol.
\end{proof}

\begin{remark}[Assumption diversity, honestly]
\label{rem:assumption-diversity}
$\mathsf{Pulsar}$ (R-LWE / M-LWE threshold) and $\mathsf{ML\text{-}DSA}$
(M-LWE, FIPS 204) both rest on \emph{lattice} assumptions; a single
sufficiently strong lattice cryptanalysis would dent both. The registry
therefore also reserves the hash-based $\mathsf{SLH\text{-}DSA}$
(FIPS 205) family for the recovery and high-value roots
(\texttt{RecoverySchemeID} $\texttt{0x05}$--$\texttt{0x07}$): a stateless
hash-based signature survives a total break of lattice assumptions and
is the genuine cross-family diversifier, not a second lattice leg. Two
lattice legs buy defense-in-depth against implementation faults, not
independent hardness.
\end{remark}

\section{Security}

\subsection{Threat model}

Let $f$ be the Byzantine fraction of $\mathcal{V}$. Classical Byzantine
thresholds require $f < 1/3$. Let the adversary $\mathcal{A}$ be any
probabilistic polynomial time quantum machine (BQP).

\subsection{Forgery reduction}

\begin{theorem}[PQ soundness of Quasar committee cert]
\label{thm:soundness}
Assume $\mathsf{ML\text{-}DSA}\text{-}65$ is existentially unforgeable under
the $\mathsf{MLWE}_{q,k,\ell,\chi}$ and $\mathsf{MSIS}$ assumptions, and
that the VRF output is pseudorandom in the quantum random oracle model.

Then an adversary $\mathcal{A}$ that produces a valid
$\textsf{cert}_h$ for a block $B_h$ not signed by $\geq 2k/3$ honest
committee members breaks $\mathsf{ML\text{-}DSA}$ or predicts the VRF
with non-negligible advantage.
\end{theorem}

\begin{proof}[Proof sketch]
By a standard hybrid argument:
\begin{itemize}
  \item[\textbf{H0:}] Real game. $\mathcal{A}$ forges $\textsf{cert}_h$
        containing $\geq 2k/3$ valid $\mathsf{ML\text{-}DSA}$ signatures
        over $B_h$ from committee members.
  \item[\textbf{H1:}] Replace VRF output with a uniform random sampling.
        Indistinguishable by VRF PQ-pseudorandomness.
  \item[\textbf{H2:}] Committee is independent of $\mathcal{A}$'s choice.
        Probability of an unchallenged forgery on $\geq 2k/3$ honest
        keys is at most $\binom{k}{2k/3} \cdot \varepsilon_{\text{ML-DSA}}^{2k/3}$
        where $\varepsilon_{\text{ML-DSA}}$ is the per-signature forgery
        advantage. For $k = 128$ and $\varepsilon_{\text{ML-DSA}} \leq 2^{-192}$
        (Level III), this is $\leq 2^{-86} \cdot 2^{-192 \cdot 85} \approx 2^{-16 \cdot 10^3}$.
\end{itemize}
The adversary's overall advantage is bounded by
$\mathsf{Adv}^{\textsf{VRF}} + \binom{k}{2k/3} \varepsilon_{\text{ML-DSA}}^{2k/3}$,
which is negligible under our assumptions.
\end{proof}

\subsection{Independence of the two lattice instances}

Both lattice legs rest on Module-LWE (with Module-SIS for binding), so
this is \emph{not} family-disjoint diversity --- it is two independent
\emph{instances} of the same family.
$\mathsf{ML\text{-}DSA}$ is secure under $\mathsf{MLWE}_{q,k,\ell,\chi}$
and $\mathsf{MSIS}$ at the FIPS~204 parameters
($q = 8\,380\,417$, ring degree $256$, module rank $(k,\ell) = (6,5)$).
$\mathsf{Corona}$ is secure under $\mathsf{MLWE}$ and $\mathsf{MSIS}$ at
its own (Ringtail-derived) parameters: a much larger 48-bit modulus
$q = \mathtt{0x1000000004A01}$ over the same ring degree $256$, with
module dimensions $M=8$, $N=7$ and $\sigma_E = 6.108$.

No reduction relating the two concrete instances is known, and the two
parameter regimes, key formats, and codebases are disjoint, so a break
that exploits one parameterisation or one implementation need not affect
the other. This is implementation- and parameter-level defense in depth,
not a hedge across distinct hardness families: a structural break against
Module-LWE \emph{as a family} would threaten both legs simultaneously.
The only truly family-disjoint signature leg in the Lux stack is the
hash-based $\mathsf{Magnetar}$ (SLH-DSA / FIPS~205); cross-family hedging
requires adding that leg, not the second lattice instance.

\begin{proposition}[Hedged PQ security within Module-LWE]
Under the conjunction ``the ML-DSA Module-LWE instance is hard $\lor$
the Corona Module-LWE instance is hard,'' the combined per-epoch
certificate
$(\textsf{cert}_h \text{ for } h \in \text{epoch}, \sigma_{\text{epoch}})$
is unforgeable.
\end{proposition}

This gives us defense in depth against parameter- or implementation-specific
breaks strictly within the post-quantum setting, without relying on any
classical primitive; for cross-family assurance, compose the Magnetar
(hash) leg as in the Polaris profile.

\section{Why BLS contributes no PQ security}

\begin{lemma}
A BLS12-381 aggregate signature $\sigma_{\text{BLS}}$ can be forged
efficiently by a quantum adversary running Shor's algorithm on the
discrete log problem in the extension field $\mathbb{F}_{q^{12}}$
underlying the pairing target group.
\end{lemma}

Consequently, any certificate whose verification \emph{requires}
$\sigma_{\text{BLS}}$ to be valid can be broken by breaking BLS alone.
If the Quasar cert verification logic is
$\mathsf{Verify}_{\text{BLS}}(\cdot) \land \mathsf{Verify}_{\text{PQ}}(\cdot)$,
then forging the cert still requires breaking the PQ components, so
BLS adds a verification cost without adding an attack barrier.
If the verification is $\mathsf{Verify}_{\text{BLS}}(\cdot) \lor \mathsf{Verify}_{\text{PQ}}(\cdot)$,
then forging the cert requires breaking \emph{only} BLS, reducing PQ
security to zero.

In practice Quasar uses the $\land$-form, so BLS is safe but superfluous.
Since it does not strengthen the cert, we remove it.

\section{Scale invariance of fixed-committee signing}

\subsection{Claim}

For a fixed committee size $k$, the per-block cert generation and
verification cost is $O(k)$, independent of the total validator count $N$.
Only the VRF sampling is touched by $N$, and the VRF sampling cost
is $O(\log N)$ with a weighted-reservoir or alias-method implementation.

\subsection{Measured costs on MacBook M3 (10-core arm64)}

Using \texttt{mldsa-bench} at $\mathsf{ML\text{-}DSA}\text{-}44$:

\begin{center}
\begin{tabular}{rrrrrr}
\toprule
$N$ & $k$ & Keygen & Sign (parallel) & Verify (parallel) & Cert size \\
\midrule
$10^3$  & 128 & 14.8 ms & 3.8 ms & 4.4 ms & 310 kB \\
$10^4$  & 128 & 14.8 ms & 3.8 ms & 4.4 ms & 310 kB \\
$10^5$  & 128 & 14.8 ms & 3.8 ms & 4.4 ms & 310 kB \\
\bottomrule
\end{tabular}
\end{center}

(Keygen is amortized across validator lifetime and only involves the
committee members for a given block; in practice keys are generated
once at validator registration. Sign and verify scale linearly with $k$
only.)

\subsection{Disk and bandwidth}

\begin{center}
\begin{tabular}{lrrr}
\toprule
 & Per block & Per epoch (128 blocks) & Per era (168 epochs) \\
\midrule
Raw ML-DSA committee cert & 310 kB & 40 MB & 6.7 GB \\
After Corona roll-up    & —      & 5--10 kB & 1.2 MB \\
After Z-chain ZK proof    & —      & —         & 200 bytes \\
\bottomrule
\end{tabular}
\end{center}

An archival node retains all raw certs (6.7 GB/era). A full node keeps the
current era's raw certs plus all past Corona epoch aggregates (${\sim}200$
MB/year). A light client synchronises from Z-chain era proofs only
(${\sim}10$ kB/year).

\section{Recommendation}

\begin{enumerate}
  \item Adopt the reduced Quasar cert (ML-DSA + Corona + Z-chain ZK).
        Remove BLS from Quasar cert generation and verification.
  \item Keep BLS available as an \emph{opt-in} classical speed-up for
        deployments that explicitly accept non-PQ security in exchange
        for sub-millisecond verification of a 96-byte aggregate. Gate
        via a chain-configuration flag, off by default.
  \item Use $k = 128$ fixed committee size for all network sizes in
        the range $10^3 \leq N \leq 10^5$.
  \item Use $\mathsf{ML\text{-}DSA}\text{-}65$ (NIST Level III) for the
        individual committee signatures.
  \item Require a PQ VRF for committee sampling. Either a lattice VRF
        (see Boneh--Dai 2024) or $\mathsf{ML\text{-}DSA}$ output used
        as a pseudorandom source in the QROM.
  \item Re-anchor every epoch via a $\mathsf{Corona}$ threshold
        aggregate for space efficiency.
  \item Re-anchor every era via a Z-chain $\mathsf{Groth16}$ or
        $\mathsf{PLONK}$ proof for light-client succinctness.
\end{enumerate}

\section{Open questions}

\begin{itemize}
  \item \textbf{PQ VRF}: which construction best balances cost and
        PQ-security? Lattice VRFs are still an active research area.
  \item \textbf{Stake-weighted sampling with liveness}: how do we
        recover when $>1/3$ of stake is offline in a specific epoch?
        Committee rotation helps but a formal liveness bound is needed.
  \item \textbf{Corona parameter selection}: parameters for
        $k = 128$ threshold Corona have not been published; we may
        need a sensitivity analysis before adopting.
\end{itemize}

\section{Related work}

\begin{itemize}
  \item Celi, del Pino, Espitau, Niot, Prest.
        \emph{Efficient Threshold ML-DSA.} USENIX Security 2026.
  \item Boschini, Kaviani, Lai, Malavolta, Takahashi, Tibouchi.
        \emph{Ringtail: Practical Two-Round Threshold Signatures from
        LWE.} IEEE S\&P 2025 (IACR ePrint 2024/1113). The construction
        Corona forks.
  \item Ethereum beacon chain attester committee design (BLS-based).
  \item Avalanche / Snowman probabilistic sampling family.
\end{itemize}

\end{document}