{"id":"2ed1f64d-a046-4e03-9fbb-10bcfde766da","arxiv_id":"2602.11592","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"A semi-decentralized circular QBA protocol using quantum digital signatures achieves O(N^2) communication and purports to tolerate up to N-2 Byzantine players.","lead":"This paper proposes a circular quantum Byzantine agreement protocol that lets many users reach consensus with a quadratic number of communication steps and a single trusted satellite hub. If it works, it would make quantum-secure blockchain-style consensus practical on existing star-shaped satellite networks where older schemes scaled exponentially.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Protocol has no liveness guarantee: a single Byzantine lieutenant can silently drop the circular package, and the restart mechanism retries the same blocked step forever, so the claimed N≥f+2 fault tolerance fails.","rationale":"The reader's weakest assumption identifies exactly the load-bearing flaw: Byzantine omission is not handled, and the single-path circular structure makes the protocol vulnerable to a single faulty node blocking all progress. My independent reading of Algorithm 1 and the protocol description confirms that the restart mechanism is local to the same step and cannot circumvent a malicious non-forwarder. The security analysis is entirely about unforgeability and non-repudiation, not about liveness. Since Byzantine agreement requires all honest parties to eventually decide, the lack of any progress guarantee under a simple 'drop message' attack is fatal to the claimed N≥f+2 fault tolerance. I therefore agree with the reader's REJECT verdict and see no reason to adjust it. The concrete test—a TLA+ liveness check with an omission fault—would settle the issue conclusively.","tokens_in":28041,"tokens_out":3813,"duration_ms":47980,"concrete_test":"Model Algorithm 1 in TLA+ (or a simple discrete-event simulator) with N=3, one Byzantine lieutenant that never sends in Phase 2 (omission), and check the liveness property: 'for every honest lieutenant, eventually output is reached.' The model will exhibit an infinite execution at the repeat loop of lines 18–32, because the same forwarding step is retried forever. Alternatively, instrument the pseudocode with an explicit timeout and observe that, without a mechanism to bypass or exclude the non-responding node, the protocol still cannot terminate.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires that every honest lieutenant eventually receives an identical full message list and outputs a value. In Phase 2 (Section III, Circular gathering; Algorithm 1 lines 18–32), each gathering traverses all other lieutenants in a fixed clockwise order. If any Byzantine lieutenant R_j simply refuses to send G^i_{j→j+1} (an omission attack, explicitly allowed in the Byzantine model), the recipient R_{j+1} never receives the package, CA never verifies, and the repeat loop at lines 24–27 enters an infinite retry of the same step. The only remedy stated—'Any failure of verification will restart a new round' (Section III) or 'Restart current step' (Algorithm 1 line 27)—does not bypass R_j: the same blocked path is retried indefinitely. There is no timeout, no alternate route, no exclusion mechanism, and no way for the honest lieutenants to complete a gathering without R_j's participation. Because every gathering started by every honest lieutenant must pass through the same malicious node, one faulty player can prevent all honest lieutenants from ever obtaining F_i, so no consensus output is produced. The security analysis in Appendix C only bounds forgery probabilities; it never addresses termination. Thus the fault-tolerance condition N≥f+2 is unsupported: even with N=3, f=1, the single malicious lieutenant can block the protocol forever. This is a liveness failure, not merely a performance issue, and it invalidates the protocol's role as a Byzantine agreement protocol.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes a semi-decentralized multiparty quantum Byzantine agreement (QBA) protocol built from one-time universal-hashing quantum digital signatures (OTUH-QDS). A certificate authority (CA) acts as the verifier for every QDS transaction and records signatures; the commanding general signs an order to each lieutenant; each lieutenant then initiates a fixed clockwise circular gathering in which every lieutenant appends its own signed order to the accumulated package, signs the whole package, and the CA verifies all signatures. Each honest lieutenant is supposed to receive an identical message list and apply a deterministic function to produce its output. The paper claims quadratic communication complexity O(N^2), fault tolerance N≥f+2, only N quantum channels in a star topology, and practical satellite-to-ground consensus rates, supported by simulations with DM-CV and BB84 key generation protocols.","tokens_in":28402,"tokens_out":10277,"duration_ms":120773,"significance":"If the claimed properties held, this would be a substantial advance: it would replace the exponential communication of recursive QBA with quadratic scaling while keeping information-theoretic security, and would fit existing star-shaped quantum networks. The manuscript has real strengths: Appendix B gives a self-contained derivation of the OTUH-QDS forgery bound, Appendix C builds a conservative union bound over QDS steps, and the satellite channel simulation is detailed and realistic. However, the central liveness failure described below means the protocol is not Byzantine agreement in the standard sense. The claimed fault tolerance N≥f+2 collapses under a single Byzantine omission, so the significance of the paper as written is conditional on a fundamental redesign rather than on local fixes.","major_comments":[{"comment":"","section":"Section III, Phase 2; Algorithm 1, lines 18–32"},{"comment":"","section":"Section III, Phase 1; Algorithm 1, lines 4–14"},{"comment":"","section":"Appendix C; Eq. (C13); Section IV(a)"}],"minor_comments":[{"comment":"","section":"Throughout; Eq. (1), Appendix B"},{"comment":"","section":"Algorithm 1, line 32"},{"comment":"","section":"Fig. 3 and Section V(b)"},{"comment":"","section":"Figs. 4–5 and Eq. (6)"}],"recommendation":"reject","confidential_remarks":"The liveness flaw is fundamental and appears in two independent phases of the protocol. A revision would require more than a small patch: it would need a timeout/round mechanism, an agreed way to exclude non-responsive nodes, a proof that all honest parties terminate with the same output, and a reconsideration of the communication-complexity and fault-tolerance claims. As written, the central claim of a scalable Byzantine-resilient protocol is not supported."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear colleague,\n\nThe useful thing to know about this paper: the circular message-gathering architecture is a real new idea, and the complexity improvement over recursive QBA is substantial. But the central fault-tolerance claim — N>=f+2 — does not survive contact with a Byzantine lieutenant who simply refuses to forward. The protocol has no timeout, no alternate route, and no exclusion mechanism; the restart loop in Algorithm 1 retries the same blocked step forever. So one faulty node can prevent honest lieutenants from ever completing a gathering, and the protocol never terminates. That's a liveness failure, not a performance issue, and it invalidates the protocol as a Byzantine agreement protocol as stated.\n\nWhat the paper does well: the protocol design is clearly described, with an algorithm and figures. The security analysis in Appendix C is a conservative union bound over forgery opportunities, which is honest and tractable. The paper also provides a self-contained derivation of the OTUH-QDS forgery bound in Appendix B. The satellite-network simulations are detailed and show high consensus rates under a realistic channel model. The comparison with prior QBA protocols is fair, and the quadratic communication and N quantum channels in a star topology are correctly counted if the protocol runs to completion.\n\nThe soft spots, in proportion: the liveness gap is the load-bearing one. The security analysis only bounds the probability of successful forgery; it never shows that honest participants eventually receive a complete message list. The 'Any failure of verification will restart a new round' remedy only works if the failure is detectable by the recipient. A silent drop is not detected, and even if a timeout were added, the retried step goes through the same malicious node. The trusted-CA-as-verifier model is also a relaxation of full decentralization, which weakens the comparison to classical authenticated Byzantine broadcast, but that alone wouldn't be disqualifying.\n\nThe central argument for N>=f+2 depends on every gathering completing. Since that isn't guaranteed under standard Byzantine behavior, the paper's main claim is unsupported. The rest of the analysis appears sound, and the protocol idea could be salvageable with an explicit mechanism to exclude or bypass silent nodes, but that's not in the paper.\n\nWho should read it: anyone working on quantum Byzantine agreement or quantum blockchain consensus. It's a worthwhile protocol proposal that needs a significant liveness fix. I'd send it to peer review — a referee can point out the gap and the authors may be able to repair it — but as it stands the central claim should not be accepted.\n\nRegards.","headline":"New circular-gathering architecture with quadratic complexity, but the claimed N>=f+2 fault tolerance fails because a single Byzantine lieutenant can silently block every gathering indefinitely.","tokens_in":28882,"tokens_out":3185,"would_cite":false,"duration_ms":37209,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["81P94","68M14"],"pacs":["03.67.Dd","03.67.Hk"],"model":"deepseek-v4-flash","headline":"A multiparty quantum Byzantine agreement protocol with O(N^2) communication, N star-topology quantum channels, and fault tolerance requiring only two honest players.","keywords":["quantum Byzantine agreement","quantum digital signatures","one-time universal hashing","circular message gathering","fault tolerance","communication complexity","satellite QKD network","consensus protocol"],"falsifier":"Run Algorithm 1 with N=3, f=1, and the single malicious lieutenant acting as a silent Byzantine node: it receives the signed package but never sends it to the next lieutenant. The protocol's response is to restart the same delivery step (Algorithm 1, lines 24–31), so the honest lieutenants loop forever and never reach consensus output. Observing this non-termination would settle that the N≥f+2 guarantee holds only for forgery-type faults, not for Byzantine omission.","tokens_in":27938,"feed_emoji":"🛰️","tokens_out":5594,"duration_ms":53069,"temperature":0.7,"pith_summary":"The paper sets out to show that multiparty quantum Byzantine agreement can be made practical by replacing recursive broadcast with a circular gathering of signed messages. It claims this cuts communication from exponential to quadratic — C(N) = N^2 − N quantum-digital-signature steps — and reduces the quantum network from a fully connected mesh to a star with only N channels. The protocol is said to be information-theoretically secure, to tolerate up to f malicious players whenever N ≥ f + 2, and to run with weak coherent states, making it compatible with satellite-to-ground QKD networks. If these claims hold, consensus for quantum blockchains moves from theoretical toy systems to deployable networks.","feed_headline":"Circular quantum agreement cuts Byzantine messaging to O(N^2)","feed_subtitle":"One certificate-authority satellite can serve N users using only N quantum channels, with N≥f+2 fault tolerance.","key_machinery":"The machinery is OTUH-QDS (one-time universal hashing quantum digital signatures), a three-party primitive (signer, forwarder, verifier) in which correlated keys define an LFSR-based Toeplitz hash; the signer sends an encrypted digest and the forwarder and verifier reconstruct the signer's keys by XOR and check it. The protocol makes the certificate authority (CA) the verifier in every transaction, so every order and every accumulated package is signed and independently checked. Circular gathering is the second mechanism: each lieutenant starts a clockwise tour, carries the growing list of orders and signatures, signs the whole package at each hop, and the CA compares each signature with its","core_discovery":"The paper's central claim is that Byzantine agreement among N players can be reached by having each lieutenant circulate one signed package clockwise around the ring, appending its own order and signature at each hop, with a certificate authority (CA) verifying every signature against stored records. Because each of N−1 lieutenants runs N−1 signing steps, communication is N^2−N quantum-digital-signature operations, and because the CA is the sole verifier, all keys can be distributed over N star links. The authors bound the failure probability by ε_QBA = max{ f[ε_for(m,n)+(N−f−1)ε_for(L_{N−1},n)], (f−1)(N−f)ε_for(L_{N−1},n) }, derived from the underlying one-time universal hashing quantum dig","pith_inferences":["The paper's security analysis covers forgery and repudiation but not Byzantine omission: a malicious lieutenant who simply stops forwarding (or forwards to the wrong node) is a valid Byzantine fault, and the protocol's restart of the same step does not provide liveness; a timeout, alternate route, or exclusion mechanism would be needed to actually guarantee N≥f+2.","Adding such a liveness mechanism would likely change the communication count — for example, rerouting around f silent nodes could multiply rounds by a factor related to f — so the O(N^2) figure should be read as the happy-path cost, not the worst-case adversarial cost.","The semi-decentralized design places the CA as a permanent verifier for every signature; the paper explicitly relaxes full decentralization, which means a dishonest or compromised CA (or a CA that goes offline) becomes a single point of failure for liveness, even though it does not learn message contents or votes.","A natural next test is to run the protocol on a small satellite-to-ground testbed with one node programmed to stay silent; if honest parties cannot terminate without manual intervention, the claimed fault tolerance needs an additional liveness layer."],"forward_implications":["Consensus requires only N^2−N QDS operations instead of the exponential rounds of recursive or QKD-based QBA, so large N becomes feasible.","The quantum layer reduces from N(N−1)/2 point-to-point channels to N star links, so existing satellite-to-ground QKD networks can serve as the key distribution backbone.","With N≥f+2, the protocol tolerates up to N−2 malicious players in the security model considered by the paper, exceeding the classical 1/3 fault-tolerance bound.","Because only weak coherent states and standard QKD primitives are used, the protocol is within reach of current photonic technology, and the paper's simulations indicate consensus rates above 10^2–10^5 per second in low-Earth-orbit settings."],"fun_headline_variants":["Circular quantum scheme makes Byzantine agreement O(N^2)","O(N^2) Byzantine agreement with circular quantum signatures","Practical quantum Byzantine agreement via circular messaging","Quantum consensus scales with circular carrier and O(N^2) cost","Circular quantum Byzantine agreement: fault-tolerant and quadratic"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The protocol assumes every circular-gathering step completes unless a signature check fails; a Byzantine lieutenant can silently refuse to forward the accumulating package, and the protocol's remedy (restart the same step, Algorithm 1 lines 24–31) retries the same blocked path with no timeout, alternate route, or exclusion, so live termination for N≥f+2 is not established.","fun_headline_variants_meta":{"raw":{"variants":["Circular quantum scheme makes Byzantine agreement O(N^2)","O(N^2) Byzantine agreement with circular quantum signatures","Practical quantum Byzantine agreement via circular messaging","Quantum consensus scales with circular carrier and O(N^2) cost","Circular quantum Byzantine agreement: fault-tolerant and quadratic"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000822,"raw_usage":{"total_tokens":3419,"prompt_tokens":713,"completion_tokens":2706,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":457,"completion_tokens_details":{"reasoning_tokens":2628}},"tokens_in":457,"tokens_out":2706,"duration_ms":17201,"temperature":1.0,"reasoning_tokens":2628,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-03T00:06:03.795396+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run Algorithm 1 with N=3, f=1, and the single malicious lieutenant acting as a silent Byzantine node: it receives the signed package but never sends it to the next lieutenant. The protocol's response is to restart the same delivery step (Algorithm 1, lines 24–31), so the honest lieutenants loop forever and never reach consensus output. Observing this non-termination would settle that the N≥f+2 guarantee holds only for forgery-type faults, not for Byzantine omission.","supporting_citations":[],"review_version":1}