Post-Quantum Cryptographic Hardware Integration and Worst-Case Latency Verification in H-PBFT/QKD Distributed Ledger Systems: Deterministic FN-DSA (Falcon) FPGA Offloading and Shadow Simulation Architecture(

This technical monograph provides rigorous architectural specifications and empirical verification protocols for integrating Post-Quantum Cryptography (PQC) hardware accelerators into a Hybrid Practical Byzantine Fault Tolerance and Quantum Key Distribution (H-PBFT/QKD) distributed ledger system (DOI: 10.5281/zenodo.24046020). 1. Cryptographic Algorithm Selection (FN-DSA / Falcon vs. ML-DSA / Dilithium): Given the O(N^2) message complexity inherent to PBFT consensus protocols, signature payload size directly governs network bandwidth saturation and end-to-end finality latency. At NIST Security Level 5, FN-DSA (Falcon-1024, FIPS 206) reduces signature byte length by approximately 72% (1,280 Bytes vs. 4,595 Bytes) and cuts per-round broadcast traffic across an N=100 node network from 45.5 MB to 12.7 MB compared to ML-DSA-87 (Dilithium5, FIPS 204). Furthermore, Falcon's asymmetric computational profile—lightweight, ultra-fast O(N^2) signature verification paired with intensive O(N) trapdoor generation—aligns with PBFT replica workloads. 2. Deterministic FPGA Offloading & Side-Channel Countermeasures (Phase A): To eliminate floating-point execution non-determinism and mitigate timing and power/electromagnetic side-channel attacks (DPA/EMA) during Fast Fourier Sampling over NTRU lattices, we define a dedicated hardware offload architecture on Xilinx (AMD) Zynq UltraScale+ MPSoC platforms: - Unified FFT/NTT Butterfly Core: Conflict-free multi-bank memory access with compressed twiddle factors supporting IEEE 754 double-precision (53-bit mantissa) and modular integer arithmetic. - Constant-Time Gaussian Sampler (SamplerZ) & First-Order Masking: Data-independent execution cycles with secret polynomial share splitting (f -> f', f''). - Direct QKD Entropy Injection: Physical-layer true random seeding via AXI-Stream/Secure SPI directly from QKD receivers into PQC salt and sampler pipelines. - Asynchronous Zero-Copy Software Stack: Non-blocking PSA Crypto API extensions (psa_sign_message_async) coupled with Linux Kernel AF_ALG splice/sendmsg zero-copy DMA rings and composite hybrid keys (SIG = SIG_ECDSA || SIG_FALCON). 3. Worst-Case Latency (WCL) Verification via Shadow Simulator (Phase B): Unlike abstract network simulators (ns-3), we employ the Shadow discrete-event simulator to execute real compiled H-PBFT/Falcon binaries and capture CPU-bound verification queuing effects under three adversarial stress scenarios: (i) Lazy Leader (compute-bound timeout induction), (ii) Flooding Replica (verification DoS saturation), and (iii) QKD Key Rate Exhaustion (token-bucket degradation dynamics), targeting <5% PQC latency overhead over 100ms WAN topologies with zero spurious View Changes. ご?