papers/lp-073-pulsar/lp-073-pulsar.tex

\documentclass[11pt,a4paper]{article}
\usepackage{../shared/luxcover}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\usepackage{amsmath,amssymb,amsfonts,amsthm}
\usepackage{graphicx}
\usepackage{hyperref}
\usepackage{booktabs}
\usepackage{algorithm}
\usepackage{algpseudocode}
\usepackage{listings}
\usepackage{xcolor}
\usepackage{tikz}
\usepackage{float}
\usepackage{enumitem}
\usepackage{array}
\usepackage{multirow}
\usepackage{tabularx}
\input{../shared/lstlang}
\usetikzlibrary{arrows.meta,positioning,shapes.geometric,fit,calc}

\hypersetup{colorlinks=true,linkcolor=black,citecolor=blue,urlcolor=blue}

\lstset{
  basicstyle=\ttfamily\scriptsize,
  breaklines=true,
  frame=single,
  numbers=left,
  numberstyle=\tiny\color{gray},
  keywordstyle=\color{blue!70!black}\bfseries,
  commentstyle=\color{green!50!black}\itshape,
  stringstyle=\color{red!60!black},
  showstringspaces=false,
}

\newtheorem{theorem}{Theorem}
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{definition}{Definition}
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{remark}{Remark}

\title{Pulsar: Dynamic Lattice Threshold Signatures\\for Permissionless Validator Sets}

\author{
Zach Kelling\thanks{Corresponding author: [email protected]}\\
\textit{Lux Industries, Inc.}\\
\texttt{[email protected]}
}

\date{2026}

\begin{document}

\luxcoverpage

\begin{abstract}
We present Lux, a hybrid post-quantum consensus architecture for DAG-native chains. Lux separates fast operational finality from durable post-quantum finality. Validators emit Photons over a Nebula DAG substrate; classical BLS aggregates form Beams for low-latency confirmation, while ML-DSA attestations and Pulsar lattice-threshold Pulses provide post-quantum finality over Nebula roots. Prism binds all certificate lanes to the same transcript, and Quasar reaches Horizon finality when the bound lanes verify.

To support dynamic validator sets, Lux introduces LSS, a lifecycle framework for threshold cryptography that manages generations, snapshots, rollback, and activation across independent threshold kernels. Pulsar instantiates LSS with a two-round Module-LWE lattice threshold kernel under a SHA3 transcript profile; Lens provides the curve-threshold counterpart. Pulsar's distinguishing target is \emph{byte-equality with FIPS~204 ML-DSA}: its combined threshold output is byte-equal to a single-party ML-DSA-65/87 signature, achieved through a boundary-cleared nonce transcript with carry elimination (BCC/CEF, Section~\ref{sec:protocol:bcc}) that recovers the FIPS hint from public data and never reconstructs the secret-bearing intermediates $c\mathbf{s}_2$, $c\mathbf{t}_0$, or the full commitment $\mathbf{w}$. Warp 2.0 extends this finality model across chains by carrying Pulse-backed source finality in cross-chain message envelopes. The result is a coherent architecture for sovereign, co-validating, and validity-based chains under a hybrid classical/post-quantum security model.

\textbf{Status.} Pulsar is \emph{review-ready, not production-certified}. The byte-equal BCC/CEF path is demonstrated under the \texttt{cloudflare/circl} and \texttt{pq-crystals} reference verifiers (ML-DSA-65 and ML-DSA-87) and the boundary-clearance / hint-recovery correspondence is machine-checked in Lean; two genuinely novel components (tight small-norm lattice range proofs, and $\mathsf{HighBits}$ evaluation inside the MPC) are fail-closed pending external review.

\textbf{Honest claim.} The crypto primitives in this paper are not new --- proactive secret sharing, secret redistribution, verifiable redistribution, two-round lattice threshold signing, and identifiable-abort lattice threshold signing all exist in prior work. \emph{What is new is the composition}: a permissionless-consensus deployment architecture that turns static two-round PQ threshold signatures into a dynamic, leaderless, validator-rotation-tolerant finality layer. The paper specifies that systems layer at a level of detail sufficient to reproduce the Go canonical at \texttt{github.com/luxfi/pulsar} byte-for-byte across C++, Metal, CUDA, and WGSL ports.

This paper is the formal companion to LP-4450 \cite{lp4450} (canonical Pulsar) and the historical LP-073; the wire-format, lifecycle, byte-equality, and security claims here are normative. Pulsar and Corona \cite{corona} are sibling Module-LWE threshold schemes sharing the two-round kernel but differing in parameter regime and standard conformance: Corona is the Ringtail-derived leg (its own parameter set, $\sim 33$~KB signatures), while Pulsar is tuned for byte-equality with FIPS~204 ML-DSA via BCC/CEF. The canonical claims/evidence table and the ten architectural commitments live in LP-105 (Lux Stack Lexicon); other Lux documents reference them by section, never duplicate them.
\end{abstract}

\tableofcontents
\newpage

\input{sections/01-introduction}
\input{sections/02-parameters}
\input{sections/03-protocol}
\input{sections/04-wire-format}
\input{sections/05-security}
\input{sections/05a-formal-model}  % Formal model: validator set, lineage chain, adversary
\input{sections/06-implementation}
\input{sections/07-related-work}
\input{sections/08-lifecycle}      % Pulsar key-era / generations / resharing / activation
\input{sections/08a-pedersen-dkg}  % Pedersen-style DKG over R_q (dkg2): hiding/binding proofs, complaint workflow
\input{sections/09-lss-pulsar}     % LSS-Pulsar adapter contract
\input{sections/10-grouped}        % Grouped Pulsar certificates for large validator sets
\input{sections/11-quasar}         % Pulsar in Quasar Horizon (BLS Beam + ML-DSA + Pulsar Pulse)

\bibliographystyle{plain}
\bibliography{references}

\appendix
\section*{Reproducibility}
\textbf{Source code.} \texttt{github.com/luxfi/pulsar} at tag \texttt{v1.0.23}; LSS adapter at \texttt{github.com/luxfi/threshold}; Quasar composition at \texttt{github.com/luxfi/consensus}.\\
\textbf{Build.} \texttt{go build ./...} and \texttt{go test ./...} at \texttt{v1.0.23}.\\
\textbf{Production threshold path (BCC/CEF).} The canonical no-leak threshold-signing path is the boundary-cleared / carry-elimination construction of Section~\ref{sec:protocol:bcc}: every secret-dependent ML-DSA decision is moved either offline and message-independent (boundary clearance on the aggregate nonce $\mathbf{w}$) or onto public data ($\mathsf{FindHint}$ over $\mathbf{w}' = \mathbf{A}\mathbf{z} - c\mathbf{t}_1 2^d$), so the protocol never reconstructs $c\mathbf{s}_2$, $c\mathbf{t}_0$, $\mathbf{r}_0$, or the full commitment $\mathbf{w}$, yet produces signatures byte-identical to single-party FIPS~204 ML-DSA-65/87. The \texttt{deriveKeyMaterial} expansion takes $\mathbf{A}$ directly in NTT domain (matching circl \texttt{NewKeyFromSeed} byte-for-byte). The headline cross-check is that a no-leak BCC/CEF signature decodes and verifies under the reference FIPS~204 verifier on the corresponding ML-DSA public key, demonstrated against both \texttt{cloudflare/circl} (\texttt{mldsa65}, \texttt{mldsa87}) and a \texttt{pq-crystals} cgo binding.

\textbf{Superseded path (V13, do not use).} The earlier \texttt{v0.3 AlgebraicAggregate} construction broadcast the secret-bearing intermediates $\mathbf{C}\mathbf{S}_2 = c\mathbf{s}_2$ and $\mathbf{C}\mathbf{T}_0 = c\mathbf{t}_0$ to a combiner so it could run the FIPS sign-side rejection sequence and $\mathsf{MakeHint}$ verbatim. Broadcasting $c\mathbf{s}_2$ / $c\mathbf{t}_0$ \emph{leaks long-term key material} (the \textbf{V13 finding}, \texttt{PULSAR-V13-HINT-LEAK}; a sibling leak exposes the full $\mathbf{w}$ in a nonce certificate). That path is gated fail-closed (returns \texttt{ErrUnsafeThresholdV03HintPath}) and retained only for research comparison. BCC/CEF is the no-leak replacement and is itself fail-closed in production (\texttt{ProductionBCCSigningReady()} returns false) until the two novel components below are externally reviewed.

\textbf{Honest status.} Review-ready, not production-certified. Fail-closed pending external review: (i) tight small-norm lattice range proofs for the nonce and DKG witnesses, and (ii) $\mathsf{HighBits}$ / boundary-clearance evaluation inside the MPC over secret-shared $\mathbf{w}$. The stock FIPS~204 \emph{verifier} is always available; only the threshold \emph{signer} is gated, and when gated the consensus layer composes the Corona leg in Pulsar's place.\\
\textbf{Hardware tested.} Commodity x86\_64 Linux; AVX2 optional for NTT; Apple Silicon Metal and CUDA dispatch via \texttt{luxfi/lattice/v7}.\\
\textbf{Standards referenced.} FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA), RFC 9591 (FROST), RFC 7693 (BLAKE2), NIST IR 8214C (MPTC).\\
\textbf{Contact.} [email protected].

\end{document}