papers/lp-073-pulsar/sections/01-introduction.tex

\section{Introduction}
\label{sec:introduction}

Threshold signatures replace a single signing key with a $(t,n)$ secret sharing of that key, requiring $t$ of $n$ parties to cooperate before a signature is produced. For a blockchain consensus pipeline, the relevant question is not only \emph{can} $t$ parties produce a signature, but \emph{how often} the protocol must run, \emph{how many bytes} cross the wire per round, and \emph{what survives} when an attacker captures any subset of $t-1$ key shares or acquires a quantum oracle for ECDSA.

Lux Quasar 3.0 \cite{lp020} answers all three questions at once: the consensus engine signs every block with three independent threshold signatures in parallel. BLS12-381 \cite{lp075} occupies the classical fast-path lane (48-byte aggregate, sub-second). ML-DSA-65 \cite{lp070} provides FIPS-compliant per-validator identity proofs (3.3~KB each). The third lane, Pulsar, is the post-quantum threshold lane: a single $\sim$33~KB aggregate that is Module-LWE-secure under both classical and quantum adversaries, recovers liveness when a quantum oracle invalidates BLS, and adds no Paillier-style range proofs because shares aggregate \emph{linearly}.

\subsection{What Pulsar is}

Pulsar is a two-round threshold signature over the cyclotomic ring $R_q = \mathbb{Z}_q[X]/(X^{\varphi}+1)$ with $\varphi = 256$ and a 48-bit NTT-friendly prime $q$. Round 1 is offline: each party samples a Discrete-Gaussian masking matrix $\hat R$, broadcasts a commitment $D_i = A \cdot \hat R_i + \hat E_i$, and authenticates the broadcast with pairwise BLAKE3-keyed MACs. Round 2 binds the message: the parties hash a Discrete-Gaussian challenge vector $u$ from the Round 1 transcript, derive a low-norm ternary challenge $c$, and open partial signatures $z_i$ that aggregate linearly. A verifier reconstructs $A z - b c$ in the rounded-coefficient hint domain $R_\nu$ and accepts iff the per-coefficient $\Delta$ correction stays below an $L_2$ bound.

The protocol mirrors the structure of FROST \cite{frost} (linear, non-interactive after Round 1) but operates on a lattice rather than an elliptic curve. The closest analog in the Module-LWE family is two-round threshold ML-DSA \cite{dilithium,dttf2024}: Pulsar differs in the rounding/hint construction (a per-coefficient correction $\Delta$ supersedes ML-DSA's $(\alpha,\beta)$-bounded hint), in the use of pairwise MACs for Round 1 authentication \cite{drijvers2019}, and in the optimized $t=K$ Shamir path \cite{lp077} that avoids per-coefficient polynomial evaluation.

\subsection{Why MAC-authenticated Round 1}

Without MAC authentication, an attacker who controls the network can replace a victim's $D_i$ with a malicious $D_i'$ and force the protocol into a transcript that accepts a forged $z$. Drijvers, Edalatnejad, Ford, Neven, and Stadler \cite{drijvers2019} showed that any threshold signature with concurrent execution and unauthenticated commitment broadcast is vulnerable to a sub-exponential attack on the underlying secret. The classical defense is non-interactive zero-knowledge proofs of well-formedness on $D_i$; these are too expensive for a 3-second consensus interval at $K{=}21$ validators.

Pulsar uses pairwise symmetric MAC keys (one 32-byte key per ordered pair $(i,j)$, distributed at key generation alongside the Shamir shares) and a 256-bit BLAKE3 \cite{blake3} MAC over $D_i$ concatenated with the session id and active set. Verification cost is one BLAKE3 hash per pair, dominated by the $D_i$ payload size. The asymmetric ``identity in slot 0'' construction (the generator embeds its own party id, the verifier embeds the recipient's id) prevents reflection attacks where a captured $\textsc{MAC}_{i \to j}$ is replayed as $\textsc{MAC}_{j \to i}$.

\subsection{What is novel}

Two-round MAC-authenticated lattice threshold signing is well-established \cite{ringtail,thresholdraccoon,hermine}. Proactive secret sharing \cite{hjky97} and secret redistribution to new access structures \cite{desmedtjajodia97} are even older. What this paper specifies, and what \texttt{github.com/luxfi/pulsar} ships, is the \emph{composition} that makes these primitives operate in a permissionless consensus setting:

\begin{enumerate}[leftmargin=2em,nosep]
  \item A key-era lifecycle (Section~\ref{sec:lifecycle}) that distinguishes the persistent group public key $(\mathbf{A}, \tilde{\mathbf{b}})$ from the rotating share distribution $\{\mathbf{s}_i\}$, so validator-set rotations preserve the master secret structurally without a per-epoch trusted dealer.
  \item An activation certificate (\S\ref{sec:lifecycle:activation}) that gates each generation transition on a threshold signature verifying under the unchanged group public key. Activation proves new signing capability; complaint and slashing-evidence pipelines are independent.
  \item An LSS-Pulsar adapter (Section~\ref{sec:lss-pulsar}) that plugs into Lux's universal MPC lifecycle framework \cite{luxlssmpc,lp077}, sharing the orchestration with curve-side schemes (Lens / FROST, LP-103 \cite{lp103}) and ECDSA (CMP).
  \item A grouped Pulsar deployment shape (Section~\ref{sec:grouped}) for large validator sets, with per-group resharing and a quorum-of-groups Horizon certificate.
  \item A Prism-bound Horizon certificate (Section~\ref{sec:quasar}) composing BLS Beam, ML-DSA cert set, and Pulsar Pulse against a shared source-chain transcript (LP-105 \cite{lp105}).
  \item A Warp 2.0 cross-chain envelope (\S\ref{sec:implementation}, \texttt{warp/pulsar/}) carrying the same Prism-bound shape over the Lux cross-chain messaging protocol, with forward / backward compatibility against shipping Warp 1.x receivers.
\end{enumerate}

The crypto exists. The systems layer that turns it into permissionless PQ-threshold consensus is the contribution.

\subsection{What this paper specifies}

This paper is the byte-exact specification of the math kernel plus the systems composition. Section~\ref{sec:parameters} pins every constant to its derivation in the Lattigo \texttt{v7} fork \cite{lattigov7}. Section~\ref{sec:protocol} documents the two-round protocol plus finalize and verify. Section~\ref{sec:wire-format} is the normative wire format: a C++ implementer reading this section alone should produce serialized output that hashes byte-equal to the Go canonical's output without consulting the Go source. Section~\ref{sec:security} states the MLWE assumption, the rejection-sampling slack $\eta_\varepsilon$, and the identifiable-abort posture. Section~\ref{sec:lifecycle} specifies the key-era lifecycle (Bootstrap, Refresh, Reshare, Reanchor) plus the activation certificate. Section~\ref{sec:lss-pulsar} specifies the LSS-Pulsar adapter contract. Section~\ref{sec:grouped} specifies grouped Pulsar certificates. Section~\ref{sec:quasar} composes Pulsar with BLS Beam and ML-DSA cert sets into the Prism-bound Horizon certificate. Section~\ref{sec:implementation} surveys the shipping Go canonical, the C++ port \cite{lp137}, and the GPU-kernel research workstream. Section~\ref{sec:related} surveys the post-quantum threshold-signature literature and locates Pulsar within it.

The companion artifacts are LP-073 \cite{lp073} (this LP) and LP-105 \cite{lp105} (vocabulary). Where this paper and LP-073 conflict, the Go canonical at commit \texttt{HEAD} of \texttt{github.com/luxfi/pulsar} is the tiebreaker.