mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
ced35b03ed
Quasar Horizon (consensus composition over Pulsar / ML-DSA / BLS lanes
under Prism + LSS lifecycle), Warp 2.0 (Pulse-backed cross-chain envelope
with forward-only v1->v2 migration and lattigo ReadUint64Slice DoS fix),
benchmark report (microbench, reshare, activation, Warp 2.0 verify, Prism
composition, GPU headroom, cross-WAN latency), and NIST IR 8214C-style
submission package (spec, parameter sets, domain separation, serialization,
reference-impl pointers, evaluation report, security analysis, side-channel
considerations).
All four deliverables compile cleanly via pdflatex+bibtex and reference
the canonical proof bucket files at proofs/{definitions,pulsar,lss,quasar}.
No duplication of proof bodies; cite by file path.
90 lines
4.2 KiB
TeX
90 lines
4.2 KiB
TeX
\section{Parameters and Ring Construction}
|
|
\label{sec:parameters}
|
|
|
|
\subsection{Rings}
|
|
|
|
The protocol uses three rings, all of degree $\varphi = 256$ and Standard NTT \cite{lp029} (negacyclic $\mathbb{Z}[X]/(X^\varphi+1)$):
|
|
|
|
\begin{table}[H]
|
|
\centering
|
|
\caption{Ring parameters. $R$ is the working ring; $R_\xi$ and $R_\nu$ are non-NTT auxiliary rings used solely as containers for rounded coefficients.}
|
|
\begin{tabular}{lrrl}
|
|
\toprule
|
|
Ring & Degree & Modulus & Purpose \\
|
|
\midrule
|
|
$R$ & 256 & $q = \texttt{0x1000000004A01}$ (48-bit) & working ring \\
|
|
$R_\xi$ & 256 & $q_\xi = \texttt{0x40000} = 2^{18}$ & rounded public key $\tilde b$ \\
|
|
$R_\nu$ & 256 & $q_\nu = \texttt{0x80000} = 2^{19}$ & hint $\tilde h$, $\tilde \Delta$ \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{table}
|
|
|
|
The construction $R$ requires $q \equiv 1 \pmod{2\varphi}$ for the existence of a $2\varphi$-th primitive root of unity; this holds since $q \mod 512 = 1$. The rings are instantiated as
|
|
\[
|
|
\texttt{ring.NewRing}(2^{8},\; \{q\}) \quad \text{etc.}
|
|
\]
|
|
in the Go canonical (\texttt{threshold/threshold.go:46}).
|
|
|
|
\subsection{NTT and Montgomery constants}
|
|
|
|
For each modulus $q_*$, Lattigo \cite{lattigov7} pre-computes:
|
|
|
|
\begin{itemize}
|
|
\item $\textsc{MRedConstant}(q) = q^{-1} \bmod 2^{64}$, used in Montgomery reduction (\texttt{lattice/ring/modular\_reduction.go:67}).
|
|
\item $\textsc{BRedConstant}(q) = (\lfloor 2^{128}/q \rfloor \gg 64,\;\lfloor 2^{128}/q \rfloor \bmod 2^{64})$, used in Barrett reduction (line 99).
|
|
\item $\textsc{RootsForward}$ and $\textsc{RootsBackward}$ tables: powers of the $2\varphi$-th primitive root in Montgomery form, bit-reversed order (\texttt{lattice/ring/subring.go:99}).
|
|
\end{itemize}
|
|
|
|
All NTT-domain multiplies in the protocol use \texttt{MulCoeffsMontgomery} (the lazy variant when output bounds permit). Polynomials are stored in Montgomery form ($a \cdot 2^{64} \bmod q$) inside the NTT domain; \texttt{MForm} and \texttt{IMForm} interconvert.
|
|
|
|
\subsection{Protocol constants}
|
|
|
|
Constants from \texttt{sign/config.go} are reproduced in Table~\ref{tab:constants}.
|
|
|
|
\begin{table}[H]
|
|
\centering
|
|
\caption{Protocol constants. \texttt{LogN}~$=8$ defines the ring degree $\varphi$; the symbol \texttt{N} in the Go source denotes the secret-vector length, which we render as $n_{\textrm{vec}}$ to avoid confusion.}
|
|
\label{tab:constants}
|
|
\begin{tabular}{llp{6.5cm}}
|
|
\toprule
|
|
Symbol & Value & Role \\
|
|
\midrule
|
|
$\varphi$ & $256$ & ring degree (\texttt{1 << LogN}) \\
|
|
$m_{\textrm{pk}}$ & $8$ & public-key matrix rows ($M$ in Go) \\
|
|
$n_{\textrm{vec}}$ & $7$ & secret-vector length (\texttt{N} in Go) \\
|
|
$\bar D$ & $48$ & masking nonce expansion factor \\
|
|
$K$ & $n$ & total parties (set per epoch) \\
|
|
$t$ & threshold & $1 \le t < n$ \\
|
|
$\kappa$ & $23$ & challenge ternary Hamming weight \\
|
|
$\xi$ & $30$ & public-key rounding $\tilde b = \lfloor b / 2^{30} \rceil$ \\
|
|
$\nu$ & $29$ & hint rounding $\tilde h = \lfloor h / 2^{29} \rceil$ \\
|
|
$|\textsc{Key}|$ & $32$ bytes & symmetric / MAC / PRNG seed length \\
|
|
$\eta_\varepsilon$ & $2.650104$ & rejection-sampling slack \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{table}
|
|
|
|
\subsection{Discrete-Gaussian parameters}
|
|
|
|
Three Discrete-Gaussian distributions appear in the protocol; bound $B = 2\sigma$ is the truncation bound passed to Lattigo's Ziggurat sampler \cite{ziggurat,lattigov7}.
|
|
|
|
\begin{table}[H]
|
|
\centering
|
|
\caption{Discrete-Gaussian samplers. All bounds are $B = 2\sigma$.}
|
|
\begin{tabular}{lll}
|
|
\toprule
|
|
Sampler & $\sigma$ & Used for \\
|
|
\midrule
|
|
$\sigma_E$ & $6.108187070284607$ & LWE error $e$, per-party $E_i$, mask $R_i$ \\
|
|
$\sigma_*$ & $1.7285 \times 10^{11}$ ($\approx 2^{37.33}$) & ``star'' column $r^*, e^*$ \\
|
|
$\sigma_U$ & $1.6396 \times 10^{8}$ & challenge-side $u$ (\textsc{GaussianHash}) \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{table}
|
|
|
|
The $L_2$ acceptance bound is
|
|
\[
|
|
B^2 = 184\,960\,669\,042\,442\,604\,975\,662\,780\,477,
|
|
\]
|
|
equivalent to $B \approx 4.30 \times 10^{14}$. Every coefficient of $z$ and $\Delta$ is reduced to its signed representative in $(-q/2, q/2]$ before squaring (\texttt{sign.go:303}).
|