papers/lp-073-pulsar/lp-073-pulsar.tex

\documentclass[11pt,a4paper]{article}
\usepackage{../shared/luxcover}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\usepackage{amsmath,amssymb,amsfonts,amsthm}
\usepackage{graphicx}
\usepackage{hyperref}
\usepackage{booktabs}
\usepackage{algorithm}
\usepackage{algpseudocode}
\usepackage{listings}
\usepackage{xcolor}
\usepackage{tikz}
\usepackage{float}
\usepackage{enumitem}
\usepackage{array}
\usepackage{multirow}
\usepackage{tabularx}
\input{../shared/lstlang}
\usetikzlibrary{arrows.meta,positioning,shapes.geometric,fit,calc}

\hypersetup{colorlinks=true,linkcolor=black,citecolor=blue,urlcolor=blue}

\lstset{
  basicstyle=\ttfamily\scriptsize,
  breaklines=true,
  frame=single,
  numbers=left,
  numberstyle=\tiny\color{gray},
  keywordstyle=\color{blue!70!black}\bfseries,
  commentstyle=\color{green!50!black}\itshape,
  stringstyle=\color{red!60!black},
  showstringspaces=false,
}

\newtheorem{theorem}{Theorem}
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{definition}{Definition}
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{remark}{Remark}

\title{Pulsar: Dynamic Lattice Threshold Signatures\\for Permissionless Validator Sets}

\author{
Lux Research\thanks{Corresponding author: [email protected]}\\
\textit{Lux Industries, Inc.}\\
\texttt{[email protected]}
}

\date{2026}

\begin{document}

\luxcoverpage

\begin{abstract}
We present Lux, a hybrid post-quantum consensus architecture for DAG-native chains. Lux separates fast operational finality from durable post-quantum finality. Validators emit Photons over a Nebula DAG substrate; classical BLS aggregates form Beams for low-latency confirmation, while ML-DSA attestations and Pulsar lattice-threshold Pulses provide post-quantum finality over Nebula roots. Prism binds all certificate lanes to the same transcript, and Quasar reaches Horizon finality when the bound lanes verify.

To support dynamic validator sets, Lux introduces LSS, a lifecycle framework for threshold cryptography that manages generations, snapshots, rollback, and activation across independent threshold kernels. Pulsar instantiates LSS with a two-round Module-LWE lattice threshold kernel under a SHA3 transcript profile; Lens provides the curve-threshold counterpart. Pulsar's distinguishing target is \emph{byte-equality with FIPS~204 ML-DSA}: its combined threshold output is byte-equal to a single-party ML-DSA-65/87 signature, achieved through a boundary-cleared nonce transcript with carry elimination (BCC/CEF, Section~\ref{sec:protocol:bcc}) that recovers the FIPS hint from public data and never reconstructs the secret-bearing intermediates $c\mathbf{s}_2$, $c\mathbf{t}_0$, or the full commitment $\mathbf{w}$. Warp 2.0 extends this finality model across chains by carrying Pulse-backed source finality in cross-chain message envelopes. The result is a coherent architecture for sovereign, co-validating, and validity-based chains under a hybrid classical/post-quantum security model.

\textbf{Status (\texttt{v1.7.1}).} Pulsar's threshold construction is realised at \texttt{github.com/luxfi/pulsar} tag \texttt{v1.7.1}, and \emph{the dealer is dead at both ends}. \textbf{Key generation} is dealerless via \emph{Mithril short replicated secret sharing} (RSS, \S\ref{sec:protocol:bcc:keydkg}) \cite{mithril2026}: the joint signing key is a sum of many \emph{short} per-subset secrets, so its $\ell_\infty$ norm stays inside the ML-DSA $S_\eta$-class admissibility bound instead of growing with the party count --- the published escape \cite{mithril2026} from the naive-additive-$S_\eta$ wall that earlier forced a trusted dealer. The RSS group key signs under the \emph{unmodified} \texttt{cloudflare/circl} FIPS-204 verifier, and a per-subset modular reduction keeps large committees admissible (proven at $n{=}16$, $t{=}14$). \textbf{Signing} is no-reconstruct: the Mithril hyperball three-round signer opens partials $\mathbf{z}_j = \mathbf{y}_j + c\,\mathbf{s}_1^{(j)}$ whose sum is the single-party response $\mathbf{z} = \mathbf{y} + c\mathbf{s}_1$; no party ever forms $\mathbf{s}_1$, $\mathbf{s}_2$, the key seed, or $\mathbf{sk}$, and the mask $\mathbf{y}$ is never serialised. The combined output verifies byte-equal under the unmodified \texttt{cloudflare/circl} and \texttt{pq-crystals} FIPS~204 verifiers (ML-DSA-65 and ML-DSA-87). The earlier W-leak hazard --- a nonce certificate exposing the full commitment $\mathbf{w}$ --- is \emph{closed} by the CSCP CarryCompare secure-comparison circuit (\S\ref{sec:protocol:bcc:cscp}): $\mathsf{HighBits}$ is evaluated over secret-shared $\mathbf{w}$ so that no party forms $\mathbf{w}_0$ or the full $\mathbf{w}$, even transiently. Two residuals are stated honestly under strict claim discipline. \textbf{(A)} The threshold signer is \emph{malicious-hardened} --- single-use nonces, identifiable abort, and a mandatory stock-FIPS-204 $\mathsf{ReleaseGate}$ bound any deviation to abort/retry (liveness), never a forge or a leak --- but a \emph{fully} malicious-secure proof and a networked (non-simulation) MPC deployment remain open. \textbf{(B)} \emph{Standard-FIPS-204-verifier compatibility} of the dealerless key is \emph{proven} (the group key verifies under stock \texttt{circl}); full \emph{FIPS-204 KeyGen distribution-equivalence} --- that the RSS key is distributed identically to a stock FIPS-204 \textsf{KeyGen} key --- is the labeled open residual. The natively-dealerless Corona leg \cite{corona} composes alongside Pulsar in the Quasar dual-PQ certificate as defence-in-depth, not as a substitute for Pulsar's own (now dealerless) keygen.

\textbf{Honest claim.} The crypto primitives in this paper are not new --- proactive secret sharing, secret redistribution, verifiable redistribution, two-round lattice threshold signing, and identifiable-abort lattice threshold signing all exist in prior work. \emph{What is new is the composition}: a permissionless-consensus deployment architecture that turns static two-round PQ threshold signatures into a dynamic, leaderless, validator-rotation-tolerant finality layer. The paper specifies that systems layer at a level of detail sufficient to reproduce the Go canonical at \texttt{github.com/luxfi/pulsar} byte-for-byte across C++, Metal, CUDA, and WGSL ports.

This paper is the formal companion to LP-4450 \cite{lp4450} (canonical Pulsar) and the historical LP-073; the wire-format, lifecycle, byte-equality, and security claims here are normative. Pulsar and Corona \cite{corona} are sibling Module-LWE threshold schemes sharing the two-round kernel but differing in parameter regime and standard conformance: Corona is the Ringtail-derived leg (its own parameter set, $\sim 33$~KB signatures), while Pulsar is tuned for byte-equality with FIPS~204 ML-DSA via BCC/CEF. The canonical claims/evidence table and the ten architectural commitments live in LP-105 (Lux Stack Lexicon); other Lux documents reference them by section, never duplicate them.
\end{abstract}

\tableofcontents
\newpage

\input{sections/01-introduction}
\input{sections/02-parameters}
\input{sections/03-protocol}
\input{sections/04-wire-format}
\input{sections/05-security}
\input{sections/05a-formal-model}  % Formal model: validator set, lineage chain, adversary
\input{sections/06-implementation}
\input{sections/07-related-work}
\input{sections/08-lifecycle}      % Pulsar key-era / generations / resharing / activation
\input{sections/08a-pedersen-dkg}  % Pedersen-style DKG over R_q (dkg2): hiding/binding proofs, complaint workflow
\input{sections/09-lss-pulsar}     % LSS-Pulsar adapter contract
\input{sections/10-grouped}        % Grouped Pulsar certificates for large validator sets
\input{sections/11-quasar}         % Pulsar in Quasar Horizon (BLS Beam + ML-DSA + Pulsar Pulse)

\bibliographystyle{plain}
\bibliography{references}

\appendix
\section*{Reproducibility}
\textbf{Source code.} \texttt{github.com/luxfi/pulsar} at tag \texttt{v1.7.1}; LSS adapter at \texttt{github.com/luxfi/threshold} (tag \texttt{v1.10.2}); shared Module-LWE base at \texttt{github.com/luxfi/mlwe}; Quasar composition at \texttt{github.com/luxfi/consensus} (tag \texttt{v1.29.1}).\\
\textbf{Build.} \texttt{GOWORK=off go build ./...} and \texttt{GOWORK=off go test ./...} at \texttt{v1.7.1}. The dealerless Mithril RSS keygen is in \texttt{ref/go/pkg/pulsar/mithril\_rss.go} and the no-reconstruct hyperball signer in \texttt{ref/go/pkg/pulsar/mithril\_rss\_hyperball.go}; a CI invariant (\texttt{ci\_build\_invariant\_test.go}) fails the build if a trusted-dealer keygen (\texttt{DealAlgShares}) appears in any non-\texttt{\_test.go} file, so the production tree is dealerless by construction. The CSCP leak-free circuit and the byte-equal stock-verify ceremony are exercised by \texttt{TestCSCP\_*} and \texttt{TestTalus\_MPC\_EndToEnd\_StockVerify} / \texttt{TestTalus\_MPC\_Mode87}.\\
\textbf{Production threshold path (BCC/CEF).} The canonical no-leak threshold-signing path is the boundary-cleared / carry-elimination construction of Section~\ref{sec:protocol:bcc}: every secret-dependent ML-DSA decision is moved either offline and message-independent (boundary clearance on the aggregate nonce $\mathbf{w}$) or onto public data ($\mathsf{FindHint}$ over $\mathbf{w}' = \mathbf{A}\mathbf{z} - c\mathbf{t}_1 2^d$), so the protocol never reconstructs $c\mathbf{s}_2$, $c\mathbf{t}_0$, $\mathbf{r}_0$, or the full commitment $\mathbf{w}$, yet produces signatures byte-identical to single-party FIPS~204 ML-DSA-65/87. The \texttt{deriveKeyMaterial} expansion takes $\mathbf{A}$ directly in NTT domain (matching circl \texttt{NewKeyFromSeed} byte-for-byte). The headline cross-check is that a no-leak BCC/CEF signature decodes and verifies under the reference FIPS~204 verifier on the corresponding ML-DSA public key, demonstrated against both \texttt{cloudflare/circl} (\texttt{mldsa65}, \texttt{mldsa87}) and a \texttt{pq-crystals} cgo binding.

\textbf{Superseded path (V13, removed).} The earlier \texttt{v0.3 AlgebraicAggregate} construction broadcast the secret-bearing intermediates $\mathbf{C}\mathbf{S}_2 = c\mathbf{s}_2$ and $\mathbf{C}\mathbf{T}_0 = c\mathbf{t}_0$ to a combiner so it could run the FIPS sign-side rejection sequence and $\mathsf{MakeHint}$ verbatim. Broadcasting $c\mathbf{s}_2$ / $c\mathbf{t}_0$ \emph{leaks long-term key material} (the \textbf{V13 finding}, \texttt{PULSAR-V13-HINT-LEAK}; a sibling \texttt{PULSAR-V13-W-LEAK} exposed the full $\mathbf{w}$ in a nonce certificate). That construction is \emph{removed} --- no \texttt{AlgebraicAggregate} definition remains in the tree. TALUS (BCC $+$ CEF $+$ CSCP, \S\ref{sec:protocol:bcc}) is the no-leak replacement; the CSCP CarryCompare circuit closes \texttt{PULSAR-V13-W-LEAK} on the TALUS-MPC path so that no party forms $\mathbf{w}_0$ or the full $\mathbf{w}$, even transiently.

\textbf{Honest status (\texttt{v1.7.1}).} The dealerless threshold scheme is realised and verifies under stock FIPS~204 (\texttt{cloudflare/circl} and \texttt{pq-crystals}, ML-DSA-65/87): keygen is Mithril RSS \cite{mithril2026} (\S\ref{sec:protocol:bcc:keydkg}) and signing is the no-reconstruct hyperball three-round signer (\S\ref{sec:protocol:bcc:online}). Two residuals remain, stated honestly under strict claim discipline. \textbf{(A)} The signer is \emph{malicious-hardened} (single-use nonces, identifiable abort, mandatory stock-FIPS-204 $\mathsf{ReleaseGate}$): a malicious party is bounded to abort/retry (liveness) by $\mathsf{FindHint}$ and the $\mathsf{ReleaseGate}$, never a forge or a leak --- but a \emph{fully} malicious-secure proof and a networked (non-simulation) MPC deployment are the open items. \textbf{(B)} \emph{Standard-FIPS-204-verifier compatibility} of the dealerless key is \emph{proven} (the group key verifies under stock \texttt{circl}); full \emph{FIPS-204 KeyGen distribution-equivalence} is the labeled open residual. The natively-dealerless Corona leg \cite{corona} composes alongside Pulsar as defence-in-depth. The stock FIPS~204 \emph{verifier} is always available.\\
\textbf{Hardware tested.} Commodity x86\_64 Linux; AVX2 optional for NTT; Apple Silicon Metal and CUDA dispatch via \texttt{luxfi/lattice/v7}.\\
\textbf{Standards referenced.} FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA), RFC 9591 (FROST), RFC 7693 (BLAKE2), NIST IR 8214C (MPTC).\\
\textbf{Contact.} [email protected].

\end{document}