papers/lp-073-pulsar/sections/01-introduction.tex

\section{Introduction}
\label{sec:introduction}

Threshold signatures replace a single signing key with a $(t,n)$ secret sharing of that key, requiring $t$ of $n$ parties to cooperate before a signature is produced. For a blockchain consensus pipeline, the relevant question is not only \emph{can} $t$ parties produce a signature, but \emph{how often} the protocol must run, \emph{how many bytes} cross the wire per round, and \emph{what survives} when an attacker captures any subset of $t-1$ key shares or acquires a quantum oracle for ECDSA.

Lux Quasar 3.0 \cite{lp020} answers all three questions at once: the consensus engine signs every block with three independent threshold signatures in parallel. BLS12-381 \cite{lp075} occupies the classical fast-path lane (48-byte aggregate, sub-second). ML-DSA-65 \cite{lp070} provides FIPS-compliant per-validator identity proofs (3.3~KB each). The third lane, Pulsar, is the post-quantum threshold lane: a single $\sim$3.3~KB aggregate \emph{byte-equal to one FIPS-204 ML-DSA-65 signature} (ML-DSA-87 is $\sim$4.6~KB) that is Module-LWE-secure under both classical and quantum adversaries, recovers liveness when a quantum oracle invalidates BLS, and adds no Paillier-style range proofs because shares aggregate \emph{linearly}.

\subsection{What Pulsar is}

Pulsar is a two-round threshold signature whose \emph{production target is byte-equality with FIPS~204 ML-DSA}: a $t$-of-$n$ quorum of validators produces a single signature byte-identical to a single-party ML-DSA-65/87 signature, verified by the \emph{unmodified} FIPS~204 verifier (\texttt{cloudflare/circl}, \texttt{pq-crystals}). It therefore signs over the ML-DSA ring $R_q = \mathbb{Z}_q[X]/(X^{256}+1)$ at the FIPS prime $q = 8380417$. Underneath sits a generic two-round lattice-threshold \emph{kernel} --- the MAC-authenticated Round-1-commit / Round-2-open mechanism Pulsar holds in common with its sibling Corona \cite{corona}, which instantiates the same kernel at the 48-bit Ringtail parameter set ($q = \mathtt{0x1000000004A01}$) with a bespoke rounded-coefficient $(c, z, \Delta)$ verifier (\S\ref{sec:parameters}--\S\ref{sec:protocol:verify}). Pulsar's FIPS-204 instantiation (TALUS, \S\ref{sec:protocol:bcc}) replaces that bespoke verifier with the stock FIPS-204 one via boundary clearance and public-data hint recovery (BCC/CEF). Round~1 is offline: each party samples a Discrete-Gaussian masking nonce, broadcasts a commitment, and authenticates it with pairwise BLAKE3-keyed MACs. Round~2 binds the message: the parties derive a low-norm challenge $c$ from the transcript and open partial responses that aggregate \emph{linearly} to the single-party ML-DSA response $\mathbf{z} = \mathbf{y} + c\mathbf{s}_1$, with no party reconstructing $\mathbf{s}_1$, $\mathbf{s}_2$, or the key seed.

The protocol mirrors the structure of FROST \cite{frost} (linear, non-interactive after Round 1) but operates on a lattice rather than an elliptic curve. The closest analog in the Module-LWE family is two-round threshold ML-DSA \cite{dilithium,dttf2024}: Pulsar differs in the rounding/hint construction (a per-coefficient correction $\Delta$ supersedes ML-DSA's $(\alpha,\beta)$-bounded hint), in the use of pairwise MACs for Round 1 authentication \cite{drijvers2019}, and in the optimized $t=K$ Shamir path \cite{lp077} that avoids per-coefficient polynomial evaluation.

\subsection{Why MAC-authenticated Round 1}

Without MAC authentication, an attacker who controls the network can replace a victim's $D_i$ with a malicious $D_i'$ and force the protocol into a transcript that accepts a forged $z$. Drijvers, Edalatnejad, Ford, Neven, and Stadler \cite{drijvers2019} showed that any threshold signature with concurrent execution and unauthenticated commitment broadcast is vulnerable to a sub-exponential attack on the underlying secret. The classical defense is non-interactive zero-knowledge proofs of well-formedness on $D_i$; these are too expensive for a 3-second consensus interval at $K{=}21$ validators.

Pulsar uses pairwise symmetric MAC keys (one 32-byte key per ordered pair $(i,j)$, distributed at key generation alongside the Shamir shares) and a 256-bit BLAKE3 \cite{blake3} MAC over $D_i$ concatenated with the session id and active set. Verification cost is one BLAKE3 hash per pair, dominated by the $D_i$ payload size. The asymmetric ``identity in slot 0'' construction (the generator embeds its own party id, the verifier embeds the recipient's id) prevents reflection attacks where a captured $\textsc{MAC}_{i \to j}$ is replayed as $\textsc{MAC}_{j \to i}$.

\subsection{What is novel}

Two-round MAC-authenticated lattice threshold signing is well-established \cite{ringtail,thresholdraccoon,hermine}. Proactive secret sharing \cite{hjky97} and secret redistribution to new access structures \cite{desmedtjajodia97} are even older. What this paper specifies, and what \texttt{github.com/luxfi/pulsar} ships, is the \emph{composition} that makes these primitives operate in a permissionless consensus setting:

\begin{enumerate}[leftmargin=2em,nosep]
  \item A \textbf{dealerless, no-reconstruct} instantiation of byte-equal threshold ML-DSA: key generation via Mithril short replicated secret sharing \cite{mithril2026} (\S\ref{sec:protocol:bcc:keydkg}) and signing via the hyperball three-round no-reconstruct signer (\S\ref{sec:protocol:bcc:online}), so neither key generation nor signing ever materialises $\mathbf{s}_1$, $\mathbf{s}_2$, the key seed, or $\mathbf{sk}$ --- closing the trusted-dealer gap that earlier Pulsar drafts could only delegate to the Corona leg. (The RSS primitive is from \cite{mithril2026}; the contribution here is its permissionless-consensus deployment with stock-FIPS-204-verifier compatibility.)
  \item A key-era lifecycle (Section~\ref{sec:lifecycle}) that distinguishes the persistent group public key $(\mathbf{A}, \tilde{\mathbf{b}})$ from the rotating share distribution $\{\mathbf{s}_i\}$, so validator-set rotations preserve the master secret structurally without a per-epoch trusted dealer.
  \item An activation certificate (\S\ref{sec:lifecycle:activation}) that gates each generation transition on a threshold signature verifying under the unchanged group public key. Activation proves new signing capability; complaint and slashing-evidence pipelines are independent.
  \item An LSS-Pulsar adapter (Section~\ref{sec:lss-pulsar}) that plugs into Lux's universal MPC lifecycle framework \cite{luxlssmpc,lp077}, sharing the orchestration with curve-side schemes (Lens / FROST, LP-103 \cite{lp103}) and ECDSA (CMP).
  \item A grouped Pulsar deployment shape (Section~\ref{sec:grouped}) for large validator sets, with per-group resharing and a quorum-of-groups Horizon certificate.
  \item A Prism-bound Horizon certificate (Section~\ref{sec:quasar}) composing BLS Beam, ML-DSA cert set, and Pulsar Pulse against a shared source-chain transcript (LP-105 \cite{lp105}).
  \item A Warp 2.0 cross-chain envelope (\S\ref{sec:implementation}, \texttt{warp/pulsar/}) carrying the same Prism-bound shape over the Lux cross-chain messaging protocol, with forward / backward compatibility against shipping Warp 1.x receivers.
\end{enumerate}

The crypto exists. The systems layer that turns it into permissionless PQ-threshold consensus is the contribution.

\subsection{What this paper specifies}

This paper is the byte-exact specification of the math kernel plus the systems composition. Section~\ref{sec:parameters} pins every constant to its derivation in the Lattigo \texttt{v7} fork \cite{lattigov7}. Section~\ref{sec:protocol} documents the two-round protocol plus finalize and verify. Section~\ref{sec:wire-format} is the normative wire format: a C++ implementer reading this section alone should produce serialized output that hashes byte-equal to the Go canonical's output without consulting the Go source. Section~\ref{sec:security} states the MLWE assumption, the rejection-sampling slack $\eta_\varepsilon$, and the identifiable-abort posture. Section~\ref{sec:lifecycle} specifies the key-era lifecycle (Bootstrap, Refresh, Reshare, Reanchor) plus the activation certificate. Section~\ref{sec:lss-pulsar} specifies the LSS-Pulsar adapter contract. Section~\ref{sec:grouped} specifies grouped Pulsar certificates. Section~\ref{sec:quasar} composes Pulsar with BLS Beam and ML-DSA cert sets into the Prism-bound Horizon certificate. Section~\ref{sec:implementation} surveys the shipping Go canonical, the C++ port \cite{lp137}, and the GPU-kernel research workstream. Section~\ref{sec:related} surveys the post-quantum threshold-signature literature and locates Pulsar within it.

The companion artifacts are LP-073 \cite{lp073} (this LP) and LP-105 \cite{lp105} (vocabulary). Where this paper and LP-073 conflict, the Go canonical at commit \texttt{HEAD} of \texttt{github.com/luxfi/pulsar} is the tiebreaker.