mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
ca327f37cb
Pulsar (LP-073, LP-223): the dealer is DEAD AT BOTH ENDS. - Keygen: dealerless via Mithril short replicated secret sharing (Celi-del Pino-Espitau-Niot-Prest, ia.cr/2026/013, USENIX Sec 2026) -- the published escape from the naive-additive-S_eta wall; group key signs under the STOCK FIPS-204 verifier (compatibility PROVEN), per-subset mod-q reduction unblocks large committees (n=16,t=14). Replaces the old 'key generation stays trusted-dealer / provably unreachable' claim everywhere. - Signing: no-reconstruct hyperball 3-round signer (z_j=y_j+c*s1_(j); no party forms s1/s2/seed/sk; mask y never serialised), verifies under stock ML-DSA. CI invariant forbids trusted-dealer keygen in production files. - Claim discipline: (A) standard-FIPS-204-verifier-COMPATIBLE = PROVEN vs (B) full FIPS-204 KeyGen-distribution-EQUIVALENCE = labeled open residual; malicious-HARDENED != fully-malicious-secure-PROVEN. Versions -> pulsar v1.7.1, threshold v1.10.2, consensus v1.29.1, mlwe shared base. - Fixed pre-pivot staleness: Pulsar sig is byte-equal ML-DSA-65 (~3.3KB), not the ~33KB 48-bit (c,z,Delta) shared kernel; q=8380417 production. Corona (LP-220): Module-LWE (Ringtail/Raccoon, M=8 N=7, q=0x1000000004A01), natively dealerless (Pedersen-VSS noise-flooded), no-reconstruct signing, consumes shared luxfi/mlwe. Both lattice legs now dealerless -> Corona is defence-in-depth, NOT the sole permissionless-public carrier. P3Q kind-0x02 dispatch still abiFalse, but the library landed + dedicated 0x012206 wired. Dual-leg diversity (LP-020, LP-220, LP-magnetar): Corona + Pulsar BOTH Module-LWE -> distinct schemes/params, adversary must break BOTH, strictly stronger than either; NOT hardness-disjoint -- assumption-disjoint leg is hash-based Magnetar (SLH-DSA). Cite Mithril ia.cr/2026/013. Scan targets: lp-020 (Ring-LWE->Module-LWE, versions, residual B), lp-stricte2epq (canonical-status note: byte-equal FIPS-204, sampled small committees n=8/t=7/m=12/r=8 not single n=64; sig sizes), lp-magnetar (Corona Ring-LWE->Module-LWE). All 6 PDFs rebuilt clean (pdflatex+bibtex+pdflatex x2): lp-073 59pp, lp-220 8pp, lp-223 5pp, lp-020 32pp, lp-stricte2epq 47pp, lp-magnetar 13pp.
103 lines
5.0 KiB
TeX
103 lines
5.0 KiB
TeX
\section{Parameters and Ring Construction}
|
|
\label{sec:parameters}
|
|
|
|
\paragraph{Scope of this section.} The parameters below pin the generic
|
|
two-round lattice-threshold \emph{kernel} --- the $(c, z, \Delta)$
|
|
mechanism Pulsar shares with Corona \cite{corona}, instantiated at the
|
|
48-bit Ringtail parameter set ($q = \mathtt{0x1000000004A01}$) with the
|
|
bespoke verifier of \S\ref{sec:protocol:verify}. Pulsar's
|
|
\emph{production} instantiation is byte-equal to FIPS~204 ML-DSA and
|
|
therefore runs at the ML-DSA parameter set instead --- prime $q =
|
|
8380417$, ring $R_q = \mathbb{Z}_q[X]/(X^{256}+1)$, with the stock
|
|
FIPS-204 verifier; those parameters and the construction that reaches
|
|
them (TALUS) are specified in \S\ref{sec:protocol:bcc}. Read this section
|
|
as the shared kernel; read \S\ref{sec:protocol:bcc} for Pulsar's
|
|
on-the-wire FIPS-204 signature.
|
|
|
|
\subsection{Rings}
|
|
|
|
The protocol uses three rings, all of degree $\varphi = 256$ and Standard NTT \cite{lp029} (negacyclic $\mathbb{Z}[X]/(X^\varphi+1)$):
|
|
|
|
\begin{table}[H]
|
|
\centering
|
|
\caption{Ring parameters. $R$ is the working ring; $R_\xi$ and $R_\nu$ are non-NTT auxiliary rings used solely as containers for rounded coefficients.}
|
|
\begin{tabular}{lrrl}
|
|
\toprule
|
|
Ring & Degree & Modulus & Purpose \\
|
|
\midrule
|
|
$R$ & 256 & $q = \texttt{0x1000000004A01}$ (48-bit) & working ring \\
|
|
$R_\xi$ & 256 & $q_\xi = \texttt{0x40000} = 2^{18}$ & rounded public key $\tilde b$ \\
|
|
$R_\nu$ & 256 & $q_\nu = \texttt{0x80000} = 2^{19}$ & hint $\tilde h$, $\tilde \Delta$ \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{table}
|
|
|
|
The construction $R$ requires $q \equiv 1 \pmod{2\varphi}$ for the existence of a $2\varphi$-th primitive root of unity; this holds since $q \mod 512 = 1$. The rings are instantiated as
|
|
\[
|
|
\texttt{ring.NewRing}(2^{8},\; \{q\}) \quad \text{etc.}
|
|
\]
|
|
in the Go canonical (\texttt{threshold/threshold.go:46}).
|
|
|
|
\subsection{NTT and Montgomery constants}
|
|
|
|
For each modulus $q_*$, Lattigo \cite{lattigov7} pre-computes:
|
|
|
|
\begin{itemize}
|
|
\item $\textsc{MRedConstant}(q) = q^{-1} \bmod 2^{64}$, used in Montgomery reduction (\texttt{lattice/ring/modular\_reduction.go:67}).
|
|
\item $\textsc{BRedConstant}(q) = (\lfloor 2^{128}/q \rfloor \gg 64,\;\lfloor 2^{128}/q \rfloor \bmod 2^{64})$, used in Barrett reduction (line 99).
|
|
\item $\textsc{RootsForward}$ and $\textsc{RootsBackward}$ tables: powers of the $2\varphi$-th primitive root in Montgomery form, bit-reversed order (\texttt{lattice/ring/subring.go:99}).
|
|
\end{itemize}
|
|
|
|
All NTT-domain multiplies in the protocol use \texttt{MulCoeffsMontgomery} (the lazy variant when output bounds permit). Polynomials are stored in Montgomery form ($a \cdot 2^{64} \bmod q$) inside the NTT domain; \texttt{MForm} and \texttt{IMForm} interconvert.
|
|
|
|
\subsection{Protocol constants}
|
|
|
|
Constants from \texttt{sign/config.go} are reproduced in Table~\ref{tab:constants}.
|
|
|
|
\begin{table}[H]
|
|
\centering
|
|
\caption{Protocol constants. \texttt{LogN}~$=8$ defines the ring degree $\varphi$; the symbol \texttt{N} in the Go source denotes the secret-vector length, which we render as $n_{\textrm{vec}}$ to avoid confusion.}
|
|
\label{tab:constants}
|
|
\begin{tabular}{llp{6.5cm}}
|
|
\toprule
|
|
Symbol & Value & Role \\
|
|
\midrule
|
|
$\varphi$ & $256$ & ring degree (\texttt{1 << LogN}) \\
|
|
$m_{\textrm{pk}}$ & $8$ & public-key matrix rows ($M$ in Go) \\
|
|
$n_{\textrm{vec}}$ & $7$ & secret-vector length (\texttt{N} in Go) \\
|
|
$\bar D$ & $48$ & masking nonce expansion factor \\
|
|
$K$ & $n$ & total parties (set per epoch) \\
|
|
$t$ & threshold & $1 \le t < n$ \\
|
|
$\kappa$ & $23$ & challenge ternary Hamming weight \\
|
|
$\xi$ & $30$ & public-key rounding $\tilde b = \lfloor b / 2^{30} \rceil$ \\
|
|
$\nu$ & $29$ & hint rounding $\tilde h = \lfloor h / 2^{29} \rceil$ \\
|
|
$|\textsc{Key}|$ & $32$ bytes & symmetric / MAC / PRNG seed length \\
|
|
$\eta_\varepsilon$ & $2.650104$ & rejection-sampling slack \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{table}
|
|
|
|
\subsection{Discrete-Gaussian parameters}
|
|
|
|
Three Discrete-Gaussian distributions appear in the protocol; bound $B = 2\sigma$ is the truncation bound passed to Lattigo's Ziggurat sampler \cite{ziggurat,lattigov7}.
|
|
|
|
\begin{table}[H]
|
|
\centering
|
|
\caption{Discrete-Gaussian samplers. All bounds are $B = 2\sigma$.}
|
|
\begin{tabular}{lll}
|
|
\toprule
|
|
Sampler & $\sigma$ & Used for \\
|
|
\midrule
|
|
$\sigma_E$ & $6.108187070284607$ & LWE error $e$, per-party $E_i$, mask $R_i$ \\
|
|
$\sigma_*$ & $1.7285 \times 10^{11}$ ($\approx 2^{37.33}$) & ``star'' column $r^*, e^*$ \\
|
|
$\sigma_U$ & $1.6396 \times 10^{8}$ & challenge-side $u$ (\textsc{GaussianHash}) \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{table}
|
|
|
|
The $L_2$ acceptance bound is
|
|
\[
|
|
B^2 = 184\,960\,669\,042\,442\,604\,975\,662\,780\,477,
|
|
\]
|
|
equivalent to $B \approx 4.30 \times 10^{14}$. Every coefficient of $z$ and $\Delta$ is reduced to its signed representative in $(-q/2, q/2]$ before squaring (\texttt{sign.go:303}).
|