papers/lp-073-pulsar/sections/07-related-work.tex

\section{Related Work}
\label{sec:related}

This section locates Pulsar within the cryptographic and systems
literature on threshold signatures. We compare against (i) the
contemporary lattice threshold-signature schemes (Threshold Raccoon,
Hermine, two-round threshold ML-DSA), (ii) the curve-side dual
(FROST / RFC~9591), (iii) the classical lifecycle layer
(HJKY97 proactive refresh, Desmedt--Jajodia97 redistribution,
Wong--Wang--Wing02 verifiable redistribution), and (iv) the standards
landscape (NIST IR 8214C). The comparison criteria in
Table~\ref{tab:comparison} are: signature size at $K = 21$
participants, communication per signing session per participant,
threshold support, native DKG support, native refresh / reshare
support, post-quantum security level.

\subsection{Lattice-based threshold signatures}
\label{sec:related:lattice}

\paragraph{Ringtail (S\&P 2025) \cite{ringtail}.} The academic
ancestor. Two-round MAC-authenticated lattice threshold over
$R_q = \mathbb{Z}_q[X]/(X^{256}+1)$ with $q \approx 2^{48}$. The Lux
Pulsar fork (\texttt{github.com/luxfi/pulsar}) inherits the
Sign1/Sign2/Combine math byte-equal and adds the key-era lifecycle
(LSS-managed generations, verifiable resharing, activation
certificate, rollback). Pulsar replaces the upstream Feldman-style
DKG (which is pseudoinverse-recoverable when commits omit the noise
term) with a Pedersen-style DKG over $R_q$ (binding under MSIS on
$[\mathbf{A}\,|\,\mathbf{B}]$, hiding under MLWE on $\mathbf{B}$) for the
shared kernel. For the \emph{production} FIPS-204 byte-equal scheme,
Pulsar's keygen is the dealerless Mithril short replicated secret sharing
of \cite{mithril2026} (\S\ref{sec:protocol:bcc:keydkg}), whose group key
signs under the stock FIPS-204 verifier --- so Pulsar inherits no
trusted dealer at either keygen or signing.

\paragraph{Threshold Raccoon (Eurocrypt 2024) \cite{thresholdraccoon}.}
Practical lattice threshold signatures from standard MLWE/MSIS at
$\sim 13$~KiB signature size and $\sim 40$~KiB per-user communication.
Targets up to $1024$ signers. Provides a structured construction with
DKG, identifiable abort, and non-interactive aggregation. Differences
versus Pulsar: (i) Raccoon does not specify a permissionless-validator
lifecycle (its paper assumes a static signing committee fixed at
setup); (ii) Raccoon's signature size is $\sim 13$~KiB per pulse versus
Pulsar's $\sim 33$~KB per pulse, but Raccoon's communication is higher
per session due to its non-interactive structure requiring more
broadcast material per signer; (iii) Raccoon's correctness proof and
KAT vectors are at an earlier stage of standardisation than Pulsar's
production fork. We treat Raccoon as the closest peer at the
primitive layer; Pulsar's contribution is the deployment shape, not a
displacement of Raccoon.

\paragraph{Hermine (NIST MPTC 2025) \cite{hermine}.} Threshold lattice
signatures with DKG, identifiable aborts, and proactive refresh,
presented at the NIST Multi-Party Threshold Cryptography project.
Provides a complete primitive-layer package similar to Threshold
Raccoon but with explicit refresh semantics. Differences versus
Pulsar: Hermine targets the cryptographic-primitive standardisation
track at NIST IR 8214C \cite{nistir8214c}; Pulsar targets a
deployment shape that composes the primitive (any of Pulsar,
Threshold Raccoon, or Hermine) with a permissionless-consensus
lifecycle. The Pulsar adapter contract
(\S\ref{sec:lss-pulsar}) is primitive-agnostic at its boundary; in
principle a Hermine-backed Pulsar is a drop-in alternative once
Hermine's KAT vectors and constant-time verifier are pinned.

\paragraph{Two-round threshold ML-DSA {\cite{boneh2018,damgard2021,
dttf2024}}.} Boneh, Eskandarian, Kim, Shih sketched a generic threshold
construction over MLWE \cite{boneh2018}; Damg\aa{}rd, Orlandi,
Takahashi, Tibouchi produced the first concrete two-round threshold
ML-DSA with rejection-sampling correctness \cite{damgard2021};
\cite{dttf2024} extended this with algebraic one-more LWE assumptions.
Differences versus Pulsar: (i) the rounded-coefficient hint $\Delta$
in $R_\nu$ replaces ML-DSA's $(\alpha, \beta)$-bounded $h$,
simplifying the verifier's reconstruction; (ii) pairwise BLAKE3-keyed
MACs replace the more expensive non-interactive zero-knowledge proofs
of well-formedness on Round~1; (iii) the optimised $t = K$ Shamir path
\cite{lp077} avoids per-coefficient polynomial evaluation when the
active set equals the threshold.

\paragraph{Threshold ML-DSA {\cite{tmldsa2025,mithril2026}}.} The
Celi--del~Pino--Espitau--Niot--Prest line is the closest peer: the 2025
construction \cite{tmldsa2025} targets threshold ML-DSA with masked
shares and amortised rejection sampling, and its 2026 successor
\emph{Mithril} \cite{mithril2026} introduces \emph{short replicated
secret sharing}, the published escape from the naive-additive-$S_\eta$
wall that makes \emph{dealerless} threshold-ML-DSA key generation
reachable. Pulsar's production keygen builds directly on Mithril RSS
(\S\ref{sec:protocol:bcc:keydkg}): the group key signs under the stock
FIPS-204 verifier (compatibility proven), with full KeyGen
distribution-equivalence the labeled open residual. The earlier
individual-ML-DSA-65-plus-Z-Chain-Groth16 path is retained in QuasarCert
only as the \emph{fallback accountability} lane (per-validator
attribution and a constant-size on-chain footprint), complementary to
Pulsar's genuine threshold seal --- not, as earlier drafts stated, a
replacement forced by the absence of a threshold construction.

\paragraph{Drijvers et al.\ on concurrent multi-signatures
\cite{drijvers2019}.} Showed that any threshold signature with
concurrent execution and unauthenticated commitment broadcast admits
a sub-exponential forgery on the underlying secret. Pulsar's
MAC-authenticated Round~1 is the direct response. The MAC layer
provides identifiable abort for Round~1 corruption (the failing MAC
names its sender) and bounds the forgery advantage at
$Q_M / 2^{256}$ per Theorem~\ref{thm:pulsar-suf-cma}.

\subsection{Schnorr-family / curve-side threshold signatures}
\label{sec:related:schnorr}

\paragraph{FROST \cite{frost,komlogoldberg20} and RFC 9591
\cite{rfc9591}.} Two-round threshold Schnorr with linear share
aggregation, the elliptic-curve analog of Pulsar. RFC 9591
standardises the wire format for FROST over secp256k1, P-256, and
ristretto255. Structural resemblance to Pulsar is intentional: both
schemes use a Round~1 commitment broadcast plus a Round~2
message-bound open. Differences: (i) FROST uses a binding factor
$\rho_i$ derived from the commitment; Pulsar uses pairwise BLAKE3
MACs (256-bit symmetric) which provide stronger security against
rogue-key style attacks; (ii) FROST's signature is $64$~bytes
regardless of $K$; Pulsar's is $\sim 3.3$~KB per pulse (byte-equal to one
FIPS-204 ML-DSA-65 signature); (iii) FROST is
classical-only (broken by Shor), Pulsar is post-quantum.

The Lux production stack runs FROST on the secp256k1 control-plane
signing for the bridge MPC (LP-019 \cite{lp019}); Pulsar runs on the
consensus-plane post-quantum lane. The sister kernel \emph{Lens}
(LP-103 \cite{lp103}) extends FROST with the same LSS lifecycle as
Pulsar, demonstrating that the LSS adapter contract is
primitive-agnostic across curve and lattice.

\subsection{ECDSA and CGGMP21}
\label{sec:related:ecdsa}

\paragraph{CGGMP21 \cite{cggmp21}.} The production ECDSA threshold
standard. Requires Paillier encryption for the multiplicative-to-
additive conversion in the per-party masked product computation and
ships an extensive zero-knowledge proof suite to handle malicious
aborts. The complexity translates into roughly an order of magnitude
more bytes on the wire than FROST or Pulsar for the same $(t, n)$.
Pulsar's linear share aggregation eliminates the entire MtA layer;
this is the fundamental advantage of moving from a multiplicative
group $\mathbb{F}_p^*$ to an additive ring $R_q$. Pulsar and CGGMP21
are not redundant in Lux: CGGMP21 signs ECDSA-format bridge
transactions for Ethereum-compatible counterparties; Pulsar signs
PQ-format consensus blocks for the Quasar pipeline; the two coexist by
jurisdiction.

\subsection{BLS aggregate signatures}
\label{sec:related:bls}

BLS12-381 \cite{bls,lp075} aggregates non-interactively. The aggregate
is $48$ bytes regardless of $K$. BLS is faster, smaller, and simpler
than Pulsar; it is the classical fast-path lane of QuasarCert 3.0.
BLS is not post-quantum: a quantum oracle for the discrete log in
$\mathbb{G}_1$ inverts the scheme. Pulsar is the PQ insurance against
that adversary; the two lanes ship in parallel \cite{lp020}.
Quasar Horizon's hedging argument (App.~E \cite{quasarcertsoundness})
isolates the assumptions one per lane: DL/co-CDH on BLS12-381 (Lane 1,
classical), MLWE/MSIS on Pulsar (Lane 2, post-quantum), MLWE/MSIS on
ML-DSA-65 (Lane 3 inner, post-quantum). No known reduction transfers
a break of one to a break of another.

\subsection{Hash-based threshold signatures}
\label{sec:related:hash}

SLH-DSA / SLH-DSA (FIPS 205, formerly SPHINCS+) \cite{fips205,sphincs} provides hash-only
post-quantum signatures. A threshold variant exists \cite{cosmin2021}
but is not competitive with Pulsar on signing rate (SLH-DSA
per-signature cost is dominated by Merkle path generation, hard to
amortise across signers). Lux uses SLH-DSA \cite{lp071} for cold-
storage / archival signing where signing rate is irrelevant, and
Pulsar for hot consensus signing where the $\sim 200$~ms aggregate
Round~1 cost dominates.

\subsection{Classical lifecycle layer}
\label{sec:related:lifecycle}

\paragraph{HJKY97 proactive secret sharing
\cite{hjky97}.} Herzberg, Jarecki, Krawczyk, Yung introduced
proactive secret sharing as a defence against mobile-adversary share
accumulation: each epoch, the parties redistribute shares of $0$ that
sum into a fresh sharing of the same secret. Pulsar's Refresh
operation (\S\ref{sec:protocol:refresh}) is the lattice port of HJKY97
with lattice Pedersen commits replacing the original Feldman commits.

\paragraph{Desmedt--Jajodia97 redistribution
\cite{desmedtjajodia97}.} Desmedt and Jajodia generalised proactive
refresh to redistribution across distinct access structures: the old
qualified subset $Q$ samples polynomials with constant terms set to
the old shares, the new committee aggregates Lagrange-weighted
contributions, and the master secret is preserved. Pulsar's Reshare
operation (\S\ref{sec:protocol:reshare}) is the lattice port of this
construction. The Lagrange-recombination identity is
equation~\eqref{eq:pulsar-lagrange} and is mechanised in
\texttt{Crypto.Threshold.Reshare.reshare\_preserves\_public\_key}.

\paragraph{Wong--Wang--Wing02 verifiable redistribution
\cite{wongwangwing02}.} Wong, Wang, Wing introduced verifiable
redistribution for archive systems: each contribution comes with a
commit that proves the contribution is consistent with the polynomial
without revealing the secret. Pulsar uses lattice Pedersen commits
$\mathbf{C}_{i,j} = \mathbf{A} \cdot \textsc{NTT}(g_i(\beta_j)) +
\mathbf{B} \cdot \textsc{NTT}(r_{i,j})$, with binding under MSIS on
$[\mathbf{A}\,|\,\mathbf{B}]$ and hiding under MLWE on $\mathbf{B}$
(LP-073 \S\ref{sec:lifecycle:dkg}).

\subsection{Standards landscape}
\label{sec:related:standards}

\paragraph{NIST IR 8214C \cite{nistir8214c}.} The NIST Multi-Party
Threshold Cryptography project surveys threshold ECDSA, threshold
Schnorr, threshold ML-DSA, and threshold ML-KEM. Pulsar is positioned
as a deployment-shape contribution rather than a primitive-layer
candidate for IR 8214C: the underlying primitive (Pulsar / Threshold
Raccoon / Hermine) is interchangeable, and Pulsar's contribution is
the lifecycle that turns any of these primitives into a permissionless-
consensus threshold signature. The Lux Core Team contributes the
Pulsar deployment specification to inform IR 8214C's
deployment-pattern documentation.

\subsection{Comparison table}
\label{sec:related:table}

\begin{table}[H]
\centering
\small
\caption{Comparison of threshold signature schemes at $K = 21$
participants. ``Sig size'' = signature wire size; ``Comm'' = total
communication per session per participant; ``DKG'' = native distributed
key-generation support; ``Refresh'' = native HJKY-style proactive
refresh; ``Reshare'' = native Desmedt--Jajodia redistribution to a new
committee; ``PQ'' = post-quantum security under standard MLWE/MSIS or
SHA-3 assumptions.}
\label{tab:comparison}
\begin{tabular}{lrrcccc}
\toprule
Scheme & Sig size & Comm & Threshold & DKG & Refresh & PQ \\
\midrule
\textbf{Pulsar} (this paper) & $\sim 3.3$~KB${}^\ddagger$ & $\sim 50$~KB & $t \in [1, K]$ & yes & yes & yes \\
Ringtail (academic) \cite{ringtail} & $\sim 33$~KB & $\sim 50$~KB & $t \in [1, K]$ & Feldman & no & yes \\
Threshold Raccoon \cite{thresholdraccoon} & $\sim 13$~KiB & $\sim 40$~KiB & $t \in [1, K]$ & yes & no & yes \\
Hermine \cite{hermine} & $\sim 13$~KiB & $\sim 40$~KiB & $t \in [1, K]$ & yes & yes & yes \\
2R-Th-Dilithium \cite{damgard2021} & $\sim 30$~KB & $\sim 50$~KB & $t \in [1, K]$ & no & no & yes \\
Threshold ML-DSA \cite{tmldsa2025} & $\sim 5$~KB & $\sim 8$~KB & $t \in [1, K]$ & no & no & yes${}^\star$ \\
FROST / RFC 9591 \cite{rfc9591} & $64$~B & $\sim 200$~B & $t \in [1, K]$ & yes & no${}^\dagger$ & no \\
CGGMP21 ECDSA \cite{cggmp21} & $64$~B & $\sim 50$~KB & $t \in [1, K]$ & yes & yes & no \\
BLS aggregate \cite{bls} & $48$~B & $96$~B & $K$-of-$K$ & no & no & no \\
SLH-DSA-thr. \cite{cosmin2021} & $\sim 30$~KB & $\sim 50$~KB & $t \in [1, K]$ & no & no & yes \\
\bottomrule
\multicolumn{7}{l}{\footnotesize ${}^\star$ Threshold ML-DSA's PQ
guarantee is conditional on the rejection-sampling resolution; see
App.~A \cite{quasarcertsoundness}.} \\
\multicolumn{7}{l}{\footnotesize ${}^\dagger$ FROST refresh is provided
by Lens (LP-103 \cite{lp103}) via the LSS adapter contract.} \\
\multicolumn{7}{l}{\footnotesize ${}^\ddagger$ Pulsar's pulse is
byte-equal to one FIPS-204 ML-DSA-65 signature (3309~B; ML-DSA-87 is
4627~B). The $\sim 33$~KB figure for the shared kernel / Ringtail is the
$(c,z,\Delta)$ output, not Pulsar's on-the-wire FIPS-204 signature.}
\end{tabular}
\end{table}

\subsection{Where Pulsar's contribution lives}
\label{sec:related:contribution}

The cryptographic primitives in this paper are not new: two-round
MAC-authenticated lattice threshold signing
\cite{ringtail,thresholdraccoon,hermine}, dealerless threshold-ML-DSA key
generation via short replicated secret sharing \cite{mithril2026},
proactive secret sharing \cite{hjky97}, secret redistribution
\cite{desmedtjajodia97}, verifiable redistribution \cite{wongwangwing02},
and standardised PQ signatures \cite{fips204,fips205} all exist in prior
work. What is new is the \emph{composition}: a permissionless-consensus
deployment architecture that
\begin{itemize}[nosep]
  \item runs the lattice threshold primitive dealerless at both ends ---
        Mithril RSS keygen \cite{mithril2026} and the no-reconstruct
        hyperball signer --- with the group key and threshold signature
        verifying under the stock FIPS-204 verifier;
  \item operates the lattice threshold primitive over rotating
        validator sets without a per-epoch trusted dealer;
  \item gates each generation transition on an activation cert
        verifying under the unchanged group public key
        (Theorem~\ref{thm:pulsar-activation});
  \item recovers from failed activation via a non-punitive rollback
        ladder (Lemma~13 of \cite{quasarcertsoundness}, ``Rollback-
        lineage forward reconstruction'') that does not require
        slashing-based attribution;
  \item scales to large validator sets via grouped Pulsar certificates
        (\S\ref{sec:grouped});
  \item composes BLS, ML-DSA, and Pulsar into a single Horizon
        finality artifact with explicit lane-by-lane verification
        (Theorem~5 of \cite{quasarcertsoundness}, ``QuasarCert
        classical soundness'');
  \item plugs into a universal MPC lifecycle framework (LSS) shared
        with curve-side schemes (Lens / FROST) and ECDSA (CMP).
\end{itemize}

The crypto exists. The systems layer that turns it into permissionless
PQ-threshold consensus is Pulsar's contribution.

\section*{Acknowledgments}

The Lux Core Team acknowledges the Ringtail authors for the
protocol design \cite{ringtail}, the Lattigo authors for the ring
arithmetic and NTT primitives \cite{lattigov7}, the Threshold Raccoon
\cite{thresholdraccoon} and Hermine \cite{hermine} authors for the
contemporary peer constructions whose comparison sharpened the Pulsar
deployment scope, and the BLAKE2 / BLAKE3 \cite{blake2,blake3} authors
for the hash and PRNG primitives that underlie every transcript
construction.