papers/lp-220-p3q-corona/sections/04-corona-kind.tex

\section{Corona Kind ($\textnormal{kind} = 0x02$)}
\label{sec:corona-kind}

\subsection{Slot and ABI}

\texttt{0x012205} with leading \texttt{kind=0x02}. Same physical
precompile address as Pulsar (kind $0x01$) and Magnetar
(kind $0x03$); dispatch resolves to the Corona
\texttt{P3QVerifier} implementation.

\begin{lstlisting}[language={}]
// EVM precompile at slot 0x012205, kind = 0x02
bool ok = P3Q.verify(
    0x02,                        // Corona kind
    coronaSig,                   // serialized Corona threshold sig
    messageHash,                 // H(prev_root || new_root || batch_hash)
    groupPubKey                  // Corona group public key
);
\end{lstlisting}

\subsection{Underlying scheme}

Corona~\cite{corona} is the Lux deployment of a two-round
lattice threshold signature scheme building on the Ringtail
line~\cite{ringtail}. Hardness reduces to Module-LWE over the
ring $R_q = \mathbb{Z}_q[X]/(X^{256}+1)$ at the Ringtail
parameter set (module matrix $A \in R_q^{8\times7}$, 48-bit
prime $q$), via the standard two-round distributed signing
protocol.

\paragraph{Dealerless key generation.}
Corona is \emph{natively dealerless}. Key generation runs a
Pedersen-style verifiable-secret-sharing DKG over $R_q$ (the
\texttt{keyera} bootstrap over the shared \texttt{luxfi/dkg} VSS:
commitment $\mathbf{C} = \mathbf{A}\cdot\mathsf{NTT}(c) +
\mathbf{B}\cdot\mathsf{NTT}(r)$, commitment broadcast, a digest
cross-check round, and verification with signed-complaint identifiable
abort), noise-flooded so the group key is a true $\mathbf{A}\mathbf{s} +
\mathbf{e}''$; no single party ever holds the group secret. As of
\texttt{corona v0.10.x} this is the production keygen default
(\texttt{keyera.Bootstrap}), now consuming the shared
\texttt{luxfi/mlwe} Module-LWE base. Signing likewise never reconstructs
the key: each party emits a \emph{masked} partial $\mathbf{z}_j$ from its
own share and the combiner sums them ($\mathbf{z} = \sum_j \mathbf{z}_j$),
so the master secret $\mathbf{s} = \sum_j \lambda_j \mathbf{s}_j$ appears
only as the coefficient of the public challenge in the masked aggregate,
never formed.

\emph{Pulsar is now also dealerless.} Its production FIPS-204 keygen uses
Mithril short replicated secret sharing \cite{mithril2026} --- the
published escape from the additive-$S_\eta$ wall that earlier forced a
trusted dealer --- and its signing is the no-reconstruct hyperball signer
(LP-073~\cite{lp073}). So in the Quasar dual-PQ AND-mode certificate
(LP-020) \emph{both} lattice legs are dealerless: Corona composes
alongside Pulsar as \textbf{defence-in-depth}, not as the sole carrier of
the permissionless-public guarantee. Corona's dealerlessness is
unconditional; Pulsar's carries a labeled FIPS-204 KeyGen
distribution-equivalence residual (verifier-compatibility is proven),
which is one more reason a sovereign validator set runs both legs.

Corona's signature is \emph{not} byte-equal to any NIST standard.
Both Corona and Pulsar (FIPS-204 ML-DSA-65) are Module-LWE
schemes; they differ in \emph{parameter regime and codebase}, not
in hardness family. Corona uses the Ringtail-derived parameter
set ($\sim$33\,KB signatures, NIST Cat-1) with Module-SIS
polynomial commitments; Pulsar uses the ML-DSA-65 tuning
($\sim$3.3\,KB, Cat-3, byte-equal to FIPS-204). Pairing them
gives parameter- and implementation-level diversity --- a
break specific to one parameter set or codebase need not hit the
other --- but \emph{not} family-disjoint hardness: a structural
break of Module-LWE would threaten both. Cross-family
independence on the signature lane comes only from the
hash-based Magnetar kind (kind~$0x03$, SLH-DSA).

\subsection{Wire format}

\begin{table}[h]
\centering
\small
\begin{tabular}{@{}rrl@{}}
\toprule
\textbf{Offset} & \textbf{Size} & \textbf{Field} \\
\midrule
0 & 1 & \texttt{kind = 0x02} \\
1 & 1 & \texttt{mode = 0x01} (reserved Corona parameter set) \\
2 & 4 & \texttt{sigLen} (BE32) \\
6 & \texttt{sigLen} & \texttt{coronaSig} (\textasciitilde\SI{33052}{B}) \\
$6{+}\textit{sigLen}$ & 4 & \texttt{pkLen} (BE32) \\
$10{+}\textit{sigLen}$ & \texttt{pkLen} & \texttt{groupPubKey} \\
$10{+}\textit{sigLen}{+}\textit{pkLen}$ & 32 & \texttt{messageHash} \\
\bottomrule
\end{tabular}
\caption{Corona-kind wire format. Sig size is the dominant cost
($\sim\SI{33}{KB}$); the rest mirrors the Pulsar layout to keep
parsing uniform across kinds.}
\label{tab:corona-wire}
\end{table}

The mode byte is reserved at \texttt{0x01}; future Corona
parameter set additions (a higher-security Module-LWE variant) get
new mode bytes without changing the wire-format skeleton.

\subsection{Verifier core}

The Corona verifier core IS \texttt{luxfi/corona/sign.Verify}, and it is
wired today behind the \emph{dedicated} Corona precompile at slot
\texttt{0x012206} (\texttt{precompile/corona/contract.go}, which imports
\texttt{luxfi/corona/sign} and \texttt{luxfi/corona/threshold}). The core
is bespoke --- not FIPS-204 byte-equal --- because Corona is a separate
Module-LWE construction (Ringtail/Raccoon lineage), not a NIST standard.

Status: the Corona threshold library has landed (\texttt{corona v0.10.x})
and the dedicated Corona precompile at \texttt{0x012206} is wired. The
\emph{P3Q-family} kind-$0x02$ dispatch at the unified slot
\texttt{0x012205} is what remains pending: the reference \texttt{p3q.Run}
still routes \texttt{kind=0x02} to \texttt{abiFalse} via the
\texttt{ErrKindNotImplemented} path,

\begin{lstlisting}[language={}]
case KindCorona, KindMagnetar:
    // Reserved kinds -- P3Q dispatch not yet wired. Return abiFalse
    // ...
    return abiFalse(), remaining, nil
\end{lstlisting}

so the verifier is callable today at \texttt{0x012206} but not yet via
the unified P3Q slot. Solidity callers MAY emit
\texttt{P3Q.verify(0x02, ...)} from network genesis; the call charges the
per-kind gas (see below) and returns \texttt{false} until the kind-$0x02$
dispatch is wired. This is the
LP-218 ``no revert on cryptographic failure'' contract:
\texttt{false} on the return word is the universal signal for
``not verified for any reason,'' and reserved-but-not-wired
joins ``malformed input'' and ``FIPS reject'' under that
umbrella.

\subsection{Gas cost}

\textbf{\SI{5000000}{gas}} -- $\sim$$100\times$ the Pulsar
kind's \SI{50000}{}. Returned by the Corona
\texttt{P3QVerifier.GasCost()} entry. Why the disparity?

\begin{enumerate}[leftmargin=2em,nosep]
\item \textbf{CPU verify cost is heavier.} The Corona verifier
  requires NTT inverse over the Module-LWE ring + polynomial
  multiplication mod $q$ over the larger Ringtail parameter set
  (\textasciitilde\SI{33}{KB} sig vs Pulsar's \SI{3.3}{KB}).
\item \textbf{Calibration uses the CPU verify cost as the
  baseline.} LP-218's calibration discipline assumes a
  CPU-class verifier -- validators are not required to have
  Blackwell GPUs. Under that assumption, Corona's effective
  per-validator verify cost is the parity audit's measured
  $\sim$\SI{1.6}{\milli\second} CPU, which is approximately
  $20\times$ the Pulsar CPU verify time
  (\textasciitilde\SI{80}{\micro\second}). The gas charge
  is rounded up to $100\times$ Pulsar's for conservative
  accounting:
  \SI{5}{M} gas.
\item \textbf{Block-budget headroom.} At \SI{12}{M} block gas
  and \SI{5}{M} per Corona verify, the limit is $\sim$2 Corona
  verifies per block -- this is the bottleneck for very high-
  density PQ-strict rollup throughput. The cost cliff is
  intentional; the LP-217 mode ladder uses it to price
  cross-family insurance correctly.
\end{enumerate}

Operators with all-Blackwell validator sets may petition for a
\textbf{Blackwell-discounted Corona gas charge} in a future
amendment; LP-220 does not codify it. The conservative
CPU-baseline gas charge applies until validator-hardware
uniformity is established. This is the same calibration
discipline LP-218 uses for the Pulsar kind.

\subsection{Performance}

\begin{table}[h]
\centering
\small
\begin{tabular}{@{}lrrl@{}}
\toprule
\textbf{Metric} & \textbf{M1 Max} & \textbf{Spark} & \textbf{Source} \\
\midrule
Per-validator Corona sign at $N{=}64$ & $\sim$\SI{30}{\milli\second} & $\sim$\SI{30}{\milli\second} & matrix bench (measured)~\cite{parityaudit} \\
CPU verify (single sig) & $\sim$\SI{1.6}{\milli\second} & $\sim$\SI{1.6}{\milli\second} & parity audit (measured) \\
Blackwell sm\_120 verify & --- & $\sim$\SI{15}{\milli\second} & projected (LP-203 kernel)~\cite{lp203} \\
Blackwell sm\_120 batched ($N{=}64$) & --- & $\sim$\SI{50}{\milli\second} aggregate & projected \\
\bottomrule
\end{tabular}
\caption{Corona kind performance. Sign and CPU-verify times are
measured per the parity audit; Blackwell verify timings remain
projections until the GPU dispatch boundary closes (see
LP-223).}
\label{tab:corona-perf}
\end{table}

\subsubsection{Scaling exponent}

The parity audit measured Corona-leg signing cost growing
super-linearly in $N$. The measured exponent across
$N \in \{16, 32, 64\}$ is approximately
$T(N) \approx c \cdot N^{1.5\text{--}1.7}$, depending on the
host platform. This is not an $O(N)$ scheme and should not be
described as such in downstream documents; the Module-LWE
distributed signing protocol's full-rank check and
Gaussian-hash PRF carry costs that grow faster than linearly in
the participant count. The measured exponent is the operative
number for sequencer capacity planning, not the
naive-amortization figure.

\subsection{Use case}

A rollup that wants \textbf{intra-lattice parameter and
implementation diversity} configures its sequencer to sign each
batch with both a Pulsar threshold sig AND a Corona threshold
sig --- two Module-LWE schemes at distinct parameter sets and
codebases. The rollup contract on Z-Chain calls
\texttt{P3Q.verify(0x01, ...)} and \texttt{P3Q.verify(0x02, ...)}
at the same precompile address \texttt{0x012205} in sequence
inside its \texttt{validateBatch} function; both must return
\texttt{true} for the batch to be accepted.

A break specific to Pulsar's parameter set or codebase need not
compromise Corona's, so the rollup retains a valid PQ leg under
an implementation- or parameter-localized failure. This is
\emph{not} family-disjoint hardness: a structural break of
Module-LWE itself would threaten both legs. For cross-family
insurance the rollup must add the hash-based Magnetar kind
(\texttt{P3Q.verify(0x03, ...)}). The cost is
$\sim$\SI{5050000}{gas} per batch (Pulsar \SI{50000}{} +
Corona \SI{5000000}{}). Acceptable for value-bearing rollups
(custody, treasury, regulated securities); prohibitive for
high-volume rollups (gaming, social).

This is the LP-217 \texttt{PQ-strict} posture made operationally
callable.