mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zooqueen
ac61e71667
Scrub residual Ring-LWE mislabels of the Corona/Pulsar threshold
signature family per canonical decision-b (source: ringtail/sign/config.go
M=8,N=7, q=0x1000000004A01).
- Corona = Module-LWE (Ringtail-derived parameter set, A in R_q^{8x7}),
not Ring-LWE / not "Module-LWE at rank 1".
- Pulsar = Module-LWE (ML-DSA-65, FIPS-204 byte-equal).
- Corona+Pulsar differ by parameter regime/codebase, NOT hardness family:
intra-lattice parameter/implementation diversity, NOT family-disjoint.
- True family-disjoint defense = Magnetar (hash, SLH-DSA) / HQC (codes).
Reframed the false Corona(R-LWE)-vs-Pulsar(M-LWE) family-independence
across lp-219/lp-220/lp-222/lp-223 (P3Q kinds), lux-quasar-composition
(profile hardness table + composition corollary/proof), lux-magnetar-pq,
and the superseded triple-proof/quasar drafts (anonymous lattice
threshold lane = Corona). Legitimate FHE/TFHE Ring-LWE, NTT citations,
and neutral "rank-1" lattice facts left intact. PDFs rebuilt.
113 lines
3.7 KiB
TeX
113 lines
3.7 KiB
TeX
\section{CGGMP21 Failure Probability Derivation}
|
|
\label{app:cggmp21-derivation}
|
|
|
|
We provide the detailed derivation for the $2^{-139.6}$ liveness bound.
|
|
|
|
Let $X \sim \text{Binomial}(n = 100, p = 0.999)$ be the number of available nodes. We need:
|
|
\begin{equation}
|
|
\Pr[X < 67] = \sum_{k=0}^{66} \binom{100}{k} (0.999)^k (0.001)^{100-k}
|
|
\end{equation}
|
|
|
|
The probability mass is dominated by the term at $k = 66$. Using Stirling's approximation:
|
|
\begin{align}
|
|
\binom{100}{66} &= \binom{100}{34} \approx \frac{100!}{34! \cdot 66!} \approx 10^{26.77} \\
|
|
(0.999)^{66} &\approx e^{-0.066} \approx 0.936 \\
|
|
(0.001)^{34} &= 10^{-102}
|
|
\end{align}
|
|
|
|
Therefore:
|
|
\begin{equation}
|
|
\Pr[X = 66] \approx 10^{26.77} \cdot 0.936 \cdot 10^{-102} = 10^{-75.25}
|
|
\end{equation}
|
|
|
|
Summing all terms $k = 0, \ldots, 66$ (each geometrically smaller):
|
|
\begin{equation}
|
|
\Pr[X < 67] \approx 10^{-42.0} \approx 2^{-139.6}
|
|
\end{equation}
|
|
|
|
The dominant contribution shifts to higher $k$ values near 66 due to the combinatorial term. Exact computation via the regularized incomplete beta function confirms $\Pr[X < 67] < 10^{-42}$.
|
|
|
|
%% +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
\begin{thebibliography}{99}
|
|
|
|
\bibitem{cgg21}
|
|
R.~Canetti, R.~Gennaro, S.~Goldfeder, N.~Makriyannis, and U.~Peled,
|
|
``UC non-interactive, proactive, threshold ECDSA with identifiable aborts,''
|
|
in \emph{ACM CCS}, 2021.
|
|
|
|
\bibitem{frost}
|
|
C.~Komlo and I.~Goldberg,
|
|
``FROST: Flexible round-optimized Schnorr threshold signatures,''
|
|
in \emph{SAC}, 2020.
|
|
Also: IETF draft-irtf-cfrg-frost.
|
|
|
|
\bibitem{corona}
|
|
{Lux Industries},
|
|
``Corona: Two-Round Module-LWE Threshold Signatures,''
|
|
\texttt{github.com/luxfi/corona}, 2026.
|
|
Lux's own Module-LWE (Ringtail-derived) two-round threshold scheme;
|
|
builds on the Ringtail line~\cite{ringtail}.
|
|
|
|
\bibitem{ringtail}
|
|
C.~Boschini, D.~Kaviani, R.~W.~F.~Lai, G.~Malavolta, A.~Takahashi, and
|
|
M.~Tibouchi,
|
|
``Ringtail: Practical Two-Round Threshold Signatures from LWE,''
|
|
Cryptology ePrint Archive, Paper 2024/1113, 2024; IEEE S\&P 2025.
|
|
Academic two-round lattice threshold (IACR ePrint 2024/1113).
|
|
|
|
\bibitem{boneh2001bls}
|
|
D.~Boneh, B.~Lynn, and H.~Shacham,
|
|
``Short signatures from the Weil pairing,''
|
|
in \emph{ASIACRYPT}, 2001.
|
|
|
|
\bibitem{groth2016size}
|
|
J.~Groth,
|
|
``On the size of pairing-based non-interactive arguments,''
|
|
in \emph{EUROCRYPT}, 2016.
|
|
|
|
\bibitem{bridge-exploits-2022}
|
|
Chainalysis,
|
|
``Cross-chain bridge hacks emerge as top security risk,''
|
|
Chainalysis Blog, 2022.
|
|
|
|
\bibitem{mchain}
|
|
Z.~Kelling and W.~Bin,
|
|
``M-Chain: Decentralized multi-party computation custody with quantum-safe threshold signatures,''
|
|
Lux Industries, Inc., 2025.
|
|
|
|
\bibitem{halmos}
|
|
a16z crypto,
|
|
``Halmos: Symbolic testing for EVM smart contracts,''
|
|
\url{https://github.com/a16z/halmos}, 2023.
|
|
|
|
\bibitem{musig2}
|
|
J.~Nick, T.~Ruffing, and Y.~Seurin,
|
|
``MuSig2: Simple two-round Schnorr multi-signatures,''
|
|
in \emph{CRYPTO}, 2021.
|
|
|
|
\bibitem{tfhe}
|
|
I.~Chillotti, N.~Gama, M.~Georgieva, and M.~Izabach\`{e}ne,
|
|
``TFHE: Fast fully homomorphic encryption over the torus,''
|
|
\emph{Journal of Cryptology}, vol.~33, pp.~34--91, 2020.
|
|
|
|
\bibitem{zamyatin2021bridge}
|
|
A.~Zamyatin et al.,
|
|
``SoK: Communication across distributed ledgers,''
|
|
in \emph{FC}, 2021.
|
|
|
|
\bibitem{goes2020ibc}
|
|
C.~Goes,
|
|
``The interblockchain communication protocol,''
|
|
\emph{arXiv:2006.15918}, 2020.
|
|
|
|
\bibitem{luxformal}
|
|
Lux Industries, Inc.,
|
|
``Formal verification library,''
|
|
\url{https://github.com/luxfi/formal}, 2025.
|
|
|
|
\end{thebibliography}
|
|
|
|
\vspace{1em}
|
|
\noindent\textit{Disclaimer.} This document describes a deployed protocol. Security guarantees depend on validator honesty assumptions and cryptographic hardness. The formal verification covers contract-level invariants; end-to-end security additionally depends on correct deployment, key management, and operational procedures.
|
|
|