papers/lux-corona-pq/sections/07-related-work.tex

\section{Related Work}

\label{sec:related}

Bendlin et al.~\cite{bendlin2013semi} introduced lattice-based threshold signatures
using NTRU. Boneh et al.~\cite{boneh2018threshold} proposed threshold signatures from
lattice assumptions but with impractical parameters. Cozzo and
Smart~\cite{cozzo2023sharing} and Espitau et al.~\cite{espitau2024fiat} improved
practical lattice-based threshold schemes. Corona is Lux's first-party fork of
Ringtail~\cite{ringtail}, a practical \emph{two-round} Module-LWE threshold signature
whose construction assumes a fixed, known set of parties.

Ringtail itself thresholdizes the \emph{Raccoon} signature family~\cite{raccoon}---a
masking-friendly Fiat--Shamir-with-aborts Module-LWE scheme \emph{distinct} from
Dilithium / ML-DSA, with a $48$-bit modulus chosen for threshold-friendly rounding. It
builds directly on Threshold Raccoon~\cite{traccoon} and adapts the random-linear-%
combination and full-rank-commitment techniques of MuSig-L~\cite{musigl} and
FROST~\cite{komlo2020frost}. Ringtail is the standard-assumption counterpart of
EKT~\cite{ekt}, which obtained a two-round threshold from the \emph{non}-standard
algebraic one-more LWE assumption; Ringtail instead reduces to standard \emph{(module)}
LWE and SIS. Consequently a Corona signature is a \emph{Raccoon} signature under the joint
key---it does \emph{not} verify under FIPS~204; FIPS compatibility is the distinguishing
role of the sibling scheme Pulsar. Corona is Lux's own production scheme: it extends
Ringtail to public, permissionless validator sets via leaderless distributed key
generation, dynamic resharing, and on-chain ceremony binding---engineering that the
academic construction does not provide. The module ring $R_q$ itself is the ideal-lattice
setting of Lyubashevsky, Peikert and Regev~\cite{lyubashevsky2010ideal}, with the module
structure of Langlois and Stehl\'e~\cite{langlois2015module}.

Within the Lux lattice threshold family, Corona and Pulsar~\cite{pulsar} (LP-4450) are
both Module-LWE Fiat--Shamir-with-aborts threshold signatures; they differ by \emph{base
signature}, parameter regime, and codebase---\emph{not} by module rank, and \emph{not} by
lifecycle: the permissionless, leaderless, dynamically-resharable adaptation is the shared
Lux layer applied to Corona, Pulsar, and Magnetar alike. Corona thresholdizes Raccoon (via
Ringtail), whereas Pulsar thresholdizes ML-DSA / Dilithium so that the combined signature
is byte-equal to FIPS~204 ML-DSA-65 ($\sim$3.3\,KB)---the harder, FIPS-compatible target,
since ML-DSA's rejection sampling and hint bits do not split cleanly across parties. Corona
carries the larger Raccoon/Ringtail parameters ($q \approx 2^{48}$) and is not
FIPS-byte-equal; both schemes share the permissionless Lux lifecycle.
Magnetar~\cite{magnetar} (LP-4540) is the hash-based threshold leg (SLH-DSA, FIPS~205),
providing the cross-family diversity that two lattice schemes cannot. Corona, Pulsar and
Magnetar are composed by the Aurora and Polaris certificate profiles under Quasar.

%% -----------------------------------------------------------------------
%%  8. CONCLUSION
%% -----------------------------------------------------------------------