mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
44bc0c7e22
Corona's hardness is Module-LWE (Ringtail/Raccoon line, module rank >1
over R_q=Z_q[X]/(X^256+1), A in R_q^{8x7}), not Ring-LWE; Pulsar is
Module-LWE (FIPS-204 ML-DSA). Both rest on the SAME assumption, so the
strict dual-lattice posture gives construction/implementation diversity,
NOT family-disjoint hardness -- the cross-family diversifier is the
hash-based Magnetar/SLH-DSA leg.
- lp-020-quasar-consensus: Corona leg label (main + sec06b + sec13);
rewrote the STRICT_QUASAR adversary claim to state the shared Module-LWE
assumption honestly (no false 'two lattice families' diversity claim).
- lux-fhe-runtime: Pulsar threshold lane mislabelled Ring-LWE -> Module-LWE.
- corona @misc citation entry (lp-220, lp-073, lux-quasar-composition,
lp-010-quasar-stm-4): title + note Ring-LWE -> Module-LWE; corrected the
wrong '= Module-LWE at rank 1' note (Corona uses rank >1).
- Rebuilt all 6 affected PDFs (pdflatex+bibtex+pdflatex x2).
79 lines
3.3 KiB
TeX
79 lines
3.3 KiB
TeX
\section{Quasar finality binding}
|
|
\label{sec:quasar-finality-binding}
|
|
|
|
Lux finality is post-quantum: BLS aggregates (Beam, classical fast
|
|
path) plus ML-DSA per-validator attestations plus Pulsar threshold
|
|
Pulses (lattice / Module-LWE), composed by Prism into a HorizonCertificate
|
|
(LP-105). FHE results enter this finality through a
|
|
$\mathsf{nebula\_fhe\_root}$ commitment in the QuasarRoundDescriptor.
|
|
|
|
\subsection{The commitment}
|
|
|
|
\[
|
|
\mathsf{nebula\_fhe\_root}
|
|
\;=\;
|
|
H\!\bigl(
|
|
\mathsf{bootstrap\_key\_root}
|
|
\;\|\;
|
|
\mathsf{key\_switch\_key\_root}
|
|
\;\|\;
|
|
\mathsf{public\_param\_root}
|
|
\;\|\;
|
|
\mathsf{active\_circuit\_dag\_root}
|
|
\;\|\;
|
|
\mathsf{finalized\_evaluations\_root} \bigr)
|
|
\]
|
|
|
|
\paragraph{Field origins.}
|
|
$\mathsf{bootstrap\_key\_root}$ and $\mathsf{key\_switch\_key\_root}$ are
|
|
produced by the M-Chain MPC keygen ceremony (LP-019, LP-076). The
|
|
Lux FHE-Go runtime computes them deterministically from the threshold
|
|
share output. $\mathsf{public\_param\_root}$ commits to the
|
|
ParameterSetID lineage. $\mathsf{active\_circuit\_dag\_root}$ is the
|
|
merkle root of currently-installed FHE circuits.
|
|
$\mathsf{finalized\_evaluations\_root}$ accumulates Nebula-FHE
|
|
$\mathsf{FheReceipt}$ commitments produced during the round.
|
|
|
|
\paragraph{Hash suite.}
|
|
Production builds use SHA3-256 as the canonical hash (LP-105
|
|
hash-suite invariance). The rc1 scaffold ships a self-contained
|
|
SHA-256 to reduce the dependency surface during scaffold validation;
|
|
the production handover is a one-line swap to
|
|
\texttt{luxcpp/crypto/sha256}. Both runtimes carry the
|
|
\texttt{HashSuiteID} field in the round descriptor so a verifier can
|
|
unambiguously distinguish.
|
|
|
|
\subsection{F-Chain alias}
|
|
|
|
In F-Chain deployments (LP-013), $\mathsf{nebula\_fhe\_root}$ and
|
|
$\mathsf{fchain\_fhe\_root}$ are the same 32-byte field. LP-013 names
|
|
it from the F-Chain perspective; this paper names it from the
|
|
dual-runtime perspective. Specifications and code paths must use one
|
|
name consistently within a given module --- inside
|
|
\texttt{github.com/luxfi/consensus} the field is named
|
|
\texttt{nebula\_fhe\_root}; inside \texttt{github.com/luxfi/fchain}
|
|
it is named \texttt{fchain\_fhe\_root}.
|
|
|
|
\subsection{Soundness}
|
|
|
|
Theorem~\ref{thm:fhe-nebula-binding} (proofs/fhe/nebula-binding.tex)
|
|
formalizes the binding soundness: a forged binding reduces to either
|
|
a hash collision in $H$ or a Pulsar SUF-CMA forgery
|
|
(\texttt{proofs/pulsar/unforgeability.tex},
|
|
Theorem~\ref{thm:pulsar-suf-cma}). The plaintext content of the FHE
|
|
evaluation is private throughout --- the GPU only handles ciphertexts
|
|
and threshold key holders are TEE-protected (LP-065). What Quasar
|
|
finalizes is the \emph{commitment} to the encrypted result, not the
|
|
result itself. Decrypting the result requires the threshold MPC
|
|
ceremony; finality of the encrypted-state machine does not.
|
|
|
|
\subsection{Replay protection}
|
|
|
|
Every contributing sub-root is keyed by $\mathsf{KeyEraID} +
|
|
\mathsf{Generation}$, and the $\mathsf{HashSuiteID}$ is bound into the
|
|
transcript. Cross-epoch replay of an FHE result is rejected because
|
|
the resulting $\mathsf{nebula\_fhe\_root}$ does not match the
|
|
descriptor in the new round; Prism's transcript-equality check
|
|
(LP-105 \S Prism) fails. The proof appears in
|
|
\texttt{proofs/fhe/nebula-binding.tex}, Remark~\ref{rem:fhe-replay-protection}.
|