papers/lux-nist-mptc-submission/spec/domain-separation-registry.tex

\documentclass[11pt,a4paper]{article}
\usepackage{../../shared/luxcover}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\usepackage{amsmath,amssymb}
\usepackage{graphicx}
\usepackage{hyperref}
\usepackage{booktabs}
\usepackage{enumitem}
\usepackage{xcolor}
\usepackage{tabularx}

\hypersetup{colorlinks=true,linkcolor=black,citecolor=blue,urlcolor=blue}

\title{Lux MPTC Domain-Separation Registry}
\author{
Lux Research\\
\textit{Lux Industries, Inc.}\\
\texttt{[email protected]}
}
\date{2026-03-03}

\begin{document}

\luxcoverpage

\section*{Abstract}

\noindent We present Lux, a hybrid post-quantum consensus architecture for DAG-native chains. Lux separates fast operational finality from durable post-quantum finality. Validators emit Photons over a Nebula DAG substrate; classical BLS aggregates form Beams for low-latency confirmation, while ML-DSA attestations and Pulsar lattice-threshold Pulses provide post-quantum finality over Nebula roots. Prism binds all certificate lanes to the same transcript, and Quasar reaches Horizon finality when the bound lanes verify.

\textbf{This document.} The complete domain-separation registry for the Lux MPTC stack. Every $\mathsf{QUASAR\text{-}*}$ / $\mathsf{PULSAR\text{-}*}$ / $\mathsf{LENS\text{-}*}$ / $\mathsf{WARP\text{-}*}$ personalization tag is enumerated, with the function it personalizes and the canonical reference. Cross-tag replay is structurally impossible by collision resistance of TupleHash256 / cSHAKE256 / KMAC256 with personalization (FIPS 202 / NIST SP 800-185).

\section{Pulsar tags}

\subsection{Hash-suite personalizations (Pulsar-SHA3 default)}

\begin{tabularx}{\textwidth}{@{}p{0.30\textwidth}p{0.20\textwidth}X@{}}
  \toprule
  \textbf{Tag} & \textbf{Function} & \textbf{Use} \\
  \midrule
  \texttt{PULSAR-HC-v1}        & cSHAKE256 32-byte hash & Challenge hash $H_c(\tau)$ over Pulsar transcript \\
  \texttt{PULSAR-HU-v1}        & cSHAKE256 XOF & Discrete-Gaussian challenge derivation $H_u(\tau, n)$ \\
  \texttt{PULSAR-TRANSCRIPT-v1} & TupleHash256 & Pulsar transcript hash $H_T(\tau_1, \ldots, \tau_k)$ \\
  \texttt{PULSAR-PRF-v1}       & KMAC256 & Pseudo-random function over share state \\
  \texttt{PULSAR-MAC-v1}       & KMAC256 & MAC over Pulsar wire frames \\
  \texttt{PULSAR-PAIRWISE-v1}  & KMAC256 & Pairwise PRF/MAC material between two parties \\
  \bottomrule
\end{tabularx}

Reference: Definition \texttt{def:pulsar-sha3} of \texttt{proofs/definitions/transcript-binding.tex}; canonical Go: \texttt{pulsar/hash/}.

\subsection{Lifecycle message tags}

\begin{tabularx}{\textwidth}{@{}p{0.32\textwidth}p{0.18\textwidth}X@{}}
  \toprule
  \textbf{Tag} & \textbf{Function} & \textbf{Use} \\
  \midrule
  \texttt{QUASAR-PULSAR-ACTIVATE-v1} & Pulsar threshold signature & Pulsar key-era activation message under unchanged GroupKey \\
  \texttt{QUASAR-PULSAR-BUNDLE-v1}   & Pulsar threshold signature & Pulse over Nebula bundle root in consensus path \\
  \texttt{QUASAR-PULSAR-RESHARE-v1}  & Pulsar reshare transcript & VSR transition from old to new validator set \\
  \texttt{QUASAR-PULSAR-REFRESH-v1}  & Pulsar refresh transcript & HJKY97 same-set zero-poly refresh \\
  \texttt{QUASAR-PULSAR-REANCHOR-v1} & Pulsar reanchor transcript & Fresh ceremony for new key era \\
  \bottomrule
\end{tabularx}

Reference: Definition \texttt{def:pulsar-activation-msg} of \texttt{proofs/definitions/transcript-binding.tex}; canonical Go: \texttt{pulsar/reshare/activation.go}, \texttt{pulsar/reshare/transcript.go}.

\section{Lens tags}

\subsection{Hash-suite personalizations}

\begin{tabularx}{\textwidth}{@{}p{0.32\textwidth}p{0.18\textwidth}X@{}}
  \toprule
  \textbf{Tag} & \textbf{Function} & \textbf{Use} \\
  \midrule
  \texttt{LENS-CHALLENGE-v1}    & SHA-512 (Ed25519) / SHA-256 (secp256k1) / SHA-512 (Ristretto255) & FROST challenge hash \\
  \texttt{LENS-NONCE-v1}        & per-curve & FROST nonce derivation \\
  \texttt{LENS-COMMIT-v1}       & TupleHash256 & Lens commit hash for VSR \\
  \texttt{LENS-TRANSCRIPT-v1}   & TupleHash256 & Lens transcript hash (mirror of Pulsar's) \\
  \bottomrule
\end{tabularx}

Reference: \texttt{lens/hash/}; algorithm signatures in Definition \texttt{def:lens-sign} of \texttt{proofs/definitions/algorithms.tex}.

\subsection{Lifecycle message tags}

\begin{tabularx}{\textwidth}{@{}p{0.34\textwidth}p{0.18\textwidth}X@{}}
  \toprule
  \textbf{Tag} & \textbf{Function} & \textbf{Use} \\
  \midrule
  \texttt{QUASAR-LENS-ACTIVATE-v1} & Lens threshold signature & Lens key-era activation under unchanged GroupKey \\
  \texttt{QUASAR-LENS-RESHARE-v1}  & Lens reshare transcript & Curve-side VSR \\
  \texttt{QUASAR-LENS-REFRESH-v1}  & Lens refresh transcript & Curve-side same-set refresh \\
  \texttt{QUASAR-LENS-REANCHOR-v1} & Lens reanchor transcript & Curve-side fresh ceremony \\
  \bottomrule
\end{tabularx}

\section{Quasar Horizon tags (consensus composition)}

\begin{tabularx}{\textwidth}{@{}p{0.32\textwidth}p{0.18\textwidth}X@{}}
  \toprule
  \textbf{Tag} & \textbf{Function} & \textbf{Use} \\
  \midrule
  \texttt{QUASAR-TRANSCRIPT-v1} & TupleHash256 & The canonical $\mathsf{QuasarTranscript}$ over (NebulaRoot, chain\_id, network\_id, epoch, round, validator\_set\_hash, KeyEraID, Generation, hash\_suite\_id) \\
  \texttt{lux-quasar-horizon-v1} & FIPS 204 ML-DSA context & ML-DSA cert set context string for Horizon transcript \\
  \texttt{QUASAR-PRISM-v1} & Domain marker & Prism predicate output binding (informal; not on the wire) \\
  \bottomrule
\end{tabularx}

Reference: Definition \texttt{def:horizon-transcript} of \texttt{proofs/definitions/transcript-binding.tex}; canonical Go: \texttt{consensus/protocol/quasar/horizon.go}.

\section{Warp 2.0 tags (cross-chain envelope, ZAP wire)}

The Warp ZAP envelope binds one digest $D = \mathrm{keccak256}(\text{\texttt{LUX-WARP-ZAP-CORE-v1}} \,\|\, \mathrm{c14n}(\mathsf{Message}))$ and signs it in each lane under a distinct prefix tag. The digest is keccak256 (Ethereum legacy Keccak), \emph{not} TupleHash256.

\begin{tabularx}{\textwidth}{@{}p{0.30\textwidth}p{0.22\textwidth}X@{}}
  \toprule
  \textbf{Tag} & \textbf{Function} & \textbf{Use} \\
  \midrule
  \texttt{LUX-WARP-ZAP-CORE-v1} & keccak256 digest prefix & Prefixes the canonical message bytes to form the digest $D$ (message ID, replay key, on-chain messageHash) \\
  \texttt{LUX-WARP-ZAP-BEAM-v1} & BLS signing prefix & The BLS Beam signs $\text{\texttt{LUX-WARP-ZAP-BEAM-v1}}\,\|\,D$ \\
  \texttt{LUX-WARP-ZAP-PULSE-v1} & Pulsar signing prefix & The Pulsar Pulse signs $\text{\texttt{LUX-WARP-ZAP-PULSE-v1}}\,\|\,D$ \\
  \texttt{LUX-WARP-ZAP-MLDSA-v1} & ML-DSA signing prefix & The ML-DSA cert set signs $\text{\texttt{LUX-WARP-ZAP-MLDSA-v1}}\,\|\,D$ \\
  \bottomrule
\end{tabularx}

All four tags are frozen. Because $\mathrm{c14n}(\mathsf{Message})$ commits sourceChainID, networkID, payload, sourceNebulaRoot, sourceKeyEraID, sourceGeneration, and hashSuiteID, $D$ binds every one of them in every lane. Reference: canonical Go \texttt{warp/codec.go} (\texttt{messageDST} / \texttt{beamDST} / \texttt{pulseDST} / \texttt{mldsaDST} constants and the \texttt{*SigningBytes} helpers).

\section{Cross-protocol context strings (FIPS 204 ML-DSA)}

Every ML-DSA / SLH-DSA caller in the Lux stack binds signatures to a context string per FIPS 204/205. The full registry:

\begin{tabularx}{\textwidth}{@{}p{0.34\textwidth}p{0.30\textwidth}X@{}}
  \toprule
  \textbf{Context} & \textbf{Used by} & \textbf{File} \\
  \midrule
  \texttt{lux-x-chain-utxo-v1}            & UTXO Fx plugins & \texttt{utxo/mldsafx}, \texttt{utxo/slhdsafx} \\
  \texttt{lux-evm-precompile-mldsa-v1}    & EVM precompile & \texttt{precompile/mldsa/contract.go} \\
  \texttt{lux-evm-precompile-slhdsa-v1}   & EVM precompile & \texttt{precompile/slhdsa/contract.go} \\
  \texttt{lux-reshare-v1}                 & Key resharing HKDF & \texttt{threshold/mpc} \\
  \texttt{lux-wave-v1}                    & Wave voting & \texttt{consensus/protocol/wave} \\
  \texttt{lux-quasar-horizon-v1}          & ML-DSA cert set on Horizon transcript & \texttt{consensus/protocol/quasar/horizon.go} \\
  \texttt{lux-warp-v2-mldsa-v1}           & ML-DSA cert set on Warp 2.0 envelope & \texttt{warp/pulsar/pulsar.go} \\
  \bottomrule
\end{tabularx}

\section{Versioning discipline}

Every personalization tag includes a version suffix (\texttt{-v1}). When a tag's semantics change, the version is bumped (\texttt{-v2}, \ldots), and the old tag remains valid for already-signed objects. There is no negotiation between versions; senders and receivers agree on the version out-of-band (typically via the chain's protocol version or the Warp envelope's wire version).

\textbf{No tag is reused across protocols.} A future $\mathsf{WARP\text{-}PULSAR\text{-}ENVELOPE\text{-}v2}$ would not collide with $\mathsf{QUASAR\text{-}PULSAR\text{-}ACTIVATE\text{-}v1}$ even if the underlying message bytes happened to coincide; the personalization tag prevents the cross-context replay.

\section{Why this matters}

\subsection{Cross-protocol replay}

Without tag separation, a Pulse over a Nebula bundle root could be lifted into a Pulse over a Warp envelope (or vice versa). The wire bytes would be syntactically distinguishable but semantically interchangeable. Tag separation makes the bytes semantically distinguishable: a TupleHash256 with one personalization is not equal to a TupleHash256 with another personalization, even on identical inputs.

This is the formal claim behind LP-073 \cite{luxpulsar} \S "Domain-separated message prefixes": the QUASAR-PULSAR-BUNDLE-v1 prefix prevents a bundle Pulse from being replayed as a Warp envelope Pulse.

\subsection{Cross-suite collision}

Pulsar-SHA3 and Pulsar-BLAKE3 use distinct personalization tags within their respective hash families. A signature produced under one suite does not verify under the other (Theorem \texttt{thm:hash-suite-separation} of \texttt{proofs/pulsar/hash-suite-separation.tex}). The HashSuiteID is bound into every transcript; cross-suite forgery would require a collision on TupleHash256 with the suite's personalization.

\subsection{Cross-version collision}

A future v2 protocol bump uses a v2 tag suffix. Signatures under v1 do not verify as v2 signatures. This is forward-only versioning: the old protocol continues to exist for already-signed objects, but the new protocol's tags are distinct.

\section{Test coverage}

The domain-separation discipline is enforced in code:

\begin{itemize}[leftmargin=2em,nosep]
  \item \texttt{warp/pulsar/hashsuite\_mismatch\_test.go}: tests that mismatched HashSuiteID returns \texttt{ErrSuiteMismatch}.
  \item \texttt{pulsar/hash/} unit tests: each hash function's personalization is checked against canonical KAT vectors.
  \item \texttt{pulsar/reshare/negative\_transcript\_test.go}: 17 transcript-mutation cases × 3 sites confirming a wrong tag fails verification.
\end{itemize}

\section{Adding a new tag}

The procedure for adding a new domain-separation tag:

\begin{enumerate}[leftmargin=2em,nosep]
  \item Choose the tag string per the LP-105 \cite{lp105} naming rules: cosmological / optical / cryptographic, Lux-owned, technically accurate.
  \item Add a versioned suffix (\texttt{-v1}).
  \item Document the tag in this registry (this file is normative).
  \item Add a test in the appropriate \texttt{*\_test.go} that verifies the tag is bound into the relevant transcript.
  \item Update the canonical reference (e.g., \texttt{proofs/definitions/transcript-binding.tex}).
\end{enumerate}

The registry is the single source of truth. A signature using a tag not in the registry is unverifiable by definition.

\bibliographystyle{plain}
\bibliography{../references}

\end{document}