mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zooqueen
ac61e71667
Scrub residual Ring-LWE mislabels of the Corona/Pulsar threshold
signature family per canonical decision-b (source: ringtail/sign/config.go
M=8,N=7, q=0x1000000004A01).
- Corona = Module-LWE (Ringtail-derived parameter set, A in R_q^{8x7}),
not Ring-LWE / not "Module-LWE at rank 1".
- Pulsar = Module-LWE (ML-DSA-65, FIPS-204 byte-equal).
- Corona+Pulsar differ by parameter regime/codebase, NOT hardness family:
intra-lattice parameter/implementation diversity, NOT family-disjoint.
- True family-disjoint defense = Magnetar (hash, SLH-DSA) / HQC (codes).
Reframed the false Corona(R-LWE)-vs-Pulsar(M-LWE) family-independence
across lp-219/lp-220/lp-222/lp-223 (P3Q kinds), lux-quasar-composition
(profile hardness table + composition corollary/proof), lux-magnetar-pq,
and the superseded triple-proof/quasar drafts (anonymous lattice
threshold lane = Corona). Legitimate FHE/TFHE Ring-LWE, NTT citations,
and neutral "rank-1" lattice facts left intact. PDFs rebuilt.
83 lines
3.3 KiB
TeX
83 lines
3.3 KiB
TeX
\section{The Three Proofs}
|
|
|
|
|
|
\subsection{Proof 1: BLS Aggregate Signature (Classical Speed)}
|
|
|
|
Every validator signs each block with their BLS12-381 key. The block proposer aggregates all signatures into a single 48-byte aggregate signature. Verification is $O(1)$ regardless of validator count.
|
|
|
|
\begin{center}
|
|
\begin{tabular}{lr}
|
|
\toprule
|
|
\textbf{Property} & \textbf{Value} \\
|
|
\midrule
|
|
Curve & BLS12-381 \\
|
|
Security & 128-bit classical \\
|
|
Signature size & 96 bytes (individual), 48 bytes (aggregated) \\
|
|
Aggregation & $N \to 1$ \\
|
|
Verification & $O(1)$ pairing check \\
|
|
Post-quantum & No \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{center}
|
|
|
|
BLS provides the real-time consensus path. It is fast, compact, and well-understood. Its lack of post-quantum security is compensated by Proofs 2 and 3.
|
|
|
|
\subsection{Proof 2: STARK-Aggregated ML-DSA (Post-Quantum Identity)}
|
|
|
|
Every validator also signs each epoch checkpoint with their ML-DSA-65 key (FIPS 204, ML-DSA). Individual ML-DSA-65 signatures are 3,309 bytes each --- too large to include in block headers.
|
|
|
|
The STARK aggregation step compresses $N$ ML-DSA signatures into a single succinct proof of approximately 200 bytes:
|
|
|
|
$$\text{STARK}(\{(\text{pk}_i, \sigma_i, m)\}_{i=1}^{N}) \to \pi \quad |\pi| \approx 200 \text{ bytes}$$
|
|
|
|
The STARK proof attests: ``$N$ valid ML-DSA-65 signatures over message $m$ exist, signed by public keys $\{\text{pk}_i\}$.'' Verification of $\pi$ is $O(\log N)$.
|
|
|
|
\begin{center}
|
|
\begin{tabular}{lr}
|
|
\toprule
|
|
\textbf{Property} & \textbf{Value} \\
|
|
\midrule
|
|
Signature scheme & ML-DSA-65 (FIPS 204) \\
|
|
Security & 128-bit post-quantum (NIST Level 3) \\
|
|
Individual signature & 3,309 bytes \\
|
|
Public key & 1,952 bytes \\
|
|
Aggregation & STARK proof ($\sim$200 bytes) \\
|
|
Verification & $O(\log N)$ \\
|
|
QuasarCert verify & ${\sim}2$--$5$\,ms CPU~\cite{lux-benchmarks} \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{center}
|
|
|
|
If BLS is broken by a quantum computer, the STARK proof of ML-DSA signatures remains valid. The entire chain history is verifiable post-quantum.
|
|
|
|
\subsection{Proof 3: Corona Threshold Signature (Post-Quantum Privacy)}
|
|
|
|
Corona~\cite{lux-corona} is a lattice-based (Module-LWE, Ringtail-derived) threshold signature scheme with an anonymity property: the verifier can confirm that a threshold of validators signed, but cannot determine \textit{which} validators participated.
|
|
|
|
Corona operates in two rounds:
|
|
|
|
\begin{enumerate}[leftmargin=2em]
|
|
\item \textbf{Round 1}: Each participating validator generates a commitment share.
|
|
\item \textbf{Round 2}: Shares are combined into a threshold signature. The anonymity set is the full validator committee.
|
|
\end{enumerate}
|
|
|
|
The Corona signature is embedded within the STARK circuit --- the STARK proof simultaneously validates both ML-DSA identity signatures and Corona threshold signatures, adding zero bytes to the epoch proof.
|
|
|
|
\begin{center}
|
|
\begin{tabular}{lr}
|
|
\toprule
|
|
\textbf{Property} & \textbf{Value} \\
|
|
\midrule
|
|
Basis & Module-LWE (lattice) \\
|
|
Security & 128-bit post-quantum \\
|
|
Threshold & $t$-of-$N$ \\
|
|
Anonymity & Yes (ring signature property) \\
|
|
Rounds & 2 \\
|
|
Additional bytes & 0 (embedded in STARK proof) \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{center}
|
|
|
|
Corona provides two properties: (1) post-quantum security at a Module-LWE parameter set distinct from ML-DSA's, and (2) validator privacy --- no external observer can determine which specific validators signed a given epoch.
|
|
|