papers/nasua/nasua.tex

% Nasua: Ring-LWE Threshold Signatures
% Academic upstream of the Lux Quasar family.
% Superseded by Corona for production; expanded to ML-DSA with Pulsar.

\documentclass[11pt,a4paper]{article}

\usepackage[margin=1in]{geometry}
\usepackage{amsmath, amssymb, amsthm}
\usepackage{hyperref}
\usepackage{cite}
\usepackage{microtype}
\usepackage{xcolor}
\usepackage{booktabs}
\usepackage{enumitem}
\usepackage{cleveref}
\usepackage{../shared/luxcover}

\hypersetup{
  colorlinks=true,
  linkcolor=blue!50!black,
  citecolor=blue!50!black,
  urlcolor=blue!50!black,
}

\newtheorem{theorem}{Theorem}
\newtheorem{lemma}[theorem]{Lemma}
\theoremstyle{definition}
\newtheorem{definition}{Definition}
\theoremstyle{remark}
\newtheorem{remark}{Remark}

\newcommand{\Rq}{R_q}
\newcommand{\Zq}{\mathbb{Z}_q}
\newcommand{\RLWE}{\mathsf{R\text{-}LWE}}
\newcommand{\MLWE}{\mathsf{MLWE}}
\newcommand{\MSIS}{\mathsf{MSIS}}
\newcommand{\Adv}{\mathsf{Adv}}
\newcommand{\negl}{\mathsf{negl}}
\newcommand{\PPT}{\mathsf{PPT}}
\newcommand{\Sign}{\textsc{Sign}}
\newcommand{\Verify}{\textsc{Verify}}
\newcommand{\DKG}{\textsc{DKG}}
\newcommand{\Reshare}{\textsc{Reshare}}

\title{Annulus\\
       \large Ring-LWE Threshold Signatures\\
       Archived academic root of the Lux Quasar family\\
       \normalsize (originally \texttt{Nasua}; archived at \texttt{github.com/luxfi/annulus})}
\author{Lux Industries Inc.}
\date{Status: \emph{archived} (academic-only, frozen). Production descendants are Pulsar and Corona.}

\begin{document}
\luxcoverpage
\maketitle

\begin{abstract}
Annulus is the archived Lux academic root of the Quasar family of
Ring-LWE threshold-signature schemes. The Lux fork was originally
released under the code-name \texttt{Nasua}; the formal-paper name
\texttt{Annulus} replaced it at the academic-archive cut. Annulus
tracks the Ring-LWE threshold construction of Boschini, Kaviani, Lai, Malavolta,
Takahashi, and Tibouchi~\cite{ringtail} verbatim, which
itself builds on the Raccoon Fiat--Shamir-without-rejection
template of del~Pino, Espitau, Katsumata, Maller, Mouhartem,
Prest, Rossi, and Saarinen~\cite{raccoon2024}. The primitive's
original formulation uses BLAKE3 for all symmetric primitives and
operates over a single polynomial ring $\Rq$ with one
threshold-quorum ceremony per signature.

Annulus is \emph{not enabled} in Lux production and the repository
is \emph{archived}: no further changes are expected at the
academic level. The production descendants are:
\begin{itemize}[leftmargin=*, itemsep=0pt]
\item \textbf{Corona}~\cite{corona} --- the Lux production-hardened
Module-LWE fork of Annulus. Lifts the Ring-LWE ring $\Rq$ to the
Module-LWE vector ring $\Rq^k$, switches the hash family to
SHA-3 / SP~800-185, adds identifiable abort, adds proactive resharing
with beacon-randomised quorum selection, and ships through the
Pulsar-SHA3 hash suite.
\item \textbf{Pulsar}~\cite{pulsar} --- the Module-LWE /
FIPS~204-compatible expansion that tunes Corona's $\Rq^k$
parameters to ML-DSA so the threshold output is
byte-identical to a single-party FIPS~204 ML-DSA signature.
\end{itemize}
\end{abstract}

\section{The Lux Quasar family}
\label{sec:family}

The Lux Quasar consensus layer composes three independent
threshold-signature primitives under a single ``Quasar Cert'' wire
format:

\begin{center}\small
\begin{tabular}{l l l l}
\toprule
name & lattice & class & status \\
\midrule
\textbf{Pulsar} & Module-LWE / FIPS~204     & NIST MPTC N1 + N4 & production-enabled \\
\textbf{Corona} & Module-LWE (Lux production) & NIST MPTC S1 + S4 & production-enabled \\
\textbf{Nasua}~(this paper) & Ring-LWE (academic upstream) & academic & \emph{not enabled} \\
\bottomrule
\end{tabular}
\end{center}

The three names follow Lux's stellar / circular-feature
discipline: a pulsar (rotating neutron star), the corona (ring of
light around a star), and an annulus (ring-shaped region; the
``ring of fire'' of an annular eclipse). Nasua is the family's
academic root and the name retains the ring-shape connection to
its Boschini et al upstream while distinguishing the Lux upstream-tracker
from production deployments.

\section{Construction summary}
\label{sec:construction}

Nasua follows the original Boschini et al construction~\cite{ringtail}:

\begin{itemize}[leftmargin=*, itemsep=0pt]
\item Lattice: Ring-LWE over $\Rq$ with $q$ a single 48-bit
NTT-friendly prime; the ring is $\Rq = \Zq[X] / (X^n + 1)$ with $n$
a power of two.
\item Sign: two rounds. Round 1 broadcasts $D$-matrix commits with
KMAC over the per-party PRNG seed. Round 2 reveals the response
$z$.
\item Verify: standard $A \cdot z = c \cdot \tilde b + \mathit{commit}$
identity, with a low-norm check on $z$.
\item Hash: BLAKE3 (the academic profile). Lux does not deploy this
hash choice in production; Corona substitutes SHA-3 / SP~800-185
across the same protocol skeleton.
\item DKG: trusted-dealer keygen in the original paper. Nasua
inherits this directly; the trusted-dealer assumption is the
single hardest blocker to production deployment.
\item Reshare: not present. Nasua is a fresh-keygen-per-epoch
primitive.
\end{itemize}

\section{Why Nasua is academic-only}
\label{sec:academic-only}

Three concrete blockers prevent direct deployment of Nasua on the
Lux primary network:

\begin{enumerate}[leftmargin=*, itemsep=0pt]
\item \textbf{Trusted-dealer DKG.} The academic Boschini et al
construction assumes a trusted dealer for key generation. Open
public chains cannot rely on a trusted dealer; Corona supplies a
Pedersen-DKG over $\Rq^k$ with identifiable abort that closes the
gap.
\item \textbf{BLAKE3 hash family.} NIST MPTC IR~8214C \S4.6 lists
the allowed symmetric primitives for Class~N submissions:
AES, Ascon, SHA-2, SHA-3, SHAKE / cSHAKE, HMAC / KMAC / CMAC / GMAC.
BLAKE3 is not on the list. The same applies to FIPS Class~N
profiles for an M-LWE submission. Corona substitutes
cSHAKE256 / KMAC256 / TupleHash256 across every transcript-binding
call to bring the family into the FIPS~202 + SP~800-185
hash discipline.
\item \textbf{No proactive resharing.} Nasua is fresh-keygen-only.
Long-lived validator sets demand proactive secret resharing without
public-key rotation. Corona supplies HJKY97-style proactive
resharing with beacon-randomised quorum selection (DD-006); this is
required for Lux primary network's epoch-rotation cadence.
\end{enumerate}

\section{Relationship to Corona and Pulsar}
\label{sec:relationship}

The Lux Quasar family is a sequence of hardenings and lifts:

\begin{center}
\begin{tabular}{r c l}
\textbf{Nasua} & $\xrightarrow{\text{harden + lift R-LWE} \to \text{M-LWE}}$ & \textbf{Corona} \\
                 &                                & \quad $\downarrow$ \\
                 &                                & \quad $\text{(FIPS~204 ML-DSA tuning)}$ \\
                 &                                & \quad $\downarrow$ \\
                 &                                & \textbf{Pulsar} \\
\end{tabular}
\end{center}

Corona keeps Nasua's 2-round sign skeleton, lifts the Ring-LWE
algebra ($\Rq$, single polynomial) to Module-LWE
($\Rq^k$, polynomial vectors), replaces the hash
family, adds Pedersen-DKG, adds proactive reshare, adds
identifiable abort, and gates the protocol's wire formats through
the Lux Pulsar-SHA3 hash suite. Pulsar then tunes the Module-LWE
parameters to FIPS~204 so that the aggregated signature is
byte-identical to a single-party FIPS~204 ML-DSA signature on the
same message and public key. The Class~N1 interchangeability claim
of Pulsar~\cite{pulsar} closes the cycle: an ML-DSA verifier can
consume Pulsar signatures with no code change.

\section{Implementation status}
\label{sec:status}

The Nasua reference implementation lives in
\texttt{github.com/luxfi/nasua}. The repository tracks the academic
upstream and ships KAT vectors against the original Boschini et al
construction. No precompile, no consensus integration: Nasua is
present as a research artifact for cross-validation of Corona's
protocol skeleton, and for future cryptanalysis exposure under the
unchanged academic profile.

\paragraph{Wire-format compatibility.} The Lux precompile at
\texttt{0x0802} is named \texttt{Boschini et al} (wire-stable; do not
rename). It dispatches to Corona's M-LWE verifier for the production
path. Nasua signatures (BLAKE3-bound transcripts, R-LWE) do not
verify under this precompile.

\paragraph{Cross-implementation conformance.} Nasua KAT vectors
are byte-stable against the upstream Boschini et al reference. Corona's
KAT vectors are byte-stable against the Pulsar-SHA3 hash suite and
are not interchangeable with Nasua's. This is intentional: the
hash family substitution is what makes Corona a Class~S NIST
submission candidate; Nasua is the research-only complement.

\begin{thebibliography}{99}

\bibitem{ringtail}
C.~Boschini, D.~Kaviani, R.~W.~F.~Lai, G.~Malavolta, A.~Takahashi,
M.~Tibouchi.
\newblock Ringtail: Practical two-round threshold signatures from
learning with errors.
\newblock \emph{IACR ePrint 2024/1113}; IEEE S\&P 2025, 2024.

\bibitem{raccoon2024}
R.~del~Pino, T.~Prest, M.~Rossi, M.-J.~O.~Saarinen.
\newblock Raccoon: A masking-friendly signature proving the Module-LWE
masking compatibility theorem.
\newblock NIST PQC additional digital signatures submission, 2024.
\newblock \texttt{raccoonfamily.org}.

\bibitem{corona}
Lux Industries Inc.
\newblock Corona: Production Module-LWE threshold signatures for the Lux
primary network.
\newblock \texttt{github.com/luxfi/corona}; spec at
\texttt{papers/corona/}.

\bibitem{pulsar}
Lux Industries Inc.
\newblock Pulsar: Threshold ML-DSA over Module-LWE with FIPS~204
output interchangeability.
\newblock \texttt{github.com/luxfi/pulsar}; spec at
\texttt{papers/pulsar/} and \texttt{pulsar/spec/pulsar.tex}.

\bibitem{nist-ir-8214c}
National Institute of Standards and Technology.
\newblock First Call for Multi-Party Threshold Schemes
(IR~8214C).
\newblock January 2026.

\bibitem{hjky97}
A.~Herzberg, M.~Jakobsson, S.~Jarecki, H.~Krawczyk, M.~Yung.
\newblock Proactive public key and signature systems.
\newblock \emph{ACM CCS}, 1997.

\end{thebibliography}

\end{document}