mirror of
https://github.com/luxfi/consensus.git
synced 2026-09-24 00:26:58 +00:00
zeekay
b0ffb5e8d2
Add the canonical parallel post-quantum finality posture: every cert carries
a Pulsar (Module-LWE / FIPS-204 ML-DSA) leg AND a Corona (Ring-LWE, dealerless)
leg, in parallel, AND-mode (both required to finalize). Security is the safest
surviving leg: an adversary must break BOTH the Module-LWE leg and the Ring-LWE
leg in the same round (orthogonal hardness, conjunctive acceptance).
dualpq.go (production):
- DualPQRequiredLegs(paramSet): the canonical {Pulsar, Corona} AND-mode
required-leg set (matches config CertModeStrict+CertVariantStrict).
- ComposeDualPQEvidence(...): pure-function composition of the two
threshold-sig leg evidences from a real Corona threshold signature + a
real Pulsar FIPS-204 signature over the same envelope message. Composition
over inheritance — wraps each primitive's output, extends neither.
consensus_cert_dualpq_test.go (multi-node proof):
- Corona leg: genuine multi-node two-round t-of-n threshold ceremony — N
separate single-share Signers, Round1/Round2 over an explicit message bus,
aggregated by one node from Round2 DATA (never shares).
- Pulsar leg: real FIPS-204 ML-DSA-65 signature accepted byte-for-byte by
the on-chain verifier (verifyPulsarLeg -> pulsarwire.VerifyBytes).
- Proves: AND-mode (both legs required + verify), sub-quorum on EITHER leg
fails finality, corrupt either leg fails, composer refuses a half cert.
- Single-share invariant: compile-time witness that the only Corona signing
constructor takes EXACTLY ONE *KeyShare; aggregator takes Round2 DATA.
Permissionless-safe today via the dealerless Corona leg in AND-mode; the
Pulsar leg's no-reconstruct t-of-n threshold production is documented as
blocked on a poly-vector secret-share type (ML-DSA s1 is non-linear in the
GF(257) seed-share) — see luxfi/pulsar BLOCKERS.md PULSAR-V12-PARALLEL-PQ.
No fakes: the Pulsar leg signature is a real FIPS-204 group-key signature,
not a claimed threshold ceremony.