The frame walkers and the boundary checks around them explained themselves by
recounting what a malformed frame did before they existed, in one case with
enough detail to reconstruct it. A comment is read by whoever maintains the
code, and what they need is the rule: a count is worth only the bytes behind
it, membership is checked before shape because shape is what the kernels size
themselves from, a Poly carries its own counts and so is walked like the rest.
No behaviour changes; every line here is a comment.
Co-authored-by: Hanzo Dev <[email protected]>
Decoding a signature or a group key means reading counts a peer chose, and the
lattice decoder allocates from a count before it discovers there is nothing to
fill the space with. A fifty-byte message naming 2^40 coefficients ended the
process — sometimes with "makeslice: len out of range", and for a challenge
naming 2^40 levels by allocating for seventy seconds until the kernel killed it.
ValidateVectorPolyFrame was meant to stop that and did not. Its doc said it
checked "vector outer length, per-poly levels count, per-level coefficient
count"; its body read the outer length, discarded the result, and returned nil,
which its own comment admitted was a stopgap. So it accepted every frame above.
It now walks the frame. The layout is a little-endian count, then per poly a
level count, a coefficient count, and the coefficients; the rule at each count
is the one readLenPrefixed already applies to the outer frame — what is declared
has to fit in what remains. That cannot refuse an honest frame, because an
honest frame's bytes are all present. A level count times a coefficient count is
compared by dividing rather than multiplying, so a product that would wrap is
refused instead of wrapping into a small number that passes.
Two frames were being decoded without ever being walked: a signature's challenge
C, on the grounds that a single Poly is "bounded by the ring size already" — it
is not, it names its own counts — and a group key's A, which is a matrix and
carries the same counts a row deeper. Both are walked now.
The tracked tests built frames with uvarint length prefixes, which is not what
lattigo writes, so what they accepted was a shape no peer could send and what
they proved was nothing about a real frame. They now build the real layout, and
every walk is controlled by a frame the library itself marshalled — without that
control the refusals would only prove this rejects everything.
Co-authored-by: Hanzo Dev <[email protected]>
VerifyWithSuite fed Z and Delta straight into MatrixVectorMul and
VectorAdd, which read a fixed prefix (A's columns, and M) and ignore the
rest. So appending a polynomial to Z or Delta produced a second, longer
byte string that verified for the same key and message — a malleable
certificate a peer could ship — and a truncated or emptied vector indexed
past its end and panicked on the VerifyBytes bus surface. Require A to be
the M-row matrix, Z to have one polynomial per column, and Delta to have
M, deriving the column count from A so the check is exact for the key's
declared shape.
Co-authored-by: Hanzo Dev <[email protected]>
GroupKey.Bytes() returned only {len(A), len(BTilde)} — the dimensions,
which every key of one parameter set shares — so two independent group
keys carried the identical identifier 0808. Anything keyed on it (a
registry, a route, a cache) treated every Corona group as the same
group. Return sha256 of the canonical serialization instead, so distinct
keys have distinct identifiers.
Co-authored-by: Hanzo Dev <[email protected]>
One round-1 message killed an honest validator. MatrixAdd answered a shape
mismatch with log.Fatalf — os.Exit, no error, no recoverable panic — and
SignRound2Preprocess folded every entry of the peer-supplied D map through it
while the MAC loop authenticated only the agreed set T. A commitment carrying a
party id outside T was never checked and still reached the adder, so a
Round1Data{PartyID: 7, D: nil} from a non-member exited the process.
Three changes, one rule: nothing that touches peer data may take the process
down, and membership is the authentication precondition. MatrixAdd returns an
error the caller refuses on. The preprocess fold ranges T rather than the whole
map, so only authenticated commitments reach a kernel. And Round2 refuses a
round-1 message from a party outside the signing set at the boundary, before its
matrix touches anything — which is where the membership check belonged, since the
MACs downstream only cover members.
Upstream never terminates on a peer message; neither does this now.
Structural + behavioural proof that the Corona threshold SIGNING path never
forms the full secret s, even transiently at sign time:
GATE A (structural, go/ast): every signing/verify function body is scanned;
none calls an across-party reconstruction primitive (reconstruct /
interpolate / combineShares / recover* / ShamirSecretSharing /
lagrangeAtZero / selectQuorum) and none invokes the trusted-dealer keygen
(Gen / GenerateKeysTrustedDealer). Per-party Lagrange (party.Lambda on the
party's OWN share) is the legitimate no-reconstruct mechanism and is NOT
forbidden. Negative-control verified: injecting a reconstruct call into
SignFinalize trips GATE A.
GATE B (behavioural, reflect): Round1Data/Round2Data/Signature carry no
share/sk/seed/lambda; Finalize ingests only map[int]*Round2Data (masked z
partials) — the aggregator never holds a second party's secret.
GATE C (independent verifier): a real (3,5) no-reconstruct ceremony, each
Signer from exactly ONE share, verifies under the bare Corona verifier
(public data only) and the stateless wire verifier; tamper rejected.
Verdict: Corona is a STRICT trustless lane — dealerless keygen (keyera.Bootstrap)
+ no-reconstruct signing. Sub-quorum-cannot-forge is pinned separately by
TestThresholdSubQuorumCannotForge.
The Pedersen-VSS DKG share-dealing now runs entirely on github.com/luxfi/dkg
(proven byte-identical at cutover); corona's own copy is dead. Remove it and its
now-orphaned tooling, keeping only corona-specific code (Ringtail signing, β
rounding, Path (a) finalize — all in sign/, utils/, keyera/, untouched).
Deleted:
- dkg2/ (the whole package: Round1/Round2/commits/complaint/GPU dispatch).
- cmd/dkg2_oracle/ (the dkg2 KAT generator; the DKG KAT now lives in
luxfi/dkg's own ring/vss vectors).
- keyera/cutover_gate_test.go (the transitional dkg2-vs-vss equality gate; its
job is done — permanent byte-stability is pinned by the golden KAT, and the
PIN-4 convention assertion is preserved dkg2-free in pin4_convention_test.go).
Updated:
- cmd/cross_runtime_oracle drops the dkg2 manifest leg (the luxcpp C++ dkg2
cross-runtime gate migrates to luxfi/dkg separately — flagged, not silently
broken).
- keyera/reanchor doc comments + threshold bench comment point at luxfi/dkg.
go build ./... + go test ./... -count=1 green (13 ok / 0 fail), go vet + gofmt
clean. The golden byte-stability KAT + Bootstrap→sign→verify + dishonest-dealer
abort all still pass on the vss path.
Corona is Module-LWE (threshold-Raccoon/Ringtail), NOT Ring-LWE. Confirmed in code: sign/sign.go samples A in R_q^{8x7} (sign.go:87 SamplePolyMatrix M=8,N=7), secret s a rank-7 ring vector, b=A*s+e (sign.go:106-107) over R_q=Z_q[X]/(X^256+1) (LogN=8), q=0x1000000004A01 -- rank>1 module structure, not rank-1 ring-LWE. threshold/threshold.go:4-5 already said Module-LWE.
Fixed the family label across README, SPEC, SUBMISSION, NIST-SUBMISSION, PATENTS, LLM, CONTRIBUTING, SECURITY, CHANGELOG, DEPLOYMENT-RUNBOOK, Makefile, AXIOM-INVENTORY, PROOF-CLAIMS, BLOCKERS, CRYPTOGRAPHER-SIGN-OFF, FIPS-TRACEABILITY, TRUSTED-COMPUTING-BASE, AUDIT-2026-05/06, docs/mptc/*, jasmin/README, 3 Go comments + cli help string.
Also corrected the downstream false claim that Corona (Ring-LWE) and Pulsar (Module-LWE) are 'different lattice families' giving 'structural/family diversity': both are Module-LWE, so the Double-Lattice defense is construction/implementation diversity (threshold-Raccoon vs ML-DSA), not hardness-family diversity; a Module-LWE break affects both legs (hash-based Magnetar is the assumption-diversifier). Fixed companion R-SIS -> Module-SIS where it was the module scheme's SIS assumption; added the Langlois-Stehle (DCC 2015) Module-LWE citation alongside LPR 2010.
Delicate artifacts: proof identifiers (rlwe_sign_op, RLWE_Functional theory/file, *_eq_rlwe bridges, CentralRLWESign, RLWESign, rlwe_compute_*) were NOT renamed -- EasyCrypt/jasmin toolchains are absent here so a rename cannot be compile-verified, and .assurance/ gates parse those names. Added clarifying naming notes to the 5 prominent .ec files, proofs/easycrypt/README.md, AXIOM-INVENTORY.md, and jasmin/rlwe/sign.jazz. .assurance/*.txt left untouched (already say Module-LWE/Module-SIS; rlwe tokens are gate-parsed identifiers). Left AUDIT-2026-06.md:463 historical rename-log and the ProtoStar-LWE paper-title substring untouched.
go build ./... and go test ./... green (GOWORK=off; all packages ok).
Part of the Lux threshold-crypto security rip (killing trusted-dealer /
full-key-reconstruction footguns).
- Rename threshold.GenerateKeys -> threshold.GenerateKeysTrustedDealer.
The function samples the full secret and sets sign.K / sign.Threshold in
one process: it IS the trusted dealer. The new name mirrors
keyera.BootstrapTrustedDealer so the trust model is explicit and
greppable. Doc comment now states it is for test/KAT/CT/CLI/oracle use
only, and that production chain keygen uses keyera.Bootstrap (dealerless
Pedersen DKG). Stays exported; every caller updated (cli, ct/dudect,
same-package tests) plus stale comment refs in cmd, keyera, wire,
reshare.
- Delete utils.ReconstructSecret. It Lagrange-interpolates the full secret
from shares and had zero callers anywhere in the repo: a
reconstruction-shaped footgun left dead. CompareSecrets and the section
retained.
- Include threshold/minority_soundness_test.go: an adversarial negative
pinning that a strict sub-quorum cannot assemble a signature that
verifies under the group key (uncancelled PRF mask fails the L2-norm
gate). A sub-quorum forgery would be a catastrophic finality break.
Closes the CRIT-1 residual (D1-2) sid-entropy gap and the CT/doc hygiene
gaps to bring Corona to the no-leak/no-gap bar. EasyCrypt proofs untouched.
PRIORITY 1 — anti-nonce-reuse / no-leak durability:
- The Round-1 nonce-PRF key no longer keys on a bare 64-bit sid. It now
derives from a 256-bit domain-separated SessionID (primitives.DeriveSessionID:
TranscriptHash("corona.sign.session-id.v1" || be64(sid) || T)) AND a fresh
per-signature 256-bit hedge salt drawn inside the kernel from party.Rand
(default crypto/rand). PRNGKeyForRound = PRF(skShare, "CoronaNonceV3" ||
sessionID || salt). Hedging restores threshold-Raccoon's fresh-per-signature
nonce posture: reuse durability no longer rests on the external consensus
layer never reissuing an sid — even an sid collision yields distinct R with
prob 2^-256. A deterministic 256-bit SessionID alone is necessary but NOT
sufficient (it repeats when sid repeats); the salt is what closes the leak.
- SignRound1 is fail-closed: rejects an all-zero derived SessionID or all-zero
salt with ErrDegenerateSession, and surfaces a short-read error. The
consensus slot-uniqueness invariant is documented as a HARD precondition at
SignRound1 and Signer.Round1 (no longer a buried comment).
- KAT/oracle determinism preserved via one seam: sign.DeterministicNonceSource
(KeyedPRNG over seed || "corona.sign.nonce-salt.v1" || partyIndex), set on
Party.Rand / Signer.SetNonceRand only by reproducibility harnesses.
- SignRound1 / Signer.Round1 now return an error; all call sites updated.
- KAT REGEN: only sign_verify_e2e.json changes (nonce-key bytes moved);
transcript_hash.json / MAC / legacy PRNGKey vectors are byte-stable, proving
the consensus-agreed transcript path was left untouched. Regenerated via
`bash scripts/regen-kats.sh`; `--verify` confirms byte-determinism (10 files).
- Regression: sign/nonce_reuse_test.go proves same-(skShare,sid) yields distinct
D (fresh R), pinned-nonce reproduces byte-identically, and the degenerate-
session guard fires. TestE2EKATReplayDeterminism rewritten to assert both the
hedged-differs and pinned-reproduces properties (was a defanged no-op).
PRIORITY 2 — constant-time hygiene:
- reshare/commit.go already used a constant-time comparator; the real gap was
the verbatim duplication of constTimePolyEqual+uint64SliceToBytes across dkg2
and reshare. Consolidated to one canonical utils.ConstantTimePolyEqual; both
delegate (no dkg2<->reshare dependency). Orphaned imports removed.
- FullRankCheck and the reshare commit path are now covered in the CT review
with their public-operand justification.
PRIORITY 3 — doc accuracy:
- CONSTANT-TIME-REVIEW.md rewritten Corona-specific and file:line-accurate:
drops the stale Pulsar/lens/warp/secp256k1 content; audits the real call
sites (hedged nonce key, masking PRF, lattigo samplers as the residual TCB
axiom, utils.ConstantTimePolyEqual, CheckL2Norm/Verify/FullRankCheck big.Int
variable-time on PUBLIC operands, activation/commit-digest array equality,
keyera/reshare zeroization).
- PROOF-CLAIMS.md §1: threshold.Combine / sign.LocalSign (nonexistent) -> the
real sign.Party.SignFinalize exposed as threshold.Signer.Finalize.
- threshold/threshold.go package doc: Ring-LWE -> Module-LWE.
Closes the long-standing Red HIGH B2 gap that forced luxfi/threshold's
JSON-RPC dispatcher (pkg/thresholdd/corona.go, pulsar.go) to refuse
every Corona op because Signature and GroupKey lacked stable
cross-process wire formats.
Adds:
Signature.MarshalBinary / UnmarshalBinary
GroupKey.MarshalBinary / UnmarshalBinary
VerifyBytes(gkBytes, msg, sigBytes) bool
Layout is domain-separated (CORS magic for Signature, CORG for
GroupKey) so the dispatcher cannot confuse the two slots. Versioning
(2-byte v1) leaves room for byte-format evolution under explicit
opt-in. Bounded validation flows through corona/wire so a malformed
length cannot trigger an oversized allocation.
VerifyBytes is the stateless surface that pkg/thresholdd consumes:
bytes-in, bool-out, no per-process state, byte-equal re-marshaling on
the roundtrip. Cross-wire feeds (GroupKey magic in the Signature slot)
are explicitly rejected.
Tests cover happy path (sign -> marshal -> unmarshal -> verify, plus
byte-equal re-marshal), tampered sig and tampered message rejection,
malformed input rejection (empty, too-short, wrong magic, wrong
version), and cross-wire confusion rejection.
Cannot t.Parallel: threshold.GenerateKeys mutates the sign package
globals K and Threshold (threshold.go:123-124); parallel use of the
kernel races on those globals. The wire codec itself is pure.
Add corona/gpu package — the single, decomplecting point where corona
opts into the lattice library's per-SubRing GPU NTT dispatcher.
Architecture (decomplected).
The lattice library already owns ALL build-tag plumbing for GPU NTT:
ring.SetGPUDispatchers (subring_ops.go) is the canonical hook; the
lattice/gpu package installs it under `cgo && gpu` build tags and
provides a real CPU fallback under !cgo or !gpu. Output is byte-equal
to ring.SubRing.NTT by lattice's own contract.
corona/gpu adds the corona-side bridge: UseAccelerator() flips a
global flag, NewParams() across corona consults the flag via
MaybeRegister and binds each created Ring's SubRings into the lattice
GPU registry. Single source of truth for the opt-in; no build tags
inside corona.
Threshold gating (honest).
Single-poly Metal NTT at corona's production N=256 is roughly 4-6x
SLOWER than pure-Go ring.SubRing.NTT (measured: BenchmarkPulsarSign_
5of7 force-GPU 7.1s vs CPU 1.1s; 14of21 force-GPU 23.5s vs CPU 5.9s).
The GPU win exists only in BATCHED dispatch (many polynomials per
kernel launch), which requires future engine-layer plumbing of
lattice/gpu.MontgomeryNTTContext.Forward(data, batch>=4) bypassing
the per-poly r.NTT() pinch point.
Therefore UseAccelerator() picks defaultThreshold=1024 — above
corona's N=256 — so the SubRing dispatch is armed but does not fire
on single-poly NTT. The registry remains primed for any future batch
caller (e.g. FHE bootstraps in thresholdvm sharing this library).
UseAcceleratorForce() (threshold=1) is provided strictly for the
correctness gate: every NTT call routes through the GPU so the
byte-equality test in threshold/threshold_gpu_test.go exercises the
GPU path end-to-end. Production callers use UseAccelerator() instead.
Byte-equality.
TestThresholdSign_CPU_vs_GPU_ByteIdentical runs the full 2-round
Pulsar signing protocol with GPU dispatch off and forced-on (same
deterministic dealer randomness, same message) and asserts byte-equal
sig.C / sig.Z / sig.Delta. Passes under CGO_ENABLED=0, CGO_ENABLED=1,
and CGO_ENABLED=1 -tags gpu. Existing TestDKG2_GPU_ByteEqual coverage
extends across n=3,5,7,11,21 (production shape).
Wiring.
NewParams() in sign-bound packages — threshold, dkg2, dkg, reshare —
calls corona/gpu.MaybeRegister(r) for the main Q ring. RXi and RNu
are power-of-two moduli; the NTT path is not taken on them.
Tests.
Full corona test suite passes under both build modes:
- CGO_ENABLED=0 go test ./... => all green
- CGO_ENABLED=1 -tags gpu test => all green
Corona signatures are Ring-LWE (C, Z, Delta) ring-polynomial triples,
not FIPS 204 byte-equal (that's Pulsar's Module-LWE sibling). Single
Verify is the only place this package touches the sign.Verify
predicate; VerifyBatch composes it across N (groupKey, message,
signature) tuples in parallel via a GOMAXPROCS-bounded worker pool.
Public surface added:
- VerifyBatch(gks, msgs, sigs) -> ([]bool, error)
- VerifyBatchAll(gks, msgs, sigs) -> (bool, error)
- ErrBatchSizeMismatch
Pure Go: NO CGO / accel dep. A future Metal/CUDA NTT-batch kernel
over the polynomial-arithmetic hotspot would live in luxfi/accel
behind the same byte interface; consumers wanting GPU dispatch call
accel directly against the wire bytes. This file is the portable
fallback everyone gets for free.
Tests (GOWORK=off go test ./threshold/ -run TestVerifyBatch):
TestVerifyBatch_AllValid (n=4, all valid) PASS
TestVerifyBatch_OneCorrupt (message swap @1) PASS
TestVerifyBatch_StructuralMismatch (slice len mismatch) PASS
TestVerifyBatch_Empty PASS
Full ./threshold suite: ok 2.068s.
Leftover from Corona's "Pulsar-R" lineage. Pulsar (M-LWE) and Corona
(R-LWE) are independent constructions with separate hardness assumptions,
so their cSHAKE personalisation strings must be distinct.
Changes (Go, non-luxcpp):
- hash tags: PULSAR-HC-v1 -> CORONA-HC-v1, etc. (HU, TRANSCRIPT, PRF, MAC, PAIRWISE)
- profile IDs: "Pulsar-SHA3" -> "Corona-SHA3", "Pulsar-BLAKE3" -> "Corona-BLAKE3"
- context strings: pulsar.dkg2.A.v1 -> corona.dkg2.A.v1, etc.
- env vars: PULSAR_RESHARE_KAT_PATH -> CORONA_RESHARE_KAT_PATH, etc.
- struct names: pulsarSHA3 -> coronaSHA3
- KAT derive roots: sign_e2e_pulsar -> sign_e2e_corona
What's preserved (different scope):
- luxcpp/crypto/pulsar/* path references in comments (separate repo,
out of scope; the C++ side will rename in its own commit)
- Cross-runtime KAT files on disk (will regenerate next CI run)
All 11 packages test green: dkg, dkg2, hash, keyera, networking,
primitives, reshare, sign, threshold, utils, wire.
Repo forks from luxfi/pulsar (R-LWE production threshold for Lux
consensus) to luxfi/corona under the family rename. Same Ring-LWE
code, same hash family (Pulsar-SHA3 / Pulsar-BLAKE3 -- wire-format
customization tags stay stable per MED-2). Only the Go module path
and internal imports change.
Lux family alignment:
- Pulsar = M-LWE / FIPS 204 / NIST MPTC N1 (was luxfi/pulsar-m)
- Corona = R-LWE / NIST MPTC S1 (this repo)
- Corona = academic upstream + Lux DKG expansions
Whitespace-only struct-tag alignment changes. Closes the CI Lint gate
that was failing across multiple recent commits on otherwise-green
build+test runs.
cmd/sign_oracle/ — emits the canonical Pulsar sign+verify KAT JSON
(Gen + SignRound1 + SignRound2{Preprocess,} + SignFinalize + Verify) for
(t, n) ∈ {2/3, 3/5, 5/7, 7/11}. The C++ port at
luxcpp/crypto/pulsar/cpp/sign/ replays these entries byte-equal.
cmd/cross_runtime_oracle/ — Go writer for the cross-runtime release
gate. Emits a SHA-256 manifest tying together the three canonical
Pulsar KATs (sign, reshare, dkg2). C++ side at
luxcpp/crypto/pulsar/test/cross_runtime_test.cpp replays each KAT and
checks byte-equality (forward direction: 30/30 PASS).
cmd/cross_runtime_verify/ — Go reader for the reverse direction
(C++ writes, Go verifies). Currently 3/3 PASS against the SHA-256s
emitted by luxcpp/crypto/pulsar/cmd/cross_runtime_oracle/.
threshold/testdata/fuzz/FuzzPulsarSign1Round1Data/ — corpus seed for
the in-tree fuzz harness; mitigates the second lattice DoS (issue #4)
where Vector[T].ReadFrom calls make([]T, size) with no bound.
23 fuzz harnesses × 30s = 10.9M execs, 0 panics.
FuzzPulsarSign1Round1Data found a 9-byte input that crashes the
goroutine with `fatal error: out of memory: cannot allocate
105589698985984-byte block` in `lattice/v7/utils/structs.Vector[T].
ReadFrom`. Recovery cannot catch the fatal OOM — the only safe path
is to reject malformed frames before `make([]T, size)` runs.
This is a SECOND DoS surface in lattice/v7, distinct from the
ReadUintNSlice recursion fixed by luxfi/lattice#3 (still open):
ReadFrom calls `make([]T, size)` with `size` read from the wire
before any bound check. PR #3 fixes the inner slice readers but the
outer Vector wrapper allocation remains exploitable.
Filed upstream as luxfi/lattice#4 with reproduction. The new
validateVectorPolyFrameInline walker mirrors the existing
warp/pulsar.validateVectorPolyFrame: walks the wire frame
end-to-end, asserts every length field is <= MaxLatticeUintSliceLen
(4096), and rejects truncated / over-large frames before the
lattigo decoder runs.
Result: FuzzPulsarSign1Round1Data passes 30s with the new walker
in place (28577 execs, 0 panics). Failing input
testdata/fuzz/FuzzPulsarSign1Round1Data/a80b8d313b40fa55 is now
rejected cleanly with "vector length 70368955777453 exceeds 4096".
Refs: luxfi/lattice#2 (open), luxfi/lattice#3 (open),
luxfi/lattice#4 (filed 2026-05-04)
zeekayandHanzo Dev