mirror of
https://github.com/luxfi/corona.git
synced 2026-09-24 00:25:54 +00:00
159e9279fff28eec0ac001ba9de56b0cd94de4b7
5
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 zeekay
|
78efc403f2 |
gpu: opt corona threshold signing into lattice/ring GPU NTT dispatch
Add corona/gpu package — the single, decomplecting point where corona opts into the lattice library's per-SubRing GPU NTT dispatcher. Architecture (decomplected). The lattice library already owns ALL build-tag plumbing for GPU NTT: ring.SetGPUDispatchers (subring_ops.go) is the canonical hook; the lattice/gpu package installs it under `cgo && gpu` build tags and provides a real CPU fallback under !cgo or !gpu. Output is byte-equal to ring.SubRing.NTT by lattice's own contract. corona/gpu adds the corona-side bridge: UseAccelerator() flips a global flag, NewParams() across corona consults the flag via MaybeRegister and binds each created Ring's SubRings into the lattice GPU registry. Single source of truth for the opt-in; no build tags inside corona. Threshold gating (honest). Single-poly Metal NTT at corona's production N=256 is roughly 4-6x SLOWER than pure-Go ring.SubRing.NTT (measured: BenchmarkPulsarSign_ 5of7 force-GPU 7.1s vs CPU 1.1s; 14of21 force-GPU 23.5s vs CPU 5.9s). The GPU win exists only in BATCHED dispatch (many polynomials per kernel launch), which requires future engine-layer plumbing of lattice/gpu.MontgomeryNTTContext.Forward(data, batch>=4) bypassing the per-poly r.NTT() pinch point. Therefore UseAccelerator() picks defaultThreshold=1024 — above corona's N=256 — so the SubRing dispatch is armed but does not fire on single-poly NTT. The registry remains primed for any future batch caller (e.g. FHE bootstraps in thresholdvm sharing this library). UseAcceleratorForce() (threshold=1) is provided strictly for the correctness gate: every NTT call routes through the GPU so the byte-equality test in threshold/threshold_gpu_test.go exercises the GPU path end-to-end. Production callers use UseAccelerator() instead. Byte-equality. TestThresholdSign_CPU_vs_GPU_ByteIdentical runs the full 2-round Pulsar signing protocol with GPU dispatch off and forced-on (same deterministic dealer randomness, same message) and asserts byte-equal sig.C / sig.Z / sig.Delta. Passes under CGO_ENABLED=0, CGO_ENABLED=1, and CGO_ENABLED=1 -tags gpu. Existing TestDKG2_GPU_ByteEqual coverage extends across n=3,5,7,11,21 (production shape). Wiring. NewParams() in sign-bound packages — threshold, dkg2, dkg, reshare — calls corona/gpu.MaybeRegister(r) for the main Q ring. RXi and RNu are power-of-two moduli; the NTT path is not taken on them. Tests. Full corona test suite passes under both build modes: - CGO_ENABLED=0 go test ./... => all green - CGO_ENABLED=1 -tags gpu test => all green |
||
|
zeekay
|
e0fdfe475b |
corona: symmetric domain separation — PULSAR-* tags -> CORONA-*
Leftover from Corona's "Pulsar-R" lineage. Pulsar (M-LWE) and Corona
(R-LWE) are independent constructions with separate hardness assumptions,
so their cSHAKE personalisation strings must be distinct.
Changes (Go, non-luxcpp):
- hash tags: PULSAR-HC-v1 -> CORONA-HC-v1, etc. (HU, TRANSCRIPT, PRF, MAC, PAIRWISE)
- profile IDs: "Pulsar-SHA3" -> "Corona-SHA3", "Pulsar-BLAKE3" -> "Corona-BLAKE3"
- context strings: pulsar.dkg2.A.v1 -> corona.dkg2.A.v1, etc.
- env vars: PULSAR_RESHARE_KAT_PATH -> CORONA_RESHARE_KAT_PATH, etc.
- struct names: pulsarSHA3 -> coronaSHA3
- KAT derive roots: sign_e2e_pulsar -> sign_e2e_corona
What's preserved (different scope):
- luxcpp/crypto/pulsar/* path references in comments (separate repo,
out of scope; the C++ side will rename in its own commit)
- Cross-runtime KAT files on disk (will regenerate next CI run)
All 11 packages test green: dkg, dkg2, hash, keyera, networking,
primitives, reshare, sign, threshold, utils, wire.
|
||
|
zeekay
|
8c010dd8ef |
corona: rename module path github.com/luxfi/pulsar → github.com/luxfi/corona
Repo forks from luxfi/pulsar (R-LWE production threshold for Lux consensus) to luxfi/corona under the family rename. Same Ring-LWE code, same hash family (Pulsar-SHA3 / Pulsar-BLAKE3 -- wire-format customization tags stay stable per MED-2). Only the Go module path and internal imports change. Lux family alignment: - Pulsar = M-LWE / FIPS 204 / NIST MPTC N1 (was luxfi/pulsar-m) - Corona = R-LWE / NIST MPTC S1 (this repo) - Corona = academic upstream + Lux DKG expansions |
||
|
zeekay
|
b70f60dc31 |
pulsar: plumb HashSuite through every Sign-path primitive (F22)
primitives/hash.go: PRNGKey / GenerateMAC / GaussianHash / PRF / Hash / LowNormHash all take HashSuite as first param. suite == nil resolves to the production default Pulsar-SHA3 (cSHAKE256 / KMAC256 / TupleHash256 per FIPS 202 + NIST SP 800-185). sign/sign.go: Party gains Suite field; NewParty defaults to hash.Default(); NewPartyWithSuite for operator-explicit construction. sign.Verify keeps its signature for callers and resolves the default internally; the suite-explicit form is sign.VerifyWithSuite. reshare/commit.go: suite-aware commit derivation aligned with the new hash.HashSuite contract used by the rest of pulsar/reshare/dkg2/keyera. Closes the gap where the HIP-0077 claim that Pulsar uses SHA-3 cSHAKE256/KMAC256/TupleHash256 in production was structurally false at the Sign layer (only pulsar/reshare/, pulsar/dkg2/, pulsar/keyera/ were consuming pulsar/hash/HashSuite previously). Pulsar-BLAKE3 retained as legacy/non-normative only for cross-port byte checks. go.mod: luxfi/math v1.3.0 -> v1.4.0 (consumes the codec for the new hash-suite tag). CHANGELOG.md added. sign_roundtrip_test.go pins the new contract. Tests: primitives + sign + reshare PASS. Patch-bump. |
||
|
zeekay
|
261ad9d290 |
pulsar: lattice threshold kernel with key-era lifecycle + Pulsar-SHA3 + Nebula binding
Forked from github.com/luxfi/corona @ d09b2c2. Pulsar inherits the
2-round signing math byte-equal but adds blockchain-grade key
lifecycle and a SHA3-based domain-separated hash profile for
permissionless validator-set rotation.
Inherits from upstream Corona (byte-equal):
- Sign1/Sign2/Combine 2-round signing math
- Lattice ring R_q = Z_q[X]/(X^256+1), q = 0x1000000004A01
- Module-LWE / Module-SIS hardness
- NTT, Discrete-Gaussian Ziggurat, MAC layer
Replaces from upstream:
- Broken Feldman-style DKG (pseudoinverse-recoverable). Replaced
with: (a) one-time foundation MPC ceremony / trusted-dealer
Bootstrap; (b) Pedersen DKG over R_q (research, dkg2/) hiding
under MLWE on B / binding under MSIS on [A | B].
- Trusted-dealer-per-epoch lifecycle (wrong shape for permissionless
rotation). Replaced with Verifiable Secret Resharing (VSR) every
epoch under the persistent group public key.
Key-era lifecycle (KeyEraID / Generation / RollbackFrom):
- KeyEraID bumps only at Reanchor (rare governance event)
- Generation bumps every Refresh / Reshare under the same GroupKey
- RollbackFrom records prior generation reverted from (0 = forward)
- Activation cert (QUASAR-PULSAR-ACTIVATE-v1) gates new generations
under the unchanged GroupKey
Pulsar-SHA3 hash profile (NIST FIPS 202 / SP 800-185):
- Hc: cSHAKE256("PULSAR-HC-v1", transcript) → challenge
- Hu: cSHAKE256("PULSAR-HU-v1", transcript) → XOF stream
- TranscriptHash: TupleHash256("PULSAR-TRANSCRIPT-v1", parts...)
- PRF: KMAC256(key, msg, "PULSAR-PRF-v1")
- MAC: KMAC256(key, msg, "PULSAR-MAC-v1")
- Pairwise: KMAC256(kex, encode(...), "PULSAR-PAIRWISE-v1")
- Default suite is Pulsar-SHA3; Pulsar-BLAKE3 retained as optional
non-normative fast profile. HashSuiteID is bound into transcripts.
- Implementation at pulsar/hash/ with HashSuite interface.
- All KATs regenerated under SHA3 profile; vectors in
luxcpp/crypto/pulsar/test/kat/.
Nebula root binding (TranscriptInputs + ActivationMessage canonical
bytes, all bound under TupleHash256):
chain_id, network_id, group_id,
key_era_id, old_generation, new_generation,
old_epoch_id, new_epoch_id,
old_set_hash, new_set_hash,
threshold_old, threshold_new,
group_public_key_hash,
nebula_root,
hash_suite_id,
implementation_version,
variant.
Packages:
primitives/ Shamir over R_q, Lagrange, hash helpers
sign/ 2-round sign math (byte-equal upstream)
threshold/ GroupKey, KeyShare, Signer types
reshare/ VSR kernel — Refresh (HJKY97 zero-poly), Reshare
(Desmedt-Jajodia), commit (Pedersen R_q), complaint,
transcript, pairwise KEX, activation cert
hash/ HashSuite interface; PulsarSHA3 (default), PulsarBLAKE3
dkg2/ Pedersen DKG over R_q (research, reference only)
keyera/ Lifecycle wrapper: Bootstrap → Reshare → Reanchor
papers/ LP-073-pulsar paper (sections + bibliography)
cmd/*_oracle/ KAT generators (Go ↔ C++ byte-equal validation)
DESIGN.md is the single source of truth:
- The Pulsar metaphor (rotating beam over persistent body)
- Vocabulary stack per LP-105: Nebula / Photon / Lumen / Beam /
Pulsar / Pulse / Prism / Horizon / Quasar
- Pulsar ≠ Lumen (PQ stream is separate, planned)
- Pulsar / Lens / LSS three-layer architecture
- Bootstrap Dealer vs Signature Coordinator
- No-slashing failure ladder (timeout → retry → rollback → reanchor)
- MVP VSR vs Robust VSR phasing
- Borrowed-brand terms ("X-Wing" used casually) replaced with
"hybrid KEM" / "Hybrid Lumen Handshake"; X-Wing cited only as
the IETF combiner primitive name where exact reference matters.
Tests: full suite green
hash 5+/5+, keyera 5/5, reshare 45+/45+, threshold, sign, dkg,
dkg2, primitives, networking, utils, corona_oracle_v2 KAT —
all pass.
Honest claim: the crypto primitives are not new (HJKY97,
Desmedt-Jajodia97, Wong-Wang-Wing02, Corona, Hermine, Threshold
Raccoon all exist). The novel contribution is the systems
composition: a permissionless-consensus deployment architecture that
turns static two-round PQ threshold signatures into a dynamic,
leaderless, validator-rotation-tolerant finality layer.
Companion docs: papers/lp-073-pulsar/ (academic paper); LP-073 +
LP-103 + LP-105 in github.com/luxfi/lps; threshold/protocols/lss/
lss_pulsar.go (LSS adapter wrapping this kernel).
|