zeekay
90e96df805
- proofs/easycrypt/: 13 EC files mirroring Pulsar layout, admit budget 0/0 statically pinned by scripts/checks/ec-admits.sh
- proofs/lean-easycrypt-bridge.md: 5-axiom Lean ↔ EC bridge (lagrange_inverse_eval, threshold_partial_response_identity, reconstruct_linear, shamir_correct, add_share_zeroR)
- jasmin/{lib,rlwe,threshold}/: round1/round2/combine .jazz with #ct annotations
- ct/dudect/: Verify + Combine harness (arm64 + x86_64 build tags)
- scripts/check-high-assurance.sh + scripts/checks/{ec-admits,ec-regressions,ec-refinement-scaffold,ec-compile,jasmin,extraction}.sh + check-lean-bridge.sh
- AXIOM-INVENTORY: residual axioms enumerated with closure pathways
- CRYPTOGRAPHER-SIGN-OFF: APPROVED WITH ROADMAP GATES; GATE-1+2+3a CLOSED; GATE-3b (dudect 10⁹ pinned CPU) + GATE-4 (external audit) + GATE-5 (Jasmin extraction filling out byte-walk) roadmap v0.8.0
Tier label: Tier A full closure scaffold landed; matches Pulsar v1.0.7 posture (admit 0/0 + Lean bridges + Jasmin + dudect harness wired). The submission-grade dudect run + external audit are v0.8.0 audit-track items.
Corona Jasmin sources
Constant-time threshold layer + centralized R-LWE Sign reference, written in Jasmin (https://github.com/jasmin-lang/jasmin) for jasmin-ct verification + EasyCrypt extraction.
Layout
jasmin/
lib/ -- Shared primitives (corona_params, seed,
transcript, mac, lagrange).
rlwe/ -- Centralized R-LWE Sign (single-party).
threshold/ -- Threshold round1.jazz, round2.jazz,
combine.jazz.
Compile / verify
Type-check:
jasminc -until_typing threshold/round1.jazz
jasminc -until_typing threshold/round2.jazz
jasminc -until_typing threshold/combine.jazz
Constant-time check:
jasmin-ct threshold/round1.jazz
jasmin-ct threshold/round2.jazz
jasmin-ct threshold/combine.jazz
The threshold-layer files are BLOCKING gates in scripts/checks/jasmin.sh.
Status
v0.7.0 ships the structural sources. Each file mirrors its luxfi/corona/sign/sign.go reference body, marked with #ct annotations at the export boundaries. The libjade-NTT kernel calls are sketched at the structural level; full body wiring is the production target for external audit at v0.8.0.
The skeleton is sufficient for:
- jasminc type-checking (the #ct annotations are syntactically valid)
- jasmin-ct CT analysis (the secret-data flow boundaries are pinned)
- EasyCrypt extraction sanity (the export ABI matches the wrapper layer)
The full body wiring is the path to closing the byte-walk axioms in
proofs/easycrypt/Corona_N1_{Combine,Sign}_Refinement.ec.
CT annotations
Each export function carries a #[ct = ...] annotation declaring the
public/secret level of each argument. The CT type is:
pointer-value-public * ... -> return-public
Pointed-to data carries its own secrecy level inside the function via
#secret / #public markers on stack arrays. The wrapper layer in
the Go reference (luxfi/corona/sign/sign.go) ensures the pointer
contents satisfy these annotations.
Refinement target
Each .jazz file refines a corresponding Go function in luxfi/corona/sign/sign.go:
| Jasmin | Go reference |
|---|---|
threshold/round1.jazz |
Party.SignRound1 |
threshold/round2.jazz |
Party.SignRound2 + Party.SignRound2Preprocess |
threshold/combine.jazz |
Party.SignFinalize |
rlwe/sign.jazz |
A centralized aggregator running all three rounds with #parties=1 |
lib/lagrange.jinc |
primitives.ComputeLagrangeCoefficients |
lib/transcript.jinc |
primitives.Hash (transcript_hash) |
lib/mac.jinc |
primitives.GenerateMAC |
lib/seed.jinc |
primitives.PRNGKeyForRound |