Files
corona/utils/utils-naive.go
T
zeekay 261ad9d290 pulsar: lattice threshold kernel with key-era lifecycle + Pulsar-SHA3 + Nebula binding
Forked from github.com/luxfi/corona @ d09b2c2. Pulsar inherits the
2-round signing math byte-equal but adds blockchain-grade key
lifecycle and a SHA3-based domain-separated hash profile for
permissionless validator-set rotation.

Inherits from upstream Corona (byte-equal):
  - Sign1/Sign2/Combine 2-round signing math
  - Lattice ring R_q = Z_q[X]/(X^256+1), q = 0x1000000004A01
  - Module-LWE / Module-SIS hardness
  - NTT, Discrete-Gaussian Ziggurat, MAC layer

Replaces from upstream:
  - Broken Feldman-style DKG (pseudoinverse-recoverable). Replaced
    with: (a) one-time foundation MPC ceremony / trusted-dealer
    Bootstrap; (b) Pedersen DKG over R_q (research, dkg2/) hiding
    under MLWE on B / binding under MSIS on [A | B].
  - Trusted-dealer-per-epoch lifecycle (wrong shape for permissionless
    rotation). Replaced with Verifiable Secret Resharing (VSR) every
    epoch under the persistent group public key.

Key-era lifecycle (KeyEraID / Generation / RollbackFrom):
  - KeyEraID bumps only at Reanchor (rare governance event)
  - Generation bumps every Refresh / Reshare under the same GroupKey
  - RollbackFrom records prior generation reverted from (0 = forward)
  - Activation cert (QUASAR-PULSAR-ACTIVATE-v1) gates new generations
    under the unchanged GroupKey

Pulsar-SHA3 hash profile (NIST FIPS 202 / SP 800-185):
  - Hc:        cSHAKE256("PULSAR-HC-v1", transcript) → challenge
  - Hu:        cSHAKE256("PULSAR-HU-v1", transcript) → XOF stream
  - TranscriptHash: TupleHash256("PULSAR-TRANSCRIPT-v1", parts...)
  - PRF:       KMAC256(key, msg, "PULSAR-PRF-v1")
  - MAC:       KMAC256(key, msg, "PULSAR-MAC-v1")
  - Pairwise:  KMAC256(kex, encode(...), "PULSAR-PAIRWISE-v1")
  - Default suite is Pulsar-SHA3; Pulsar-BLAKE3 retained as optional
    non-normative fast profile. HashSuiteID is bound into transcripts.
  - Implementation at pulsar/hash/ with HashSuite interface.
  - All KATs regenerated under SHA3 profile; vectors in
    luxcpp/crypto/pulsar/test/kat/.

Nebula root binding (TranscriptInputs + ActivationMessage canonical
bytes, all bound under TupleHash256):
    chain_id, network_id, group_id,
    key_era_id, old_generation, new_generation,
    old_epoch_id, new_epoch_id,
    old_set_hash, new_set_hash,
    threshold_old, threshold_new,
    group_public_key_hash,
    nebula_root,
    hash_suite_id,
    implementation_version,
    variant.

Packages:
  primitives/   Shamir over R_q, Lagrange, hash helpers
  sign/         2-round sign math (byte-equal upstream)
  threshold/    GroupKey, KeyShare, Signer types
  reshare/      VSR kernel — Refresh (HJKY97 zero-poly), Reshare
                (Desmedt-Jajodia), commit (Pedersen R_q), complaint,
                transcript, pairwise KEX, activation cert
  hash/         HashSuite interface; PulsarSHA3 (default), PulsarBLAKE3
  dkg2/         Pedersen DKG over R_q (research, reference only)
  keyera/       Lifecycle wrapper: Bootstrap → Reshare → Reanchor
  papers/       LP-073-pulsar paper (sections + bibliography)
  cmd/*_oracle/ KAT generators (Go ↔ C++ byte-equal validation)

DESIGN.md is the single source of truth:
  - The Pulsar metaphor (rotating beam over persistent body)
  - Vocabulary stack per LP-105: Nebula / Photon / Lumen / Beam /
    Pulsar / Pulse / Prism / Horizon / Quasar
  - Pulsar ≠ Lumen (PQ stream is separate, planned)
  - Pulsar / Lens / LSS three-layer architecture
  - Bootstrap Dealer vs Signature Coordinator
  - No-slashing failure ladder (timeout → retry → rollback → reanchor)
  - MVP VSR vs Robust VSR phasing
  - Borrowed-brand terms ("X-Wing" used casually) replaced with
    "hybrid KEM" / "Hybrid Lumen Handshake"; X-Wing cited only as
    the IETF combiner primitive name where exact reference matters.

Tests: full suite green
  hash 5+/5+, keyera 5/5, reshare 45+/45+, threshold, sign, dkg,
  dkg2, primitives, networking, utils, corona_oracle_v2 KAT —
  all pass.

Honest claim: the crypto primitives are not new (HJKY97,
Desmedt-Jajodia97, Wong-Wang-Wing02, Corona, Hermine, Threshold
Raccoon all exist). The novel contribution is the systems
composition: a permissionless-consensus deployment architecture that
turns static two-round PQ threshold signatures into a dynamic,
leaderless, validator-rotation-tolerant finality layer.

Companion docs: papers/lp-073-pulsar/ (academic paper); LP-073 +
LP-103 + LP-105 in github.com/luxfi/lps; threshold/protocols/lss/
lss_pulsar.go (LSS adapter wrapping this kernel).
2026-03-03 12:00:00 -08:00

158 lines
4.6 KiB
Go

package utils
import (
"log"
"math/big"
"github.com/luxfi/lattice/v7/ring"
"github.com/luxfi/lattice/v7/utils/structs"
)
const logN = 8
func MulPolyNaive(r *ring.Ring, p1 ring.Poly, p2 ring.Poly, p3 ring.Poly) {
degree := 1 << logN // Since we are in a ring modulo x^256 + 1
q := r.Modulus()
// Initialize result slice with big.Ints set to zero
result := make([]*big.Int, degree)
for i := range result {
result[i] = big.NewInt(0)
}
p1Coeffs := make([]*big.Int, degree)
r.PolyToBigint(p1, 1, p1Coeffs)
p2Coeffs := make([]*big.Int, degree)
r.PolyToBigint(p2, 1, p2Coeffs)
// Polynomial multiplication (convolution)
for i := range p1Coeffs {
for j := range p2Coeffs {
coeff1 := p1Coeffs[i]
coeff2 := p2Coeffs[j]
temp := new(big.Int).Mul(coeff1, coeff2)
if i+j < degree {
// Multiply coefficients and add to the right place
result[i+j].Add(result[i+j], temp)
} else {
index := (i + j) % degree
if (((i+j)-((i+j)%degree))/(2<<logN))%2 == 0 {
// Wrap around due to cyclotomic ring, i+j >= degree
result[index].Add(result[index], temp)
} else {
// Wrap around due to cyclotomic ring, i+j >= degree
result[index].Sub(result[index], temp) // subtracting because of x^256 + 1
}
}
}
}
// Reduce each coefficient modulo q
for i := range result {
result[i].Mod(result[i], q)
}
r.SetCoefficientsBigint(result, p3)
}
// Sets p3 = p1 * p2 by first converting into NTT, multiplying coefficient-wise, and then converting out of NTT with INTT
func MulPolyNTT(r *ring.Ring, p1 ring.Poly, p2 ring.Poly, p3 ring.Poly) {
// Transform p1 and p2 to the NTT domain
r.NTT(p1, p1)
r.NTT(p2, p2)
p1Coeffs := make([]*big.Int, r.N())
p2Coeffs := make([]*big.Int, r.N())
p3Coeffs := make([]*big.Int, r.N())
r.PolyToBigint(p1, 1, p1Coeffs)
r.PolyToBigint(p2, 1, p2Coeffs)
// Perform coefficient-wise multiplication in the NTT domain
for i := 0; i < r.N(); i++ {
p3Coeffs[i] = new(big.Int).Mul(p1Coeffs[i], p2Coeffs[i])
p3Coeffs[i] = new(big.Int).Mod(p3Coeffs[i], r.Modulus())
}
r.SetCoefficientsBigint(p3Coeffs, p3)
// Transform the result back to the standard domain using INTT
r.INTT(p3, p3)
r.INTT(p1, p1)
r.INTT(p2, p2)
}
// MulCoeffsNTT performs coefficient-wise multiplication of two polynomials in the NTT domain.
func MulCoeffsNTT(r *ring.Ring, p1, p2, result ring.Poly) {
p1Coeffs := make([]*big.Int, r.N())
p2Coeffs := make([]*big.Int, r.N())
p3Coeffs := make([]*big.Int, r.N())
r.PolyToBigint(p1, 1, p1Coeffs)
r.PolyToBigint(p2, 1, p2Coeffs)
for i := 0; i < r.N(); i++ {
p3Coeffs[i] = new(big.Int).Mul(p1Coeffs[i], p2Coeffs[i])
p3Coeffs[i] = new(big.Int).Mod(p3Coeffs[i], r.Modulus())
}
r.SetCoefficientsBigint(p3Coeffs, result)
}
// NAIVE MULTIPLICATIONS
// MatrixVectorMul performs matrix-vector multiplication.
// It takes a matrix of ring.Poly pointers, a vector of ring.Poly pointers, and outputs the result in a given result vector.
func MatrixVectorMulNaive(r *ring.Ring, M structs.Matrix[ring.Poly], vec structs.Vector[ring.Poly], result structs.Vector[ring.Poly]) {
for i := range M {
result[i] = r.NewPoly()
for j := range M[i] {
temp := r.NewPoly()
MulPolyNaive(r, M[i][j], vec[j], temp)
r.Add(result[i], temp, result[i])
}
}
}
// MatrixMatrixMul performs matrix-matrix multiplication.
// It takes two matrices of ring.Poly pointers, M1 of dimensions m x p and M2 of dimensions p x n,
// and outputs the result in a given result matrix of dimensions m x n.
func MatrixMatrixMulNaive(r *ring.Ring, M1, M2 structs.Matrix[ring.Poly], result structs.Matrix[ring.Poly]) {
if M1 == nil || M2 == nil || len(M1) == 0 || len(M2) == 0 || len((M1)[0]) != len(M2) {
log.Fatalf("Matrix dimensions are not compatible for multiplication.")
return
}
m := len(M1)
p := len(M1[0])
n := len(M2[0])
// Initialize the result matrix with zeros
for i := 0; i < m; i++ {
result[i] = make([]ring.Poly, n)
for j := 0; j < n; j++ {
result[i][j] = r.NewPoly()
}
}
// Perform matrix multiplication
for i := 0; i < m; i++ {
for j := 0; j < n; j++ {
for k := 0; k < p; k++ {
temp := r.NewPoly()
MulPolyNaive(r, M1[i][k], M2[k][j], temp)
r.Add(result[i][j], temp, result[i][j])
}
}
}
}
// VectorPolyMulNaive performs element-wise multiplication of a vector by a polynomial.
// It takes a vector of ring.Poly pointers, a single ring.Poly pointer, and outputs the result in a given result vector.
func VectorPolyMulNaive(r *ring.Ring, vec structs.Vector[ring.Poly], poly ring.Poly, result structs.Vector[ring.Poly]) {
for i := range vec {
MulPolyNaive(r, vec[i], poly, result[i]) // Multiply each vector element by the polynomial
}
}