pkg/keycommit keeps what stays: a Shamir split, over the RFC 3526 Group-14
prime, of the SHA-256 commitment to a key. Its shares cannot decrypt, so
CommitKey and KeyCommitment replace GenerateSharedKey and KeyShare. fhed's
threshold mode follows the rename.
Co-authored-by: Hanzo Dev <[email protected]>
The 8 demo mains imported github.com/hanzoai/base (HTTP server scaffold)
which pulled the legacy Google Cloud / temporal / grpc transitive chain.
Demos were the only consumers of that chain in the fhe tree.
One way only: fhe is a cryptographic library, not an app harness. App
authors who want HTTP wiring can vendor hanzoai/base directly in their
own cmd binary — fhe doesn't ship that scaffold.
The 8 demo mains import github.com/hanzoai/base which pulls grpc
transitively via the legacy Google Cloud SDK chain. grpc is opt-in
only across the Lux stack, so demos follow the same discipline:
build with -tags demos.
Default fhe build: 0 grpc / 0 google cloud.
Lands the Lux FHE-KAT corpus generators consumed by the C++ production
runtime at github.com/luxfi/luxcpp/crypto/fhe (LP-167). Mirrors the
pulsar/lens/warp regen script shape; emits a sha256 manifest and
supports --verify mode for determinism diffing.
Delivered:
cmd/kat_oracle/main.go KAT oracle. --emit --out <dir>
writes one JSON entry per
(param_set, seed) tuple. Each
entry pins parameter-set ID,
seed, operation tag, and a
CRC32 fingerprint of the SHA-256
digest of the canonical SecretKey
MarshalBinary output.
scripts/regen-kats.sh Driver: runs kat_oracle, runs the
in-tree determinism tests
(TestNewKeyGeneratorFromSeed_Deterministic
+ TestNewKeyGeneratorFromSeed_DifferentSeeds),
emits manifest. --verify mode
diffs against existing manifest;
fails on mismatch.
scripts/regen-kats.manifest.sha256 Initial 4-entry manifest:
PN10QP27 / PN11QP54 × seed-zero /
seed-lp167-stable.
Verification:
$ LUXCPP_DIR=$HOME/work/luxcpp scripts/regen-kats.sh --verify
OK: Lux FHE KAT regeneration is byte-equal across runs (4 files)
$ cd \$HOME/work/luxcpp/crypto/fhe
$ ctest --test-dir build -R fhe_kat_replay
OK lux-fhe-cpp KAT replay (4 entries)
LP-167 §"Cross-runtime KAT contract" requires both directions of
byte-equality. The Go→C++ direction is exercised by this commit and
the C++ replay test. The reverse direction (C++ generates, Go
verifies) is queued behind v0.1.0-rc2-fhe-gpu in lockstep with the
production CUDA NTT + key-switch + bootstrap kernels.
go test -count=1 -timeout=300s ./... -> 3/3 ok
ok github.com/luxfi/fhe 48.345s
ok github.com/luxfi/fhe/pkg/encrypted 98.833s
ok github.com/luxfi/fhe/pkg/threshold 0.778s
Document fhed's two operating modes (standalone + threshold) explicitly
in cmd/fhed/README.md. fhed never reaches across the network for crypto
state — both modes are self-contained.
Add cmd/fhed/standalone_test.go behind the integration build tag. It
builds fhed, starts it on a free port with a fresh data dir, waits for
/v1/fhe/health, and round-trips an encrypted bit through the HTTP API.
Run: go test -tags=integration ./cmd/fhed/... -count=1 -timeout 180s
Honest scope-limit: the test currently fails on bootstrap-key persistence
("max slice length exceeded" from zapdb). The bug is upstream of this
change — fhed itself cannot complete first-time keygen on any parameter
set against current zapdb. Test is correct against the documented API
and will go green once the zapdb blob-size cap is raised in
github.com/luxfi/database.
Operators can't see your data. Nobody can decrypt without t-of-n MPC approval.
Regulators can force-decrypt via legal process (threshold approval flow).
Endpoints:
POST /v1/vault/store encrypt + store (operator sees only ciphertext)
GET /v1/vault/list list records (all encrypted, no plaintext)
POST /v1/vault/request request decryption (starts approval process)
POST /v1/vault/approve/{id} MPC key holder approves (t-of-n threshold)
GET /v1/vault/reveal/{id} get plaintext (only after threshold met)
GET /v1/vault/audit full audit trail of all requests + approvals
POST /v1/vault/compute homomorphic computation on encrypted data
Architecture: FHE public key encrypts. Secret key Shamir-split across N MPC nodes.
No single party (including operator) can decrypt. Social/legal process required.
Each demo is a sovereign app: go run ./cmd/demos/<name> serve
darkpool: /v1/orders, /v1/match, /v1/reveal — encrypted order matching
compliance: /v1/portfolio, /v1/check — SEC diversification on encrypted holdings
marketmaker: /v1/quotes, /v1/best — private market making
auction: /v1/bids, /v1/determine-winner, /v1/reveal — sealed-bid auction
voting: /v1/votes, /v1/tally, /v1/result — encrypted shareholder voting
nav: /v1/holdings, /v1/compute — confidential fund valuation
proof: /v1/positions, /v1/prove — compliance proofs without revealing data
All use Base embedded SQLite + admin UI at /_/. FHE key material
stored in Base's encrypted collections. Original FHE logic preserved.
Replace flat-file key storage (secret.key, public.key, bootstrap.key)
with encrypted ZapDB (ChaCha20-Poly1305). All FHE key material is now
stored in a single encrypted database at <dataDir>/zapdb/.
New pkg/store package wraps luxfi/database/encdb for:
- Secret/public/bootstrap key storage (encrypted at rest)
- Ciphertext cache by content hash
- Metadata storage
New --password flag (or FHED_PASSWORD env) for ZapDB encryption.
Both standard and threshold modes use ZapDB.
Six production-ready example applications demonstrating the FHE library:
- cmd/seal: document integrity sealing with encrypted verification
- cmd/vote: encrypted voting system with threshold tallying
- cmd/mediaseal: media content authentication with FHE
- cmd/provenance: AI model provenance tracking with encrypted attestation
- cmd/crdt: encrypted LWW-Register for fheCRDT architectures (LP-6500)
- cmd/stats: secure multiparty statistics over encrypted data
Also pins luxfi/mdns to v0.1.0 and excludes compiled binaries from git.
- Remove old Go FHE code (now in lux/fhe)
- Remove old Zama compatibility layers
- Update CI for TypeScript/JS SDK only
- This repo is now purely the @luxfhe npm package ecosystem
- Remove replace directive for lattice/v7 (now using published v7.0.0)
- Keep gpu replace as it requires local C++ compilation and the git repo
path (luxfi/mlx) doesn't match module path (luxfi/gpu)
- TODO: Rename github.com/luxfi/mlx to github.com/luxfi/gpu to fix module path
BSD-3-Clause-Research License: Pure Go TFHE implementation with
patent-pending innovations including deterministic FHE for blockchain
consensus, transaction-batch amortized bootstrapping, and parallel
bootstrapping with work-stealing scheduler.
zeekayandHanzo Dev