mirror of
https://github.com/luxfi/pulsar.git
synced 2026-09-24 00:25:52 +00:00
spec: cite Ringtail by its title, and state Corona's licence
references.bib gave ePrint 2024/1113 the title "Corona: Practical Two-Round Threshold Signatures from Learning with Errors". The paper is "Ringtail: Practical Two-Round Threshold Signatures from Learning with Errors", by the six authors the entry already named correctly. A title is the authors' words. The file's own header asks for exactly this — "verified against https://eprint.iacr.org... Do not paraphrase or guess". Ringtail is their scheme. Corona is Lux's implementation over Ring-LWE; Pulsar retargets the same two-round structure to Module-LWE for FIPS 204. The prose and the citation key now say so, and this spec is the NIST MPTC submission, so it is the last place to get it wrong. patent-notes.tex stated "Corona's open-source repo is Apache-2.0 with no asserted patent claims". Corona is under the Lux Ecosystem License v1.2, which reserves commercial use — no Apache grant and no Apache §3 patent grant. The surrounding paragraph had been flattened by a rename into "Pulsar ... is derivative of Pulsar" and "Pulsar (and therefore Pulsar) is a fork"; it now names Corona and Ringtail where each is meant. Dropped the residual Pulsar-M spelling, including the naming rule that forbade writing "Pulsar" and required writing "Pulsar". Co-authored-by: Hanzo Dev <[email protected]>
This commit is contained in:
Hanzo Dev
+2
-2
@@ -525,7 +525,7 @@ item 2 RESEARCH-BLOCKED with a computed obstruction):**
|
||||
holds ȳ, computes w1 directly, and CAN pre-filter BCC offline
|
||||
(`TalusTEEComputeW1`; TEE attestation binding is the OPTIONAL luxfi/tee
|
||||
extension via `attest.go AttestationContext`, never baked into core).
|
||||
**Pulsar-MPC** = TEE-free, fully distributed, no node forms ȳ or w;
|
||||
**PulsarPC** = TEE-free, fully distributed, no node forms ȳ or w;
|
||||
honest-majority N≥2T−1 for T≥3 (`TalusProfileAllows`). The online path
|
||||
and emitted signature are byte-identical across profiles.
|
||||
|
||||
@@ -541,7 +541,7 @@ item 2 RESEARCH-BLOCKED with a computed obstruction):**
|
||||
no suite string routes a Pulsar leg to the wrong verifier.
|
||||
|
||||
- **Headline proof.** `TestTalus_MPC_EndToEnd_StockVerify` /
|
||||
`_Mode87`: a full multi-node Pulsar-MPC ceremony over a message bus
|
||||
`_Mode87`: a full multi-node PulsarPC ceremony over a message bus
|
||||
(dealerless DKG → per-node commitment shares → CEF w1 → one z-broadcast
|
||||
round → release gate) produces a signature that verifies under the
|
||||
UNMODIFIED stock `cloudflare/circl` `mldsa{65,87}.Verify`, with
|
||||
|
||||
+1
-1
@@ -25,7 +25,7 @@ shares); the *algorithm* never reconstructs `w`/`w0`, faithfully proven, but
|
||||
this is NOT yet a networked/deployed distributed MPC and the malicious-secure
|
||||
layer is unbuilt.
|
||||
|
||||
- **Two profiles.** **Pulsar-TEE** (TEE-backed `w1` source) and **Pulsar-MPC**
|
||||
- **Two profiles.** **Pulsar-TEE** (TEE-backed `w1` source) and **PulsarPC**
|
||||
(honest-majority N ≥ 2T−1, enforced by `TalusMinPartiesMPC` / `newCSCPCtx` /
|
||||
`cscpSecureHighBitsVec` / `bgwMulShares`). The emitted signature is
|
||||
byte-identical across profiles.
|
||||
|
||||
@@ -1,17 +1,17 @@
|
||||
# Pulsar -- Agent Knowledge Base (formerly Pulsar-M)
|
||||
# Pulsar -- Agent Knowledge Base (formerly Pulsar)
|
||||
|
||||
**Repository (current)**: github.com/luxfi/pulsar
|
||||
**Repository (target)**: github.com/luxfi/pulsar
|
||||
**Latest Tag**: v1.2.0
|
||||
**Status**: TALUS threshold ML-DSA BUILT; PULSAR-V13-W-LEAK CLOSED (semi-honest, simulation-proven). Not yet FIPS-validated; open residuals = the malicious-secure CSCP layer + a networked MPC deployment (Residual A) and dealerless-key impossibility ⇒ trusted-dealer keygen + Corona-carries-permissionless (Residual B). EasyCrypt + Lean machine-check on host (gate `ec-machine-check.sh`, 14/14); TALUS / no-leak BCC threshold path interop-verified byte-equal under CIRCL + pq-crystals.
|
||||
|
||||
## Rename in progress: Pulsar-M → Pulsar
|
||||
## Rename in progress: Pulsar → Pulsar
|
||||
|
||||
Per the Lux family rebrand, the three threshold libraries are:
|
||||
|
||||
| Name | Lattice | Class | Source path going forward |
|
||||
|---|---|---|---|
|
||||
| **Pulsar** (this repo, was Pulsar-M) | Module-LWE | NIST MPTC N1+N4 | `~/work/lux/pulsar` |
|
||||
| **Pulsar** (this repo, was Pulsar) | Module-LWE | NIST MPTC N1+N4 | `~/work/lux/pulsar` |
|
||||
| **Corona** (was the prior R-LWE Pulsar) | Ring-LWE | NIST MPTC S1+S4 | `~/work/lux/corona` |
|
||||
| **Corona** (unchanged) | Ring-LWE | academic upstream + Lux lifecycle DKG expansions | `~/work/lux/corona` |
|
||||
|
||||
@@ -153,7 +153,7 @@ Threshold ML-DSA: a two-round lattice kernel + one-round online signing
|
||||
FIPS 204 ML-DSA verification**. Targeting NIST MPTC Class N1 (signing) + N4
|
||||
(ML keygen / DKG).
|
||||
|
||||
Pulsar-M is the Module-LWE sibling of `luxfi/pulsar` (Ring-LWE). Pulsar's
|
||||
Pulsar is the Module-LWE sibling of `luxfi/pulsar` (Ring-LWE). Pulsar's
|
||||
two-round kernel is transplanted onto ML-DSA-65's polynomial-vector-over-`R_q`
|
||||
algebra so the aggregated signature is bit-identical to a single-party
|
||||
FIPS 204 signature on the same message + public key; TALUS (v1.2.0) adds
|
||||
@@ -178,7 +178,7 @@ adding **one-round online signing**. Source: `ref/go/pkg/pulsar/talus*.go`.
|
||||
`TestCSCP_LeakFree_Structural` / `TestCSCP_MaskOpen_HidesW` — but in an
|
||||
in-process N-party SIMULATION (NOT a networked/deployed MPC, NOT
|
||||
malicious-secure). Always describe as **semi-honest, simulation-proven**.
|
||||
- **Two profiles.** **Pulsar-TEE** (TEE-backed `w1`) and **Pulsar-MPC**
|
||||
- **Two profiles.** **Pulsar-TEE** (TEE-backed `w1`) and **PulsarPC**
|
||||
(honest-majority N ≥ 2T−1, enforced by `TalusMinPartiesMPC` / `newCSCPCtx` /
|
||||
`cscpSecureHighBitsVec` / `bgwMulShares`). Signature byte-identical across both.
|
||||
- **Stock FIPS-204.** A TALUS signature verifies byte-equal under UNMODIFIED
|
||||
@@ -231,13 +231,13 @@ adding **one-round online signing**. Source: `ref/go/pkg/pulsar/talus*.go`.
|
||||
|
||||
- Repo: `v1.2.0` (current; TALUS threshold ML-DSA + PULSAR-V13-W-LEAK closed semi-honest).
|
||||
- Pinned by: `luxfi/consensus v1.23.5+` (finality verify path replaces
|
||||
the placeholder Pulsar-M verifier).
|
||||
the placeholder Pulsar verifier).
|
||||
|
||||
## Cross-repo dependencies
|
||||
|
||||
- Depends on:
|
||||
- `golang.org/x/crypto/sha3` (cSHAKE / KMAC primitives)
|
||||
- `luxfi/crypto/pq/mldsa/mldsa65` (FIPS 204 verifier — Pulsar-M outputs
|
||||
- `luxfi/crypto/pq/mldsa/mldsa65` (FIPS 204 verifier — Pulsar outputs
|
||||
must round-trip through it byte-equal)
|
||||
- Consumed by:
|
||||
- `luxfi/consensus/protocol/quasar` (finality path) — F107/F109 closure.
|
||||
|
||||
@@ -75,7 +75,7 @@ additive-nonce threshold ML-DSA is impossible (HighBits/r0/carry rounding is
|
||||
non-linear; no homomorphic nonce commitment exists); TALUS routes around it
|
||||
with the BCC (Boundary Clearance Condition) + CEF + dealerless nonce DKG.
|
||||
|
||||
- **Two profiles.** **Pulsar-TEE** — a TEE-backed `w1` source. **Pulsar-MPC** —
|
||||
- **Two profiles.** **Pulsar-TEE** — a TEE-backed `w1` source. **PulsarPC** —
|
||||
TEE-free, honest-majority (N ≥ 2T−1); no node forms the joint nonce `ȳ` or
|
||||
the commitment `w`. The emitted signature is byte-identical across profiles.
|
||||
- **W-LEAK closed (semi-honest, simulation-proven).** The REAL CSCP
|
||||
|
||||
+17
-17
@@ -16,7 +16,7 @@ points here for the variant table.
|
||||
| variant | repo | lattice basis | hash family (canonical) | FIPS 204 verifier interchange? | NIST MPTC class | status |
|
||||
|-----------|-----------------------------------|---------------|--------------------------------|--------------------------------|-----------------|-------------------------------|
|
||||
| **Pulsar.R** | `github.com/luxfi/pulsar` | Ring-LWE (`R_q`) | SHA-3 / cSHAKE256 (SP 800-185) | no — special threshold-friendly primitive | Class S1 + S4 | shipping, hardened, MPTC-ready |
|
||||
| **Pulsar.M** | `github.com/luxfi/pulsar` | Module-LWE (`R_q^k`) | SHA-3 / cSHAKE256 (SP 800-185) | yes — output is a single FIPS 204 ML-DSA σ | Class N1 + N4 | bootstrap repo, spec in flight |
|
||||
| **Pulsar** | `github.com/luxfi/pulsar` | Module-LWE (`R_q^k`) | SHA-3 / cSHAKE256 (SP 800-185) | yes — output is a single FIPS 204 ML-DSA σ | Class N1 + N4 | bootstrap repo, spec in flight |
|
||||
| `Pulsar.W` (reserved slot) | reserved | reserved | reserved | reserved | reserved | naming reservation; not specified |
|
||||
|
||||
All variants share:
|
||||
@@ -37,16 +37,16 @@ All variants share:
|
||||
|
||||
What differs between variants:
|
||||
|
||||
- **Algebra** — Ring-LWE for Pulsar.R, Module-LWE for Pulsar.M. The
|
||||
- **Algebra** — Ring-LWE for Pulsar.R, Module-LWE for Pulsar. The
|
||||
algebraic shape determines parameter sizes, signature sizes, and the
|
||||
structure of the Pedersen commitment scheme.
|
||||
- **Verification target** — Pulsar.R verifies under its own verifier
|
||||
(a custom 2-round-aggregated check); Pulsar.M verifies under
|
||||
(a custom 2-round-aggregated check); Pulsar verifies under
|
||||
unmodified FIPS 204 ML-DSA.Verify. The latter is the single highest-
|
||||
value property of the family.
|
||||
- **NIST submission posture** — see Class column above.
|
||||
- **Production maturity** — Pulsar.R has a hardened reshare path,
|
||||
KAT suite, deployed code. Pulsar.M has a spec stub and skeleton repo.
|
||||
KAT suite, deployed code. Pulsar has a spec stub and skeleton repo.
|
||||
|
||||
## Why one family
|
||||
|
||||
@@ -58,7 +58,7 @@ in either Class N or Class S. Submitting two as a coordinated **family**:
|
||||
patent disclosure, and IP review build to a shared `pulsar-test/` and
|
||||
`pulsar-spec-common/` set of artifacts both submissions reference.
|
||||
2. **Cross-validates the protocol skeleton.** A reviewer attacking the
|
||||
Pedersen DKG soundness in Pulsar.R is also attacking it in Pulsar.M.
|
||||
Pedersen DKG soundness in Pulsar.R is also attacking it in Pulsar.
|
||||
Soundness arguments compose; reviewers don't have to redo work.
|
||||
3. **Demonstrates orthogonality.** Both submissions running on the same
|
||||
2-round structure with different lattice bases is itself a security
|
||||
@@ -71,7 +71,7 @@ in either Class N or Class S. Submitting two as a coordinated **family**:
|
||||
|
||||
## What goes where
|
||||
|
||||
| artifact | shared | Pulsar.R | Pulsar.M |
|
||||
| artifact | shared | Pulsar.R | Pulsar |
|
||||
|-----------------------------------|--------------|-----------------------------------|-------------------------------------|
|
||||
| 2-round protocol description | shared spec | parameterised for `R_q` | parameterised for `R_q^k` |
|
||||
| Pedersen DKG (proper hiding) | shared spec | params for `R_q` | params for `R_q^k` |
|
||||
@@ -92,7 +92,7 @@ algorithms in Round 3.
|
||||
|
||||
- The umbrella name is **Pulsar**. Always capitalised, no hyphen.
|
||||
- A specific variant is **Pulsar.X** where X is one uppercase letter
|
||||
identifying the lattice basis: `Pulsar.R` (Ring-LWE), `Pulsar.M`
|
||||
identifying the lattice basis: `Pulsar.R` (Ring-LWE), `Pulsar`
|
||||
(Module-LWE). The dot is part of the name in prose; in identifiers
|
||||
the canonical machine form is `pulsar-r`, `pulsar` (lowercase,
|
||||
hyphen).
|
||||
@@ -101,8 +101,8 @@ algorithms in Round 3.
|
||||
is a separate academic upstream (`luxfi/corona`) that Pulsar.R
|
||||
forks; Pulsar.R is not Corona.
|
||||
- HashSuiteID byte (per HIP-0077 §"Lux consensus PQ modes") identifies
|
||||
the **hash family**, not the variant. Pulsar.R and Pulsar.M canonical
|
||||
profiles both use `HashSuiteSHA3 = 2`. A future Pulsar.M with a
|
||||
the **hash family**, not the variant. Pulsar.R and Pulsar canonical
|
||||
profiles both use `HashSuiteSHA3 = 2`. A future Pulsar with a
|
||||
different hash family (e.g. SHAKE256 only) would claim a new
|
||||
HashSuiteID without renaming the variant.
|
||||
|
||||
@@ -117,7 +117,7 @@ algorithms in Round 3.
|
||||
│ ├── reshare/ ← proactive resharing
|
||||
│ ├── hash/ ← Pulsar-SHA3 + Pulsar-BLAKE3 (legacy)
|
||||
│ └── ...
|
||||
├── pulsar/ ← Pulsar.M (M-LWE, FIPS 204-compatible)
|
||||
├── pulsar/ ← Pulsar (M-LWE, FIPS 204-compatible)
|
||||
│ ├── ref/go/
|
||||
│ ├── spec/ ← own MPTC technical spec PDF
|
||||
│ ├── docs/ ← family-architecture.md = THIS file
|
||||
@@ -140,7 +140,7 @@ which is exactly the orthogonality the family architecture claims.
|
||||
|
||||
Per CTO Decision 4 (recorded in this branch's HIP-0077 process notes):
|
||||
|
||||
> Submit BOTH. Pulsar.M leads (Class N1+N4, FIPS 204 verifier-interchangeable,
|
||||
> Submit BOTH. Pulsar leads (Class N1+N4, FIPS 204 verifier-interchangeable,
|
||||
> highest strategic value). Pulsar.R parallel (Class S1+S4, established
|
||||
> production code, demonstrates the family's R-LWE branch). Withdrawing
|
||||
> either wastes existing work; submitting both forces the team to factor
|
||||
@@ -158,11 +158,11 @@ via amendments NIST permits in the public-analysis window.
|
||||
- [x] Pulsar.R hardening: F8 (no log of secret state), F9 (constant-time reshare), F12 (LIGHT_MNEMONIC guard)
|
||||
- [ ] Pulsar.R MPTC spec doc finalised (`pulsar/spec/pulsar-r.pdf` to be added)
|
||||
- [ ] Pulsar.R `mptc-preview-2026` tag
|
||||
- [x] Pulsar.M repo bootstrap (`pulsar/`)
|
||||
- [ ] Pulsar.M Module-LWE algorithm body in spec (in flight via scientist agent)
|
||||
- [ ] Pulsar.M reference implementation
|
||||
- [ ] Pulsar.M FIPS 204 cross-validation (output interchangeability proof)
|
||||
- [ ] Pulsar.M `mptc-preview-2026` tag
|
||||
- [x] Pulsar repo bootstrap (`pulsar/`)
|
||||
- [ ] Pulsar Module-LWE algorithm body in spec (in flight via scientist agent)
|
||||
- [ ] Pulsar reference implementation
|
||||
- [ ] Pulsar FIPS 204 cross-validation (output interchangeability proof)
|
||||
- [ ] Pulsar `mptc-preview-2026` tag
|
||||
- [ ] Family architecture cross-reference baked into HIP-0077
|
||||
|
||||
## See also
|
||||
@@ -171,7 +171,7 @@ via amendments NIST permits in the public-analysis window.
|
||||
— defines the PQMode enum that selects which Pulsar variant the
|
||||
consensus layer asks for.
|
||||
- HIP-0078 (in flight) — Q-Chain PQ-rollup. Replaces Z-Chain Groth16/BN254
|
||||
with a PQ-secure SNARK. Pulsar.M's per-validator ML-DSA-65 sigs are the
|
||||
with a PQ-secure SNARK. Pulsar's per-validator ML-DSA-65 sigs are the
|
||||
rollup target.
|
||||
- NIST IR 8214C — *First Call for Multi-Party Threshold Schemes* (January
|
||||
2026, package deadline 2026-Nov-16).
|
||||
|
||||
+1
-1
@@ -80,7 +80,7 @@ func (p TalusProfile) String() string {
|
||||
case TalusTEE:
|
||||
return "Pulsar-TEE"
|
||||
case TalusMPC:
|
||||
return "Pulsar-MPC"
|
||||
return "PulsarPC"
|
||||
default:
|
||||
return "Pulsar-unspecified"
|
||||
}
|
||||
|
||||
@@ -13,7 +13,7 @@ package pulsar
|
||||
//
|
||||
// Pulsar-TEE: a trusted coordinator/TEE forms w (DealNonceMPCDebug) and
|
||||
// publishes w1 + the per-party y-shares. No honest-majority bound.
|
||||
// Pulsar-MPC: the CEF computes w1 over secret-shared ȳ (CEFComputeW1) with no
|
||||
// PulsarPC: the CEF computes w1 over secret-shared ȳ (CEFComputeW1) with no
|
||||
// node forming w; the y-shares come from the dealerless nonce DKG.
|
||||
//
|
||||
// This file adds (1) the fail-closed release gate that runs MANDATORY FIPS 204
|
||||
@@ -88,7 +88,7 @@ type TalusNonceEntry struct {
|
||||
//
|
||||
// Profile discipline: in Pulsar-TEE only boundary-clear entries are admitted
|
||||
// (the TEE pre-filters BCC, ~31.7% yield, so every pooled nonce signs in one
|
||||
// online round). In Pulsar-MPC BCC cannot be pre-tested, so entries are admitted
|
||||
// online round). In PulsarPC BCC cannot be pre-tested, so entries are admitted
|
||||
// unconditionally and a non-clear nonce is consumed + retried when FindHint
|
||||
// fails at aggregation (the same ~3.15× preprocessing overhead, online instead
|
||||
// of offline).
|
||||
|
||||
@@ -5,7 +5,7 @@ package pulsar
|
||||
|
||||
// talus_test.go — multi-node proof harness for the TALUS construction.
|
||||
//
|
||||
// Pulsar-MPC profile: separate per-node state + an in-memory message bus. The
|
||||
// PulsarPC profile: separate per-node state + an in-memory message bus. The
|
||||
// harness proves, end to end:
|
||||
// - dealerless Shamir Nonce DKG: no node holds the joint nonce ȳ;
|
||||
// - CEF distributed commitment: each node computes its own g_i = A·λ_i·y_i;
|
||||
@@ -380,7 +380,7 @@ func TestTalus_SharedRandomBit(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
// runTalusMPCCeremony drives the full Pulsar-MPC ceremony over a bus: dealerless
|
||||
// runTalusMPCCeremony drives the full PulsarPC ceremony over a bus: dealerless
|
||||
// nonce DKG → per-node CEF commitment shares → CEFComputeW1 → one z-broadcast
|
||||
// round → mandatory release gate. Retries with a FRESH dealerless nonce on a
|
||||
// non-boundary-clear (hint) rejection.
|
||||
@@ -487,7 +487,7 @@ func runTalusMPCCeremony(t *testing.T, f *bccFixture, q int, sid [32]byte, ctx,
|
||||
return nil, errors.New("no acceptance within MaxRestart dealerless nonces")
|
||||
}
|
||||
|
||||
// TestTalus_MPC_EndToEnd_StockVerify is the headline Pulsar-MPC proof: a full
|
||||
// TestTalus_MPC_EndToEnd_StockVerify is the headline PulsarPC proof: a full
|
||||
// dealerless ceremony whose aggregated signature verifies under the UNMODIFIED
|
||||
// stock FIPS 204 verifier, with single-share custody and no joint-nonce/no-w
|
||||
// reconstruction.
|
||||
|
||||
@@ -65,7 +65,7 @@ var (
|
||||
// Class N1 manifesto: this function MUST remain a thin dispatch over
|
||||
// the FIPS 204 verifier. Adding logic here breaks output
|
||||
// interchangeability with single-party FIPS 204 — the whole point
|
||||
// of the Pulsar.M variant.
|
||||
// of the Pulsar variant.
|
||||
func Verify(params *Params, groupPubkey *PublicKey, message []byte, sig *Signature) error {
|
||||
return VerifyCtx(params, groupPubkey, message, nil, sig)
|
||||
}
|
||||
|
||||
@@ -25,7 +25,7 @@ downstream system points here for the variant table.
|
||||
variant & repo (target) & lattice basis & hash family (canonical) &
|
||||
FIPS 204 verifier interchange? & NIST MPTC class & status \\
|
||||
\midrule
|
||||
\textbf{Pulsar} (was Pulsar.M / pulsar) &
|
||||
\textbf{Pulsar} (was Pulsar / pulsar) &
|
||||
\texttt{github.com/luxfi/pulsar} &
|
||||
Module-LWE ($\Rq^k$) &
|
||||
SHA-3 / cSHAKE256 (SP 800-185) &
|
||||
@@ -54,7 +54,7 @@ variant & repo (target) & lattice basis & hash family (canonical) &
|
||||
family. The Lux fork was originally released under the code-name
|
||||
\texttt{Nasua}; the formal-paper name \texttt{Annulus} replaced it
|
||||
at the academic-archive cut. Annulus tracks the Corona primitive
|
||||
of Boschini et~al.~\cite{boschini2024corona}, which builds on
|
||||
of Boschini et~al.~\cite{boschini2024ringtail}, which builds on
|
||||
the Raccoon Fiat--Shamir-without-rejection template~\cite{raccoon2024}.
|
||||
Annulus is \emph{not enabled} in Lux production and the repository
|
||||
is archived (no further academic-level changes).
|
||||
@@ -117,7 +117,7 @@ unmodified FIPS~204 ML-DSA.Verify. The latter is the single
|
||||
highest-value property of the family.
|
||||
\item \textbf{NIST submission posture} --- see Class column above.
|
||||
\item \textbf{Production maturity} --- Pulsar.R has a hardened
|
||||
reshare path, KAT suite, deployed code. Pulsar.M has a complete spec
|
||||
reshare path, KAT suite, deployed code. Pulsar has a complete spec
|
||||
(\texttt{spec/pulsar.tex} plus \texttt{parameters.tex},
|
||||
\texttt{system-model.tex}, \texttt{security-games.tex}), a working
|
||||
Go reference (single-party and threshold paths, both
|
||||
@@ -142,7 +142,7 @@ shared \texttt{pulsar-test/} and \texttt{pulsar-spec-common/} set of
|
||||
artifacts both submissions reference.
|
||||
\item \textbf{Cross-validates the protocol skeleton.} A reviewer
|
||||
attacking the Pedersen DKG soundness in Pulsar.R is also attacking
|
||||
it in Pulsar.M. Soundness arguments compose; reviewers don't have to
|
||||
it in Pulsar. Soundness arguments compose; reviewers don't have to
|
||||
redo work.
|
||||
\item \textbf{Demonstrates orthogonality.} Both submissions running
|
||||
on the same 2-round structure with different lattice bases is itself
|
||||
@@ -161,7 +161,7 @@ pre-paid.
|
||||
\small
|
||||
\begin{tabular}{p{4.0cm}p{2.5cm}p{3.5cm}p{3.5cm}}
|
||||
\toprule
|
||||
artifact & shared & Pulsar.R & Pulsar.M \\
|
||||
artifact & shared & Pulsar.R & Pulsar \\
|
||||
\midrule
|
||||
2-round protocol description & shared spec &
|
||||
parameterised for $\Rq$ & parameterised for $\Rq^k$ \\
|
||||
@@ -215,11 +215,12 @@ lifecycle DKG expansions. Always capitalised. Identifier form:
|
||||
Naming rules:
|
||||
|
||||
\begin{itemize}[leftmargin=*, itemsep=0pt]
|
||||
\item Do not write ``Pulsar.M'' or ``Pulsar'' in new prose; both
|
||||
are the pre-rebrand legacy names of the M-LWE threshold (now just
|
||||
``Pulsar'').
|
||||
\item Do not write ``Pulsar.R'' or ``Pulsar-R''; the R-LWE threshold
|
||||
is now ``Corona'' --- distinct name, distinct repo.
|
||||
\item \textbf{Ringtail} is the published Ring-LWE construction of
|
||||
Boschini, Kaviani, Lai, Malavolta, Takahashi and Tibouchi
|
||||
(\cite{boschini2024ringtail}). It is their name for their scheme and is
|
||||
used whenever the paper is meant. \textbf{Corona} is Lux's
|
||||
implementation of it; \textbf{Pulsar} retargets the same two-round
|
||||
structure to Module-LWE for FIPS~204.
|
||||
\item HashSuiteID byte (per HIP-0077 \S``Lux consensus PQ modes'')
|
||||
identifies the \textbf{hash family}, not the variant. Pulsar and
|
||||
Corona canonical profiles both use \texttt{HashSuiteSHA3 = 2}. A
|
||||
@@ -238,7 +239,7 @@ would claim a new HashSuiteID without renaming the variant.
|
||||
| |-- reshare/ <- proactive resharing
|
||||
| |-- hash/ <- Pulsar-SHA3 + Pulsar-BLAKE3 (legacy)
|
||||
| `-- ...
|
||||
|-- pulsar/ <- Pulsar.M (M-LWE, FIPS 204-compatible)
|
||||
|-- pulsar/ <- Pulsar (M-LWE, FIPS 204-compatible)
|
||||
| |-- ref/go/
|
||||
| |-- spec/ <- own MPTC technical spec PDF
|
||||
| |-- docs/ <- family-architecture moved to spec/
|
||||
@@ -264,7 +265,7 @@ Per CTO Decision 4 (recorded in this branch's HIP-0077 process
|
||||
notes):
|
||||
|
||||
\begin{quote}
|
||||
Submit BOTH. Pulsar.M leads (Class N1+N4, FIPS~204
|
||||
Submit BOTH. Pulsar leads (Class N1+N4, FIPS~204
|
||||
verifier-interchangeable, highest strategic value). Pulsar.R parallel
|
||||
(Class S1+S4, established production code, demonstrates the family's
|
||||
R-LWE branch). Withdrawing either wastes existing work; submitting
|
||||
@@ -288,13 +289,13 @@ F9 (constant-time reshare), F12 (LIGHT\_MNEMONIC guard)
|
||||
\item[$\square$] Pulsar.R MPTC spec doc finalised
|
||||
(\texttt{pulsar/spec/pulsar-r.pdf} to be added)
|
||||
\item[$\square$] Pulsar.R \texttt{mptc-preview-2026} tag
|
||||
\item[$\boxtimes$] Pulsar.M repo bootstrap (\texttt{pulsar/})
|
||||
\item[$\square$] Pulsar.M Module-LWE algorithm body in spec (in
|
||||
\item[$\boxtimes$] Pulsar repo bootstrap (\texttt{pulsar/})
|
||||
\item[$\square$] Pulsar Module-LWE algorithm body in spec (in
|
||||
flight via scientist agent)
|
||||
\item[$\square$] Pulsar.M reference implementation
|
||||
\item[$\square$] Pulsar.M FIPS~204 cross-validation (output
|
||||
\item[$\square$] Pulsar reference implementation
|
||||
\item[$\square$] Pulsar FIPS~204 cross-validation (output
|
||||
interchangeability proof)
|
||||
\item[$\square$] Pulsar.M \texttt{mptc-preview-2026} tag
|
||||
\item[$\square$] Pulsar \texttt{mptc-preview-2026} tag
|
||||
\item[$\square$] Family architecture cross-reference baked into
|
||||
HIP-0077
|
||||
\end{itemize}
|
||||
@@ -307,7 +308,7 @@ HIP-0077
|
||||
--- defines the PQMode enum that selects which Pulsar variant the
|
||||
consensus layer asks for.
|
||||
\item HIP-0078 (in flight) --- Q-Chain PQ-rollup. Replaces Z-Chain
|
||||
Groth16/BN254 with a PQ-secure SNARK. Pulsar.M's per-validator
|
||||
Groth16/BN254 with a PQ-secure SNARK. Pulsar's per-validator
|
||||
ML-DSA-65 sigs are the rollup target.
|
||||
\item NIST IR 8214C --- \emph{First Call for Multi-Party Threshold
|
||||
Schemes} (January 2026, package deadline 2026-Nov-16).
|
||||
|
||||
+17
-18
@@ -13,26 +13,25 @@ appendix tracks claims as contributors disclose them.
|
||||
|
||||
\subsection{Inherited from upstream}
|
||||
|
||||
\paragraph{Pulsar (\texttt{luxfi/pulsar}).}
|
||||
Pulsar reuses Pulsar's protocol structure. Pulsar's IP posture per
|
||||
its README:
|
||||
\paragraph{Corona (\texttt{luxfi/corona}).}
|
||||
Pulsar reuses Corona's protocol structure without importing its code.
|
||||
Corona is distributed under the Lux Ecosystem License v1.2, which
|
||||
permits research use and reserves commercial use to a separate licence
|
||||
from Lux Industries Inc. It is not an Apache-2.0 grant and carries no
|
||||
Apache~\S3 patent grant.
|
||||
|
||||
\begin{itemize}[leftmargin=*, itemsep=0pt]
|
||||
\item Apache-2.0 licensed.
|
||||
\item Patent grant per Apache 2.0 \S3 from each contributor.
|
||||
\item No known active patent claims as of repository creation.
|
||||
\end{itemize}
|
||||
Corona's \texttt{PATENTS.md} asserts no Lux patents on the published
|
||||
Boschini et al.\ algorithm itself, which it implements unchanged in its
|
||||
mathematics.
|
||||
|
||||
This applies to Pulsar to the extent that Pulsar code or
|
||||
protocol elements are derivative of Pulsar.
|
||||
|
||||
\paragraph{Boschini et al construction \cite{boschini2024corona}.}
|
||||
Pulsar (and therefore Pulsar) is a fork of the R-LWE academic line.
|
||||
ePrint 2024/1113 authors: Cecilia Boschini, Darya
|
||||
Kaviani, Russell W. F. Lai, Giulio Malavolta, Akira Takahashi, Mehdi
|
||||
Tibouchi. Corona's open-source repo is Apache-2.0 with no asserted
|
||||
patent claims as of mid-2026. Pulsar's M-LWE adaptation does not
|
||||
import Corona code directly but inherits the protocol structure.
|
||||
\paragraph{Ringtail \cite{boschini2024ringtail}.}
|
||||
Both Corona and Pulsar descend from Ringtail, the two-round threshold
|
||||
construction of Cecilia Boschini, Darya Kaviani, Russell W. F. Lai,
|
||||
Giulio Malavolta, Akira Takahashi and Mehdi Tibouchi (ePrint 2024/1113,
|
||||
IEEE S\&P 2025). Corona implements it over Ring-LWE; Pulsar retargets
|
||||
the same structure to Module-LWE for FIPS~204. Ringtail is the authors'
|
||||
name for their scheme; Corona and Pulsar are ours for our
|
||||
implementations.
|
||||
|
||||
\paragraph{ML-DSA / FIPS 204.}
|
||||
ML-DSA is a NIST-standardized algorithm. The Dilithium team's IP
|
||||
|
||||
+7
-7
@@ -100,7 +100,7 @@ The threshold ceremony emits signatures byte-equal to single-party
|
||||
FIPS~204 ML-DSA signatures: Pulsar signatures verify under
|
||||
unmodified \texttt{ML-DSA.Verify}. The protocol structure is the
|
||||
two-round threshold scheme of Boschini, Kaviani, Lai, Malavolta,
|
||||
Takahashi, and Tibouchi (``Corona''~\cite{boschini2024corona}), retargeted
|
||||
Takahashi, and Tibouchi (``Ringtail''~\cite{boschini2024ringtail}), retargeted
|
||||
from Ring-LWE ($\Rq$, single polynomial) to Module-LWE ($\Rq^k$,
|
||||
polynomial vectors) so the protocol's algebraic shape matches
|
||||
FIPS~204.
|
||||
@@ -161,7 +161,7 @@ threshold/non-threshold split at the wire format: a relying party
|
||||
who can verify ML-DSA can verify Pulsar.
|
||||
|
||||
\paragraph{Why Pulsar alongside Pulsar.}
|
||||
The companion scheme Corona (R-LWE)~\cite{boschini2024corona} is a
|
||||
The companion scheme Corona (R-LWE)~\cite{boschini2024ringtail} is a
|
||||
Class~S candidate over the single-polynomial ring $\Rq$. Pulsar's
|
||||
construction is faster, simpler, and produces a different wire
|
||||
format (the verifier is \emph{not} FIPS~204; it is a Pulsar-specific
|
||||
@@ -383,7 +383,7 @@ categories $2$, $3$, $5$.
|
||||
Pulsar's DKG and reshare protocols build on a module-shaped
|
||||
Pedersen commitment. The construction is the natural lift of the
|
||||
$\Rq$ Pedersen commitment used by the Pulsar reference
|
||||
implementation~\cite{boschini2024corona} to the module
|
||||
implementation~\cite{boschini2024ringtail} to the module
|
||||
ring $\Rq^k$.
|
||||
|
||||
\begin{construction}[Module Pedersen commitment]
|
||||
@@ -416,7 +416,7 @@ for an efficient reduction $\mathcal{B}$.
|
||||
\end{theorem}
|
||||
|
||||
\begin{proof}[Proof sketch]
|
||||
Identical to the BDLOP18~\cite{boschini2024corona} commitment-hiding
|
||||
Identical to the BDLOP18~\cite{boschini2024ringtail} commitment-hiding
|
||||
argument applied per Shamir-coordinate slot of the module ring.
|
||||
Given an M-LWE instance $(\mathbf{B}, \mathbf{B}\mathbf{r} + \mathbf{e})$
|
||||
vs.\ $(\mathbf{B}, \mathbf{u})$, the reduction sets
|
||||
@@ -1436,7 +1436,7 @@ by the operator runbook at \texttt{docs/deployment.md}.
|
||||
\label{sec:related}
|
||||
% =====================================================================
|
||||
|
||||
\paragraph{Pulsar (R-LWE), Class~S~\cite{boschini2024corona}.}
|
||||
\paragraph{Pulsar (R-LWE), Class~S~\cite{boschini2024ringtail}.}
|
||||
The companion Lux scheme over $\Rq$, single polynomial. Faster,
|
||||
simpler, but \emph{not} output-interchangeable with any NIST primitive.
|
||||
Different wire format. Pulsar shares Pulsar's protocol structure
|
||||
@@ -1522,7 +1522,7 @@ Final patent disclosure assembled from
|
||||
\texttt{docs/patent-notes-draft.md} at the submission freeze. Lux
|
||||
Industries Inc.\ asserts no patent claims on the cryptographic body
|
||||
of Pulsar; the threshold protocol is a port of the publicly-known
|
||||
Corona~\cite{boschini2024corona} construction with the beacon-quorum
|
||||
Ringtail~\cite{boschini2024ringtail} construction with the beacon-quorum
|
||||
strengthening of DD-006, both of which are explicitly placed into
|
||||
the public domain by this submission.
|
||||
|
||||
@@ -1613,7 +1613,7 @@ estimator commit hash is recorded in \texttt{estimator/README.md}.
|
||||
\begin{openq}[Adaptive corruption tightness]
|
||||
The static-to-adaptive corruption gap for two-round threshold
|
||||
lattice signatures is an active research direction. The
|
||||
\cite{boschini2024corona} paper's adaptive variant uses a complexity
|
||||
\cite{boschini2024ringtail} paper's adaptive variant uses a complexity
|
||||
leveraging argument that loses a multiplicative
|
||||
$\binom{n}{t}$ factor in the security parameter. Can a tighter
|
||||
adaptive reduction be constructed for the module-shaped
|
||||
|
||||
+5
-5
@@ -1,14 +1,14 @@
|
||||
% Pulsar-M bibliography
|
||||
% Pulsar bibliography
|
||||
%
|
||||
% Canonical citations for the technical specification. Authors and
|
||||
% Canonical citations for the technical specification. Authors, titles and
|
||||
% identifiers verified against https://eprint.iacr.org and the linked
|
||||
% conference proceedings. Do not paraphrase or guess — every entry has a
|
||||
% checked source URL.
|
||||
% checked source URL, and a title is the authors' words, not ours.
|
||||
|
||||
@misc{boschini2024corona,
|
||||
@misc{boschini2024ringtail,
|
||||
author = {Cecilia Boschini and Darya Kaviani and Russell W.~F.~Lai
|
||||
and Giulio Malavolta and Akira Takahashi and Mehdi Tibouchi},
|
||||
title = {Corona: Practical Two-Round Threshold Signatures from Learning with Errors},
|
||||
title = {Ringtail: Practical Two-Round Threshold Signatures from Learning with Errors},
|
||||
howpublished = {Cryptology ePrint Archive, Paper 2024/1113},
|
||||
year = {2024},
|
||||
url = {https://eprint.iacr.org/2024/1113}
|
||||
|
||||
@@ -291,7 +291,7 @@ adaptive-corruption proof requires either (i) a complexity-leveraging
|
||||
argument that loses a $\binom{n}{t-1}$ factor in the security
|
||||
parameter and is therefore loose for practical $(n, t)$, or (ii) a
|
||||
trapdoor-based simulation argument compatible with the Pedersen
|
||||
commit structure. \cite{boschini2024corona} sketches direction (i) for the
|
||||
commit structure. \cite{boschini2024ringtail} sketches direction (i) for the
|
||||
Ring-LWE setting; the module-shaped adaptation is structural but
|
||||
non-trivial.
|
||||
\end{theorem}
|
||||
|
||||
Reference in New Issue
Block a user