pulsar: scrub stale dealer/LargeCombine references from surviving sources

Comment-only fixups so no surviving production file names the symbols being ripped: - distributed_bcc.go: the keygen fence is no longer a trusted dealer — point to Mithril RSS (mithril_rss.go) + the hyperball sibling; drop the redundant 'DealAlgShares RIPPED OUT' narration block. - types.go: drop the dangling 'LargeCombine (large_threshold.go)' reference. - talus_dkg_vss.go: the stock-verifiable key is dealerless Mithril RSS, not a trusted dealer. - mithril_rss.go: 'instead of a trusted dealer' (un-name DealAlgShares). - naive_additive_seta_obstruction.go: fix the stale distributed_bcc_dkg.go filename; Mithril RSS is now IMPLEMENTED (the realized dealerless escape), not 'fall back to a dealer'; reframe the error + entry-point docs. The COMPUTED S_eta obstruction math is unchanged. The obstruction guard's tests still pin the arithmetic; no symbol removed.
2026-09-24 00:25:52 +00:00 · 2026-06-28 14:17:09 -07:00
parent d6f37003eb
commit 551abf7cdf
6 changed files with 64 additions and 73 deletions
@@ -11,8 +11,8 @@ package pulsar
 //	The public KeyShare (types.go) is a GF(257) byte-share of the 32-byte
 //	ML-DSA SEED. ML-DSA's s1/s2 are a NON-LINEAR SHAKE expansion of the
 //	seed, so seed-shares admit ONLY Lagrange reconstruct-then-sign
-//	(Combine / LargeCombine — the H-1 footgun that materialises the master
-//	key in the aggregator). The new RoundSigner / Partial / FlatAggregateZ
+//	(Combine — the H-1 footgun that materialises the master key in the
+//	aggregator). The new RoundSigner / Partial / FlatAggregateZ
 //	model carried the interface and the z-sum aggregation primitive for a
 //	no-reconstruct signer, but NO concrete poly-vector share type or
 //	concrete RoundSigner implementor existed on the current line (the v0.3
@@ -54,11 +54,15 @@ package pulsar
 // summed, secret shares Lagrange-weighted), inheriting ML-DSA's EUF-CMA
 // under Module-LWE/Module-SIS.
 //
-// WHAT THIS FILE IS NOT — the two fences that remain open:
-//   - Part-1 KEYGEN here is a TRUSTED DEALER (DealAlgShares expands the
-//     seed once, shares s1, wipes). It is no-RECONSTRUCT at SIGN time, not
-//     dealerless at KEYGEN time. Dealerless ML-DSA DKG is the separate,
-//     research-blocked Part-2 problem (see distributed_bcc_dkg.go).
+// WHAT THIS FILE IS NOT — the fences that remain open:
+//   - This SIGN primitive consumes Shamir s1-shares (AlgShare). A dealerless
+//     KEYGEN that emits ML-DSA *Shamir* s1-shares is the research-blocked
+//     Part-2 problem (naive_additive_seta_obstruction.go computes the
+//     obstruction). The realized dealerless keygen is Mithril RSS
+//     (mithril_rss.go): its short replicated shares drive the sibling
+//     hyperball no-reconstruct signer (mithril_rss_hyperball.go). The
+//     trusted-dealer s1-share keygen has been REMOVED; this file is
+//     no-RECONSTRUCT at SIGN time regardless of how the shares were dealt.
 //   - The joint nonce ȳ is established by DealNonceMPCDebug, a stand-in
 //     for the validator NonceMPC. It reveals the joint commitment w to the
 //     harness — exactly the leak production must avoid (PULSAR-V13-W-LEAK).
@@ -137,18 +141,6 @@ type AlgSetup struct {
 	s1ShareCommit map[uint32][]byte
 }

-// DealAlgShares (the Part-1 TRUSTED-DEALER s1-share keygen) has been RIPPED
-// OUT of the production surface. It expanded the seed and formed the master
-// key for the duration of one call — a centralized-trust genesis. It now
-// lives ONLY in the test/bootstrap file bootstrap_dealer_test.go (a
-// `_test.go` file, so it is uncompilable into any production binary) where
-// it seeds the no-reconstruct SIGNING tests. The production no-reconstruct
-// SIGN path (DistributedBCCSigner / AggregateBCC, below) never forms s1,
-// the seed, or sk. A genuinely DEALERLESS s1-share keygen is the
-// research-blocked Part-2 problem — see naive_additive_seta_obstruction.go
-// (DealerlessMLDSADKG, COMPUTED obstruction; Mithril short-replicated
-// shares ia.cr/2026/013 is the adoption target).
-
 // shamirSharePolyVecGFq shares each coefficient of secret (a length-L
 // poly-vector, coefficients already normalized to [0,q)) with a fresh
 // degree-(t−1) GF(q) polynomial whose constant term is that coefficient,
@@ -4,10 +4,10 @@
 package pulsar

 // mithril_rss.go — the DEALERLESS FIPS-204 signing key, generated by Replicated
-// Secret Sharing (Mithril, ePrint 2026/013) instead of the trusted-dealer
-// DealAlgShares. This is the file that walks past the pick-2 wall: a key
-// produced with NO trusted dealer whose signatures verify byte-for-byte under
-// unmodified cloudflare/circl mldsa65.Verify.
+// Secret Sharing (Mithril, ePrint 2026/013) instead of a trusted dealer. This is
+// the file that walks past the pick-2 wall: a key produced with NO trusted
+// dealer whose signatures verify byte-for-byte under unmodified
+// cloudflare/circl mldsa65.Verify.
 //
 // Why it works (the wall, beaten). The vss/large-blinding dealerless DKG yields
 // t = A·s1 + B·u with ‖B·u‖∞ ≈ q/2 — far outside S_η — so FindHint never fits a
@@ -3,9 +3,9 @@

 package pulsar

-// distributed_bcc_dkg.go — the obstruction to a NAIVE dealerless DKG for
-// byte-FIPS-204 ML-DSA, DERIVED from the parameter arithmetic (not asserted).
-// This is the honest Part-2 deliverable of PULSAR-V12-PARALLEL-PQ: a
+// naive_additive_seta_obstruction.go — the obstruction to a NAIVE dealerless
+// DKG for byte-FIPS-204 ML-DSA, DERIVED from the parameter arithmetic (not
+// asserted). This is the honest Part-2 deliverable of PULSAR-V12-PARALLEL-PQ: a
 // Pedersen/Gennaro-style dealerless DKG that forms the joint secret as a SUM
 // of N≥2 independent S_η contributions does NOT produce a key whose
 // signatures verify byte-for-byte under unmodified FIPS 204, and THIS FILE
@@ -20,14 +20,14 @@ package pulsar
 // a KNOWN, published technique that achieves a dealerless DKG AND a-posteriori
 // sharing of an existing key whose signatures verify under the STANDARD ML-DSA
 // verifier, for a small party count N (≲8; replicated-share cost grows with
-// (T,N)). Pulsar does not implement it yet — it is the candidate to adopt
-// (see CANDIDATE RESEARCH DIRECTIONS). What is genuinely barred is the naive
-// sum, not "dealerless ML-DSA" as a class.
+// (T,N)). Pulsar IMPLEMENTS it — mithril_rss.go (MithrilRSSKeygen) is the
+// production dealerless escape past this wall. What is genuinely barred is the
+// naive additive sum, not "dealerless ML-DSA" as a class.
 //
 // It mirrors rangeproof.go's pattern: the fail-closed decision is a
 // COMPUTED consequence of the FIPS 204 bounds (assessDealerlessFIPS), and a
-// test (distributed_bcc_dkg_test.go) pins the arithmetic so the obstruction
-// is reproducible, not a claim.
+// test (naive_additive_seta_obstruction_test.go) pins the arithmetic so the
+// obstruction is reproducible, not a claim.
 //
 // ─────────────────────────────────────────────────────────────────────────
 // THE OBSTRUCTION (precise; which step breaks).
@@ -108,19 +108,19 @@ package pulsar
 // Pulsar leg is FIPS-204-standard defence-in-depth.
 //
 // ─────────────────────────────────────────────────────────────────────────
-// CANDIDATE RESEARCH DIRECTIONS — a byte-FIPS-204 dealerless DKG. This package
-// implements none yet; direction (1) is published and adoptable.
+// DEALERLESS ESCAPE (implemented) + remaining research directions for a
+// byte-FIPS-204 dealerless threshold ML-DSA. Direction (1) is IMPLEMENTED
+// (mithril_rss.go); (2)–(4) remain open.
 //
 //  1. SHORT replicated secret sharing + local per-party rejection (Mithril:
 //     Celi–del Pino–Espitau–Niot–Prest, ia.cr/2026/013, USENIX Security 2026).
-//     This is the byte-FIPS-204 dealerless path: it keeps shares SHORT by
-//     construction (replicated, not Shamir/Lagrange — naive Lagrange blows up
-//     coefficient norms and breaks ML-DSA's short-vector requirement), enables
-//     local rejection (no global-abort MPC), supports DKG AND a-posteriori
-//     sharing of an existing key, and emits STANDARD ML-DSA-verifiable sigs.
-//     Practical at small N (≲8; replicated-share cost grows with (T,N)). This
-//     is the recommended adoption target for a dealerless Pulsar (see
-//     PULSAR-M committee architecture). Contrast Threshold Raccoon
+//     IMPLEMENTED — mithril_rss.go (MithrilRSSKeygen). This is the byte-FIPS-204
+//     dealerless path: it keeps shares SHORT by construction (replicated, not
+//     Shamir/Lagrange — naive Lagrange blows up coefficient norms and breaks
+//     ML-DSA's short-vector requirement), enables local rejection (no
+//     global-abort MPC), supports DKG AND a-posteriori sharing of an existing
+//     key, and emits STANDARD ML-DSA-verifiable sigs. Practical at small N
+//     (≲8; replicated-share cost grows with (T,N)). Contrast Threshold Raccoon
 //     (EUROCRYPT 2024 / NIST MPTC): noise-flooded, NON-FIPS verifier — that is
 //     Corona's dealerless lane, not byte-ML-DSA.
 //  2. Distributed-rejection DKG with an EXACT ℓ∞ lattice range proof: each
@@ -140,23 +140,22 @@ package pulsar

 import "errors"

-// ErrDealerlessByteFIPSUnreachable is returned by DealerlessMLDSADKG: this
-// package does not implement a dealerless byte-FIPS-204 ML-DSA DKG. The NAIVE
-// additive (Pedersen/Gennaro) construction is barred by the computed S_η
-// obstruction below; this is NOT a general impossibility — a short-replicated-
-// share construction (Mithril) achieves it at small N and is the adoption
-// target (see the file header). This entry point fails closed — it NEVER fakes
-// a key and NEVER silently falls back to a trusted dealer or a TEE (those are
-// the explicit, opt-in DealAlgShares / mldsa-tee paths). Today's dealerless
-// genesis is Corona's job in the AND-mode dual-PQ cert.
+// ErrDealerlessByteFIPSUnreachable is returned by DealerlessMLDSADKG: the NAIVE
+// additive (Pedersen/Gennaro) dealerless byte-FIPS-204 ML-DSA DKG is barred by
+// the computed S_η obstruction below. This is NOT a general impossibility — a
+// short-replicated-share construction (Mithril) achieves it at small N and is
+// IMPLEMENTED in mithril_rss.go. This entry point fails closed — it NEVER fakes
+// a key and NEVER silently falls back to a trusted dealer or a TEE; the
+// production dealerless keygen is Mithril RSS (mithril_rss.go), and Corona's
+// noise-flooded leg carries the second dealerless lane in the AND-mode dual-PQ
+// cert.
 var ErrDealerlessByteFIPSUnreachable = errors.New(
 	"pulsar: naive additive (Pedersen/Gennaro) dealerless byte-FIPS-204 ML-DSA " +
 		"DKG is unsound — a summed joint secret has ‖s2‖∞ ≤ Nη, violating the BCC " +
 		"boundary-clearance hypothesis ‖c·s2‖∞ ≤ β (and ML-DSA's S_η-calibrated " +
-		"EUF-CMA). This is the naive lift only, NOT a general impossibility: short " +
-		"replicated-share constructions (Mithril, ia.cr/2026/013) achieve dealerless " +
-		"byte-FIPS-204 at small N. Until adopted, use DealAlgShares (dealer/TEE " +
-		"genesis) for the Pulsar leg and rely on the dealerless Corona leg")
+		"EUF-CMA). This is the naive lift only, NOT a general impossibility: the " +
+		"production dealerless keygen is Mithril RSS (mithril_rss.go, ia.cr/2026/013) " +
+		"— short replicated shares that escape this wall at small N")

 // DealerlessFIPSObstruction is the COMPUTED obstruction for a dealerless DKG
 // over `parties` contributors at a given parameter set. Every field is
@@ -231,14 +230,14 @@ func assessDealerlessFIPS(mode Mode, parties int) (DealerlessFIPSObstruction, bo
 	return o, true
 }

-// DealerlessMLDSADKG is the fail-closed dealerless-DKG entry point. There is
-// no byte-FIPS-204 dealerless construction (see the file header and
-// assessDealerlessFIPS), so for any real committee (parties ≥ 2) it returns
-// ErrDealerlessByteFIPSUnreachable with the COMPUTED obstruction. It NEVER
-// fabricates a key and NEVER falls back to a dealer/TEE — those are the
-// explicit, opt-in DealAlgShares / mldsa-tee paths a caller must choose by
-// name. The Corona leg provides the dealerless guarantee in the AND-mode
-// dual-PQ cert.
+// DealerlessMLDSADKG is the fail-closed guard against the NAIVE additive
+// dealerless DKG. There is no byte-FIPS-204 dealerless construction via the
+// naive Pedersen/Gennaro sum (see the file header and assessDealerlessFIPS), so
+// for any real committee (parties ≥ 2) it returns ErrDealerlessByteFIPSUnreachable
+// with the COMPUTED obstruction. It NEVER fabricates a key and NEVER falls back
+// to a dealer/TEE; the production dealerless keygen is Mithril RSS
+// (mithril_rss.go), and Corona's leg carries the second dealerless lane in the
+// AND-mode dual-PQ cert.
 func DealerlessMLDSADKG(params *Params, committee []NodeID, threshold int) (*DealerlessFIPSObstruction, error) {
 	if err := params.Validate(); err != nil {
 		return nil, err
@@ -248,8 +247,9 @@ func DealerlessMLDSADKG(params *Params, committee []NodeID, threshold int) (*Dea
 		return nil, ErrBCCParamSet
 	}
 	if o.ByteFIPSReachable {
-		// parties ≤ 1 — degenerate (a single contributor is a dealer). There
-		// is no dealerless setting to satisfy; route through DealAlgShares.
+		// parties ≤ 1 — degenerate (a single contributor IS a dealer). There is
+		// no dealerless setting for the naive lift to satisfy; the production
+		// dealerless keygen is Mithril RSS (mithril_rss.go).
 		return &o, ErrDealerlessByteFIPSUnreachable
 	}
 	return &o, ErrDealerlessByteFIPSUnreachable
@@ -3,11 +3,11 @@

 package pulsar

-// distributed_bcc_dkg_test.go — pins the dealerless-DKG obstruction
+// naive_additive_seta_obstruction_test.go — pins the dealerless-DKG obstruction
 // arithmetic. The fail-closed Part-2 verdict is DERIVED from the FIPS 204
-// bounds (distributed_bcc_dkg.go assessDealerlessFIPS), and these tests
-// reproduce every load-bearing number so the obstruction is computable, not
-// asserted. They also rule out the t0 red herring by computation.
+// bounds (naive_additive_seta_obstruction.go assessDealerlessFIPS), and these
+// tests reproduce every load-bearing number so the obstruction is computable,
+// not asserted. They also rule out the t0 red herring by computation.

 import (
 	"errors"
@@ -25,10 +25,10 @@ package pulsar
 // no ±1 hint (weight > ω) and a stock-FIPS-204 signature CANNOT be produced
 // against this key. Concretely: this is the no-reconstruct DKG PRIMITIVE and the
 // no-reconstruct ROOT, NOT the stock-signable key. The stock-verifiable threshold
-// signature keeps the trusted-dealer key (DealAlgShares, test/bootstrap scope) —
-// dealerless byte-FIPS-204 keygen is unreachable (naive_additive_seta_obstruction
+// signature is keyed by the dealerless Mithril RSS keygen (mithril_rss.go) — the
+// NAIVE additive byte-FIPS-204 lift is unreachable (naive_additive_seta_obstruction
 // / assessDealerlessFIPS: the joint S_η sum violates the BCC norm bound at N≥2).
-// Permissionless safety rests on the genuinely-dealerless CORONA leg in the
+// Permissionless safety also carries the genuinely-dealerless CORONA leg in the
 // AND-mode dual-PQ cert. TestDKG_VSS_NotDirectlyBCCSignable pins the obstruction
 // so it is proven, not asserted.
 //
@@ -140,8 +140,7 @@ type KeyShare struct {
 //     interpolation over byte-wise GF(257) shares before calling
 //     FIPS 204 sign. TEE-attestation is required on funds-bearing
 //     networks; the aggregator process is in the TCB for the sign
-//     call. LargeCombine (large_threshold.go) is the large-committee
-//     variant.
+//     call.
 //
 //   - BCC/CEF (bcc_sign.go): the no-leak path. It never forms c·s2,
 //     c·t0, r0, or full w — the hint is recovered from public data