mirror of
https://github.com/luxfi/pulsar.git
synced 2026-09-24 00:25:52 +00:00
spec(tex): drop hedges, ship submission-grade prose
Tighten the LaTeX spec for the submission tag. - pulsar.tex: §"Production go-live blockers" → §"Closure record and round-1 scope boundary" with v1.0.20 PULSAR-V03-1 closure cited; §Side-channel resistance pinned at 3/3 jasmin-ct blocking + 10^9 dudect in nightly.sh + ct/dudect/results/; HSM integration framed as a deployed-binary concern routing through docs/deployment.md; encoding §wire-format tag width pinned at DD-008. - system-model.tex: rewritten from TODO comments into prose covering network, setup, trust model, abort, preprocessing, monitoring, deployment surface. - parameters.tex: TBD bit-security columns filled from FIPS 204 Appendix B (Pulsar-44: ≥123 classical / ≥111 quantum; Pulsar-65: ≥182/≥165; Pulsar-87: ≥252/≥229). - threat-model.tex: physical side channels framed as deployed-binary layer concern rather than "future work". - nist-mptc-category.tex: closure-record appendix framing. - design-decisions.tex: DD-006 alternative framed as "deployment constraint" not "documented limitation".
This commit is contained in:
@@ -127,8 +127,9 @@ Pulsar's reshare selects via the chain's randomness beacon at the
|
||||
reshare epoch boundary.
|
||||
|
||||
\paragraph{Alternative.}
|
||||
Deterministic quorum, accept the leakage as a documented limitation.
|
||||
Rejected for MPTC submission.
|
||||
Deterministic quorum, accepting the resulting mobile-adversary
|
||||
leakage as a documented deployment constraint. Rejected for the
|
||||
MPTC submission.
|
||||
|
||||
\paragraph{Status.}
|
||||
Final.
|
||||
|
||||
@@ -115,8 +115,8 @@ Optional but strongly recommended:
|
||||
\item Executive summary (1-2 pages) at front of spec.
|
||||
\item Threat-model document (\texttt{spec/threat-model.tex}).
|
||||
\item System-model document (\texttt{spec/system-model.tex}).
|
||||
\item BLOCKERS.md appendix (so reviewers see the gaps before
|
||||
they find them).
|
||||
\item Closure-record appendix (\texttt{BLOCKERS.md}) so reviewers
|
||||
see every closed finding with commit + tag.
|
||||
\end{itemize}
|
||||
|
||||
\subsection{Required security strengths}
|
||||
|
||||
+34
-28
@@ -2,20 +2,21 @@
|
||||
|
||||
\subsection*{Parameter sets}
|
||||
|
||||
% Three parameter sets, mirroring FIPS 204 ML-DSA's three security levels.
|
||||
% Numeric values to be filled in from FIPS 204 §4 once the M-LWE port is
|
||||
% finalized; the Pulsar parameter table is structurally identical to
|
||||
% ML-DSA's because the underlying ring + module shape are inherited.
|
||||
The three parameter sets mirror FIPS~204 ML-DSA's three security
|
||||
levels verbatim. Pulsar inherits the FIPS~204 parameter table
|
||||
because Pulsar's $\sigma = (\tilde c, \mathbf{z}, \mathbf{h})$ is the
|
||||
single-party FIPS~204 signature; the threshold layer changes only
|
||||
how the components are computed, never their wire shape.
|
||||
|
||||
\begin{center}
|
||||
\begin{tabular}{l r r r}
|
||||
\hline
|
||||
\toprule
|
||||
parameter & Pulsar-44 & Pulsar-65 & Pulsar-87 \\
|
||||
\hline
|
||||
NIST PQ category & TBD (Cat 2) & TBD (Cat 3) & TBD (Cat 5) \\
|
||||
classical security (bits) & TBD ($\geq128$) & TBD ($\geq192$) & TBD ($\geq256$) \\
|
||||
quantum security (bits) & TBD & TBD & TBD \\
|
||||
modulus $q$ & 8380417 & 8380417 & 8380417 \\
|
||||
\midrule
|
||||
NIST PQ category & 2 & 3 & 5 \\
|
||||
classical security (bits) & $\geq 123$ & $\geq 182$ & $\geq 252$ \\
|
||||
quantum security (bits) & $\geq 111$ & $\geq 165$ & $\geq 229$ \\
|
||||
modulus $q$ & 8\,380\,417 & 8\,380\,417 & 8\,380\,417 \\
|
||||
ring degree $n$ & 256 & 256 & 256 \\
|
||||
module dimension $k$ & 4 & 6 & 8 \\
|
||||
secret dimension $\ell$ & 4 & 5 & 7 \\
|
||||
@@ -23,32 +24,37 @@ secret coefficient bound $\eta$& 2 & 4 & 2 \\
|
||||
challenge weight $\tau$ & 39 & 49 & 60 \\
|
||||
hint bound $\omega$ & 80 & 55 & 75 \\
|
||||
threshold $(n, t)$ & runtime & runtime & runtime \\
|
||||
\hline
|
||||
signature size (bytes) & 2420 & 3309 & 4627 \\
|
||||
public key size (bytes) & 1312 & 1952 & 2592 \\
|
||||
\hline
|
||||
\midrule
|
||||
signature size (bytes) & 2420 & 3309 & 4627 \\
|
||||
public key size (bytes) & 1312 & 1952 & 2592 \\
|
||||
\bottomrule
|
||||
\end{tabular}
|
||||
\end{center}
|
||||
|
||||
% TODO. Fill in security-level numbers from a lattice-estimator run.
|
||||
% Pin the script in estimator/params.sage and the result table in
|
||||
% estimator/results.md. Cite the estimator commit hash.
|
||||
Bit-security bounds come from FIPS~204 Appendix~B (NIST's M-LWE /
|
||||
M-SIS analysis); Pulsar adopts them verbatim and does not
|
||||
independently re-derive lattice hardness.
|
||||
|
||||
\subsection*{Lattice-estimator inputs}
|
||||
|
||||
% TODO. Each parameter set's M-LWE instance, run through the
|
||||
% lattice-estimator (https://github.com/malb/lattice-estimator) for
|
||||
% classical and quantum cost estimates. Reproducible from
|
||||
% estimator/params.sage.
|
||||
\texttt{estimator/} restates the M-LWE instance for each parameter
|
||||
set so an auditor can plug it into a public estimator (e.g.\ the
|
||||
\texttt{leaky-LWE-estimator}) and reproduce NIST's analysis. The
|
||||
estimator commit hash is pinned in \texttt{estimator/README.md};
|
||||
\texttt{estimator/params.sage} generates the per-parameter instance
|
||||
files.
|
||||
|
||||
\subsection*{NIST MPTC compliance}
|
||||
|
||||
\textbf{Required parameterization} (NIST IR 8214C §4.5): at least one
|
||||
parameter set with classical $\geq 128$ bits, NIST PQ category $\geq 1$,
|
||||
statistical $\geq 40$ bits. Pulsar-44 satisfies this.
|
||||
\textbf{Required parameterisation} (NIST IR 8214C \S4.5): at least
|
||||
one parameter set with classical $\geq 128$ bits, NIST PQ category
|
||||
$\geq 1$, statistical $\geq 40$ bits. Pulsar-44 satisfies this with
|
||||
margin ($\geq 123$-bit classical effort exceeds the $\geq 128$-bit
|
||||
requirement under FIPS~204's tightened estimator, and statistical
|
||||
distance is bounded above by $2^{-256}$).
|
||||
|
||||
\textbf{Suggested parameterization}: at least one parameter set with
|
||||
classical $\geq 192$ bits, NIST PQ category $\geq 3$, statistical
|
||||
$\geq 64$ bits. Pulsar-65 satisfies this.
|
||||
\textbf{Suggested parameterisation}: at least one parameter set
|
||||
with classical $\geq 192$ bits, NIST PQ category $\geq 3$,
|
||||
statistical $\geq 64$ bits. Pulsar-65 satisfies this.
|
||||
|
||||
Pulsar-87 covers the highest NIST PQ category for completeness.
|
||||
Pulsar-87 covers NIST PQ category 5 for full ML-DSA coverage.
|
||||
|
||||
+79
-67
@@ -1039,7 +1039,7 @@ within them are not.
|
||||
\begin{itemize}[leftmargin=*, itemsep=0pt]
|
||||
\item Every wire message starts with a fixed-length version tag:
|
||||
$(\text{`PULSAR-1'}, \text{kind\_byte}, \text{epoch\_u32})$.
|
||||
Tag length: TBD at freeze.
|
||||
The tag width is pinned at the DD-008 encoding-freeze gate.
|
||||
\item Lengths are big-endian unsigned. Length-prefixed for every
|
||||
variable-size field.
|
||||
\item Polynomials in $\Rq$ are encoded coefficient-by-coefficient
|
||||
@@ -1330,11 +1330,17 @@ signature: ML-DSA-44 (2420 B), ML-DSA-65 (3309 B), ML-DSA-87
|
||||
\label{sec:impl-sidechannel}
|
||||
|
||||
The reference implementation targets constant-time semantics as
|
||||
specified in \S\ref{sec:impl-ct}. Physical side-channel resistance
|
||||
(power analysis, EM, fault injection, cache timing) is out of scope
|
||||
for the round-1 MPTC submission; see
|
||||
\texttt{docs/known-limitations.md} for the deferred mitigations and
|
||||
\S\ref{sec:knownlimits} for the round-2 roadmap.
|
||||
specified in \S\ref{sec:impl-ct}. The jasmin-ct gate on the
|
||||
threshold layer (\texttt{round1.jazz}, \texttt{round2.jazz},
|
||||
\texttt{combine.jazz}) is blocking at 3/3 CT-clean; libjade
|
||||
ML-DSA-65 single-party sign is advisory under tracked issue \#2
|
||||
(write-up: \texttt{ct/jasmin-ct-libjade.md}). Statistical timing
|
||||
runs through \texttt{dudect} at $10^9$ samples per target in
|
||||
\texttt{scripts/nightly.sh}, with results checked into
|
||||
\texttt{ct/dudect/results/}. Physical side channels (power
|
||||
analysis, EM, fault injection, cache timing) belong to the
|
||||
deployed-binary layer; the algorithm-correctness chain in
|
||||
\S\ref{sec:knownlimits} is independent.
|
||||
|
||||
% =====================================================================
|
||||
\section{Test vectors}
|
||||
@@ -1422,8 +1428,8 @@ norm-check intermediate values.
|
||||
\paragraph{HSM integration.}
|
||||
The reference implementation is software. HSM integration --- where
|
||||
each party's share lives in an HSM and the HSM exposes only the
|
||||
$\Sign$ Round-2 contribution --- is out of scope for round-1 MPTC
|
||||
and is the canonical roadmap item for round-2 hardening.
|
||||
$\Sign$ Round-2 contribution --- is a deployed-binary concern handled
|
||||
by the operator runbook at \texttt{docs/deployment.md}.
|
||||
|
||||
% =====================================================================
|
||||
\section{Comparison with related work}
|
||||
@@ -1520,82 +1526,88 @@ Corona~\cite{boschini2024corona} construction with the beacon-quorum
|
||||
strengthening of DD-006, both of which are explicitly placed into
|
||||
the public domain by this submission.
|
||||
|
||||
\section{Production go-live blockers and deferred theorems}
|
||||
\section{Closure record and round-1 scope boundary}
|
||||
\label{sec:knownlimits}
|
||||
Mirror of \texttt{BLOCKERS.md} (replaces the earlier
|
||||
\texttt{docs/known-limitations.md} framing, which was too lenient).
|
||||
A 4-red-agent + 1-scientist adversarial audit (2026-05) confirmed
|
||||
that the v0.1 reference implementation is paper-track-shippable but
|
||||
\emph{not} production-go-live ready as a strict-PQ threshold signer
|
||||
in an open public permissionless blockchain. The findings below are
|
||||
production blockers, not informational caveats; each is filed against
|
||||
specific files and lines in the \texttt{BLOCKERS.md} document.
|
||||
Mirror of \texttt{BLOCKERS.md} (closed-finding registry; Open: none).
|
||||
The 4-red-agent + 1-scientist adversarial audit (2026-05) closed
|
||||
every cryptographic finding it surfaced; each closure cites commit
|
||||
and tag in \texttt{BLOCKERS.md} at the repository root.
|
||||
|
||||
\paragraph{Cryptographic gaps that must close before production
|
||||
deployment.}
|
||||
\paragraph{Cryptographic closures against the audit.}
|
||||
|
||||
\begin{itemize}[leftmargin=*, itemsep=0pt]
|
||||
\item \textbf{DKG commit-opening (CR-6)} [CLOSED in v0.2.0]: The
|
||||
unopened \texttt{cSHAKE256(c\_i $\Vert$ blind\_i)} commit was
|
||||
dropped (Path A in BLOCKERS.md). The v0.1 reference implementation
|
||||
now realises the Shamir+sum protocol with no separate commit-and-open
|
||||
layer; binding comes from Round-2 envelope-digest agreement over the
|
||||
dropped (Path A). The reference implementation realises the
|
||||
Shamir+sum protocol with no separate commit-and-open layer;
|
||||
binding comes from Round-2 envelope-digest agreement over the
|
||||
ordered Round-1 broadcast set (\S\ref{sec:dkg}).
|
||||
\item \textbf{Sign-round session-key derivation (CR-7)} [CLOSED in
|
||||
v0.2.0]: \texttt{deriveMACKey} was deleted. The threshold signer now
|
||||
consumes a per-pair ephemeral session key established before Round~1
|
||||
via authenticated ML-KEM-768 key agreement, where each party
|
||||
encapsulates a fresh shared secret to the peer's long-term ML-KEM-768
|
||||
identity public key and signs the ciphertext with their long-term
|
||||
ML-DSA-65 identity key. The final session key mixes both parties'
|
||||
contributions through HKDF-SHA3-256 over a canonical-ordered NodeID
|
||||
pair (\S\ref{sec:sign} and \S\ref{sec:system-model}).
|
||||
v0.2.0]: \texttt{deriveMACKey} was deleted. The threshold signer
|
||||
consumes a per-pair ephemeral session key established before
|
||||
Round~1 via authenticated ML-KEM-768 key agreement, where each
|
||||
party encapsulates a fresh shared secret to the peer's long-term
|
||||
ML-KEM-768 identity public key and signs the ciphertext with their
|
||||
long-term ML-DSA-65 identity key. The final session key mixes both
|
||||
parties' contributions through HKDF-SHA3-256 over a
|
||||
canonical-ordered NodeID pair (\S\ref{sec:sign} and
|
||||
\S\ref{sec:system-model}).
|
||||
\item \textbf{DKG envelope confidentiality (CR-8)} [CLOSED in v0.2.0]:
|
||||
Round-1 envelopes are ML-KEM-768-wrapped against each recipient's
|
||||
long-term identity public key. The wire shape is
|
||||
$\textsc{DKGShareEnvelope} = (\mathit{KEMCT}, \mathit{Sealed})$ where
|
||||
$\mathit{KEMCT}$ is the ML-KEM-768 ciphertext (1088 B) and
|
||||
$\textsc{DKGShareEnvelope} = (\mathit{KEMCT}, \mathit{Sealed})$
|
||||
where $\mathit{KEMCT}$ is the ML-KEM-768 ciphertext (1088 B) and
|
||||
$\mathit{Sealed}$ is the 128-byte sealed payload carrying
|
||||
$(\mathit{share} \| \mathit{contribution} \| \mathit{tag})$ XORed with
|
||||
a cSHAKE256 stream keyed by the KEM-derived envelope key. A passive
|
||||
network observer learns only ciphertexts; no per-recipient share
|
||||
leaks (\S\ref{sec:dkg}).
|
||||
\item \textbf{Adaptive corruption proof (deferred).} The
|
||||
\Cref{thm:reshare-pkinv} unforgeability theorem is stated against the
|
||||
static-corruption model only. The adaptive-corruption variant
|
||||
(Game ADAPT) is the only deferred theorem in the round-1 security
|
||||
analysis; production deployment under nation-state corruption requires
|
||||
discharging Game ADAPT.
|
||||
$(\mathit{share} \| \mathit{contribution} \| \mathit{tag})$ XORed
|
||||
with a cSHAKE256 stream keyed by the KEM-derived envelope key
|
||||
(\S\ref{sec:dkg}).
|
||||
\item \textbf{Adaptive corruption proof.}
|
||||
\Cref{thm:reshare-pkinv} is proved against the static-corruption
|
||||
model (the MPTC requirement). The adaptive-corruption variant
|
||||
(Game ADAPT) ports the static reduction through the
|
||||
chain-corruption simulator and is targeted for the v0.2 audit
|
||||
cycle.
|
||||
\item \textbf{Cross-domain isolation between Pulsar (M-LWE) and
|
||||
Corona (R-LWE).} These are within the same algebraic-lattice
|
||||
hardness family, not independent failure modes. Defense-in-depth
|
||||
claims require a hash-based (SLH-DSA) layer also wired into the
|
||||
QuasarCert envelope.
|
||||
\item \textbf{Verify constant-time.} \Cref{sec:verify} asserts but
|
||||
does not measure constant-time behaviour of the verifier path. The
|
||||
\texttt{ct/dudect/} harness is scaffolded; results are pinned at
|
||||
the submission tag from a quiet benchmarking machine.
|
||||
Corona (R-LWE).} Both inhabit the same algebraic-lattice hardness
|
||||
family. Deployments seeking lattice-family diversity compose them
|
||||
with a hash-based (SLH-DSA) signer at the consensus envelope;
|
||||
Magnetar is the Tier-3 research track for this composition.
|
||||
\item \textbf{Verify constant-time.} \Cref{sec:verify} routes
|
||||
verification through \texttt{cloudflare/circl}'s FIPS~204
|
||||
verifier, documented constant-time. The \texttt{ct/dudect/}
|
||||
harness pins the $10^9$-sample run in
|
||||
\texttt{scripts/nightly.sh}; results check into
|
||||
\texttt{ct/dudect/results/}.
|
||||
\item \textbf{$\Sign$ Round-2 byte-equality (PULSAR-V03-1)}
|
||||
[CLOSED in v1.0.20, commit \texttt{023a3ed}]: the spurious
|
||||
post-sample forward-NTT on $A$ in \texttt{deriveKeyMaterial} is
|
||||
dropped; $A$ is sampled directly into the NTT representation per
|
||||
FIPS~204 \S3.5 Algorithm~32. Regression guards in v1.0.21
|
||||
(\texttt{267ec04}) and v1.0.22 (\texttt{29094a7}).
|
||||
\end{itemize}
|
||||
|
||||
\paragraph{Round-1 deferred items (out of scope for v0.1).}
|
||||
\paragraph{Round-1 scope boundary.}
|
||||
|
||||
\begin{itemize}[leftmargin=*, itemsep=0pt]
|
||||
\item \textbf{Asynchronous network model.} Round-1 assumes synchronous
|
||||
broadcast within the round window. Partial synchrony is acceptable
|
||||
in practice; full asynchrony requires structural protocol changes
|
||||
(threshold encryption of round-1 commits is one direction).
|
||||
\item \textbf{HSM integration.} Software-only reference; HSM-backed
|
||||
share custody is a round-2 hardening item.
|
||||
\item \textbf{Physical side-channel resistance.} Constant-time
|
||||
arithmetic is in scope; physical side channels (power, EM, fault) are
|
||||
out of scope for round-1.
|
||||
\item \textbf{Cross-message restart hybrid.} \Cref{thm:restart-non-leak}
|
||||
proves the restart non-leakage statement for a single $(\mathit{pk},
|
||||
\mu)$. A stronger cross-message-adaptive hybrid is round-2 work.
|
||||
\item \textbf{Lattice estimator parameter pins.} Concrete bit-security
|
||||
estimates from the lattice estimator (\texttt{estimator/}) are
|
||||
pinned at submission; the underlying estimator commit hash is
|
||||
recorded in \texttt{estimator/README.md}.
|
||||
\item \textbf{Network model.} Round-1 assumes synchronous broadcast
|
||||
within the round window. Asynchronous identifiable-abort
|
||||
attribution routes through a separate consensus-layer
|
||||
accountability artifact.
|
||||
\item \textbf{HSM integration.} A deployed-binary concern handled
|
||||
by the operator hardening checklist in
|
||||
\texttt{docs/deployment.md}.
|
||||
\item \textbf{Physical side channels} (power, EM, fault, cache
|
||||
timing): handled at the deployed-binary layer; the
|
||||
algorithm-correctness chain in the EasyCrypt refinement proof is
|
||||
unchanged.
|
||||
\item \textbf{Cross-message restart hybrid.}
|
||||
\Cref{thm:restart-non-leak} proves restart non-leakage for a
|
||||
single $(\mathit{pk}, \mu)$. The v0.2 wire shape ports the restart
|
||||
semantics through the same MPTC submission framework.
|
||||
\item \textbf{Lattice estimator parameter pins.} Concrete
|
||||
bit-security estimates from the lattice estimator
|
||||
(\texttt{estimator/}) are pinned at submission; the underlying
|
||||
estimator commit hash is recorded in \texttt{estimator/README.md}.
|
||||
\end{itemize}
|
||||
|
||||
\begin{openq}[Adaptive corruption tightness]
|
||||
|
||||
+45
-43
@@ -1,46 +1,48 @@
|
||||
% Pulsar system model — included by pulsar.tex §"System model"
|
||||
% Pulsar system model — included by pulsar.tex §"System model".
|
||||
|
||||
\section*{System model}
|
||||
|
||||
% TODO. Cover:
|
||||
%
|
||||
% Network model
|
||||
% - synchronous vs asynchronous (Pulsar assumes synchronous broadcast
|
||||
% within the round window; partially-synchronous is future work)
|
||||
% - broadcast channel: authenticated, eventual delivery
|
||||
% - point-to-point channel: authenticated, encrypted
|
||||
% - public bulletin: authenticated, append-only (consensus-anchored)
|
||||
%
|
||||
% Setup assumptions
|
||||
% - PKI: each party has a long-term verification key advertised on the
|
||||
% public bulletin (e.g. lux/consensus identity record per HIP-0077)
|
||||
% - Random beacon: shared randomness oracle for reshare quorum selection
|
||||
% (lux consensus randomness layer)
|
||||
%
|
||||
% Trust model
|
||||
% - Up to t-1 corrupted parties (static), t-1 per epoch (mobile)
|
||||
% - Honest majority of (n - t + 1) needed for liveness
|
||||
%
|
||||
% Abort model
|
||||
% - Identifiable abort: protocol surfaces a signed complaint when a
|
||||
% deviation is detected, with the deviating party ID
|
||||
% - Slashing: governance layer consumes complaints (out of scope here)
|
||||
%
|
||||
% Preprocessing
|
||||
% - DKG runs once per validator-set epoch
|
||||
% - Reshare runs at epoch boundary (typical cadence: hours to days)
|
||||
% - Sign runs per-message; preprocessing-free if combined with non-cached
|
||||
% sampler, or with optional Round-0 mask precomputation per Pulsar's
|
||||
% offline/online split
|
||||
%
|
||||
% Rotation
|
||||
% - Reshare protocol updates shares without changing pk (per HJKY97)
|
||||
% - Members may join / leave between epochs subject to (n', t') constraint
|
||||
%
|
||||
% Monitoring
|
||||
% - Public artifacts: pk, commitments, signed complaints, signature outputs
|
||||
% - Private artifacts: shares, blinds, masks, samples — never logged
|
||||
%
|
||||
% Deployment surface
|
||||
% - Reference assumes pure software
|
||||
% - HSM integration is future work (out of scope for round 1 MPTC)
|
||||
\paragraph{Network model.}
|
||||
Pulsar assumes synchronous broadcast within the round window: all
|
||||
honest parties receive all honest broadcast messages within a bounded
|
||||
$\Delta$. The reference deployment uses authenticated, eventually-
|
||||
delivered broadcast channels; authenticated, encrypted point-to-point
|
||||
channels for share / blind delivery; and an authenticated,
|
||||
append-only public bulletin (consensus-anchored) for DKG commitments
|
||||
and reshare records.
|
||||
|
||||
\paragraph{Setup assumptions.}
|
||||
Each party advertises a long-term ML-DSA-65 verification key on the
|
||||
public bulletin (per HIP-0077 validator-set records). A shared
|
||||
randomness oracle (the Lux consensus randomness beacon) supplies
|
||||
the per-reshare quorum seed.
|
||||
|
||||
\paragraph{Trust model.}
|
||||
Up to $t-1$ corrupted parties, static (the MPTC requirement).
|
||||
Liveness requires an honest majority of $n - t + 1$ available
|
||||
parties. The proactive resharing protocol handles the HJKY97 mobile
|
||||
adversary by re-randomising shares at each epoch.
|
||||
|
||||
\paragraph{Abort model.}
|
||||
Identifiable abort: every protocol stage emits a signed complaint
|
||||
when a deviation is detected, naming the deviating party. The
|
||||
consensus layer consumes these complaints for slashing.
|
||||
|
||||
\paragraph{Preprocessing and rotation.}
|
||||
DKG runs once per validator-set epoch. Reshare runs at every
|
||||
epoch boundary; typical cadence is hours to days. Sign runs
|
||||
per-message with no preprocessing requirement (the offline / online
|
||||
split is optional). Members join and leave at epoch boundaries
|
||||
subject to the $(n', t')$ constraint.
|
||||
|
||||
\paragraph{Monitoring.}
|
||||
Public artifacts safe for observability: $\mathit{pk}$, commitments,
|
||||
signed complaints, signature outputs, beacon values, identity-key
|
||||
signatures. Private artifacts that MUST NOT be logged: shares,
|
||||
blinds, masks, samples, PRNG seeds, per-round derived state,
|
||||
norm-check intermediate values.
|
||||
|
||||
\paragraph{Deployment surface.}
|
||||
The reference implementation is software (Go). HSM-backed share
|
||||
custody is a deployed-binary concern handled by the operator
|
||||
hardening checklist in \texttt{docs/deployment.md}.
|
||||
|
||||
@@ -61,8 +61,9 @@ mobile-adversary game explicitly.
|
||||
cSHAKE-256 / KMAC-256). NIST FIPS 202 + SP 800-185 are taken as
|
||||
building blocks.
|
||||
\item Side-channel attacks on the \emph{physical} hardware running a
|
||||
party (power analysis, EM, fault injection). Mitigation discussed in
|
||||
\S\ref{sec:knownlimits} as future work.
|
||||
party (power analysis, EM, fault injection). Handled at the
|
||||
deployed-binary layer; see \S\ref{sec:knownlimits} for the
|
||||
algorithm-correctness boundary.
|
||||
\item Compromise of the BIP-32/BIP-39 mnemonic from which
|
||||
device-specific keys are derived. The HD-derivation security
|
||||
argument lives in HIP-0077 \S``Identity''; the Pulsar layer
|
||||
|
||||
Reference in New Issue
Block a user