pulsar: Mithril 3-round hyperball no-reconstruct threshold signer

Browse Source

mithril_rss_hyperball.go: SignHyperball runs the dealerless RSS ML-DSA-65
key with NO key reconstruction. Each active party holds only its balanced-
partition share s1_(j), samples its own hyperball mask y_j (Box-Muller
uniform-in-ball), and emits only z_j = y_j + c*s1_(j) under a leak-free
Excess gate; the coordinator sums z = Σ z_j = y + c*s1 and recovers the hint
from the PUBLIC w' = A*z − c*t1*2^d (BoundaryClear + FindHint). No party or
coordinator ever forms full s1/s2/t0/y/w/w0/sk. K-parallel slots + maxRounds
re-runs amortise acceptance; fail-closed self-verify before emit. blameSlot
gives leak-free identification (stops at culprit so Σ T_j = t−s2 never forms).

Explicit hyperballParty (private share) vs hyperballCoordinator (public
aggregates only) types make the no-reconstruct boundary structural.

...

This commit is contained in:

zeekay

2026-06-28 01:03:25 -07:00

parent be9b5db56a

commit d3ef96d6cf

1 changed files with 1069 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

ref/go/pkg/pulsar/mithril_rss_hyperball.go

+1069

File diff suppressed because it is too large Load Diff