references.bib gave ePrint 2024/1113 the title "Corona: Practical Two-Round
Threshold Signatures from Learning with Errors". The paper is "Ringtail:
Practical Two-Round Threshold Signatures from Learning with Errors", by the
six authors the entry already named correctly. A title is the authors' words.
The file's own header asks for exactly this — "verified against
https://eprint.iacr.org... Do not paraphrase or guess".
Ringtail is their scheme. Corona is Lux's implementation over Ring-LWE;
Pulsar retargets the same two-round structure to Module-LWE for FIPS 204.
The prose and the citation key now say so, and this spec is the NIST MPTC
submission, so it is the last place to get it wrong.
patent-notes.tex stated "Corona's open-source repo is Apache-2.0 with no
asserted patent claims". Corona is under the Lux Ecosystem License v1.2,
which reserves commercial use — no Apache grant and no Apache §3 patent
grant. The surrounding paragraph had been flattened by a rename into
"Pulsar ... is derivative of Pulsar" and "Pulsar (and therefore Pulsar) is a
fork"; it now names Corona and Ringtail where each is meant.
Dropped the residual Pulsar-M spelling, including the naming rule that
forbade writing "Pulsar" and required writing "Pulsar".
Co-authored-by: Hanzo Dev <[email protected]>
The keygen-track tables claimed 'KEYGEN stays trusted-dealer (Residual B)' and
'Dealerless byte-FIPS-204 KEY DKG | PROVEN UNREACHABLE' — both false since v0.6.0.
Corrected to the accurate scoped truth: dealerless committee keygen via Mithril
RSS (mithril_rss.go) is the production keygen, standard-verifier-compatible
(proven); only the NAIVE additive S_eta lift is unreachable (not a class
impossibility — RSS is the published escape). Added v0.6.0-v0.6.3 + HYPERBALL
signer to the version ledger. Distribution-equivalence stays a labeled residual.
Docs-only; matches PULSAR.md (31f681d).
Final hedge-removal pass.
- CHANGELOG.md: "Known limitations" → "Scope boundary"; "Out-of-scope
for v0.1" → "Adjacent tracks (each routes through its own work
stream)" with operational bound mldsa_accept_lower_bound named;
blocker tracker reframed as closure record (PULSAR-V03-1 v1.0.20).
- LLM.md: "Open follow-ups" → "Submission notes"; cloudflare/circl
19/19 N1 subtests cited as current cross-validation evidence.
- SECURITY.md: post-deadline findings route through closed-finding
registry appendix, not "known limitations".
- bench/results/REPORT.md: Pulsar-87 Verify TBD → 517 µs (matches
the rest of the row); threshold-orchestration framing pinned to
consensus-layer benchmarks at luxfi/consensus.
- vectors/README.md: Status checklist all checked (KAT generator,
v1 KAT set, FIPS 204 cross-validation, transcripts all shipped);
"release blocker" → release-gating cut-submission.sh language.
- jasmin/README.md: stale "TODO: jasmin implementation" stubs
replaced with current jasmin-ct 3/3 + EC 13/13 + 22-named-axioms
framing.
- jasmin/ml-dsa-65/README.md: "ML-KEM out of scope" → "consume via
~/work/lux/crypto/mlkem/ per FIPS 203".
The v0.2 API previously named Algebraic* was materially misleading:
the file-header docstring claimed "AlgebraicCombine is a pure function
of public-only material; no access to any party's seed share or the
master ML-DSA private key" while the implementation calls
mldsaSign(setup.SkBytes, message, ...) against the master sk packed
in AlgebraicSetup.SkBytes. The aggregator TCB at sign time is
identical to v0.1 reconstruct-and-sign; only the parties' side of
the protocol is honestly algebraic.
v1.0.14 fixes the honesty defect without changing the algorithm.
Forward-only renames (no compat aliases):
- AlgebraicThresholdSigner → TransitionalThresholdSigner
- NewAlgebraicThresholdSigner → NewTransitionalThresholdSigner
- AlgebraicCombine → TransitionalAggregate
- AlgebraicSetup → TransitionalSetup
- AlgebraicRound1Message → TransitionalRound1Message
- AlgebraicRound2Message → TransitionalRound2Message
- DealAlgebraicShares → DealTransitionalShares
- ErrAlg* → ErrTransitional*
- TestV02_* → TestTransitional_*
Docstrings rewritten to honestly disclose the SkBytes dependency:
- threshold_v02.go file header opens with HONEST SCOPE.
- TransitionalAggregate docstring spells out TCB equivalence with v0.1.
- TransitionalSetup names SkBytes as the v0.2 TCB defect.
- types.go Signature docstring rewritten.
- DEPLOYMENT-RUNBOOK.md rewritten with "suitable / not suitable"
deployment guidance and a v0.3 milestone section.
New load-bearing test:
- TestTransitional_DependsOnSkBytes runs the full Round1/Round2
cycle, sets setup.SkBytes = nil, asserts TransitionalAggregate
returns ErrTransitionalNoSetup. Currently PASSES (because v0.2
depends on SkBytes). When v0.3 lands, this test FAILS — that
failure is the load-bearing red flag for v0.3 graduation.
New blocker tracker:
- BLOCKERS.md entry PULSAR-V03-1 documents the v0.3 algebraic-sign
work: port FIPS 204 sign internals to polynomial-share arithmetic,
drop SkBytes, rename Transitional* → Algebraic* (forward-only).
Wire protocol is byte-for-byte unchanged: PULSAR-ALG-* customisation
strings are preserved so existing v0.2 test vectors keep verifying.
Tests: full suite green (go test -count=1 -short -timeout 300s
./pkg/pulsar/ → ok 2.053s).
zeekayandHanzo Dev