pulsar/PULSAR.md

PULSAR — Dealerless Committee-Threshold ML-DSA Certificate Layer

Status. Architecture specification, current to v0.6.3 (git log → 0650729, origin/main). This document defines the certificate layer of Pulsar: how dealerless committee-threshold ML-DSA is organized into epochs, committees, signing sessions, and on-chain-verifiable certificates so that it scales to a permissionless validator set of N > 1000 by sampling many small committees and accumulating confidence by repetition (Avalanche-native), not by pushing one giant Shamir/FROST sharing across all N. It is the consensus-integration companion to the algorithm-level NIST-MPTC submission spec (spec/pulsar.tex, spec/parameters.tex, spec/system-model.tex) and the proofs under ~/work/lux/proofs/pulsar/.

SPEC + grounded reality. Sections labelled implemented today cite the real reference implementation under ref/go/pkg/pulsar/ at v0.6.3; sections labelled consensus target are the integration surface to build. No code is changed by this document.

---

0. Claim discipline (read first)

This layer makes two distinct claims that must never be conflated. Most flawed "threshold post-quantum" marketing collapses them; Pulsar keeps them apart on purpose.

• Claim (A) — FIPS-204 verification compatibility — PROVEN. The verifier boundary is standard, unmodified FIPS-204 ML-DSA verification:

  Verify_MLDSA(GroupPK, digest, sig) ∈ {accept, reject}
  

  The threshold-produced (c̃, z, h) is byte-for-byte a FIPS-204 signature; a stock verifier (cloudflare/circl mldsa65.Verify / mldsa87.Verify, BoringSSL/AWS-LC FIPS ML-DSA, OpenSSL 3.x PQ provider) accepts it with no Pulsar code in the verify path. This is proven today for:

  • the no-reconstruct BCC/CEF signer over a single group key (ref/go/pkg/pulsar/bcc_sign_test.go:86, TestBCCSignRoundTripVerifiesCIRCL);
  • the dealerless RSS group key, signed and verified under stock circl for every viable committee N ≤ 6 and the T = N committees n=8,t=8 / n=16,t=16 (mithril_rss_test.go:38, mithril_rss_n8_test.go:16);
  • the no-reconstruct hyperball signer over the dealerless RSS key (mithril_rss_hyperball_test.go:41, TestHyperballStockCirclVerify).

• Claim (B) — DKG/threshold construction soundness — Lux-authored, SCOPED. The dealerless key generation (RSS / Mithril) and the threshold signing protocols (BCC/CEF/CSCP + hyperball) are a Lux-authored construction. Its security is argued by reduction to ML-DSA EUF-CMA under Module-LWE / Module-SIS, plus the protocol-level privacy/abort properties argued in ~/work/lux/proofs/pulsar/. This is our theorem, not NIST's, and parts of it are scoped residuals (§18) — labelled, fail-closed, never silently weakened.

What we never say. There is no such thing as "FIPS-certified threshold ML-DSA" or "NIST-certified threshold ML-DSA." FIPS 204 standardizes single-party ML-DSA KeyGen/Sign/Verify. We never claim fully-malicious-secure-proven (mechanized) or a global-1000-validator DKG. Conformance language is always one of: "verifies under unmodified FIPS-204" (Claim A), or "Lux-authored threshold construction, reduction in proofs/pulsar/" (Claim B).

The honest one-line scope (canonical). Dealerless committee key generation (RSS / Mithril) + no-reconstruct signing (BCC/CSCP, and the Mithril hyperball 3-round signer) + standard-FIPS-204-verifier output, malicious-hardened; the full FIPS-204 KeyGen-distribution-equivalence proof and the malicious-secure CSCP/identifiable-abort layer are labelled residuals.

---

1. Why a committee certificate layer, and why not Shamir/FROST end-to-end

ML-DSA is not Schnorr. Four features break Schnorr-style threshold composition:

1. Small secrets. s1, s2 are sampled uniformly from S_η = {p ∈ R_q : ‖p‖∞ ≤ η} (η = 4 for ML-DSA-65, η = 2 for ML-DSA-87). The entire parameter set is calibrated to this bound.
2. Rejection sampling. Signing loops until ‖z‖∞ < γ1 − β and ‖r0‖∞ < γ2 − β; the accepted distribution is not a simple linear image of the inputs.
3. Decompose / rounding. w1 = HighBits(A·y) and r0 = LowBits(w − c·s2) are non-linear; there is no homomorphic commitment to w1 over additive nonce shares — this is precisely why naive FROST-style additive-nonce threshold ML-DSA is impossible.
4. Hints. The signature carries h = MakeHint(...); recovering it from shares without leaking the key residual c·t0 − c·s2 is the delicate part.

Consequence for the key layer — the naive-additive obstruction:

• Naive Lagrange/additive DKG blows the norm. A dealerless joint secret formed as a sum / Lagrange combination of N ≥ 2 independent S_η contributions has ‖s2_joint‖∞ ≤ N·η, hence ‖c·s2_joint‖∞ ≤ N·β. This violates both the BCC boundary-clearance hypothesis (‖c·s2‖∞ ≤ β) and ML-DSA's S_η-calibrated EUF-CMA. This naive-additive obstruction is computed, not asserted, in ref/go/pkg/pulsar/naive_additive_seta_obstruction.go:196 (assessDealerlessFIPS: JointS2Linf = N·η, JointCS2Linf = N·β) and is the reason the naive dealerless entry point fails closed (ErrDealerlessByteFIPSUnreachable, naive_additive_seta_obstruction.go:152). It is the naive lift only — it does not prove a general impossibility; the file's own header (:84–:107) lists the escape: a sharing whose reconstruction stays in S_η by construction.

That escape is now built (v0.6.0+): Mithril short Replicated Secret Sharing (RSS). The key is the plain sum of C(N, N−T+1) fresh short χ_η subset secrets, so ‖s2‖∞ ≤ C·η stays genuinely small (§4). RSS does not form an N-way additive blow-up — it sidesteps the obstruction the obstruction file itself names. The dealer is dead at keygen too, not just at signing.

So Pulsar does not push one global Shamir/FROST sharing across all N validators, and it does not rely on a trusted dealer. Instead it scales by sampling many small dealerless committees and treats the certificate (an epoch/committee-bound, stock-FIPS-204-verifiable ML-DSA signature) as the unit of composition (§5, §12).

---

2. What exists today (grounded in ref/go/pkg/pulsar/ @ v0.6.3)

Concern	Implemented today (file:line)
(A) Threshold output verifies under unmodified FIPS-204	DONE — bcc_sign_test.go:86 checks a no-leak BCC/CEF signature byte-for-byte under independent circl mldsa65/87.Verify (+ tamper / wrong-msg / wrong-ctx negatives).
Dealerless committee keygen	DONE (RSS / Mithril) — mithril_rss.go:133 MithrilRSSKeygen: no trusted dealer; each subset's short secret is sampled by that subset's leader and replicated; no party holds the whole (s1,s2). Stock-circl-verifiable: mithril_rss_test.go:38 (all 15 committees N ≤ 6), mithril_rss_n8_test.go:16 (T=N at n=8, n=16).
Large-committee keygen (arithmetic)	DONE (v0.6.3) — per-subset reduction accumulateSubset (mithril_rss.go:122) fixes a uint32 overflow that wrapped the key once C(N,N−T+1) ≥ 512; unblocks the owner-default large committees (e.g. n=16,t=14, C(16,3)=560).
No-reconstruct online signing (single group key)	DONE — distributed_bcc.go:645 partial z_i = λ_i·y_i + c·λ_i·s1_i; AggregateBCCWithBlame (:875) sums to z = ȳ + c·s1 without ever forming s1 (let alone the seed); hint from public w' = A·z − c·t1·2^d.
No-reconstruct signing over the dealerless RSS key	DONE (hyperball, gates 5/6) — mithril_rss_hyperball.go:780 SignHyperball: the Mithril 3-round protocol; each party emits only z_j = y_j + c·s1_(j); no party or coordinator forms the full s1, any s2, t0, the mask y, the commitment w, w0, or any sk.
Malicious hardening	DONE (v0.5) — nonce single-use safe-by-construction (nonce_ledger.go), authenticated-PartyID blame / identifiable abort (blame.go, protocol_auth.go), origin-auth safe-by-default (ErrOriginAuthRequired, distributed_bcc.go:813), GATE-2 call-graph reachability (gate2_reachability_test.go).
Offline preprocessing / ticket factory (TALUS)	BUILT (semi-honest) — TALUS talus.go, CEF talus_cef.go, CSCP secure-comparison talus_cscp.go (W-LEAK closed semi-honest, simulation-proven).
Shared lattice base	DONE (v0.6.1/.2) — transcript, Shamir, SHAKE samplers, and the ML-DSA ring core routed onto github.com/luxfi/mlwe (byte-preserving); Pulsar and Corona share one Module-LWE base.
Committee/epoch object model + on-chain registry	Consensus target — the sampled-certificate finality layer (§12) lives in luxfi/consensus; the pulsar repo supplies the per-committee keygen + signing primitive each committee runs.

The load-bearing fact, restated for v0.6.3: dealerless keygen and no-reconstruct signing are both built and stock-FIPS-204-verifiable. The open work (B) is the full KeyGen-distribution-equivalence proof and the malicious-secure CSCP / identifiable-abort layer (§18), not the existence of a dealerless committee key.

---

3. Version lineage (the certificate kernel's own ledger)

Read alongside ref/go/pkg/pulsar/VERSIONS.md (the gate-read track ledger) and PROOF-CLAIMS.md (the assurance vocabulary). Package-version scheme (distinct from the repo's vX module tags).

Version	What it is	Status
v0.3 — algebraic broadcast	The AlgebraicAggregate path broadcast per-party c·s2/c·t0 residual shares and reconstructed the MakeHint residual at the aggregator.	REMOVED — leaked the long-term key (PULSAR-V13-HINT-LEAK). Ripped out forward-only; no backward-compatible re-entry.
v0.4 — BCC/CSCP no-reconstruct	Boundary-Clearance-Condition (BCC) + Carry-Elimination (CEF) + CarryCompare secure-comparison (CSCP). Each member holds one poly-vector Shamir share of s1; signing aggregates only masked z-partials; the hint comes from the public w' = A·z − c·t1·2^d. No process forms s1, the seed, sk, c·s2, c·t0, r0, or full w.	Production sign path.
v0.5 — malicious hardening	Nonce single-use safe by construction (w1-only dedup, per-share registry); authenticated-PartyID blame (forged victim-slot partials dropped before attribution); origin-auth safe by default (ErrOriginAuthRequired); identifiable-abort plumbing; GATE-2 reachability + indirection lint; CI pure-Go + reconstruct-quarantine-sealed invariants.	Merged, RED-verified 0 crit/high. Malicious-hardened, not fully-malicious-secure-proven.
v0.6.0 — dealerless RSS keygen	The dealer is dead at keygen too. Mithril short Replicated Secret Sharing (ia.cr/2026/013): the key is the sum of C(N,N−T+1) fresh χ_η subset secrets (‖s2‖∞ ≤ C·η, genuinely small), sampled leaderwise and replicated; no party holds all subsets. Signs byte-for-byte under stock circl.	Built. mithril_rss.go.
v0.6.1 / v0.6.2 — mlwe de-dup	Route transcript → mlwe/transcript, Shamir → mlwe/share, SHAKE samplers → mlwe/sample/shake, ML-DSA ring core → mlwe/ring/mldsa. Byte-preserving (all KATs replay identically). Pulsar + Corona on one Module-LWE base.	Built.
v0.6.3 — RSS overflow fix	accumulateSubset reduces mod q per subset; without it, summing all C(N,M) χ_η coefficients (each stored ≈ q ≈ 2²³) overflows uint32 once C ≥ ⌊2³²/q⌋ = 512, wrapping the key into an unsignable large-secret wall key. Mod-q is additively homomorphic ⇒ small committees (n ≤ 8) are byte-unchanged.	Built (current main). mithril_rss.go:110–127.
+ HYPERBALL signer	The Mithril 3-round no-reconstruct threshold signer for the RSS key: each party reveals only z_j = y_j + c·s1_(j) under a leak-free Excess gate; the summed z is a standard FIPS-204 response. Gates 5 (verifies under stock circl, no reconstruction) and 6 (fail-closed).	Built. mithril_rss_hyperball.go. Lands on the dealerless RSS keygen (commits 645b5c5→0faa086).

---

4. Dealerless RSS keygen — the dealer is dead at keygen

MithrilRSSKeygen(mode, t, n, partySeeds) (mithril_rss.go:133) runs the dealerless Mithril RSS DKG for an (T, N) committee, driven by one contributed 32-byte seed per party. There is no trusted dealer.

Construction. For every M-subset S of the committee (M = N − T + 1), that subset's leader (lowest-indexed member) derives a 64-byte sampling seed from its own contributed entropy (mithrilSubsetSeed, :84, domain-separated "pulsar.mithril.rss.subset.v1"), samples a short secret (s1^(S), s2^(S)) ∈ S_η from it, and replicates it to the subset's members and to no one else (:169–182). The composite key is the plain sum s1 = Σ_S s1^(S), s2 = Σ_S s2^(S); the public key t = A·s1 + s2 is Power2Round-split into (t0, t1) exactly as deriveKeyMaterial / circl does (computePublicKey, :192), so the published t1 is byte-identical to what circl derives from (rho, s1, s2).

Why it beats the pick-2 wall (the obstruction's named escape). The vss/large-blinding dealerless DKG yields t = A·s1 + B·u with ‖B·u‖∞ ≈ q/2 — far outside S_η — so FindHint never fits a ±1 hint of weight ≤ ω and no byte-stock-FIPS-204 signature exists. RSS keeps every share short: ‖s2‖∞ ≤ C(N,N−T+1)·η, genuinely small. The BCC signer recovers the hint from the public w' = A·z − c·t1·2^d exactly as the verifier does, so the small s2 only lowers the per-nonce acceptance rate — it never breaks verifiability (mithril_rss.go:12–23).

Dealerless guarantee (structural). No single party is a member of every subset (T ≥ 2), so no party ever holds the whole (s1, s2); any T parties cover all subsets and reconstruct via the balanced partition; fewer than T are disjoint from at least one whole subset whose fresh short secret masks the key. Proven for the entire viability range by TestMithrilRSSDealerless (mithril_rss_test.go:91): no party holds all subsets, and no (T−1)-coalition covers all subsets.

Admission (the per-(N,T) norm bound, not a flat cap). A committee is admitted iff 2 ≤ T ≤ N ≤ 63 and τ·C(N,N−T+1)·η < γ2 (luxfi/dkg rss.ValidateCommittee). The second condition is load-bearing: the signer's hint term ‖c·s2‖∞ ≤ τ·C·η must stay inside one γ2 rounding bucket. Worked numerically (dkg v0.3.5): admitted n=8,t=7 (τCη = 5 488, 48× margin), n=8,t=8 (1 568), n=16,t=14 (109 760, 2.4× margin — tight but viable); rejected n=16,t=12 (856 128 > γ2, hint budget blown). The empirical reconstructed norms at n=16,t=14 are ‖s1‖∞, ‖s2‖∞ ≈ 185–230 — far below the worst-case C·η = 2240 and far below γ2 = 261 888 (so the key is genuinely signable). MaxParties = 6 is only the small-committee fast-path / iteration cap, not the admissible ceiling.

The v0.6.3 overflow fix (why large committees were blocked). Every χ_η coefficient is stored in pulsar's [q−η, q+η] representation (≈ q ≈ 2²³), and poly.add is a raw uint32 add. Summing all C(N,M) subset secrets without intermediate reduction overflows the accumulator once C ≥ ⌊2³²/q⌋ = 512 — exactly the owner-default n=16,t=14 with C(16,3) = 560 — wrapping the coefficient into an unsignable large-secret wall key. accumulateSubset (mithril_rss.go:122) reduces mod q per subset; because reduction mod q is an additive homomorphism, the result is the identical short Σ_S secret a single final reduction would give for a small committee (so n ≤ 8 is byte-unchanged), while every intermediate accumulator stays below 2q ≪ 2³².

Signing the RSS key — two paths.

• Quorum-reconstruct (MithrilKey.Sign, mithril_rss.go:266): rebuilds the key material from any T parties' holdings (ReconstructKeyMaterial, :223, balanced partition rss.RSSRecover), BCC-signs, and fail-closed self-verifies under the FIPS-204 verifier before returning. This rebuilds the secret at the signing coordinator — fine for a single trusted signer, but it is reconstruct-at-sign.
• No-reconstruct (MithrilKey.SignHyperball, §5): never rebuilds the key.

---

5. No-reconstruct hyperball signer — the Mithril 3-round protocol

SignHyperball(active, message, ctx, rng, maxRounds) (mithril_rss_hyperball.go:780) produces a byte-stock-FIPS-204 ML-DSA signature under the dealerless RSS group key from any T active parties without ever reconstructing the key. No party and no coordinator ever forms the full s1, any s2, t0, the mask y, the commitment w, w0 = LowBits(w), or any sk.

The kernel idea. Each active party holds only its balanced-partition share s1_(j) (the sum of the subset secrets the partition assigns to it, taken from this party's own holdings — partyShareS1, :870, never summed across parties). The party emits only its partial response z_j = y_j + c·s1_(j). The sum z = Σ_j z_j = y + c·s1 is the standard FIPS-204 response; the hint is recovered from the public w' = A·z − c·t1·2^d. s2 is never touched during signing.

Three rounds (mithril_rss_hyperball.go):

1. Commit (round1, :294). Each party samples K = kReps ephemeral masks y_{j,k} uniformly inside a hyperball B(0, r1) (sampleHyperballInBall, :895), computes w_{j,k} = A·y_{j,k}, and broadcasts binding commitment hashes CommitW (and a blame-only CommitT to T_j = A·s1_(j), hyperballCommitT, :1019).
2. Reveal + aggregate (round2 :321; coordinator aggregateCommitments :430). Parties reveal w_{j,k}; the coordinator verifies each against the Round-1 commitment (equivocation gate, :466), sums w_k = Σ_j w_{j,k}, and derives the challenge c_k for every boundary-clear slot (BoundaryClear, boundary.go:103). A non-clear slot gets c = nil (dead — no party responds, no secret consulted).
3. Respond (round3, :333). For each live slot the party computes z_{j,k} = y_{j,k} + c_k·s1_(j) and applies a leak-free Excess gate (hyperballExcess, :966): if the continuous response leaves B(0, r) the partial is rejected and never revealed. The coordinator finalize (:518) requires every active party to have accepted a slot, sums z_k = Σ_j z_{j,k}, runs the FIPS-204 reject bound + FindHint (boundary.go:154) on the public w', and emits (c̃, z, h). A mandatory fail-closed release gate runs stock VerifyCtx before returning — a biased or malformed partial makes w' miss w1, so that slot is skipped, never a bad signature emitted.

Why it is stock-verifiable (Claim A). Verifiability is independent of the hyperball parameters: the produced (c̃, z, h) clears the FIPS-204 verifier iff the summed z, w clear the central BCC checks — identical to what bccSign checks on a single reconstructed key, only here y and z are formed additively. So the signature verifies byte-for-byte under unmodified circl mldsa65.Verify.

Why the partials are leak-free (Claim B argument). Conditioned on the Excess gate's acceptance, the revealed z_j is (almost) uniform on B(0, r), independent of the secret shift c·s1_(j); the residual dependence is bounded by Rényi divergence ≤ 1/(1 − 2⁻⁶⁴) per signature via the leak-free gap Δ = r1 − r (deriveHyperballParams, :106; κ = 64 conservative; docs/hyperball-mldsa65-params.md). The mask y_j is never serialised — the wire carries only w_{j,k} = A·y_{j,k} (recovering y is Module-SIS) and the public z_{j,k}.

Gate evidence (proven today):

• GATE 5(a) — TestHyperballStockCirclVerify (mithril_rss_hyperball_test.go:41): the hyperball signature verifies under unmodified circl mldsa65.Verify for every committee N ≤ 6 and for n=8,t=8; tamper / wrong-message / wrong-context rejected (verifier non-vacuous).
• GATE 5(b) — TestHyperballNoReconstructStructural (:100): a go/ast scan proves the signing path never calls ReconstructKeyMaterial; a source byte scan proves no secret share/mask is ever packed to the wire; a runtime transcript oracle proves no party's share s1_(j) nor the full reconstructed s1/s2 bytes appear in publicBytes(); and no (T−1)-coalition even covers all subsets.
• GATE 6 — fail-closed: TestHyperballSubThresholdFailsClosed (:298, below-threshold/malformed active sets refused before signing), TestHyperballBiasedPartialCaughtAndBlamed (:329, the release gate rejects a biased partial and blameSlot pinpoints the culprit without forming Σ_j T_j = t − s2 — leak-free blame), TestHyperballEquivocationCaught (:404, a rushing party that changes w between rounds is rejected by the binding check).
• Mask never on wire — TestHyperballMaskNeverOnWire (:529, commit 0faa086): no party's mask y (nor its share) bytes appear in the Round-2 / Round-3 wire data.

Honest blame residual (mithril_rss_hyperball.go:633–637). A party that uses a share inconsistent with keygen but self-consistent with its own (equivocated-at-keygen) T_j passes the per-party blame check; it is still caught by the fail-closed release gate (no bad signature ever emitted) but is not pinpointed there. This is the same identifiable-abort residual as the malicious-CSCP layer (§18) — flagged, not faked.

---

6. Parameter sets

Pulsar is defined for the BCC-proven scope only: ML-DSA-65 and ML-DSA-87. ML-DSA-44 has no Pulsar suite.

Common FIPS-204 modulus q = 8380417 = 2²³ − 2¹³ + 1, ring R_q = Z_q[X]/(X²⁵⁶ + 1), Power2Round d = 13.

Symbol	ML-DSA-65	ML-DSA-87	Meaning
Category	NIST 3 (production target)	NIST 5
(K, L)	(6, 5)	(8, 7)	matrix A ∈ R_q^{K×L}
η	4	2	secret bound, s1,s2 ∈ S_η
τ	49	60	challenge weight
β = τ·η	196	120	key-shift bound ‖c·s2‖∞ ≤ β
γ2	261888 = (q−1)/32	261888	HighBits bucket half-width
ω	55	75	hint weight bound
|c̃|	48 B	64 B	challenge-hash length

BCC clearance (boundary.go): a nonce is accepted only if its commitment clears a fixed boundary so HighBits(w − c·s2) = HighBits(w); the hint is then public-computable and the key residual never appears in the transcript.

Why ML-DSA-44 is excluded. BCC requires ‖c·t0‖∞ ≤ τ·2^(d−1) < γ2. For ML-DSA-44, 39·4096 = 159744 > γ2 = 95232 — the hint cannot be kept public-computable. bccParams returns ok = false (boundary.go:40, :38–:39); both the BCC signer and deriveHyperballParams (ErrHyperballScope, mithril_rss_hyperball.go:72) refuse ML-DSA-44.

---

7. Avalanche-native committee math — sample many, accumulate by repetition

This is the load-bearing scaling idea, and it is not "one big BFT committee." Lux consensus is Avalanche-family: safety on the chain itself comes from repeated small-sample sub-sampling. Pulsar mirrors that for the post-quantum certificate: do not make one small committee the finality root — sample MANY small dealerless RSS committees over the same finalized digest and accumulate confidence by repetition.

Setup. A permissionless validator set of N ≥ 1000 with a Byzantine fraction f ≤ 1/3. Per epoch, sample m independent committees, each of size n with signing threshold t; require r of the m committees to produce a valid certificate over the same digest.

One-committee capture probability. A single committee of n stake-weighted members is captured (the adversary controls ≥ t of it, hence could forge that committee's leg) with probability

p  =  Pr[X ≥ t],   X ~ Binomial(n, f).

r-of-m failure probability. Treating committee captures as independent (unbiased sampling, §8), the certificate forges only if at least r of the m committees are captured:

P_fail  ≈  Σ_{j ≥ r}  C(m, j) · p^j · (1 − p)^{m − j}     (exact binomial tail)

The special case r = m (require all sampled committees) collapses to P_fail ≈ p^r. The general r-of-m tail is what the default uses, because it tolerates up to m − r offline/stalled committees for liveness while keeping the forgery budget astronomically small.

Default profile — Pulsar-HYBRID-PQ-v1: n = 8, t = 7, m = 12, r = 8.

• One-committee capture p = Pr[X ≥ 7], X ~ Binomial(8, 1/3) = 17/6561 ≈ 2⁻⁸·⁶.
• 8-of-12 tail P_fail ≈ 2⁻⁵⁹·⁸ (the dominant j = 8 term C(12,8)·p⁸·(1−p)⁴ dominates; computed with exact math/big on the consensus side).
• This is NOT n = 64 / t = 5 or any single large committee. Small, high threshold (t close to n) maximizes per-committee p-resistance; repetition (r-of-m) does the security amplification.

Why small-and-high-t committees, specifically: the dealerless RSS keygen is norm-viable exactly in the small/high-t regime (§4: n=8,t=7 has 48× margin; n=16,t=14 is 2.4×; n=16,t=12 is rejected). The Avalanche sampled-cert model wants exactly those committees — so the cryptographic feasibility envelope and the consensus security model coincide. We never need the research-open large-committee dealerless DKG, because we never use a large committee.

PulsarSampledCert shape. r standard ML-DSA signatures (one per contributing committee, each a (c̃, z, h) under that committee's RSS GroupPK), plus the committee plan binding (§8). Storage and verify cost are O(r), independent of N — each leg is verified by an unmodified FIPS-204 verifier.

---

8. Unbiasable committee selection

The independence assumption behind §7's P_fail requires that the adversary cannot grind committee membership.

• Stake-weighted VRF sortition. Each committee's members are drawn by stake-weighted VRF from the snapshotted validator set, seeded by an unbiasable beacon.
• The seed is the previous finalized block, not a proposer-chosen value — it is not proposer-grindable. An adversary cannot re-roll the sortition to land ≥ t members in a committee.
• committeePlanHash is bound into the Quasar subject M. The full plan (epoch, the m committees' member sets, thresholds, the seed) is hashed and folded into the message the committees sign, so a certificate is valid only for the exact plan it was sampled under — a captured committee from one plan cannot be replayed into another.

This is what lets §7 treat the m committee captures as (near-)independent Bernoulli trials, and what makes the r-of-m tail meaningful rather than grindable down to one lucky committee.

---

9. Three finality tiers

Pulsar's sampled certificate is the default PQ finality, sitting between a fast classical path and a maximal large-quorum PQ root.

Tier	Cert	Use	PQ posture
FAST	Beam-only (classical BLS/consensus finality)	low-latency, non-adversarial-PQ lanes	classical only
HYBRID_PQ	Beam + Pulsar sampled-cert (§7 default n=8,t=7,m=12,r=8)	default finality	classical safety + compact PQ certs (P_fail ≈ 2⁻⁵⁹·⁸)
PQ_ROOT	P3Q large-quorum — a ≥ ⅔-weighted ML-DSA quorum over the validator set	recovery / checkpoint / maximal-assurance root of trust	full PQ super-majority

Division of labour. Avalanche sub-sampling carries chain safety; Pulsar produces compact post-quantum certificates over consensus-finalized digests. The sampled-cert tier (HYBRID_PQ) is not re-deriving consensus — it is attaching a small, independently-verifiable PQ proof to a digest consensus already finalized. PQ_ROOT (P3Q) is the heavyweight fallback when a maximal, non-sampled, super-majority PQ attestation is required.

---

10. System, adversary, and synchrony model

Parties. N permissionless validators (target N > 1000), each with stake and a registered long-term identity key; the epoch validator set is committed by validator_set_root (§11). Per epoch, m committees of size n are sampled by stake-weighted VRF (§8). A per-session coordinator is a committee member with no special trust — it routes/aggregates public data, and the fail-closed release gate makes coordinator misbehavior detectable (liveness-only).

Adversary. Byzantine, Module-LWE/Module-SIS-bounded, SHA3/SHAKE modeled as a RO for domain-separated input. Per committee, up to t − 1 corruptions for unforgeability and (t−1)-privacy (the standard threshold bound). The certificate forgery budget is the r-of-m product across committees (§7), not a single committee. Static corruption is the submission posture. The hyperball signer's malicious-deviation containment is fail-closed/liveness-only: a biased partial cannot forge or leak (§5); identifiable-abort against an equivocated-at-keygen share is a labelled residual (§18).

Synchrony. Keygen (RSS) and preprocessing: partially synchronous with a bounded complaint/blame round. Online signing: 3 rounds (hyperball) or 1 round (BCC over an offline ticket) under partial synchrony; liveness is provided by sampling m > r committees so a stalled committee does not stall finality. On-chain verification: deterministic, no synchrony assumption.

---

11. Object model

All objects are content-addressed by a SHAKE256 hash over their canonical encoding with a domain tag (§14). On-chain we store commitments, not raw material.

PulsarEpoch

epoch_id            uint64        monotonic epoch counter
validator_set_root  [32]byte      Merkle root over (validator_id, stake, ltk) leaves
randomness_seed     [32]byte      UNBIASABLE beacon (prev finalized block) → committee sampling (§8)
policy_id           uint32        selects (n, t, m, r) profile + suite (§7, §9)
activation_height   uint64        first block at which this epoch's committees may sign
expiry_height       uint64        last block; certs under this epoch invalid after it

PulsarCommittee

epoch_id            uint64
committee_id        uint32        index within the epoch (0..m-1)
members             []ValidatorID stake/VRF-sampled, size n
stake_weights       []uint64      aligned with members
threshold_t         uint16        RSS signing threshold (§4 viability bound)
scheme              uint8         ML-DSA-65 | ML-DSA-87
group_public_key    []byte        FIPS-204 pk bytes — the RSS GroupPK a verifier uses
keygen_root         [32]byte      commitment to the RSS keygen transcript (DKG-PROOF-BOUNDARY.md)
status              uint8         Proposed | Active | Expired | Slashed

PulsarSampledCert

epoch_id              uint64
policy_id             uint32      the (n,t,m,r) profile (§7)
message_kind          uint16      finality | bridge | upgrade | warp | emergency
message_digest        [32]byte    domain-separated digest the committees signed (§14)
committee_plan_hash   [32]byte    bound into the signed digest (§8) — anti-grinding
legs                  []Leg       r entries, each { committee_id, signature (c̃,z,h), group_public_key_ref }

Each Leg.signature is a standard FIPS-204 signature under that committee's RSS GroupPK. O(r) storage; r independent stock-verifier checks (§13).

---

12. Per-epoch lifecycle

1. Epoch start → snapshot the validator set; commit validator_set_root.
2. Beacon → randomness_seed (prev finalized block, §8) seeds the stake-weighted VRF sortition of m committees.
3. Dealerless committee DKG (off-chain / p2p) → each committee runs MithrilRSSKeygen (§4): no dealer, no party holds the full key, the public GroupPK is a genuine FIPS-204 key. The keygen transcript root is committed.
4. Commit → the chain accepts each committee's GroupPK iff the keygen transcript is well-formed and the committee is admissible (§4 norm bound). Faulty members → blame set → slashing input.
5. Per certificate: for a consensus-finalized digest, each sampled committee runs the no-reconstruct signer (hyperball, §5 — or the 1-round BCC signer over an offline ticket) and emits its leg; the chain assembles a PulsarSampledCert once r legs land.
6. Verify (any relying party / chain) → §13.
7. Rotation → at expiry_height the epoch's committees expire; membership changes take effect at the next epoch's fresh DKG (key expiry, not key mutation — a live committee key is never mutated per join/leave).

Never all-N-sign. A certificate is signed by r small committees of n members each, never by all N validators. Cost is O(r·n), independent of N.

---

13. On-chain verification

Verification is cheap and stateless w.r.t. DKG — no threshold or DKG math runs per signature. Given a PulsarSampledCert and the on-chain committee registry, check, in order, fail-closed:

1. Epoch active. epoch_id resolves to an epoch whose [activation_height, expiry_height] brackets the current height, and whose policy_id admits message_kind.
2. Plan binding. Recompute committee_plan_hash from the registered epoch sortition and confirm it equals the value bound into message_digest (§8).
3. Quorum of legs. Exactly r distinct committees' legs are present, each resolving to an Active committee of this epoch.
4. Each leg: GroupPK matches registry (group_public_key_ref == hash(registry GroupPK)), then standard verify: MLDSA.Verify(GroupPK, message_digest, leg.signature) with an unmodified FIPS-204 verifier (Claim A). This is the only crypto op, run r times.
5. Not replayed. (epoch_id, message_digest) has not been accepted before.

The r-of-m policy (§7) is enforced by step 3 + the per-leg checks; the forgery budget is P_fail (§7). This is the HYBRID_PQ tier verifier; PQ_ROOT (P3Q) runs the analogous large-quorum check over a ≥ ⅔-weighted ML-DSA set.

---

14. Domain separation tags

All hashing uses SHAKE256 / cSHAKE256 (SP 800-185) with a version-pinned tag; one tag per purpose, never reused. The implemented DSTs (grounded in transcript.go and the RSS/hyperball files) include:

Tag	Purpose	Site
Pulsar (cSHAKE function-name N)	all cSHAKE calls	transcript.go:73
PULSAR-DKG-COMMIT-V1	seed-share DKG Round-2 digest + committeeRoot	transcript.go:40
PULSAR-SEED-SHARE-V1	Shamir coeff stream + master-seed mix	transcript.go:66
pulsar.mithril.rss.rho.v1	RSS joint public seed rho	mithril_rss.go:101
pulsar.mithril.rss.subset.v1	RSS per-subset sampling seed	mithril_rss.go:86
pulsar.mithril.hyperball.nonce.v1	hyperball per-round nonce seed	mithril_rss_hyperball.go:993
pulsar.mithril.hyperball.commitW.v1	hyperball w-commitment binding	mithril_rss_hyperball.go:1006
pulsar.mithril.hyperball.commitT.v1	hyperball T_j (blame-only) commitment	mithril_rss_hyperball.go:1021
pulsar.mithril.hyperball.sid.v1	hyperball session id	mithril_rss_hyperball.go:1032
PULSAR/nonce-single-use/v1	nonce dedup key (w1 alone)	nonce_ledger.go:395
PULSAR-BCC-CEF/joint-pk-id/v1	stable group-PK id	distributed_bcc.go
PULSAR/protocol-msg/v1	authenticated-protocol-message TBS	protocol_auth.go:61

The certificate-layer namespace (pulsar:v1:<kind> for message_digest) is the consensus target binding epoch / committee-plan / policy / chain_id / message_kind (§8, §13); it is kept distinct from the implemented kernel DSTs above on purpose.

---

15. Abort, blame, and slashing

• DKG abort. A member that fails to deliver/open a subset secret, or equivocates, is placed in the blame set; the committee re-runs without it (if n − |blame| ≥ t) or the epoch resamples. Blame is on-chain → slashing input.
• Signing abort (liveness, not safety). A biased z_j or a bad aggregate is caught by the mandatory fail-closed release gate (finalize runs stock FIPS-204 verify before emit, mithril_rss_hyperball.go:610–616; the BCC path's TalusReleaseGate): the slot is skipped/aborted. A deviating party is bounded to liveness — never a forgery or leak. blameSlot (:638) attributes the culprit leak-free (never forming Σ_j T_j = t − s2).
• Nonce-reuse. The hyperball protocol derives fresh per-round nonces (round1 is keyed on fresh round entropy); TestHyperballNonceReuseFatal (:419) demonstrates why reuse would be catastrophic (z1 − z2 = (c1 − c2)·s1_(j) recovers the share) and that the derivation prevents it. The BCC path enforces w1-keyed single-use (ErrNonceReused, nonce_ledger.go:80).

---

16. Build note — packaging & shared base

Pulsar's lattice primitives are routed onto github.com/luxfi/mlwe (v0.6.1 / v0.6.2): transcript → mlwe/transcript, Shamir → mlwe/share, SHAKE samplers → mlwe/sample/shake, ML-DSA ring core → mlwe/ring/mldsa, all byte-preserving. The dealerless committee combinatorics (subset enumeration, the (n,t) viability bound, the balanced reconstruction partition) come from github.com/luxfi/dkg/rss. Pulsar and Corona share the one Module-LWE base, so a change to the shared arithmetic is made in one place — and the two legs of the Quasar dual-PQ cert build and version independently (a Module-LWE issue in one must not block the other).

---

17. Security summary

• (A) Verification compatibility — PROVEN today. The no-reconstruct BCC/CEF signer (bcc_sign_test.go:86), the dealerless RSS key (mithril_rss_test.go:38, mithril_rss_n8_test.go:16), and the no-reconstruct hyperball signer (mithril_rss_hyperball_test.go:41) all produce (c̃, z, h) accepted by unmodified circl mldsa{65,87}.Verify, with tamper/wrong-message/wrong-context negatives.
• (B) Construction — Lux-authored, partly residual. Dealerless RSS keygen (no dealer, no party holds the whole key) + no-reconstruct signing (BCC/CSCP + hyperball) reduce to ML-DSA EUF-CMA under Module-LWE / Module-SIS for the output bytes. The scoped residuals (§18) are the full FIPS-204 KeyGen-distribution-equivalence proof and the malicious-secure CSCP/identifiable-abort layer.
• Certificate-level safety — sampling, not one committee. A PulsarSampledCert forges only if r of m independent, unbiasably-sampled committees are captured: P_fail ≈ 2⁻⁵⁹·⁸ for the default n=8,t=7,m=12,r=8 (§7).
• Dual-PQ defence in depth. Pulsar is the FIPS-204-standard, Module-LWE leg of the Quasar AND-mode dual-PQ cert; Corona (natively dealerless Module-LWE Raccoon/Ringtail line — a non-FIPS verifier) is the assumption-diverse companion leg. A forgery requires breaking both legs.

---

18. Residuals (labelled, fail-closed, never silently weakened)

#	Residual	Status
R1	Full FIPS-204 KeyGen-distribution-equivalence for the dealerless RSS keygen — that GroupPK is distributed identically to a single honest KeyGen, with (i) an unbiased composite secret, (ii) hiding against < t corruptions, (iii) abort-bias resistance. Standard-verifier compatibility (A) is proven; this distributional (B) equivalence needs a simulation/hiding/abort-bias proof.	open-research (Claim B). The structural facts (no party holds the key, ‖s2‖∞ ≤ C·η, stock-circl-verifiable) are proven; the distributional proof is not.
R2	Malicious-secure CSCP + identifiable-abort. A valid-sigma but wrong-z partial (BCC), or an equivocated-at-keygen share (hyperball blameSlot), is bounded to a liveness fault (never forgery/leak — the release gate catches it) but is not yet attributed. Needs BDLOP/Ajtai hiding share-commitments + an extended linear-sigma.	fail-closed-pending-review (share_commit.go:73 ErrIdentifiableAbortResidual; mithril_rss_hyperball.go:633).
R3	Leak-free distributed NonceMPC (BCC offline ticket factory). The production sign path consumes a NonceCert (only w1 public); the stand-in dealer-models the nonce and exposes DebugW to tests only (PULSAR-V13-W-LEAK).	fail-closed-pending-review. The hyperball signer does not use this path (it forms w additively from per-party commitments, no nonce dealer).
R4	Networked, non-simulation MPC + persistent (crash-restart) nonce ledger. The crypto binding is in place; the authenticated transport and a restart-surviving per-share ledger are consensus-layer residuals.	flagged.

Never claimed. FIPS/NIST-certified threshold ML-DSA · fully-malicious-secure- proven (mechanized) · global-1000-validator DKG. (RSS keygen is per-committee and small; the global scale is achieved by sampling small committees, §7.)

---

19. References

• TALUS — J. Kao, "TALUS: Threshold ML-DSA with One-Round Online Signing via Boundary Clearance and Carry Elimination," arXiv:2603.22109. (BCC = Boundary Clearance Condition; CEF = Carry Elimination Framework; reduces to ML-DSA EUF-CMA; offline ticket factory + one-round online signing.)
• Mithril — Celi, del Pino, Espitau, Niot, Prest, "Mithril: Threshold ML-DSA from Short Replicated Secret Sharing," ia.cr/2026/013, USENIX Security 2026. (Short replicated sharing — the dealerless RSS keygen; the 3-round hyperball no-reconstruct signer; standard-verifier-compatible; practical for small, high-threshold committees.)
• Threshold Raccoon — del Pino, Katsumata, Prest, Rossi, EUROCRYPT 2024. (Noise-flooded lattice signatures — a non-FIPS verifier; the Corona/Raccoon line, why Corona is the assumption-diverse dealerless leg.)
• Corona — Boschini et al., Module-LWE threshold signatures (luxfi/corona), the dealerless companion leg of the dual-PQ Quasar cert.
• Avalanche — Team Rocket, "Scalable and Probabilistic Leaderless BFT Consensus through Metastability." (The repeated-small-sample sub-sampling whose Pr[capture]^r-style amplification the sampled-cert model mirrors for PQ certificates.)
• FIPS 204 — NIST, Module-Lattice-Based Digital Signature Standard (ML-DSA). (The single-party standard whose verifier accepts Pulsar output — Claim A. NIST does not standardize threshold ML-DSA.)

Companion artifacts

• DKG/threshold proof boundary: DKG-PROOF-BOUNDARY.md + vectors/dkg-proof-boundary.json.
• Assurance vocabulary / gate-read: PROOF-CLAIMS.md; track ledger: ref/go/pkg/pulsar/VERSIONS.md; open findings: BLOCKERS.md.
• Algorithm-level spec: spec/pulsar.tex, spec/parameters.tex, spec/system-model.tex, spec/security-games.tex.
• Proofs: ~/work/lux/proofs/pulsar/ (LaTeX) + ~/work/lux/proofs/lean/Crypto/Pulsar/.
• Reference implementation: ref/go/pkg/pulsar/ (BCC/CEF kernel, TALUS, the dealerless RSS keygen mithril_rss.go, the hyperball signer mithril_rss_hyperball.go, the computed naive-additive obstruction).