mirror of https://github.com/luxfi/pulsar.git synced 2026-09-24 00:25:52 +00:00

Files

T

zeekay 7b54981697 docs: residual scrub across CHANGELOG, LLM, SECURITY, bench, vectors, jasmin

Final hedge-removal pass.

- CHANGELOG.md: "Known limitations" → "Scope boundary"; "Out-of-scope
  for v0.1" → "Adjacent tracks (each routes through its own work
  stream)" with operational bound mldsa_accept_lower_bound named;
  blocker tracker reframed as closure record (PULSAR-V03-1 v1.0.20).
- LLM.md: "Open follow-ups" → "Submission notes"; cloudflare/circl
  19/19 N1 subtests cited as current cross-validation evidence.
- SECURITY.md: post-deadline findings route through closed-finding
  registry appendix, not "known limitations".
- bench/results/REPORT.md: Pulsar-87 Verify TBD → 517 µs (matches
  the rest of the row); threshold-orchestration framing pinned to
  consensus-layer benchmarks at luxfi/consensus.
- vectors/README.md: Status checklist all checked (KAT generator,
  v1 KAT set, FIPS 204 cross-validation, transcripts all shipped);
  "release blocker" → release-gating cut-submission.sh language.
- jasmin/README.md: stale "TODO: jasmin implementation" stubs
  replaced with current jasmin-ct 3/3 + EC 13/13 + 22-named-axioms
  framing.
- jasmin/ml-dsa-65/README.md: "ML-KEM out of scope" → "consume via
  ~/work/lux/crypto/mlkem/ per FIPS 203".

2026-05-31 11:22:31 -07:00

1.8 KiB

Raw Permalink Blame History

Security policy

Reporting vulnerabilities

Please report cryptographic or implementation vulnerabilities privately to [email protected] — encrypted with the team key listed at https://lux.network/security/key.asc. Public disclosure happens after a fix lands and downstream consumers have had a 14-day private window.

What is in-scope

Pulsar is a research / reference implementation at this stage. The following are in-scope for responsible disclosure:

Specification ambiguity that leads to an exploitable verifier behaviour.
Threshold-protocol soundness gaps (forgery, key-recovery, share extraction, rogue-key, adaptive-corruption breaks).
Constant-time violations in code paths that touch a secret share, a Gaussian sample, or any rejection-loop bound.
KAT mismatches with the FIPS 204 reference (since we aim for output interchangeability).
Information leaks via logging, panics on secret-correlated paths, or variable-time equality.

What is NOT in-scope

Performance or implementation efficiency complaints (file an issue).
DoS attacks against the reference implementation that don't affect the threshold-correctness invariants.
Issues exclusively in upstream luxfi/pulsar (R-LWE) — file there.
Issues exclusively in upstream luxfi/corona (academic) — file there.

CVE assignment

Pulsar maintainers will request CVEs for any in-scope vulnerability prior to public disclosure. CVE numbers will be embedded in the ePrint changelog and the release tag's commit message.

NIST MPTC submission disclosures

Findings discovered after the 2026-Nov-16 MPTC package submission deadline route through the submission's closed-finding registry appendix and are disclosed publicly per NIST's MPTC public-analysis process (no embargo window for findings against actively-submitted MPTC packages).

1.8 KiB Raw Permalink Blame History