pulsar/spec/family-architecture.tex

% Pulsar threshold-signature family architecture -- included by
% pulsar.tex. Mirrors docs/family-architecture.md (now deleted;
% this file is the canonical LaTeX form).

\begin{quote}
The \textbf{Lux Quasar family} is the set of lattice-based
threshold-signature schemes deployed under one Quasar Cert wire
format. Variants share the same protocol skeleton (2-round
threshold sign, Pedersen DKG with proper hiding, proactive
resharing, identifiable abort) but differ in the underlying lattice
problem and NIST-compatibility target.
\end{quote}

This document is the canonical statement of the family architecture.
Every Lux Quasar family variant references it. Every NIST submission
cites it. Every consumer that wires ``the Lux Quasar family'' into a
downstream system points here for the variant table.

\subsection{Variants}

\begin{center}
\small
\begin{tabular}{p{2.3cm}p{3.0cm}p{1.8cm}p{2.6cm}p{2.2cm}p{1.6cm}p{2.4cm}}
\toprule
variant & repo (target) & lattice basis & hash family (canonical) &
  FIPS 204 verifier interchange? & NIST MPTC class & status \\
\midrule
\textbf{Pulsar} (was Pulsar / pulsar) &
  \texttt{github.com/luxfi/pulsar} &
  Module-LWE ($\Rq^k$) &
  SHA-3 / cSHAKE256 (SP 800-185) &
  yes --- output is a single FIPS~204 ML-DSA $\sigma$ &
  Class N1 + N4 &
  production-enabled; reference complete, KAT-pinned \\
\textbf{Corona} (was Pulsar.R / luxfi/pulsar) &
  \texttt{github.com/luxfi/corona} &
  Ring-LWE ($\Rq$) &
  SHA-3 / cSHAKE256 (SP 800-185) &
  no --- special threshold-friendly primitive &
  Class S1 + S4 &
  production-enabled; Lux R-LWE fork, lifecycle DKG complete \\
\textbf{Annulus} (archived; was \texttt{Nasua}; tracks Corona upstream) &
  \texttt{github.com/luxfi/annulus} &
  Ring-LWE ($\Rq$) &
  BLAKE3 (academic profile) &
  no &
  academic-only &
  \emph{archived}; research-frozen; production descendants are Pulsar and Corona \\
\bottomrule
\end{tabular}
\end{center}

\paragraph{Lineage.} Annulus is the archived academic root of the
family. The Lux fork was originally released under the code-name
\texttt{Nasua}; the formal-paper name \texttt{Annulus} replaced it
at the academic-archive cut. Annulus tracks the Corona primitive
of Boschini et~al.~\cite{boschini2024ringtail}, which builds on
the Raccoon Fiat--Shamir-without-rejection template~\cite{raccoon2024}.
Annulus is \emph{not enabled} in Lux production and the repository
is archived (no further academic-level changes).

The production descendants of Annulus are:
\begin{itemize}[leftmargin=*, itemsep=0pt]
\item \textbf{Corona} --- the Lux R-LWE production fork of Annulus.
Switches the hash family to SHA-3 / SP~800-185, adds identifiable
abort, adds proactive resharing with beacon-randomised quorum
selection.
\item \textbf{Pulsar} --- the Module-LWE / FIPS~204-compatible
expansion. Lifts the same two-round protocol from $\Rq$ to $\Rq^k$
so the threshold output is byte-equal to a single-party FIPS~204
ML-DSA signature.
\end{itemize}

\paragraph{Naming discipline.}

\begin{itemize}[leftmargin=*, itemsep=0pt]
\item \textbf{Pulsar} --- rotating neutron star; the M-LWE
production variant.
\item \textbf{Corona} --- ring of light around a star; the R-LWE
production variant.
\item \textbf{Annulus} --- ring-shaped region (the ``ring of fire''
of an annular eclipse); the archived academic root. The
implementation repository was originally named after the ring-tailed
coati \emph{Nasua nasua}; the formal-paper name Annulus is the
canonical surface today.
\end{itemize>

All variants share:

\begin{itemize}[leftmargin=*, itemsep=0pt]
\item \textbf{Protocol skeleton} --- 2-round threshold sign, Pedersen
DKG, proactive resharing with beacon-randomized quorum, identifiable
abort with signed complaints.
\item \textbf{Hash suite} --- NIST SP 800-185 (cSHAKE256, KMAC256,
TupleHash256) is canonical for every NIST-track variant. BLAKE3
deltas appear only in legacy / academic profiles
(\texttt{Pulsar.R-BLAKE3}, upstream Corona) and are explicitly
out-of-scope for any MPTC submission.
\item \textbf{Constant-time discipline} --- every secret-touching
path constant-time via \texttt{crypto/subtle} or local equivalents.
No stdlib \texttt{log} in any primitive package; all logging goes
through \texttt{github.com/luxfi/log} at fields the threat model has
explicitly classified as public.
\item \textbf{Implementation language} --- Go reference; C / Rust
conformance after encoding-freeze gate per variant.
\end{itemize}

What differs between variants:

\begin{itemize}[leftmargin=*, itemsep=0pt]
\item \textbf{Algebra} --- Ring-LWE for Corona, Module-LWE for
Pulsar. The algebraic shape determines parameter sizes, signature
sizes, and the structure of the Pedersen commitment scheme.
\item \textbf{Verification target} --- Corona verifies under its own
verifier (a custom 2-round-aggregated check); Pulsar verifies under
unmodified FIPS~204 ML-DSA.Verify. The latter is the single
highest-value property of the family.
\item \textbf{NIST submission posture} --- see Class column above.
\item \textbf{Production maturity} --- Pulsar.R has a hardened
reshare path, KAT suite, deployed code. Pulsar has a complete spec
(\texttt{spec/pulsar.tex} plus \texttt{parameters.tex},
\texttt{system-model.tex}, \texttt{security-games.tex}), a working
Go reference (single-party and threshold paths, both
$\mathrm{GF}(257)$ and $\mathrm{GF}(q)$ Shamir layers), and a KAT
suite. The scaling target $N^* = 1{,}111{,}111$ is empirically
validated. Production hardening (HSM integration, formal CT
guarantees, cross-implementation conformance vs.\ BoringSSL FIPS /
AWS-LC / OpenSSL 3) is round-2 work.
\end{itemize}

\subsection{Why one family}

NIST MPTC IR 8214C accepts each variant as a separate submission
package in either Class N or Class S. Submitting two as a
coordinated \textbf{family}:

\begin{enumerate}[leftmargin=*, itemsep=0pt]
\item \textbf{Reuses infrastructure once.} The DKG harness, KAT
cross-validation, transcript binding, constant-time analysis,
lattice-estimator runs, patent disclosure, and IP review build to a
shared \texttt{pulsar-test/} and \texttt{pulsar-spec-common/} set of
artifacts both submissions reference.
\item \textbf{Cross-validates the protocol skeleton.} A reviewer
attacking the Pedersen DKG soundness in Pulsar.R is also attacking
it in Pulsar. Soundness arguments compose; reviewers don't have to
redo work.
\item \textbf{Demonstrates orthogonality.} Both submissions running
on the same 2-round structure with different lattice bases is itself
a security argument: the family's robustness comes from a small,
audited protocol skeleton with parameterized algebra, not from a
one-off primitive.
\item \textbf{Forwards-only.} Adding \texttt{Pulsar.W} (or whichever
future variant) becomes a parameter-set + algebra change against the
same skeleton, not a new project. The naming reservation is
pre-paid.
\end{enumerate}

\subsection{What goes where}

\begin{center}
\small
\begin{tabular}{p{4.0cm}p{2.5cm}p{3.5cm}p{3.5cm}}
\toprule
artifact & shared & Pulsar.R & Pulsar \\
\midrule
2-round protocol description & shared spec &
  parameterised for $\Rq$ & parameterised for $\Rq^k$ \\
Pedersen DKG (proper hiding) & shared spec &
  params for $\Rq$ & params for $\Rq^k$ \\
Proactive resharing (beacon-rand) & shared spec &
  params for $\Rq$ & params for $\Rq^k$ \\
Reference Go impl & shared testkit &
  full primitive in \texttt{pulsar/} &
  full primitive in \texttt{pulsar/} \\
KATs & shared format &
  \texttt{vectors/} per repo &
  \texttt{vectors/} per repo \\
Lattice estimator & shared script &
  parameter file per variant &
  parameter file per variant \\
Patent claims & shared review &
  repo-local \texttt{patent-notes.tex} &
  repo-local \texttt{patent-notes.tex} \\
MPTC technical specification PDF & NO &
  \texttt{pulsar/spec/pulsar-r.pdf} &
  \texttt{pulsar/spec/pulsar.pdf} \\
MPTC submission package & NO --- separate Class S vs Class N &
  one per variant & one per variant \\
\bottomrule
\end{tabular}
\end{center}

Two separate MPTC packages, one shared technical foundation. The
shared material is brought in by reference from each submission's
spec PDF, matching how PQ-CRYSTALS submitted Dilithium and Kyber as
related algorithms in Round 3.

\subsection{Naming discipline}

Three sibling threshold-signature libraries; each is its own NIST
MPTC submission package (no umbrella package).

\begin{itemize}[leftmargin=*, itemsep=0pt]
\item \textbf{Pulsar} --- the FIPS 204-compatible Module-LWE
threshold. Always capitalised, no hyphen, no suffix. Identifier
form: \texttt{pulsar}.
\item \textbf{Corona} --- the Ring-LWE production threshold (Lux's
hardened fork of Corona). Always capitalised. Identifier form:
\texttt{corona}.
\item \textbf{Corona} --- the academic Ring-LWE upstream plus Lux's
lifecycle DKG expansions. Always capitalised. Identifier form:
\texttt{corona}.
\end{itemize}

Naming rules:

\begin{itemize}[leftmargin=*, itemsep=0pt]
\item \textbf{Ringtail} is the published Ring-LWE construction of
Boschini, Kaviani, Lai, Malavolta, Takahashi and Tibouchi
(\cite{boschini2024ringtail}). It is their name for their scheme and is
used whenever the paper is meant. \textbf{Corona} is Lux's
implementation of it; \textbf{Pulsar} retargets the same two-round
structure to Module-LWE for FIPS~204.
\item HashSuiteID byte (per HIP-0077 \S``Lux consensus PQ modes'')
identifies the \textbf{hash family}, not the variant. Pulsar and
Corona canonical profiles both use \texttt{HashSuiteSHA3 = 2}. A
future Pulsar with a different hash family (e.g.\ SHAKE256 only)
would claim a new HashSuiteID without renaming the variant.
\end{itemize}

\subsection{Repo organisation}

\begin{verbatim}
~/work/lux/
|-- pulsar/                <- Pulsar.R (R-LWE, production fork of Corona)
|   |-- sign/
|   |-- primitives/
|   |-- dkg2/              <- Pedersen DKG over R_q
|   |-- reshare/           <- proactive resharing
|   |-- hash/              <- Pulsar-SHA3 + Pulsar-BLAKE3 (legacy)
|   `-- ...
|-- pulsar/              <- Pulsar (M-LWE, FIPS 204-compatible)
|   |-- ref/go/
|   |-- spec/              <- own MPTC technical spec PDF
|   |-- docs/              <- family-architecture moved to spec/
|   `-- ...
|-- corona/              <- academic upstream (NOT Pulsar; cited as the
|                             R-LWE 2-round skeleton's origin)
`-- consensus/
    `-- protocol/quasar/   <- witness orchestrator that consumes Pulsar
                              variants via WitnessProducer interface
\end{verbatim}

The \texttt{consensus/protocol/quasar/} orchestrator binds to Pulsar
variants through \texttt{QWitnessProducer} (interface in
\texttt{consensus/protocol/quasar/witness\_producer.go}). Quasar
doesn't know which variant produces the witness --- it gets a
\texttt{[]byte} and a HashSuiteID. Variants are interchangeable at
the orchestration layer, which is exactly the orthogonality the
family architecture claims.

\subsection{NIST submission strategy}

Per CTO Decision 4 (recorded in this branch's HIP-0077 process
notes):

\begin{quote}
Submit BOTH. Pulsar leads (Class N1+N4, FIPS~204
verifier-interchangeable, highest strategic value). Pulsar.R parallel
(Class S1+S4, established production code, demonstrates the family's
R-LWE branch). Withdrawing either wastes existing work; submitting
both forces the team to factor shared infrastructure into reusable
modules --- the orthogonality requirement.
\end{quote}

Single Git tag, simultaneous cut: \texttt{mptc-preview-2026} on
\texttt{pulsar} and \texttt{pulsar} at the same SHA discipline.
Both submissions reference frozen artifacts. Drift between the two
repos after the tag is only allowed via amendments NIST permits in
the public-analysis window.

\subsection{Status}

\begin{itemize}[leftmargin=*, itemsep=0pt]
\item[$\boxtimes$] Pulsar.R production code (shipping in Lux primary
network)
\item[$\boxtimes$] Pulsar.R hardening: F8 (no log of secret state),
F9 (constant-time reshare), F12 (LIGHT\_MNEMONIC guard)
\item[$\square$] Pulsar.R MPTC spec doc finalised
(\texttt{pulsar/spec/pulsar-r.pdf} to be added)
\item[$\square$] Pulsar.R \texttt{mptc-preview-2026} tag
\item[$\boxtimes$] Pulsar repo bootstrap (\texttt{pulsar/})
\item[$\square$] Pulsar Module-LWE algorithm body in spec (in
flight via scientist agent)
\item[$\square$] Pulsar reference implementation
\item[$\square$] Pulsar FIPS~204 cross-validation (output
interchangeability proof)
\item[$\square$] Pulsar \texttt{mptc-preview-2026} tag
\item[$\square$] Family architecture cross-reference baked into
HIP-0077
\end{itemize}

\subsection{See also}

\begin{itemize}[leftmargin=*, itemsep=0pt]
\item HIP-0077
(\texttt{hanzo/hips/HIPs/hip-0077-mesh-identity-gossip-and-payments.md})
--- defines the PQMode enum that selects which Pulsar variant the
consensus layer asks for.
\item HIP-0078 (in flight) --- Q-Chain PQ-rollup. Replaces Z-Chain
Groth16/BN254 with a PQ-secure SNARK. Pulsar's per-validator
ML-DSA-65 sigs are the rollup target.
\item NIST IR 8214C --- \emph{First Call for Multi-Party Threshold
Schemes} (January 2026, package deadline 2026-Nov-16).
\end{itemize}