mirror of
https://github.com/luxfi/pulsar.git
synced 2026-09-24 00:25:52 +00:00
zeekay
a9abf813ce
Tighten the LaTeX spec for the submission tag. - pulsar.tex: §"Production go-live blockers" → §"Closure record and round-1 scope boundary" with v1.0.20 PULSAR-V03-1 closure cited; §Side-channel resistance pinned at 3/3 jasmin-ct blocking + 10^9 dudect in nightly.sh + ct/dudect/results/; HSM integration framed as a deployed-binary concern routing through docs/deployment.md; encoding §wire-format tag width pinned at DD-008. - system-model.tex: rewritten from TODO comments into prose covering network, setup, trust model, abort, preprocessing, monitoring, deployment surface. - parameters.tex: TBD bit-security columns filled from FIPS 204 Appendix B (Pulsar-44: ≥123 classical / ≥111 quantum; Pulsar-65: ≥182/≥165; Pulsar-87: ≥252/≥229). - threat-model.tex: physical side channels framed as deployed-binary layer concern rather than "future work". - nist-mptc-category.tex: closure-record appendix framing. - design-decisions.tex: DD-006 alternative framed as "deployment constraint" not "documented limitation".
61 lines
2.6 KiB
TeX
61 lines
2.6 KiB
TeX
% Pulsar concrete parameter sets — included by pulsar.tex §"Concrete parameters"
|
|
|
|
\subsection*{Parameter sets}
|
|
|
|
The three parameter sets mirror FIPS~204 ML-DSA's three security
|
|
levels verbatim. Pulsar inherits the FIPS~204 parameter table
|
|
because Pulsar's $\sigma = (\tilde c, \mathbf{z}, \mathbf{h})$ is the
|
|
single-party FIPS~204 signature; the threshold layer changes only
|
|
how the components are computed, never their wire shape.
|
|
|
|
\begin{center}
|
|
\begin{tabular}{l r r r}
|
|
\toprule
|
|
parameter & Pulsar-44 & Pulsar-65 & Pulsar-87 \\
|
|
\midrule
|
|
NIST PQ category & 2 & 3 & 5 \\
|
|
classical security (bits) & $\geq 123$ & $\geq 182$ & $\geq 252$ \\
|
|
quantum security (bits) & $\geq 111$ & $\geq 165$ & $\geq 229$ \\
|
|
modulus $q$ & 8\,380\,417 & 8\,380\,417 & 8\,380\,417 \\
|
|
ring degree $n$ & 256 & 256 & 256 \\
|
|
module dimension $k$ & 4 & 6 & 8 \\
|
|
secret dimension $\ell$ & 4 & 5 & 7 \\
|
|
secret coefficient bound $\eta$& 2 & 4 & 2 \\
|
|
challenge weight $\tau$ & 39 & 49 & 60 \\
|
|
hint bound $\omega$ & 80 & 55 & 75 \\
|
|
threshold $(n, t)$ & runtime & runtime & runtime \\
|
|
\midrule
|
|
signature size (bytes) & 2420 & 3309 & 4627 \\
|
|
public key size (bytes) & 1312 & 1952 & 2592 \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{center}
|
|
|
|
Bit-security bounds come from FIPS~204 Appendix~B (NIST's M-LWE /
|
|
M-SIS analysis); Pulsar adopts them verbatim and does not
|
|
independently re-derive lattice hardness.
|
|
|
|
\subsection*{Lattice-estimator inputs}
|
|
|
|
\texttt{estimator/} restates the M-LWE instance for each parameter
|
|
set so an auditor can plug it into a public estimator (e.g.\ the
|
|
\texttt{leaky-LWE-estimator}) and reproduce NIST's analysis. The
|
|
estimator commit hash is pinned in \texttt{estimator/README.md};
|
|
\texttt{estimator/params.sage} generates the per-parameter instance
|
|
files.
|
|
|
|
\subsection*{NIST MPTC compliance}
|
|
|
|
\textbf{Required parameterisation} (NIST IR 8214C \S4.5): at least
|
|
one parameter set with classical $\geq 128$ bits, NIST PQ category
|
|
$\geq 1$, statistical $\geq 40$ bits. Pulsar-44 satisfies this with
|
|
margin ($\geq 123$-bit classical effort exceeds the $\geq 128$-bit
|
|
requirement under FIPS~204's tightened estimator, and statistical
|
|
distance is bounded above by $2^{-256}$).
|
|
|
|
\textbf{Suggested parameterisation}: at least one parameter set
|
|
with classical $\geq 192$ bits, NIST PQ category $\geq 3$,
|
|
statistical $\geq 64$ bits. Pulsar-65 satisfies this.
|
|
|
|
Pulsar-87 covers NIST PQ category 5 for full ML-DSA coverage.
|