zeekay
1793dd64ac
Canonical Known Answer Tests for the Pulsar-M v0.1 reference,
generated by ref/go/cmd/genkat. Re-running scripts/gen_vectors.sh on
a clean checkout reproduces these files byte-identically — the
deterministic-fixture gate.
Coverage:
vectors/keygen.json — 9 KATs (3 seeds × 3 modes)
seed → (public_key, private_key)
vectors/sign.json — 9 KATs (3 messages × 3 modes)
(seed, message) → signature
vectors/verify.json — 6 KATs (3 positive + 3 negative)
(pubkey, message, signature, valid)
vectors/threshold-sign.json — 4 KATs at (n,t) ∈ {(3,2),(5,3),
(7,4),(10,7)} for Pulsar-M-65;
every signature passes
mldsa65.Verify (Class N1 demo)
vectors/dkg.json — 3 KATs at (3,2), (5,3), (7,4) for
Pulsar-M-65; per-party shares and
transcript hash committed
The replay harness in kat_test.go reads each JSON at test time and
verifies the round-trip:
- Keygen replay: KeyFromSeed(seed) reproduces (pk, sk)
- Sign replay: Sign(deterministic) reproduces signature
- Verify replay: pulsarm.Verify accepts every positive case and
rejects every negative case
- Threshold: every committed signature passes pulsarm.Verify
(which dispatches to FIPS 204 ML-DSA.Verify
verbatim — the load-bearing Class N1 property)
- DKG: wire-format invariants (sizes match parameter
set, transcript hash is 48 bytes, share count
matches committee count)
scripts/gen_vectors.sh + scripts/test.sh are now functional CI
gates.
Signed-off-by: Lux Industries <[email protected]>
Pulsar-M
Threshold ML-DSA — a 2-round threshold signing and DKG system whose generated signatures are verifiable by unmodified FIPS 204 ML-DSA verification. Targeting NIST MPTC Class N1 (signing) + N4 (ML keygen / DKG).
Pulsar-M is the Module-LWE sibling of Pulsar
(Ring-LWE). Pulsar's 2-round threshold protocol structure is transplanted onto
ML-DSA-65's polynomial-vector-over-R_q algebra so the per-party-aggregated
signature is bit-identical to a single-party FIPS 204 signature on the same
message + public key.
Status: Research / Reference (not production hardened, not FIPS validated). NIST-profile vectors use SHAKE / cSHAKE / KMAC. Any BLAKE3 deltas are experimental and out-of-scope for the MPTC submission.
Why
NIST FIPS 204 (ML-DSA) is the only NIST-approved post-quantum digital signature in 2026. Threshold variants of ML-DSA are not yet standardized — NIST's Multi-Party Threshold Cryptography project is collecting them now (IR 8214C, January 2026; first call package deadline expected 2026-Nov-16).
Pulsar-M aims to enter that process with a credible, output-interchangeable
threshold ML-DSA candidate — built from the production-tested protocol
machinery already shipping in luxfi/pulsar (R-LWE), retargeted to the
M-LWE primitives ML-DSA itself uses.
The win, if Pulsar-M's Sign output is byte-equal to FIPS 204 Sign:
- Threshold-produced signatures verify under unmodified FIPS 204 verifiers.
- Existing FIPS-validated ML-DSA modules (BoringSSL FIPS, AWS-LC, OpenSSL 3.0 PQ provider) consume Pulsar-M certs without code changes.
- The threshold layer can be Class-N-claimed at NIST without a parallel algorithm standardization track.
Repository layout
pulsar-m/
├── docs/ human-readable design notes
│ ├── threat-model.md
│ ├── nist-mptc-category.md
│ ├── design-decisions.md
│ ├── known-limitations.md
│ └── patent-notes-draft.md
├── spec/ LaTeX technical specification (MPTC package)
│ ├── pulsar-m.tex main spec
│ ├── security-games.tex EUF-CMA / TS-UF / robustness / adaptive corr.
│ ├── system-model.tex network / setup / abort / preprocessing
│ ├── parameters.tex concrete parameter sets, lattice-estimator
│ └── references.bib
├── ref/
│ ├── go/ reference implementation (Go, no assembly)
│ │ ├── cmd/ CLI entry points
│ │ ├── internal/ private helpers
│ │ └── pkg/ public API (sign/, dkg/, primitives/, hash/, fmt/)
│ └── c/ conformance implementation (post-encoding-freeze)
├── vectors/ Known Answer Tests (KATs)
│ ├── kat-v1.json input/output vectors per MPTC §IO-Testing
│ ├── kat-v1.rsp CAVS-style response file (compatibility)
│ └── transcripts/ full-protocol KATs (n,t sweeps)
├── bench/ reproducible benchmark harness
├── test/ fuzz / negative / interoperability tests
├── ct/dudect/ constant-time analysis harness
├── estimator/ lattice-estimator parameter scripts
├── scripts/ build.sh / test.sh / bench.sh / gen_vectors.sh / sbom.sh
└── go.mod
Quickstart
Pulsar-M is in pre-spec stage. Reference impl, vectors, and bench harness ship after the spec freezes. Track docs/known-limitations.md for what's stable vs in-flight.
git clone https://github.com/luxfi/pulsar-m
cd pulsar-m
./scripts/build.sh # checks spec compile + Go build
./scripts/test.sh # runs unit + KAT suite (when available)
./scripts/bench.sh # reproduces bench/results/ (when available)
./scripts/gen_vectors.sh # regenerates KATs from reference impl (when available)
NIST MPTC submission
| package element | location | status |
|---|---|---|
| Technical Specification | spec/pulsar-m.pdf (built from spec/pulsar-m.tex) |
draft |
| Reference Implementation | ref/go/ |
skeleton |
| Report on Experimental Evaluation | bench/results/REPORT.md |
TBD |
| Notes on Patent Claims | docs/patent-notes-draft.md |
TBD |
| Open-source license | LICENSE (Apache-2.0) |
✓ |
| Build/test/benchmark scripts | scripts/ |
skeleton |
| I/O test vectors | vectors/kat-v1.{json,rsp} |
TBD |
Target dates:
- 2026-Jul-20 preview writeup (NIST third preview deadline)
- 2026-Nov-16 package submission (NIST first call deadline)
Relationship to upstream
| repo | what | hash family |
|---|---|---|
| luxfi/corona | academic R-LWE 2-round threshold sig (Boschini–Kaviani–Lai–Malavolta–Takahashi–Tibouchi, ePrint 2024/1113) | BLAKE3 |
| luxfi/pulsar | production fork of Corona with Pedersen DKG + proactive resharing | SHA-3 / cSHAKE256 (canonical), BLAKE3 (legacy) |
| luxfi/pulsar-m (this repo) | Module-LWE sibling: threshold ML-DSA | SHA-3 / SHAKE256 (NIST profile) only |
Security
SECURITY.md describes how to disclose vulnerabilities and what's in-scope for
bug bounty.
License
Apache-2.0 — same as luxfi/pulsar and luxfi/corona. See LICENSE.