zeekay
c79fe61d62
Single repo, one canonical impl + spec + proofs + KAT + cut tool.
Per "ONE and ONLY ONE way to do things" the prior dual-repo split
(luxfi/pulsar = production library, luxfi/pulsar-mptc = NIST MPTC
submission framework) is collapsed into a single canonical home at
github.com/luxfi/pulsar. SINGLE-IMPL-PLAN.md (now marked COMPLETED)
describes the steps; this commit lands the final step.
Files moved (89 new):
16 submission docs (SUBMISSION, NIST-SUBMISSION, SPEC, SUITE,
PATENTS, AXIOM-INVENTORY, PROOF-CLAIMS, FIPS-TRACEABILITY,
TRUSTED-COMPUTING-BASE, HANZO-CRYPTO-SUITE, INFORMATION-
ARCHITECTURE, ROADMAP, CHANGELOG, SYNC-STATUS, STATUS-
SUBMISSION-READINESS, SINGLE-IMPL-PLAN)
10 docs/ supplements (ietf-draft-skeleton, magnetar, evaluation,
patent-claims, x-wing-sig, design-decisions, family-architecture,
threat-model, nist-mptc-category, patent-notes-draft)
19 proofs/ (13 EC theories + 2 EC lemmas + 4 metadata/READMEs +
lean-easycrypt-bridge.md)
14 jasmin/ (lib/* + ml-dsa-65 fetch + threshold/{combine,round1,
round2}.jazz + READMEs)
10 ct/dudect/ (Makefile, combine_ct.go, dudect_combine.c,
dudect_compat.h, dudect_verify.c, fetch.sh, README, run-
submission.sh, verify_ct.go) + ct/jasmin-ct-libjade.md
1 .github/workflows/ci.yml
1 test/interoperability/n1_class_test.go (19/19 N1 subtests)
1 bench/results/REPORT.md
11 scripts/ (cut-submission, check-high-assurance, check-lean-
bridge, nightly, extract-jasmin-ec, checks/{ec-admits, ec-
compile, ec-refinement-scaffold, ec-regressions, extraction,
jasmin}, checks/test/{go-unit, interop, kat, no-secret-logs})
Files merged (16 overlapping, mptc-canonical chosen because newer +
post-rewire-correct; pulsar versions still bore stale "Pulsar-M" /
"pulsarm" branding):
README.md, BLOCKERS.md, CONTRIBUTING.md, LICENSE, LICENSING.md,
SECURITY.md, .gitignore, bench/run_all.sh, vectors/dkg.json (v1.0.7
regen), scripts/{bench,build,gen_vectors,sbom,test}.sh,
spec/{pulsar,parameters,system-model}.tex,
CRYPTOGRAPHER-SIGN-OFF.md (path refs).
Pulsar-only spec supplements preserved:
spec/{blockers,design-decisions,family-architecture,nist-mptc-
category,patent-notes,threat-model}.tex.
Path rewrites applied: 158 occurrences across 26 files
github.com/luxfi/pulsar-mptc -> github.com/luxfi/pulsar
~/work/lux/pulsar-mptc/ -> ~/work/lux/pulsar/
luxfi/pulsar-mptc -> luxfi/pulsar
pulsar-mptc/ -> ./
Narrative collapses (no more two-repo framing):
SUBMISSION.md "At a glance" — single Repository row
SYNC-STATUS.md — rewritten to single-repo state
SINGLE-IMPL-PLAN.md — marked COMPLETED 2026-05-18
HANZO-CRYPTO-SUITE.md — tier 1 row = single canonical home
scripts/cut-submission.sh — replace/vendor dance removed; cuts
directly from in-tree canonical sources
go.mod: dropped mptc's replace directive (no longer needed since this
IS the canonical pulsar repo). Module path is github.com/luxfi/pulsar.
Deps: cloudflare/circl v1.6.3, golang.org/x/crypto v0.32.0.
Verification:
GOWORK=off go build ./... PASS
GOWORK=off go test -count=1 ./... PASS (1.4s)
GOWORK=off go test -race ./ref/... PASS (14.7s)
go test ./test/interoperability/ PASS (19/19 N1 subtests)
scripts/check-high-assurance.sh PASS
scripts/check-lean-bridge.sh PASS (5/5 bridges)
scripts/gen_vectors.sh byte-identical replay
scripts/cut-submission.sh --help PASS
Pulsar — Jasmin high-assurance track
This directory holds the Jasmin sources for the Pulsar high- assurance implementation track. Jasmin (https://github.com/jasmin-lang/jasmin) is a low-level cryptographic implementation language with a verified compiler whose generated assembly is bit-identical to the source-level semantics and admits machine-checked side-channel (constant-time) guarantees through the EasyCrypt companion proof system (https://github.com/EasyCrypt/easycrypt).
The libjade project (https://github.com/formosa-crypto/libjade) ships
Jasmin sources for ML-DSA (Dilithium) and ML-KEM (Kyber) with
EasyCrypt-machine-checked functional correctness against FIPS 204 /
FIPS 203 and constant-time proofs against the leakage model of Barbosa
et al. (Eurocrypt 2021). NIST PQC submissions that integrate
libjade-verified primitives sit in the high-assurance evaluation track
alongside the formosa-crypto reference work.
For Pulsar, the high-assurance plan splits along the Class N1 / Class N4 boundary of the construction itself:
| Layer | What Jasmin verifies | Source of truth |
|---|---|---|
| Single-party ML-DSA-65 core | Functional equivalence to FIPS 204 + constant-time over secret key and nonce paths | libjade (jasmin/ml-dsa-65/, vendored via fetch script) |
| Threshold layer (Round-1 commit, Round-2 response, Combine) | Functional correctness of the round protocol's polynomial-vector arithmetic + constant-time over each party's secret share | new (jasmin/threshold/, this submission) |
The Class N1 byte-equality claim composes the two: a Pulsar
threshold signature is a single-party FIPS 204 signature whose
underlying (z, h, c̃) components have been computed by an honest
quorum running the threshold protocol. So the Pulsar Jasmin proof
chain is
libjade ML-DSA-65 (functional ≡ FIPS 204)
∘ Pulsar threshold (functional ≡ single-party computation under
honest quorum + share-additivity)
⇒ Pulsar output ≡ FIPS 204 output (Class N1)
with constant-time taken as a side condition on every secret-dependent control- and memory-access path.
Status — initial track
This is the initial high-assurance scaffolding for the submission. Functional verification of the threshold layer in EasyCrypt is a in this repository release point; what we commit at submission time is:
- The libjade ML-DSA-65 single-party baseline as the verified core
(vendored via
ml-dsa-65/fetch.sh, not checked into this repository). - Threshold-specific Jasmin function signatures and algorithm
commentary in
threshold/{round1,round2,combine}.jazz. These are stubs, marked// TODO: jasmin implementation. Implementing them is tracked in the Pulsar roadmap (seeBLOCKERS.md). - EasyCrypt theory shells in
../proofs/easycrypt/. The Class N1 lemma is stated; the proof body isadmit. Everyadmitis marked with aTODOcomment.
This is honest and standard for an MPTC this repository — NIST reviewers see the high-assurance intent, the directory structure, the formal-method tooling wiring, and the libjade integration plan. The proof work tracks the submission process across rounds.
How to fetch libjade
cd jasmin/ml-dsa-65
./fetch.sh # clones libjade at the pinned commit
The fetch script pins libjade to a specific commit so the submission artifact reproduces deterministically. The libjade tree itself is not committed to this repository — it is fetched on demand. This keeps the submission tarball small and avoids re-licensing complexity (libjade is MIT-licensed; we cite + link rather than redistribute).
How to check
../scripts/check-high-assurance.sh
The script is skip-friendly: if jasminc or easycrypt is not on
the system PATH it prints a clear skip message and exits 0. When the
tools are present it compiles each .jazz file and runs easycrypt check on each .ec file.
Tool installation
- Jasmin compiler — https://github.com/jasmin-lang/jasmin#installation
(OPAM:
opam install jasmin). The reference platform is OCaml 4.14 with Coq 8.18. - EasyCrypt — https://github.com/EasyCrypt/easycrypt#installation
(OPAM:
opam install easycrypt). Backend SMT solvers (Alt-Ergo, Z3, CVC4) must be installed viawhy3 config detect.
Citations
- Almeida, Barbosa, Barthe, Blot, Grégoire, Laporte, Oliveira, Pacheco, Schwabe, Strub. The last mile: High-assurance and high-speed cryptographic implementations. IEEE S&P 2020.
- Bond, Hawblitzel, Maillard, Protzenko et al. EverCrypt: A Fast, Verified, Cross-Platform Cryptographic Provider. IEEE S&P 2020.
- Barbosa, Barthe, Doczkal, Don, Fehr, Grégoire, Huang, Hülsing, Lee, Wu. Fixing and Mechanizing the Security Proof of Fiat–Shamir with Aborts and Dilithium. CRYPTO 2023.
- libjade ML-DSA implementation — https://github.com/formosa-crypto/libjade