zeekay f4a11d5b55 Pulsar v0.6.3: fix uint32 overflow in RSS subset-secret accumulation (unblocks large committees) ...

MithrilRSSKeygen / ReconstructKeyMaterial summed all C(N,M) per-subset short
secrets with raw uint32 poly.add and reduced mod q only once at the end. Each
chi_eta coefficient sits in the [q-eta, q+eta] rep (~q~2^23), so the accumulator
overflows once C(N,M) >= floor(2^32/q) = 512 — wrapping the coefficient into a
large-secret (unsignable) wall key. This silently broke the owner fault-tolerant
default n=16,t=14 (C(16,3)=560): reconstructed ||s2||_inf came out ~q/2 instead
of <= C*eta = 2240, so no signature could verify. n=8,t=7 (C=28) and all prior
committees (C<=20) were below threshold, hence unnoticed.

Fix: accumulateSubset reduces mod q PER subset. modQ is an additive homomorphism
=> the short Sum_S secret is IDENTICAL to a single final reduction for small
committees (n<=8 bit-identical) while every intermediate stays below 2q << 2^32.

Byte-preserving for small committees: golden KAT vectors unchanged, RSS gold
proof + full suite green (77s). Single-file keygen-correctness fix.

2026-06-28 05:53:29 -07:00

..

go

Pulsar v0.6.3: fix uint32 overflow in RSS subset-secret accumulation (unblocks large committees)

2026-06-28 05:53:29 -07:00