compliance/docs/pq-cryptography-compliance.md

Post-Quantum Cryptography — Standards & Regulatory Compliance

Global standards-conformance posture for the Lux PQ cryptographic stack. This complements the per-jurisdiction regulatory modules (pkg/regulatory/) with the cryptographic-standards axis (FIPS / NIST / crypto-agility). The security framework and per-primitive assurance live in luxfi/security; this document is the regulatory-facing map.

Honest status

Standards-conformant by construction; external cryptographic review pending. Every threshold primitive verifies under an unmodified NIST-standard verifier (that is the conformance hook); no scheme is presented as audited/certified until external sign-off. Do not represent any of this as FIPS-validated — it is FIPS-conformant in design and interop-tested, which is a different and weaker claim, and must be stated as such to any regulator or auditor.

FIPS conformance (the hook: standard verification is unmodified)

Standard	Algorithm	Where used	Conformance evidence
FIPS 204	ML-DSA-65/87	Pulsar threshold; per-validator ID sigs	threshold output verifies byte-equal under unmodified ML-DSA.Verify (interop-tested: cloudflare/circl + pq-crystals)
FIPS 205	SLH-DSA (SHAKE)	Magnetar (per-validator standalone leg)	standalone signatures verify under unmodified SLH-DSA.Verify; threshold is certification over independent sigs, not threshold signing
FIPS 202	SHAKE/cSHAKE/KMAC/TupleHash (SP 800-185)	all hashing, domain separation	the only hash family; no non-standard hashes on any conformance path
FIPS 203	ML-KEM-768	session establishment (transport)	stdlib / standard KEM

The PQ STARK layer (luxfi/p3q) is strict-PQ: Goldilocks + SHA-3 + FRI only — no pairings/BN254/Groth16 — so the succinct-proof path introduces no classical (non-PQ) cryptographic assumption.

NIST MPTC (Multi-Party Threshold Cryptography)

Pulsar and Corona target NIST MPTC Class N1 (threshold signing) + N4 (DKG). The architecture deliberately takes the non-threshold / threshold-certification path for consensus where threshold signing is unstandardized or impossible:

• Threshold ML-DSA has no FIPS standard and hits a rejection-sampling circularity; the consensus path is a STARK-QC over independent signatures.
• Threshold SLH-DSA is impossible to thresholdize cheaply in the no-dealer/no-preprocessing model (Kondi–Kumar–Vanegas); Magnetar production is certification over independent FIPS 205 signatures.

Submission package + formal claims: luxfi/pulsar/spec/ (LaTeX), tracked for the NIST MPTC call.

Crypto-agility / migration posture

• All signature schemes are profile-selectable; the consensus cert composes classical (BLS, optional) with PQ legs (Pulsar / Corona / Magnetar) so a break in any one family does not forge finality (defence-in-depth).
• Identity/validator keys are PQ-native (ML-DSA-65) at the wire layer.

Assurance → regulatory evidence mapping

The luxfi/security framework vocabulary maps to the evidence a regulator/auditor should ask for:

Assurance level	Regulatory evidence
machine-checked	a proof-assistant artifact, zero sorry/admit (Lean/EasyCrypt)
interop-tested	byte-equality KAT vs ≥2 independent standard verifiers
sound-by-reduction	a written reduction to a named hardness assumption
asserted-axiom	a disclosed assumption in AXIOM-INVENTORY.md
fail-closed-pending-review	the production path refuses until external review clears it
open-research	stated open; not relied upon for production

Per-primitive traceability: luxfi/{pulsar,corona,magnetar}/FIPS-TRACEABILITY.md and .assurance/ trust surfaces; runnable gate luxfi/security/framework/check.sh.