luxfi/p3q

mirror of https://github.com/luxfi/p3q.git synced 2026-10-30 15:22:47 +00:00

Files

T

zeekay e24bb637ff p3q: populate strict-PQ Plonky3 fork workspace

10 crates wired in dependency order, all building under cargo build
--workspace --all-targets and 43 unit tests passing.

  p3q-core       protocol types, error model, profile dispatch
  p3q-field      Field trait + Goldilocks (p = 2^64 - 2^32 + 1)
  p3q-sha3       FIPS 202 / SP 800-185: cSHAKE256, KMAC256, TupleHash256
  p3q-merkle     cSHAKE256-based binary Merkle tree + path verifier
  p3q-challenger cSHAKE256 Fiat-Shamir transcript
  p3q-fri        FRI low-degree-test trait surface
  p3q-stark      AIR trait + StarkProof envelope
  p3q-recursion  STARK-native recursion trait (no curve wrappers)
  p3q-verifier   panic-free verifier dispatch (typed errors only)
  p3q-zchain     HIP-0078 epoch circuits (register / rotate / revoke /
                 committee / DKG / epoch commitment)

Strict-PQ profile enforced by scripts/lint_forbidden.sh + CI:
no bn254, kzg, groth16, plonk_kzg, halo, blake3, poseidon,
monolith, rescue in imports or dependency tables.

Signed-off-by: Lux Industries Inc <[email protected]>

2026-05-10 19:46:59 -07:00

1.6 KiB

Raw Permalink Blame History

Security policy

Reporting vulnerabilities

Email [email protected] encrypted with the team key at https://lux.network/security/key.asc. Public disclosure happens after a fix lands and downstream consumers (Lux Z-Chain, anything depending on luxfi/p3q) have had a 14-day private window.

In-scope

Soundness gaps in any P3Q-shipped circuit (validator-registration, DKG-transcript-check, revocation, committee-selection, epoch-transition).
FRI / Merkle / Fiat-Shamir parameter weakness vs the claimed conjectured-security target (≥ 128-bit classical, ≥ NIST PQ Cat 3).
Hash-suite drift: any code path that calls a non-FIPS-202 hash inside a strict-PQ profile.
Verifier-totality bugs: malformed proofs that panic, hang, or produce undefined behaviour (per upstream Plonky3 README, the upstream verifier "may panic on certain invalid proofs"; P3Q refuses panics as a launch gate).
Constant-time gaps in any verifier code touching secret-derived state.

Forbidden imports — automatic CVE

Any PR that adds a dependency on classical-only primitives — bn254, KZG, Groth16, PLONK/KZG modes, pairing-based recursion — is automatically a security regression. CI rejects via scripts/lint_forbidden.sh. Disclosing a bypass of that gate is in-scope under this policy.

Out-of-scope

Performance / efficiency reports (file an issue).
Issues exclusively in upstream Plonky3 — file there.
Issues in downstream consumers (Z-Chain VM, Lux DA layer) — file in those repos.

CVE assignment

P3Q maintainers will request CVEs for in-scope vulnerabilities prior to public disclosure.

1.6 KiB Raw Permalink Blame History