mirror of
https://github.com/luxfi/proofs.git
synced 2026-10-30 15:21:05 +00:00
zeekay
1430256d11
Squashed batch covering:
- lux-adopts-liquidity-protocol.tex: protocol adoption proof artifact
- chronology updates aligning Quasar consensus references to LP-020
- pq-finality-no-bls.tex: Pulsar (Corona-derived lattice threshold)
naming clarification; per-block / per-epoch / per-era cert language
- quasar-cert-soundness.tex: Pulsar (systems-layer composition with
key-era lifecycle, resharing, activation cert, rollback) vs Corona
(signing primitive); math notation and theorems unchanged
- INFRASTRUCTURE-STATUS-2026-04-20.md → INFRASTRUCTURE-STATUS.md
(drop date stamp from filename)
- LP back-refs and chronology integration
quasar-cert-soundness.tex production-publishable depth (March 3 final):
- NEW Section 6 (Pulsar Key-Era Lifecycle Lemmas): formal
definitions for Pulsar share state, GroupKey hash, and Refresh /
Reshare / Reanchor transitions. Four lifecycle lemmas with full
proofs:
Lemma 10 (Generation monotonicity)
Lemma 11 (KeyEraID stability across Reshare)
Lemma 12 (GroupKey byte-identity across Refresh and Reshare)
Lemma 13 (Rollback-lineage forward reconstruction)
Plus Theorem 14 (Activation-certificate soundness): VerifyActivation
accepts iff the new committee shares Lagrange-recombine to the
master secret under the unchanged GroupKey, except with negligible
probability under MLWE/MSIS.
- Lagrange-recombination identity written as a labelled display
equation, citing
Crypto.Threshold.Reshare.reshare_preserves_public_key in
lean/Crypto/Threshold/Reshare.lean for the mechanised companion.
- Bibliography additions: hjky97 (Herzberg--Jarecki--Krawczyk--Yung
proactive secret sharing), desmedtjajodia97 (redistribution),
wongwangwing02 (verifiable redistribution), lp073 (Pulsar paper).
- LP-073 section pointers updated to text-form references that
survive without LP-073 .aux file.
Naming evolution: throughout this work, "Corona" refers to the
lattice signing primitive (Sign1/Sign2/Combine math); "Pulsar" refers
to the Lux production fork at github.com/luxfi/pulsar that wraps it
with key-era lifecycle for permissionless validator-set rotation.
- proofs/fhe/ (NEW): canonical proof bucket for the Lux FHE
dual-runtime stack (LP-167 companion):
correctness.tex — encrypt → evaluate → decrypt correctness.
dual-runtime-equivalence.tex — Lux FHE-Go and Lux FHE-C++ produce
byte-equal output on identical inputs
and parameters; KAT closure witness.
nebula-binding.tex — FHE result roots bind into Nebula /
Quasar transcripts; reduces a forged
binding to hash collision + Pulsar
SUF-CMA forgery.
parameter-security.tex — concrete LWE parameter security under
the Albrecht estimator; ≥128-bit
classical and ≥128-bit quantum for
PN10QP27 / PN11QP54 / PN9QP28_STD128.
Theorem statements + remarks; no proof bodies duplicated in the
companion paper (papers/lux-fhe-runtime/) — the paper cites these.
47 lines
2.1 KiB
TeX
47 lines
2.1 KiB
TeX
%% ============================================================
|
|
%% quasar/horizon-soundness.tex
|
|
%% ============================================================
|
|
%%
|
|
%% Canonical Horizon (Prism-bound) soundness theorem.
|
|
%% ============================================================
|
|
|
|
\subsection*{Horizon soundness}
|
|
|
|
\begin{theorem}[Horizon-final implies all lanes verify the same transcript]
|
|
\label{thm:horizon-soundness}
|
|
Let $\mathsf{cert}$ be a Horizon certificate
|
|
(Definition~\ref{def:horizon-cert}) with
|
|
$\mathsf{Prism}(\mathsf{cert}) = 1$. Then the underlying validator set
|
|
of size $n$ with $f < n/3$ corruptions cannot have produced a Horizon-
|
|
final certificate for two distinct $\mathsf{NebulaRoot}$ values at the
|
|
same epoch and round, except with negligible probability under:
|
|
\begin{enumerate}[nosep]
|
|
\item BLS12-381 co-CDH (for the Beam lane);
|
|
\item Module-LWE / Module-SIS (for the Pulsar lane,
|
|
Theorem~\ref{thm:pulsar-suf-cma});
|
|
\item EUF-CMA security of ML-DSA-65 / FIPS 204 (for the ML-DSA cert
|
|
set lane).
|
|
\end{enumerate}
|
|
The proof is by independent reduction: any pair of Prism-accepted certs
|
|
on conflicting bundle roots forces a forgery in at least one lane.
|
|
This is independent across the three lanes (different hardness
|
|
assumptions); a quantum adversary breaking BLS does not break Pulsar
|
|
or ML-DSA, and vice-versa.
|
|
|
|
\textbf{Companion proof:} \texttt{quasar-cert-soundness.tex} Theorem
|
|
7.5 (classical soundness), 7.6 (parallel-lane liveness), 7.7 (PQ
|
|
safety).
|
|
\end{theorem}
|
|
|
|
\begin{remark}[Groth16 wrapper does not contribute PQ security]
|
|
\label{rem:groth16-wrapper}
|
|
A Z-Chain Groth16 rollup proof of ML-DSA cert-set verification
|
|
(Definition~\ref{def:proof-lane}) is a \emph{classical succinct proof of
|
|
post-quantum signature verification}. The proof system is
|
|
pairing-based and is not post-quantum. Horizon's PQ soundness
|
|
(Theorem~\ref{thm:horizon-soundness} parts 2 and 3) flows from the
|
|
ML-DSA signatures and Pulsar threshold signature alone; the Groth16
|
|
proof is verified for compatibility / compression only and is not part
|
|
of the PQ reduction. See Remark~\ref{rem:groth16-not-pq}.
|
|
\end{remark}
|