mirror of
https://github.com/luxfi/security.git
synced 2026-10-30 15:17:20 +00:00
zooqueen
582ebad75d
- ADVERSARIAL-MATRIX.md: 5-verifier per-primitive attack matrix + the four assurances - RELEASE-MANIFEST.toml pinned to final SHAs (consensus ConsensusCert envelope now on main) - gate upgrades: ec-machine-check.sh (compiles every .ec), comment-aware axiom-budget, PASS_WITH_OPEN_ASSUMPTIONS verdict + open_assumptions; p3q redteam cmd fixed - EC-toolchain-live corrections; corona C11 = lemma; gate-results regenerated (verdict PASS_WITH_OPEN_ASSUMPTIONS)
79 lines
3.5 KiB
TOML
79 lines
3.5 KiB
TOML
# Lux PQ Threshold Stack -- frozen release manifest.
|
|
#
|
|
# This pins ONE release at EXACT commits. Everything proved in this release
|
|
# directory refers to these hashes -- no floating branches, no "latest main".
|
|
# A later commit must either preserve the proof through CI (prove-release.sh)
|
|
# or open a new release cycle (a new security/releases/<id>/ directory).
|
|
#
|
|
# STATUS: review-ready CANDIDATE. The `commit` fields are FINALIZED to the
|
|
# merged, pushed main HEADs (the published tags). External cryptographic review
|
|
# (EXTERNAL-REVIEW-SIGNOFF.md) is the last gate before "released".
|
|
|
|
release = "2026-06-pq-threshold-stack"
|
|
status = "review-ready-candidate" # -> "released" only after external signoff
|
|
gate = "luxfi/security/framework/check.sh"
|
|
prover = "luxfi/security/framework/prove-release.sh"
|
|
|
|
[pulsar]
|
|
repo = "github.com/luxfi/pulsar"
|
|
commit = "b3959f1" # main, tag v1.1.5 (pushed)
|
|
version = "v1.1.5"
|
|
role = "threshold ML-DSA (FIPS 204, byte-equal); BCC/CEF no-leak signing"
|
|
claims = "PULSAR-C1..C7"
|
|
redteam = "framework/redteam/lattice.tex"
|
|
|
|
[corona]
|
|
repo = "github.com/luxfi/corona"
|
|
commit = "7c102d2" # main, tag v0.7.9 (pushed); combine bridge C11 = lemma; kernel uniq-guard
|
|
version = "v0.7.9"
|
|
role = "threshold Module-LWE (Ringtail/Raccoon family); masked-aggregate no-leak"
|
|
claims = "CORONA-C1..C7, CORONA-EC (C11 lemma)"
|
|
redteam = "framework/redteam/lattice.tex"
|
|
|
|
[magnetar]
|
|
repo = "github.com/luxfi/magnetar"
|
|
commit = "378f29c" # main, tag v1.2.3 (pushed); seed-reconstruct runtime-gated (no build tags)
|
|
version = "v1.2.3"
|
|
role = "threshold SLH-DSA (FIPS 205); standalone leg sound; threshold = certification"
|
|
claims = "MAGNETAR-C1..C7"
|
|
redteam = "framework/redteam/hash-based.tex"
|
|
|
|
[consensus]
|
|
repo = "github.com/luxfi/consensus"
|
|
commit = "f9ec127" # main, tag v1.25.17 (pushed). The ConsensusCert envelope
|
|
# (threshold CERTIFICATION) is NOW ON MAIN: one policy-gated
|
|
# envelope, per-leg evidence modes (ThresholdSig lattice /
|
|
# WeightedSigSet incl. SLH-DSA / StarkCompressed P3Q /
|
|
# ClassicalAggregate). Required legs are policy-derived (Red H3);
|
|
# SLH-DSA never threshold-signed; 27 named tests + F1-F5 + 6 CTO.
|
|
version = "v1.25.17"
|
|
role = "policy-gated ConsensusCert envelope (threshold certification; fail-closed pure-PQ)"
|
|
claims = "QUASAR-C1..C7 (the WeightedSigSet/certification design, now on main); CertPolicy anti-downgrade; StarkCompressed audit-gated stub"
|
|
redteam = "framework/redteam/lattice.tex#S4 + framework/redteam/stark.tex#S3"
|
|
|
|
[p3q]
|
|
repo = "github.com/luxfi/p3q"
|
|
commit = "96f7db4" # main, tag v0.0.2 (pushed); Cargo.toml version 0.0.1 (canonical; tag-drift cosmetic — internal deps + c-abi pin 0.0.1)
|
|
version = "v0.0.2"
|
|
role = "post-quantum STARK/FRI substrate (Goldilocks/SHA-3; no pairings)"
|
|
claims = "P3Q-C1..C7"
|
|
redteam = "framework/redteam/stark.tex"
|
|
|
|
[security]
|
|
repo = "github.com/luxfi/security"
|
|
commit = "FINALIZE-AFTER-CERT-COMMIT" # self-referential: set to the commit that lands this manifest
|
|
version = "v0.1.2"
|
|
role = "high-assurance framework + standard + gate + this release certificate"
|
|
|
|
[proofs]
|
|
repo = "github.com/luxfi/proofs"
|
|
commit = "a3a9bfc" # main, tag v0.1.2 (pushed); machine-checked Lean core
|
|
version = "v0.1.2"
|
|
role = "machine-checked mathematical proofs only"
|
|
|
|
[compliance]
|
|
repo = "github.com/luxfi/compliance"
|
|
commit = "679a821"
|
|
version = "n/a"
|
|
role = "standards-conformance + regulatory mapping (FIPS/NIST docs)"
|