* fix: add mutex to FROST sign rounds (concurrent map write at 8+ signers)
* fix: LSS keygen race condition — use MarshalBinary instead of Equal (dcrd ToAffine mutates)
* feat: add threshold ML-DSA scaffold per Celi et al. (USENIX '26)
First practical threshold signature scheme compatible with NIST FIPS 204
ML-DSA. Outputs byte-identical standard ML-DSA signatures, enabling drop-in
replacement of classical threshold ECDSA/Schnorr wallets with a PQ scheme
that keeps the standardized verification path.
Paper: Celi, del Pino, Espitau, Niot, Prest — Efficient Threshold ML-DSA,
USENIX Security Symposium 2026.
Files:
- papers/threshold-mldsa.tex — paper summary + integration notes (LaTeX)
- protocols/mldsa/doc.go — package doc
- protocols/mldsa/params.go — (T,N) × level parameter tables (44/65/87)
from paper Tables 3, 10, 11
- protocols/mldsa/rss.go — replicated secret sharing with hardcoded optimal
partitions for 2 ≤ T ≤ N ≤ 6 (Appendix B, Algorithm 6)
- protocols/mldsa/hrej.go — imbalanced hyperball rejection (Fig. 4)
— mathematical spec stub, ring ops pending CIRCL integration
- protocols/mldsa/rss_test.go — 6 tests covering subsets, recovery
completeness, balance bounds, parameter coverage
Config range: 2 ≤ T ≤ N ≤ 6 (2-of-3, 3-of-5, etc.)
Security: static dishonest-majority in ROM under MLWE + ML-DSA unforgeability.
Rounds: 3 per attempt, K parallel instances for ≥ 1/2 success probability.
* feat: mldsa-bench — PQ signing benchmarks for quasar + LP-045
Bench harness for 3 / 5 / 10 / 100 node PQ signing patterns:
- individual: each validator signs, no aggregation (baseline)
- committee: k-of-n sample signs, the LP-045 cluster cert
- hierarchical: n validators in M clusters (LP-045 two-layer)
Uses deterministic light mnemonic derivation — 100 validators from a
single 32-byte master seed, no interactive keygen, no mainnet keys.
Results on MacBook M3 / 10 cores / arm64 at ML-DSA-44:
n=100 individual: 8.87 ms sign / 3.57 ms verify / 242 kB
n=100 committee (k=32): 3.57 ms sign / 4.14 ms verify / 77 kB
n=100 hierarchical (4 clusters): 14.7 ms sign / 5.35 ms verify
Committee sampling cuts signing cost 3× vs all-100 signing.
ML-DSA-65 is ~3× slower. Even at Level III, 100 validators sign in
<30 ms per block — fine for quasar finality at any realistic block time.
.gitignore: scope mldsa-bench binary ignore to repo root only
so the cmd/mldsa-bench/ source dir is tracked.
* feat: fixed-committee mode — scale-invariant PQ signing at N=1K/10K/100K
Adds -mode=fixed which samples a fixed k-size committee regardless of
total validator count N. Proves the scale-invariance claim in LP-045 +
the PQ-finality-without-BLS proof (~/work/lux/proofs).
Measured on MacBook M3 (arm64, 10 cores) at ML-DSA-44, k=128:
N=1,000 sign=7.9ms verify=3.2ms cert=310 kB
N=10,000 sign=7.4ms verify=3.2ms cert=310 kB
N=100,000 sign=7.8ms verify=3.4ms cert=310 kB
N=100,000 (ML-DSA-65): sign=10.8ms verify=5.9ms cert=424 kB
Same cost from 10^3 to 10^5 validators. Only the VRF-based sampling
touches N, and that is O(log N) in a weighted-reservoir implementation.
* docs: add docs/audit.md and fix broken README links (closes#5)
The README linked to `docs/audit.md`, `docs/api.md`, and
`docs/integration.md` — none of which exist. This confuses users
evaluating the library for production use.
- Add `docs/audit.md` that honestly states external-audit status is
"not yet commissioned", lists upstream primitive audits that users
can rely on, documents known limitations, and points at the
responsible-disclosure contact. The audit-log table is left empty
for future audits to be appended.
- Replace the two other dangling links (`api.md`, `integration.md`)
with links to docs that actually exist in the repo today
(`FROST.md`, `Broadcast.md`, `LUX_INTEGRATION.md`).
Closes#5.
---------
Co-authored-by: Hanzo AI <dev@hanzo.ai>
Co-authored-by: Abhishek Krishna <abhi@kcolbchain.com>
