mirror of
https://github.com/luxfi/threshold.git
synced 2026-10-30 15:15:53 +00:00
zeekay
e8f154a5b1
Adds the Tier A formal-artifact cluster for protocols/bls (Lux profile of Boldyreva 2003 threshold BLS over BLS12-381). Mirrors luxfi/pulsar's Tier A structure adapted to BLS's algebraically minimal threshold construction (Lagrange + G2-linearity, no nonce sampling, no MtA, no ZK). - proofs/easycrypt/BLS_Threshold_N1.ec — Class N1 byte-equality reduction - proofs/easycrypt/BLS_Threshold_N1_Refinement.ec — partial_sign + aggregate - proofs/easycrypt/BLS_Threshold_N4.ec — DKG public-key preservation - proofs/easycrypt/lemmas/BLS_Threshold_CT.ec — constant-time obligations - proofs/easycrypt/AXIOM-INVENTORY.md — honest enumeration - proofs/lean-easycrypt-bridge.md — Lean↔EC bridge map - jasmin/lib/ + jasmin/single-party/ + jasmin/threshold/ — Jasmin scaffolds BLS-threshold has the smallest formal-methods surface of the three classical threshold protocols. Admit budget: 1/1 (same one-line group-identity admit as FROST_N4, CGGMP21_N4, Pulsar_N4). Production deployment note: ships with trusted-dealer keygen only; DKG gap disclosed in SUBMISSION-STATUS.md §3.3.
27 lines
926 B
Plaintext
27 lines
926 B
Plaintext
// BLS-threshold Lagrange coefficient computation in F_r (BLS12-381).
|
|
//
|
|
// For a quorum Q = (x_1, ..., x_n) of party IDs and party position i:
|
|
// lambda_i(0) = prod_{j != i} (0 - x_j) / (x_i - x_j)
|
|
// in F_r where r is the BLS12-381 group order.
|
|
|
|
require "bls_params.jinc"
|
|
|
|
// quorum_ids[0..n) : party IDs in the quorum (PUBLIC, 32-byte big-endian)
|
|
// n : |Q| (PUBLIC)
|
|
// my_idx_pos : position of THIS party in quorum_ids (PUBLIC)
|
|
// lambda_out : output 32-byte lambda_i scalar (PUBLIC)
|
|
inline
|
|
fn bls_lagrange_at_zero(
|
|
reg ptr u8[BLS_SCALAR_BYTES * BLS_MAX_QUORUM] quorum_ids,
|
|
reg u64 n,
|
|
reg u64 my_idx_pos,
|
|
reg ptr u8[BLS_SCALAR_BYTES] lambda_out
|
|
) -> reg ptr u8[BLS_SCALAR_BYTES]
|
|
{
|
|
// TODO: jasmin implementation.
|
|
//
|
|
// CT: the (j != my_idx_pos) test branches on PUBLIC data only.
|
|
// The scalar_inv (1/(x_i - x_j)) operation must be CT.
|
|
return lambda_out;
|
|
}
|