TEST-VECTORS — CGGMP21 (Lux Profile)

KAT format and sourcing for Lux's CGGMP21 threshold-ECDSA profile.

§1 Sources

Source	Scope
CCS '21 paper test vectors	Reference values in ePrint 2021/060 appendices
Lux profile KATs	Lux-specific transcripts (party-id ordering, transcript-binding tag, Paillier modulus pinning). Generated by `cmd/cmp_oracle/` (roadmap; see `SUBMISSION-STATUS.md §3.1`).
LSS-CMP integration KATs	Dynamic-resharing transcripts via `protocols/lss/lss_cmp.go`.
Cross-chain interop vectors	Bitcoin Core ECDSA fixtures, Ethereum ECDSA fixtures — see `cmp_integration_test.go`.

§2 Format

Each KAT is a deterministic JSON record:

{
  "curve": "secp256k1",
  "n": 5,
  "t": 3,
  "seed": "<32-byte hex>",
  "keygen": {
    "groupPublicKey": "<65-byte hex (uncompressed)>",
    "paillierModuli": ["<256-byte hex>", ...],
    "pedersenParams": [{"N": "<hex>", "s": "<hex>", "t": "<hex>"}, ...],
    "signerShares": [{"id": "01..", "x_i": "<hex>"}, ...],
    "transcriptHash": "<hex>"
  },
  "presign": [
    {
      "presigID": "<hex>",
      "signers": ["01..", "03..", "05.."],
      "round1": [...],
      "round2": [...],
      "round3": [...],
      "K_i": "<hex>",
      "delta_i": "<hex>"
    }
  ],
  "sign": [
    {
      "message": "<hex>",
      "presigID": "<hex>",
      "signers": ["01..", "03..", "05.."],
      "signature": "<70-byte DER hex>",
      "verifies_under_secp256k1_ecdsa": true,
      "verifies_under_bitcoin_core": true,
      "verifies_under_geth": true
    }
  ]
}

The verifies_under_* fields are the third-party verifier accept results. All three MUST be true for a valid KAT.

§3 Cross-validation

The Lux profile cross-validates against:

crypto/ecdsa (Go stdlib) — primary smoke test
Bitcoin Core libsecp256k1 — bridge custody target
luxfi/geth ECDSA verifier — EVM custody target

See cmp_integration_test.go for the cross-validation harness.

§4 Determinism

CGGMP21 has multiple randomness sources:

Source	Determinism
Paillier modulus generation	Seeded by KAT seed (deterministic)
Nonce generation per signing round	Seeded by KAT seed
ECDSA nonce `k`	Lux profile uses RFC 6979 deterministic nonces
Random oracles (`zk/*`)	Hash-based, deterministic given inputs

KATs are byte-identical across runs given the same seed. Drift is a CI failure once cmd/cmp_oracle/ ships.

§5 Cross-runtime byte-equality

Cross-runtime KAT manifest scope: roadmap. The C++ port of CGGMP21 (if it exists) would byte-validate against this manifest.

§6 Open items

cmd/cmp_oracle/ generator — see SUBMISSION-STATUS.md §3.1
Paillier-modulus determinism audit — does each run produce the same modulus given the same seed? Verified yes for current pkg/paillier; document in KAT generator.
Cross-bitcoin-version interop — Bitcoin Core libsecp256k1 has released-version pinning required for reproducibility.

§7 Cross-references

SPEC.md §3.4 — Paillier modulus pinning
SUBMISSION-STATUS.md §3.1, §3.2 — KAT gating items
PARAMS.md — secp256k1 + Paillier parameter pinning

3.2 KiB Raw Permalink Blame History