mirror of https://github.com/luxfi/threshold.git synced 2026-10-30 15:15:53 +00:00

Files

T

zeekay f6093e719b protocols/rlwe-tee: institutional-custody Ring-LWE via TEE-gated trusted-dealer reconstruction

Sibling of protocols/{slhdsa,mldsa}-tee for the corona Ring-LWE
primitive. Master trusted-dealer key (32 B, sign.KeySize) lives
sealed-at-rest in hsm.Provider; per-Sign the TEE attestation
authorizes release and then the dealer's GenerateKeys + the n-party
Round1 / Round2 / Finalize all run inside the attested process.

Composition (not inheritance):
  Signer { gate kms.ReleaseGate; hsmP hsm.Provider;
           appr approval.ApprovalProvider; cfg Config }

corona.threshold.GenerateKeys writes package-level globals
(sign.K, sign.Threshold) — coronaSerializer wraps every entry point
into corona so two concurrent Signers on the same process do not race
through that shared state. Workaround for an upstream constraint; not
a security boundary.

Permissionless path (corona.keyera.BootstrapPedersen — no party ever
holds the master) UNAFFECTED. This is the opt-in institutional-
custody extension. Use cases: foundation HSM ceremonies, single-
operator bridge custody.

11 tests + 9 Config sub-tests; t.Parallel; depends on luxfi/corona
v0.7.6 (canonical Signature/GroupKey/VerifyBytes wire codec).

2026-06-01 12:18:07 -07:00

1.7 KiB

Raw Permalink Blame History

rlwe-tee

Operator-controlled Ring-LWE threshold signing via TEE-gated trusted-dealer-key reconstruction.

What this is

Sibling of protocols/slhdsa-tee and protocols/mldsa-tee for the corona Ring-LWE primitive. The master trusted-dealer key (32 bytes) lives sealed-at-rest in the HSM; per sign call the TEE attestation authorizes release, then the dealer's GenerateKeys + the n-party Round1/Round2/Finalize all run inside the attested process. The resulting corona.threshold.Signature is structurally identical to a permissionless corona threshold signature on the same (GroupKey, message).

When to use

Foundation HSM ceremonies that need a single-operator dealer with attested release.
Bridge custody operators that hold a corona PQ threshold signing key and require executive approval per signature.

When NOT to use

Permissionless threshold custody: use corona.keyera.BootstrapPedersen — no party ever holds the master trusted-dealer key.
Single-operator dev: use corona.threshold.GenerateKeys directly.

Layering

caller
  └── rlwetee.Signer.Sign(ctx, env, jobID, msg)
        ├── approval.ApprovalProvider.ApproveIntent
        ├── kms.ReleaseGate.Issue / Release
        │     └── cc/attest.Dispatch
        ├── hsm.Provider.GetKey
        ├── corona.threshold.GenerateKeys → Round1 → Round2 → Finalize
        └── hsm.Provider.Sign (audit)

Compatibility

Wire output is corona.threshold.Signature.MarshalBinary. Verifiers holding the published GroupKey bytes validate via corona.threshold.VerifyBytes(gkBytes, msg, sigBytes) — no awareness of the TEE substrate required.

1.7 KiB Raw Permalink Blame History