Antje Worring
988e4cc15a
Reclassify (not reduce) the EasyCrypt axiom surface and correct the prior
inventory's understatement. NO axioms discharged this pass (honest): no
easycrypt toolchain on host, and every in-file-derivable axiom is already a
proved lemma; residual A/B axioms are over abstract ops/constants
(op group_pk_width : int., op sig_len : int.) and the C axioms are open.
- AXIOM-INVENTORY.md: replace the §2 table that mislabelled the wrapper
bridges and section-local module contracts as "Discharged in the
Wrapper". They are now correctly bucket C / OPEN: combine_body_spec hides
the Boschini combine steps 2-6, and combine_abs_op_lifted_bridge /
sign_abs_op_lifted_eq_rlwe pin the lifted op to rlwe_sign_op on the
Lagrange-RECONSTRUCTED master secret (reconstruct-then-sign). Complete
bucketed census of all 56 axioms -- A (18, 5 Lean-bridged), B (27), C
(11) -- one row per axiom with name, file:line, justification. CT
contracts (sign_round{1,2}_constant_time) classified C/fail-closed.
- PROOF-CLAIMS.md: add assurance vocabulary + two load-bearing disclosures
-- (1) the EC byte-equality MODELS reconstruct-then-sign; (2) Corona has
NO independent interop verifier (R-LWE has no NIST target), so its
byte-equality is asserted + same-construction Go<->C++ KAT, never
"proven/verified". Corrects the §4 claim that Pulsar is machine-checked
"at every step" (it too rests on the same reconstruct-then-sign cone).
- BLOCKERS.md (new): CORONA-EC-RECON-MODEL, CORONA-CT-PENDING,
CORONA-NO-INDEP-VERIFIER -- all OPEN, all cross-referenced to the shared
external-review gate.
- .assurance/reviewed-axioms.txt: list every load-bearing / security-cone
axiom (A: 5 Lean-bridged; C: combine_body_axiom, S_functional_spec,
combine_body_spec, combine_abs_op_lifted_bridge, sign_abs_op_lifted_eq_rlwe)
with bucket + justification.
- .assurance/budget.txt: correct prose (0 real admit. tactics; AXIOM=56 exact).
Framework gate (circular-proof + axiom-budget + the other three) PASS with
full disclosure. go test ./... green (no Go touched).
Corona
Lux is not merely adding post-quantum signatures to a chain; it defines a hybrid finality architecture for DAG-native consensus, with protocol-agnostic threshold lifecycle, post-quantum threshold sealing, and cross-chain propagation of Horizon finality.
See LP-105 §Claims and evidence for the canonical claims/evidence table and the ten architectural commitments — single source of truth.
Corona is the Lux Ring-LWE post-quantum threshold signature library
for Quasar consensus. The 2-round threshold construction line traces back
to the Boschini–Kaviani–Lai–Malavolta–Takahashi–Tibouchi R-LWE paper
(ePrint 2024/1113). Corona adds the
production lifecycle that line lacked: Pedersen DKG over R_q with proper
hiding, proactive resharing for epoch validator rotation, identifiable
abort, and the integration surface Quasar consumes.
The Module-LWE sibling library lives at luxfi/pulsar.
Pulsar's threshold signature output is byte-equal to FIPS 204 single-party
ML-DSA (NIST MPTC Class N1). The two libraries are independent — there is
no import line between them — and Quasar consumes them as parallel kernels
selected per-chain via FinalitySchemeID.
Why "Corona"
A corona is the luminous ring of light surrounding a star — visible only when the brighter central body (the Pulsar / Quasar) is partially occluded. Brand-paired with Pulsar (Module-LWE) and Quasar (the consensus that consumes both): the same family of threshold-finality light, observed at a different layer.
Production lifecycle additions
The original Boschini et al construction (ePrint 2024/1113) is a research artefact — trusted-dealer DKG, no proactive resharing, no integration surface. Corona is the production track that fills those gaps:
| Layer | Original R-LWE construction | Corona |
|---|---|---|
| 2-round threshold sign | ✅ same byte-equal protocol | ✅ inherited |
| Trusted-dealer Gen | ✅ for fixed federation | ✅ retained for bridge MPC |
| Proactive resharing for epoch validator rotation | ❌ not specified | 🚧 corona/reshare/ (this fork) |
| Pedersen DKG over R_q with proper hiding | ❌ not specified | 🚧 corona/dkg2/ (this fork) |
| Per-validator triple-sign integration with Quasar | ❌ N/A | 🚧 corona/consensus/ integration |
Composition with Pulsar as optional layered PQ defense
Corona is independently usable: a chain can pick Ring-LWE Corona as its sole PQ threshold layer, no cross-dependency on Pulsar. Lux primary- network QuasarCert combines both lattice families as a Double Lattice layered defence so a break in one family does not break finality:
QuasarCert {
BLS — optional classical fast-path (BLS-12-381 aggregate)
Corona — Ring-LWE threshold ML-DSA (this repo)
Pulsar — Module-LWE threshold ML-DSA (luxfi/pulsar)
MLDSARollup — per-validator ML-DSA-65 rolled up via STARK/FRI (P3Q)
}
Each layer is checkable independently with no shared code; selecting
the layer happens at chain-construction time via the FinalitySchemeID
axis on the chain's ChainSecurityProfile. The pure-PQ profile drops
BLS entirely and runs on Corona + Pulsar.
Layout
sign/— 2-round threshold signing (byte-equal with upstream)primitives/— Shamir, hashes, MACs, PRFs (byte-equal with upstream)utils/— NTT, Montgomery, ring helpers (byte-equal with upstream)networking/— TCP peer-to-peer (byte-equal with upstream)dkg/— original Lux DKG (Feldman VSS without noise; broken for public broadcast — see RED-DKG-REVIEW). Retained for reference.dkg2/— proper Pedersen DKG over R_q (Pulsar addition; this fork)reshare/— proactive secret resharing for epoch rotation (Pulsar addition; this fork)cmd/— KAT oracle generators
Status
WIP. The 2-round Sign+Verify path is byte-equal-validated against the original R-LWE construction (ePrint 2024/1113) via 16 SHA-256 KATs. The production-lifecycle additions (resharing + Pedersen DKG) are under design and implementation.