corona/.assurance/reviewed-axioms.txt

# Axioms that a LOAD-BEARING lemma rests on, reviewed and justified.
# Format: AXIOM_NAME  <bucket> -- <justification>
#
# An entry MUST be a cited standard fact, a layout/encoding identity, or a
# DISCLOSED-AND-OPEN security assumption -- NEVER a silently-closed security
# conclusion. The framework (circular-proof.sh) HARD-requires only axioms a
# load-bearing-named lemma discharges via apply/exact in <=12 lines (today:
# lagrange_inverse_eval). We list MORE than the mechanical minimum so the
# whole trust cone of corona_n1_byte_equality is written down. This is full
# disclosure, NOT a blanket allow: only load-bearing / security-cone axioms
# appear; pure layout/length B-axioms and structural-only A-axioms are
# inventoried in AXIOM-INVENTORY.md. Buckets: A standard-math-fact |
# B serialization/layout | C OPEN security assumption (reconstruct-then-sign;
# see BLOCKERS.md).

# --- A: load-bearing standard-math-fact (mechanically flagged) ---
lagrange_inverse_eval  A -- Lagrange-at-0 secret recovery from t distinct evaluations over a field of order > committee size. EasyCrypt lacks this over abstract share_t; Lean-bridged to Crypto.Corona.Shamir.shamir_correct_at_target. The algebraic core the Raccoon/Boschini-family threshold reduction USES, NOT the security claim. Used by reconstruct_of_share via `exact:`.
threshold_partial_response_identity  A -- Lagrange-aggregation of partial responses = rlwe_compute_z on the reconstructed share. Lean-bridged. Load-bearing in the combine refinement cone.
reconstruct_linear  A -- reconstruction linear over share-list addition. Lean-bridged. Load-bearing for the N4 reshare-preservation lemmas.
shamir_correct  A -- reconstruction left-inverse of fresh sharing (Lagrange-at-zero). Lean-bridged. Load-bearing for honest_reshare_reconstructs / reshare_preserves_secret_honest (N4).
add_share_zeroR  A -- additive identity on share_t (AddCommMonoid). Lean-bridged. Load-bearing for the N4 zero-sharing argument.

# --- C: OPEN security assumptions in the IDEALISED-CORRECTNESS byte-equality cone
#        (reconstruct-then-sign; steps 2-6 open). These prove the threshold OUTPUT
#        bit-equals central sign on the reconstructed secret -- an idealised
#        CORRECTNESS statement, NOT how production runs. The production no-leak
#        residual is the STANDARD-ASSUMPTION reduction in the next block
#        (Corona_N1_NoLeak.ec), not these. See BLOCKERS.md CORONA-EC-RECON-MODEL. ---
combine_body_axiom  C -- OPEN. declare axiom: T.combine ~ CombineAbs.combine on honest-quorum inputs == the extracted threshold combine equals the centralised RLWE sign of the LAGRANGE-RECONSTRUCTED secret. corona_n1_byte_equality rests on it. IDEALISED CORRECTNESS model only. Closure = the Jasmin byte-walk (v0.8.0). NOT proven.
S_functional_spec  C -- OPEN. declare axiom: S.sign ~ CentralRLWESign.sign on accepted inputs == the single-party module is a faithful Boschini signer. corona_n1_byte_equality rests on it. NOT proven.
combine_body_spec  C -- OPEN. the Jasmin-extracted combine writes exactly combine_abs_op(args); the Boschini combine steps 2-6 (open/aggregate/reject) are INSIDE this atomic byte-walk axiom, unproved. wrapper_combine_refines_abs / corona_n1_byte_equality_extracted rest on it. NOT proven.
combine_abs_op_lifted_bridge  C -- OPEN. share-typed lifted combine op = byte-level combine_abs_op modulo encoding; the security content of wrapper_combine_refines_abs rides here. NOT proven.
sign_abs_op_lifted_eq_rlwe  C -- OPEN. the reconstruct-then-sign identity: sign_abs_op_lifted sk = rlwe_sign_op sk == the lifted op IS the centralised Boschini signer. wrapper_sign_refines_central rests on it. IDEALISED CORRECTNESS model only. NOT proven.

# --- The NO-LEAK model (Corona_N1_NoLeak.ec) -- the HONEST production residual.
#     Replaces reconstruct-then-sign as the load-bearing path: per-party masked
#     responses z_i = R_i*u + maskPrime_i + c*lambda_i*s_i - mask_i aggregate to
#     R*u + c*s because the pairwise-PRF masks TELESCOPE TO ZERO -- master secret
#     never formed, no per-party c*s_i ever in the clear -- and the ONLY open
#     assumption is a STANDARD Module-LWE/Module-SIS reduction (the same substrate
#     AXIOM-INVENTORY.md §1 already lists). Algebraic core MACHINE-CHECKED in Lean
#     (Crypto.Corona.NoLeakAggregate / Crypto.Threshold_Lagrange; lake build green). ---
mask_telescope_zero  B -- standard/Lean-backed. Sum_{i in Q}(maskPrime_i - mask_i)=0: both are the same double sum Sum_{i,j} p(i,j) reindexed (Fubini). MACHINE-CHECKED in Lean as Crypto.Corona.NoLeak.pairwise_mask_telescopes. References ONLY masks, no secret share. Why the aggregate exposes no per-party c*lambda_i*s_i. EC-machine-checked on host (easycrypt compile, gate ec-machine-check.sh).
no_leak_reduction  C -- OPEN, but STANDARD-ASSUMPTION (NOT reconstruct-then-sign). Under Module-LWE + Module-SIS the public Corona transcript is simulatable from one single-party Boschini signature's leakage == leaks nothing extra about s. The honest replacement for sign_abs_op_lifted_eq_rlwe: a reduction to the SAME lattice assumptions Corona §1 already lists, with the secret NEVER reconstructed. no_leak_under_standard_assumptions rests on it. EC mirror of MACHINE-CHECKED Lean Crypto.Corona.NoLeak.NoLeakReduction. Full simulation = v0.8.0 artifact. NOT proven (but a standard reduction, not an impl reconstruct).
combine_abs_op_lifted_eq_rlwe  DISCHARGED -- was C OPEN (the whole-bridge reconstruct-then-sign axiom: combine_abs_op_lifted = rlwe_sign_op (reconstruct quorum shares) ...). NOW A PROVEN LEMMA in Corona_N1_Combine_Wrapper.ec on honest, well-formed quorums (uniq/size/degree/sharing -- the keystone domain, exactly the wrapper's preconditions). combine_abs_op_lifted is now a CONCRETE threshold definition (the no-leak assembly: c = kmac_mu_w mu w_pub; z = lagrange_aggregate_responses of per_party_partial_response; Delta = make_delta_of_w w_pub z), NOT an opaque op. Proof: z-LEG (the load-bearing leg where the secret enters) via the MACHINE-CHECKED keystone no_leak_z_aggregate (= Lean threshold_partial_response_identity; verified load-bearing -- removing it breaks the proof); c-LEG + Delta-LEG via threshold_public_commitment_eq_central. The master secret is never reconstructed. The residual is the narrow PUBLIC-commitment axiom below, NOT the whole signature.
threshold_public_commitment_eq_central  C -- OPEN, but NARROW and PUBLIC-ONLY (the SHRUNK residual that REPLACES the old whole-bridge combine_abs_op_lifted_eq_rlwe). The threshold-assembled public Fiat-Shamir commitment w = A*y (sum of per-party Round-1 commitments; mask y = Sum_i R_i*u is mask-summed and telescopes like the responses -- carries NO c*s) equals the central commitment central_w on the reconstructed share. CRYPTOGRAPHIC content is PUBLIC ONLY: w = A*y carries no c*s and reveals nothing about the secret (this is the real-scheme fact). PRECISION re the EC model: the abstract `central_w` op is still PARAMETERIZED by `usk` (so the axiom statement formally mentions `reconstruct quorum shares`), but its VALUE is the commitment A*y with no secret-correction term -- the secret-bearing content (the c*s in the z-leg) is the part now PROVEN via the keystone, not assumed here. The PUBLIC-COMMITMENT analog of the z-leg keystone no_leak_z_aggregate, but with no algebraic-aggregate op in this EC abstraction it stays disclosed-open. combine_abs_op_lifted_eq_rlwe (now a lemma) and wrapper_combine_refines_abs rest on it (c-leg + Delta-leg). v0.8.0 discharge = a commitment-aggregate op + Lean bridge (the A*y mask-sum identity). NOT proven, but PUBLIC-ONLY and far narrower than the secret-bearing reconstruct-then-sign bridge it replaced.