zeekay
df1db68bd0
Corona is Module-LWE (threshold-Raccoon/Ringtail), NOT Ring-LWE. Confirmed in code: sign/sign.go samples A in R_q^{8x7} (sign.go:87 SamplePolyMatrix M=8,N=7), secret s a rank-7 ring vector, b=A*s+e (sign.go:106-107) over R_q=Z_q[X]/(X^256+1) (LogN=8), q=0x1000000004A01 -- rank>1 module structure, not rank-1 ring-LWE. threshold/threshold.go:4-5 already said Module-LWE.
Fixed the family label across README, SPEC, SUBMISSION, NIST-SUBMISSION, PATENTS, LLM, CONTRIBUTING, SECURITY, CHANGELOG, DEPLOYMENT-RUNBOOK, Makefile, AXIOM-INVENTORY, PROOF-CLAIMS, BLOCKERS, CRYPTOGRAPHER-SIGN-OFF, FIPS-TRACEABILITY, TRUSTED-COMPUTING-BASE, AUDIT-2026-05/06, docs/mptc/*, jasmin/README, 3 Go comments + cli help string.
Also corrected the downstream false claim that Corona (Ring-LWE) and Pulsar (Module-LWE) are 'different lattice families' giving 'structural/family diversity': both are Module-LWE, so the Double-Lattice defense is construction/implementation diversity (threshold-Raccoon vs ML-DSA), not hardness-family diversity; a Module-LWE break affects both legs (hash-based Magnetar is the assumption-diversifier). Fixed companion R-SIS -> Module-SIS where it was the module scheme's SIS assumption; added the Langlois-Stehle (DCC 2015) Module-LWE citation alongside LPR 2010.
Delicate artifacts: proof identifiers (rlwe_sign_op, RLWE_Functional theory/file, *_eq_rlwe bridges, CentralRLWESign, RLWESign, rlwe_compute_*) were NOT renamed -- EasyCrypt/jasmin toolchains are absent here so a rename cannot be compile-verified, and .assurance/ gates parse those names. Added clarifying naming notes to the 5 prominent .ec files, proofs/easycrypt/README.md, AXIOM-INVENTORY.md, and jasmin/rlwe/sign.jazz. .assurance/*.txt left untouched (already say Module-LWE/Module-SIS; rlwe tokens are gate-parsed identifiers). Left AUDIT-2026-06.md:463 historical rename-log and the ProtoStar-LWE paper-title substring untouched.
go build ./... and go test ./... green (GOWORK=off; all packages ok).
4.6 KiB
FIPS-TRACEABILITY — Corona
Construction-paper → code traceability map. Module-LWE has no FIPS standard, so this document maps Boschini ePrint 2024/1113 (IEEE S&P 2025) sections to
~/work/lux/corona/implementation paths. Equivalent role to Pulsar'sFIPS-TRACEABILITY.md(which maps FIPS 204 § → code).
§1 Reference
- Boschini, C., Kaviani, A., Lai, R. W. F., Malavolta, G., Takahashi, A., Tibouchi, M. Practical two-round threshold signatures from learning with errors. IACR ePrint 2024/1113 → IEEE S&P 2025.
This is the construction-level normative reference for Corona. The
Lux production fork extends the construction with a public-DKG
lifecycle (dkg2/) and proactive resharing (reshare/); these
extensions are documented in SPEC.md.
§2 Section → code mapping
§2.1 Notation + ring construction (paper §2-3)
| Paper § | Topic | Code |
|---|---|---|
| §2.1 | Cyclotomic ring R_q = Z_q[X]/(X^256+1) |
sign/config.go:19 (Q = 0x1000000004A01); threshold/threshold.go:46 (ring.NewRing(256, []uint64{Q})) |
| §2.2 | Module-LWE parameters | sign/config.go:25 (M, N, K, Dbar, Kappa) |
| §2.3 | Montgomery + Barrett constants | luxfi/lattice/v7/ring/modular_reduction.go (via dependency) |
| §2.4 | NTT roots + cyclotomic factorization | luxfi/lattice/v7/ring/ntt.go (via dependency) |
§2.2 Distributed key generation (paper §4)
| Paper § | Topic | Code |
|---|---|---|
| §4.1 | Pedersen-VSS over R_q |
dkg2/dkg2.go, dkg2/round1.go, dkg2/round2.go |
| §4.2 | Per-party complaint records | dkg2/complaint.go |
| §4.3 | Round-3 share verification | dkg2/dkg2.go (Round3 method) |
| §4.4 | Group public key derivation | keyera/keyera.go (EpochShareState.GroupPubkey) |
Note: the paper's DKG uses Feldman commitments; the Lux profile
replaces this with Pedersen-VSS to close the pseudoinverse-
recoverable attack described in ~/work/luxcpp/crypto/corona/RED-DKG-REVIEW.md.
The Lux delta is conservative — Pedersen is strictly more hiding
than Feldman. Documented in SPEC.md §4.
§2.3 Threshold signing (paper §5)
| Paper § | Topic | Code |
|---|---|---|
| §5.1 | Round-1: commit-and-MAC | threshold/round1.go |
| §5.2 | Round-2: mask reveal | threshold/round2.go |
| §5.3 | Combine: Lagrange + ML-DSA aggregation | threshold/combine.go |
| §5.4 | Hash domain separation (cSHAKE256 / KMAC256) | hash/sp800_185.go (SP 800-185 conformance) |
§2.4 Reshare protocol (paper §7, Lux extension)
The paper's §7 covers proactive secret sharing under fixed committees. The Lux profile adds cross-committee resharing via the keyera-lifecycle pattern:
| Topic | Code |
|---|---|
Reshare protocol (Desmedt-Jajodia over R_q) |
reshare/reshare.go |
| Activation cert circuit-breaker | reshare/activation.go |
| Per-party complaints | reshare/complaint.go |
| Key-era management (Bootstrap → Reshare → Reanchor) | keyera/keyera.go |
The Lux Reshare extension preserves the group public key across an
arbitrary number of epochs within a key era. Reanchor opens a new
key era. Documented in SPEC.md §5 + DEPLOYMENT-RUNBOOK.md.
§2.5 Identifiable abort (paper §6)
The Lux profile implements identifiable abort across both DKG and signing phases:
| Phase | Code |
|---|---|
| DKG complaint records | dkg2/complaint.go |
| Threshold-sign complaint records | threshold/complaint.go (if present; otherwise via per-round share verification) |
| Reshare complaint records | reshare/complaint.go |
Each complaint carries a signed evidence blob attributable to a
specific signer. Soundness reduces to identity-key signature
unforgeability — see AXIOM-INVENTORY.md §2.
§3 What this document is NOT
- NOT a security proof. The Boschini construction's security is proved in the cited paper.
- NOT a NIST FIPS standard reference (Module-LWE has no FIPS standard).
- NOT a mechanized refinement against the cited paper. EC theories
that formalize this mapping are roadmap v0.7.0 (see
AXIOM-INVENTORY.md§2 +PROOF-CLAIMS.md§3).
This document is the citation discipline: every operation in the shipped code traces to a specific paper section, with Lux deltas (Pedersen-VSS, keyera lifecycle, proactive cross-committee reshare) called out explicitly.
§4 Cross-references
SUBMISSION.md— submission cover sheetSPEC.md— protocol specification (includes Lux-delta detail)AXIOM-INVENTORY.md— residual axiom inventoryPROOF-CLAIMS.md— narrow claim + non-claimsTRUSTED-COMPUTING-BASE.md— TCB- Boschini ePrint 2024/1113 — construction-level normative reference