luxfi/corona
1
0
Fork 0
mirror of https://github.com/luxfi/corona.git synced 2026-07-27 02:50:34 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
df1db68bd0f2a871b1c0a0ad813d2ef0741133dd
corona/LLM.md
T
zeekay df1db68bd0 docs/comments: correct lattice-family label Ring-LWE -> Module-LWE (Corona is Module-LWE) 
Corona is Module-LWE (threshold-Raccoon/Ringtail), NOT Ring-LWE. Confirmed in code: sign/sign.go samples A in R_q^{8x7} (sign.go:87 SamplePolyMatrix M=8,N=7), secret s a rank-7 ring vector, b=A*s+e (sign.go:106-107) over R_q=Z_q[X]/(X^256+1) (LogN=8), q=0x1000000004A01 -- rank>1 module structure, not rank-1 ring-LWE. threshold/threshold.go:4-5 already said Module-LWE.

Fixed the family label across README, SPEC, SUBMISSION, NIST-SUBMISSION, PATENTS, LLM, CONTRIBUTING, SECURITY, CHANGELOG, DEPLOYMENT-RUNBOOK, Makefile, AXIOM-INVENTORY, PROOF-CLAIMS, BLOCKERS, CRYPTOGRAPHER-SIGN-OFF, FIPS-TRACEABILITY, TRUSTED-COMPUTING-BASE, AUDIT-2026-05/06, docs/mptc/*, jasmin/README, 3 Go comments + cli help string.

Also corrected the downstream false claim that Corona (Ring-LWE) and Pulsar (Module-LWE) are 'different lattice families' giving 'structural/family diversity': both are Module-LWE, so the Double-Lattice defense is construction/implementation diversity (threshold-Raccoon vs ML-DSA), not hardness-family diversity; a Module-LWE break affects both legs (hash-based Magnetar is the assumption-diversifier). Fixed companion R-SIS -> Module-SIS where it was the module scheme's SIS assumption; added the Langlois-Stehle (DCC 2015) Module-LWE citation alongside LPR 2010.

Delicate artifacts: proof identifiers (rlwe_sign_op, RLWE_Functional theory/file, *_eq_rlwe bridges, CentralRLWESign, RLWESign, rlwe_compute_*) were NOT renamed -- EasyCrypt/jasmin toolchains are absent here so a rename cannot be compile-verified, and .assurance/ gates parse those names. Added clarifying naming notes to the 5 prominent .ec files, proofs/easycrypt/README.md, AXIOM-INVENTORY.md, and jasmin/rlwe/sign.jazz. .assurance/*.txt left untouched (already say Module-LWE/Module-SIS; rlwe tokens are gate-parsed identifiers). Left AUDIT-2026-06.md:463 historical rename-log and the ProtoStar-LWE paper-title substring untouched.

go build ./... and go test ./... green (GOWORK=off; all packages ok).
2026-06-27 16:12:24 -07:00

8.5 KiB
Raw Blame History

Corona -- Agent Knowledge Base

Repository: github.com/luxfi/corona Latest Tag: v0.8.0 (dealerless Pedersen DKG is the production keygen default; signing never reconstructs the master secret) Status: Production (consensus path); NIST MPTC submission package included. Sibling submission luxfi/pulsar is the M-LWE byte-equal FIPS 204 path.

Purpose (one-liner)

Module-LWE threshold signature library used as the post-quantum threshold layer in Quasar consensus. Corona provides O(1) per-cert proofs after DKG, paired with BLS12-381 + ML-DSA-65 in the QuasarCert.

Keygen is natively dealerless: the Pedersen DKG (dkg2/, entered via keyera.Bootstrap → BootstrapPedersen) is the production default since v0.7.5 — no single party ever holds the secret. Signing never reconstructs the key: SignFinalize sums the per-party partial responses (z_sum = Σ z_j, then A·z_sum); ReconstructSecret was dropped (f08e2b5), and the trusted-dealer helpers (GenerateKeysTrustedDealer, BootstrapTrustedDealer*) are tests / KAT / CLI footguns, never the chain keygen path. This is why Corona — not Pulsar — carries the permissionless / no-trusted-dealer guarantee in the Quasar AND-mode dual-PQ cert: Pulsar's byte-FIPS-204 keygen is provably stuck at a trusted dealer (a dealerless sum of FIPS-204 secrets breaks ML-DSA's small-norm S_η bound), so the dealerless property must come from Corona's Module-LWE leg.

This repository is BOTH the production library AND the active NIST MPTC submission package (Class N1 + N4). The submission tarball is cut from a tag on main via scripts/cut-submission.sh; reviewer feedback lands here.

NIST MPTC submission package (this revision)

Doc Purpose
SUBMISSION.md Cover sheet — cites Boschini et al. 2024/1113, declares construction-level N1 + N4, honest delta vs Pulsar
NIST-SUBMISSION.md One-page executive summary
SPEC.md Standalone construction specification (companion to papers/lp-073-pulsar/)
PROOF-CLAIMS.md HONEST framing — NO mechanized refinement; KAT + code review + academic construction analysis
PATENTS.md Royalty-free grant + defensive termination
TRUSTED-COMPUTING-BASE.md Implementation TCB (Go + lattigo + crypto/subtle); structurally simpler than Pulsar's
DEPLOYMENT-RUNBOOK.md Operator-facing trust-model disclosure
LICENSING.md, CONTRIBUTING.md, SECURITY.md Standard NIST-MPTC artifacts
docs/evaluation.md Performance + correctness + KAT cross-validation
docs/ietf-draft-skeleton.md IETF draft skeleton (HONEST: draft form)
docs/nist-mptc-category.md Class N1 + N4 mapping for Corona
docs/patent-claims.md Attorney-prep claim drafts (FEWER than Pulsar — only Corona-novel lifecycle additions)

HONESTY GUARD: do not claim Corona has EC / Lean / Jasmin proofs. It does not. Pulsar does; Corona's Module-LWE construction has no FIPS standard target to refine against. See PROOF-CLAIMS.md §3 for the explicit non-claims list.

Recent significant commits

SHA Tag Impact
f08e2b5 v0.8.0 threshold: trusted-dealer keygen made explicit/footgun-only; dead ReconstructSecret dropped; sub-quorum soundness pinned — signing sums partials, master secret never formed
7c102d2 v0.7.9 threshold: reject duplicate PartyID in Round2/Finalize combine (kernel-boundary uniq guard)
6b4d5d5 v0.7.8 docs: correct stale 'no EC toolchain' claims; combine bridge discharged to lemma + jasminc available
baf2ba8 v0.7.7 ec: machine-check all 14 theories; discharge combine bridge C11 → lemma via no_leak_z_aggregate keystone, residual shrunk to public w-agreement
ee2c5b8 v0.7.6 threshold: canonical wire codec for Signature / GroupKey / VerifyBytes
1d44430 v0.7.5 keyera: public-BFT Bootstrap default → BootstrapPedersen; trusted-dealer impl moved to unexported helper; loud-name invariant across Bootstrap + Reanchor
607d71c v0.7.4 keyera: ReanchorPedersen — closes Reanchor trusted-dealer regression; mathSqrt → stdlib math.Sqrt
e412c7e v0.7.3 keyera: BootstrapPedersen — Pedersen-DKG over R_q + Path (a) noise flooding; closes trusted-dealer caveat
920195e v0.7.2 gpu: opt corona threshold signing into lattice/ring GPU NTT dispatch
4f54c28 v0.7.1 remove detailed patent-claims docs (relocated to lux-private/patents)
6f905a0 v0.7.0 Tier A full closure: EC theories admit 0/0 + Lean bridges + Jasmin CT + dudect harness + e2e/fuzz
1726e36 v0.4.1 threshold: add parallel VerifyBatch — N-signature throughput for consensus
2d910dc v0.4.x corona: don't mix — QUASAR-PULSAR-* prefixes -> QUASAR-CORONA-* in Corona's table
13e1cd8 v0.4.x corona: doc drift cleanup — CHANGELOG references match renamed Go code
a7c3919 v0.4.x corona: symmetric domain separation — PULSAR-* tags -> CORONA-*
2b262ef v0.4.x go.mod: bump go directive to 1.26.3 (security advisory)
4d02472 v0.4.x corona: final Corona purge — code, docs, KAT-side PRF tag
43e7d88 v0.4.x corona/papers: Corona2025 cite → boschini2024corona; coronaThreshold → coronaThreshold in TeX

Active versions

  • Repo: v0.8.0. The default keyera.Bootstrap / keyera.BootstrapWithSuite route through BootstrapPedersen (dealerless Pedersen DKG over R_q); the legacy trusted-dealer impl is the unexported bootstrapTrustedDealerImpl, reachable only via the explicit BootstrapTrustedDealer* / ReanchorTrustedDealer* names.
  • Pinned by: luxfi/consensus v1.23.6+ (Module-LWE path is consensus-only).

Canonical params

  • Ring degree: 256 (LogN=8).
  • M=8, N=7, Dbar=48, Kappa=23.
  • Q=0x1000000004A01 (48-bit NTT-friendly prime).
  • Hash suite: Corona-SHA3 (KMAC over cSHAKE256), hash/sp800_185.go.

Cross-repo dependencies

  • luxfi/math/codec → wire codec (LP-107 Phase 4).
  • luxfi/lattice/v7 → lattigo-backed polynomial ops.
  • golang.org/x/crypto/sha3 → cSHAKE256 / KMAC256 / TupleHash256.
  • zeebo/blake3 → LEGACY only (cross-port byte-check).
  • Consumed by:
    • luxfi/consensus/protocol/quasar (Module-LWE threshold for QuasarCert).
  • Cross-runtime byte-equal port: ~/work/luxcpp/crypto/corona/ (KAT manifest at scripts/regen-kats.manifest.sha256).

Where to look for X

  • Threshold kernel: threshold/ (includes verify_batch.go)
  • 2-round signing: sign/
  • Pedersen DKG (lifecycle, replaces broken dkg/): dkg2/
  • Legacy Feldman DKG (broken for public broadcast; reference only): dkg/
  • Proactive resharing (Refresh + ReshareToNewSet): reshare/
  • Activation cert circuit-breaker: reshare/activation.go
  • Corona-SHA3 / KMAC: hash/sp800_185.go
  • Key-era management: keyera/
  • KAT oracles: cmd/{reshare,dkg2,activation,cross_runtime,sign,corona_oracle_v2}*/
  • Submission scripts: scripts/{cut-submission,build,test,bench,gen_vectors,check-high-assurance,regen-kats}.sh

Open follow-ups (tracked in BLOCKERS.md)

  • Constant-time: jasminc -checkCT on the extracted threshold layer + dudect submission-grade 10⁹-sample run (CORONA-CT-PENDING).
  • no_leak_reduction discharged to a full Module-LWE/M-SIS simulation proof, OR accepted by external review as a standard reduction; plus the C11′ public-w commitment-aggregate bridge (CORONA-EC-RECON-MODEL).
  • Independent Module-LWE interop verifier, OR external review accepting the same-construction Go↔C++ KAT posture (CORONA-NO-INDEP-VERIFIER).
  • External cryptographic review — shared gate across the three open findings above.
  • Variable-size Corona (Module-LWE, Raccoon-line) certs remain a wire-size cost vs Pulsar's fixed-size ML-DSA certs; consensus uses Corona for finality-throughput and Pulsar for the identity rollup.

Rules

  1. Patch-bump only (v0.7.x → v0.7.y). Minor bumps require explicit approval.
  2. HashSuite is the only acceptable hash plumbing (F22 closure); never hardcode SHAKE / KMAC outside hash/sp800_185.go.
  3. Param changes require a new key-era boundary; never edit in place.
  4. NEVER claim mechanized refinement Corona does not have. See PROOF-CLAIMS.md §3.
  5. NEVER mix Pulsar (ML-DSA) types into Corona (threshold-Raccoon) — both Module-LWE, but independent libraries with no shared types.
  6. NEVER push the legacy dkg/ package onto a deployment surface — it has known leakage (Feldman VSS without blinding). Production uses dkg2/.
  7. Cross-runtime byte-equality with the C++ port (~/work/luxcpp/crypto/corona/) is a CI-enforced invariant via scripts/regen-kats.sh --verify.
Reference in New Issue View Git Blame Copy Permalink