zeekay
df1db68bd0
Corona is Module-LWE (threshold-Raccoon/Ringtail), NOT Ring-LWE. Confirmed in code: sign/sign.go samples A in R_q^{8x7} (sign.go:87 SamplePolyMatrix M=8,N=7), secret s a rank-7 ring vector, b=A*s+e (sign.go:106-107) over R_q=Z_q[X]/(X^256+1) (LogN=8), q=0x1000000004A01 -- rank>1 module structure, not rank-1 ring-LWE. threshold/threshold.go:4-5 already said Module-LWE.
Fixed the family label across README, SPEC, SUBMISSION, NIST-SUBMISSION, PATENTS, LLM, CONTRIBUTING, SECURITY, CHANGELOG, DEPLOYMENT-RUNBOOK, Makefile, AXIOM-INVENTORY, PROOF-CLAIMS, BLOCKERS, CRYPTOGRAPHER-SIGN-OFF, FIPS-TRACEABILITY, TRUSTED-COMPUTING-BASE, AUDIT-2026-05/06, docs/mptc/*, jasmin/README, 3 Go comments + cli help string.
Also corrected the downstream false claim that Corona (Ring-LWE) and Pulsar (Module-LWE) are 'different lattice families' giving 'structural/family diversity': both are Module-LWE, so the Double-Lattice defense is construction/implementation diversity (threshold-Raccoon vs ML-DSA), not hardness-family diversity; a Module-LWE break affects both legs (hash-based Magnetar is the assumption-diversifier). Fixed companion R-SIS -> Module-SIS where it was the module scheme's SIS assumption; added the Langlois-Stehle (DCC 2015) Module-LWE citation alongside LPR 2010.
Delicate artifacts: proof identifiers (rlwe_sign_op, RLWE_Functional theory/file, *_eq_rlwe bridges, CentralRLWESign, RLWESign, rlwe_compute_*) were NOT renamed -- EasyCrypt/jasmin toolchains are absent here so a rename cannot be compile-verified, and .assurance/ gates parse those names. Added clarifying naming notes to the 5 prominent .ec files, proofs/easycrypt/README.md, AXIOM-INVENTORY.md, and jasmin/rlwe/sign.jazz. .assurance/*.txt left untouched (already say Module-LWE/Module-SIS; rlwe tokens are gate-parsed identifiers). Left AUDIT-2026-06.md:463 historical rename-log and the ProtoStar-LWE paper-title substring untouched.
go build ./... and go test ./... green (GOWORK=off; all packages ok).
2.6 KiB
Corona Jasmin sources
Constant-time threshold layer + centralized Module-LWE Sign reference, written in Jasmin (https://github.com/jasmin-lang/jasmin) for jasmin-ct verification + EasyCrypt extraction.
Layout
jasmin/
lib/ -- Shared primitives (corona_params, seed,
transcript, mac, lagrange).
rlwe/ -- Centralized Module-LWE Sign (single-party).
threshold/ -- Threshold round1.jazz, round2.jazz,
combine.jazz.
Compile / verify
Type-check:
jasminc -until_typing threshold/round1.jazz
jasminc -until_typing threshold/round2.jazz
jasminc -until_typing threshold/combine.jazz
Constant-time check:
jasmin-ct threshold/round1.jazz
jasmin-ct threshold/round2.jazz
jasmin-ct threshold/combine.jazz
The threshold-layer files are BLOCKING gates in scripts/checks/jasmin.sh.
Status
v0.7.0 ships the structural sources. Each file mirrors its luxfi/corona/sign/sign.go reference body, marked with #ct annotations at the export boundaries. The libjade-NTT kernel calls are sketched at the structural level; full body wiring is the production target for external audit at v0.8.0.
The skeleton is sufficient for:
- jasminc type-checking (the #ct annotations are syntactically valid)
- jasmin-ct CT analysis (the secret-data flow boundaries are pinned)
- EasyCrypt extraction sanity (the export ABI matches the wrapper layer)
The full body wiring is the path to closing the byte-walk axioms in
proofs/easycrypt/Corona_N1_{Combine,Sign}_Refinement.ec.
CT annotations
Each export function carries a #[ct = ...] annotation declaring the
public/secret level of each argument. The CT type is:
pointer-value-public * ... -> return-public
Pointed-to data carries its own secrecy level inside the function via
#secret / #public markers on stack arrays. The wrapper layer in
the Go reference (luxfi/corona/sign/sign.go) ensures the pointer
contents satisfy these annotations.
Refinement target
Each .jazz file refines a corresponding Go function in luxfi/corona/sign/sign.go:
| Jasmin | Go reference |
|---|---|
threshold/round1.jazz |
Party.SignRound1 |
threshold/round2.jazz |
Party.SignRound2 + Party.SignRound2Preprocess |
threshold/combine.jazz |
Party.SignFinalize |
rlwe/sign.jazz |
A centralized aggregator running all three rounds with #parties=1 |
lib/lagrange.jinc |
primitives.ComputeLagrangeCoefficients |
lib/transcript.jinc |
primitives.Hash (transcript_hash) |
lib/mac.jinc |
primitives.GenerateMAC |
lib/seed.jinc |
primitives.PRNGKeyForRound |