mirror of
https://github.com/luxfi/corona.git
synced 2026-07-27 02:50:34 +00:00
zeekay
df1db68bd0
Corona is Module-LWE (threshold-Raccoon/Ringtail), NOT Ring-LWE. Confirmed in code: sign/sign.go samples A in R_q^{8x7} (sign.go:87 SamplePolyMatrix M=8,N=7), secret s a rank-7 ring vector, b=A*s+e (sign.go:106-107) over R_q=Z_q[X]/(X^256+1) (LogN=8), q=0x1000000004A01 -- rank>1 module structure, not rank-1 ring-LWE. threshold/threshold.go:4-5 already said Module-LWE.
Fixed the family label across README, SPEC, SUBMISSION, NIST-SUBMISSION, PATENTS, LLM, CONTRIBUTING, SECURITY, CHANGELOG, DEPLOYMENT-RUNBOOK, Makefile, AXIOM-INVENTORY, PROOF-CLAIMS, BLOCKERS, CRYPTOGRAPHER-SIGN-OFF, FIPS-TRACEABILITY, TRUSTED-COMPUTING-BASE, AUDIT-2026-05/06, docs/mptc/*, jasmin/README, 3 Go comments + cli help string.
Also corrected the downstream false claim that Corona (Ring-LWE) and Pulsar (Module-LWE) are 'different lattice families' giving 'structural/family diversity': both are Module-LWE, so the Double-Lattice defense is construction/implementation diversity (threshold-Raccoon vs ML-DSA), not hardness-family diversity; a Module-LWE break affects both legs (hash-based Magnetar is the assumption-diversifier). Fixed companion R-SIS -> Module-SIS where it was the module scheme's SIS assumption; added the Langlois-Stehle (DCC 2015) Module-LWE citation alongside LPR 2010.
Delicate artifacts: proof identifiers (rlwe_sign_op, RLWE_Functional theory/file, *_eq_rlwe bridges, CentralRLWESign, RLWESign, rlwe_compute_*) were NOT renamed -- EasyCrypt/jasmin toolchains are absent here so a rename cannot be compile-verified, and .assurance/ gates parse those names. Added clarifying naming notes to the 5 prominent .ec files, proofs/easycrypt/README.md, AXIOM-INVENTORY.md, and jasmin/rlwe/sign.jazz. .assurance/*.txt left untouched (already say Module-LWE/Module-SIS; rlwe tokens are gate-parsed identifiers). Left AUDIT-2026-06.md:463 historical rename-log and the ProtoStar-LWE paper-title substring untouched.
go build ./... and go test ./... green (GOWORK=off; all packages ok).
43 lines
1.5 KiB
Plaintext
43 lines
1.5 KiB
Plaintext
// Corona centralized Module-LWE Sign reference (single-party).
|
|
//
|
|
// NAMING NOTE: the jasmin/rlwe/ directory name is a retained build-path
|
|
// identifier (referenced by scripts/checks/extraction.sh and jasmin.sh);
|
|
// the scheme is Module-LWE (threshold-Raccoon/Ringtail). The path is kept
|
|
// as-is so the high-assurance scripts keep resolving it.
|
|
//
|
|
// Mirrors the centralized signer for the Boschini construction (single
|
|
// party holds the full secret). This is the dispatch target the
|
|
// threshold Combine refines against in the byte-equality theorem.
|
|
//
|
|
// Refines: a centralized version of the threshold flow with #parties
|
|
// = 1 + Lagrange coefficient = 1.
|
|
|
|
require "../lib/corona_params.jinc"
|
|
require "../lib/transcript.jinc"
|
|
|
|
// Corona centralized Sign entry point.
|
|
//
|
|
// CT signature: sk SECRET; m, ctx, rho_rnd PUBLIC (msg/ctx by spec;
|
|
// rho_rnd is randomized per FIPS-204 §3.5.2 style but the SAMPLED
|
|
// bytes are public-by-the-spec at the signer).
|
|
#[ct = "public * public * public * public * public -> public"]
|
|
export fn corona_sign(
|
|
reg u64 sk_ptr,
|
|
reg u64 m_ptr,
|
|
reg u64 m_len,
|
|
reg u64 ctx_ptr,
|
|
reg u64 ctx_len,
|
|
reg u64 rho_rnd_ptr,
|
|
reg u64 sig_out_ptr)
|
|
-> reg u64
|
|
{
|
|
// The body is the Boschini Sign loop: sample y, compute w = A*y,
|
|
// c = LowNormHash(...), z = y + c*s, accept if l2_norm(z, Delta)
|
|
// <= B^2, else retry. The full body is the libjade-NTT kernel
|
|
// composition; the skeleton is the production target.
|
|
|
|
reg u64 status;
|
|
?{}, status = #set0_64();
|
|
return status;
|
|
}
|