zeekay
df1db68bd0
Corona is Module-LWE (threshold-Raccoon/Ringtail), NOT Ring-LWE. Confirmed in code: sign/sign.go samples A in R_q^{8x7} (sign.go:87 SamplePolyMatrix M=8,N=7), secret s a rank-7 ring vector, b=A*s+e (sign.go:106-107) over R_q=Z_q[X]/(X^256+1) (LogN=8), q=0x1000000004A01 -- rank>1 module structure, not rank-1 ring-LWE. threshold/threshold.go:4-5 already said Module-LWE.
Fixed the family label across README, SPEC, SUBMISSION, NIST-SUBMISSION, PATENTS, LLM, CONTRIBUTING, SECURITY, CHANGELOG, DEPLOYMENT-RUNBOOK, Makefile, AXIOM-INVENTORY, PROOF-CLAIMS, BLOCKERS, CRYPTOGRAPHER-SIGN-OFF, FIPS-TRACEABILITY, TRUSTED-COMPUTING-BASE, AUDIT-2026-05/06, docs/mptc/*, jasmin/README, 3 Go comments + cli help string.
Also corrected the downstream false claim that Corona (Ring-LWE) and Pulsar (Module-LWE) are 'different lattice families' giving 'structural/family diversity': both are Module-LWE, so the Double-Lattice defense is construction/implementation diversity (threshold-Raccoon vs ML-DSA), not hardness-family diversity; a Module-LWE break affects both legs (hash-based Magnetar is the assumption-diversifier). Fixed companion R-SIS -> Module-SIS where it was the module scheme's SIS assumption; added the Langlois-Stehle (DCC 2015) Module-LWE citation alongside LPR 2010.
Delicate artifacts: proof identifiers (rlwe_sign_op, RLWE_Functional theory/file, *_eq_rlwe bridges, CentralRLWESign, RLWESign, rlwe_compute_*) were NOT renamed -- EasyCrypt/jasmin toolchains are absent here so a rename cannot be compile-verified, and .assurance/ gates parse those names. Added clarifying naming notes to the 5 prominent .ec files, proofs/easycrypt/README.md, AXIOM-INVENTORY.md, and jasmin/rlwe/sign.jazz. .assurance/*.txt left untouched (already say Module-LWE/Module-SIS; rlwe tokens are gate-parsed identifiers). Left AUDIT-2026-06.md:463 historical rename-log and the ProtoStar-LWE paper-title substring untouched.
go build ./... and go test ./... green (GOWORK=off; all packages ok).
2.4 KiB
Corona EasyCrypt Theories
This directory holds the EasyCrypt mechanization of the Class N1
(byte-equality) and Class N4 (reshare public-key preservation)
correctness claims for Corona, mirroring ~/work/lux/pulsar/proofs/easycrypt/.
Naming note. Identifiers and file names containing
RLWE/rlwehere (e.g. theRLWESignmodule type,rlwe_sign_op, andlemmas/RLWE_Functional.ec) are retained proof identifiers for the single-party reference signer the threshold protocol refines against; Corona is a Module-LWE scheme (threshold-Raccoon/Ringtail; module dims M=8, N=7 overZ_q[X]/(X^256+1)).
File map
| File | Contains |
|---|---|
Corona_N1.ec |
Master theorem: threshold output = single-party output (byte-equal) on the reconstructed share |
Corona_N4.ec |
Reshare public-key preservation on the honest reshare module |
Corona_N1_Memory.ec |
byte-memory model (mem_t + load/store + frame laws) |
Corona_N1_Signature_Codec.ec |
Corona signature type + codec round-trip + length |
Corona_N1_Combine_Layout.ec |
Combine input/output byte layout invariants |
Corona_N1_Sign_Layout.ec |
centralized Sign input/output byte layout invariants |
Corona_N1_Combine_Refinement.ec |
byte-walk + memory-sep + layout-frame axioms for the extracted Combine |
Corona_N1_Sign_Refinement.ec |
byte-walk + memory-sep + layout-frame axioms for the extracted Sign |
Corona_N1_Combine_Wrapper.ec |
wrapper bridge: extracted Combine -> Corona_Threshold module interface |
Corona_N1_Sign_Wrapper.ec |
wrapper bridge: extracted Sign -> RLWESign module interface |
Corona_N1_Extracted.ec |
the IMPLEMENTATION-BACKED end-to-end theorem; cite this |
lemmas/RLWE_Functional.ec |
in-house EC mechanization of Boschini ePrint 2024/1113 §3 Sign |
lemmas/Corona_CT.ec |
constant-time obligations on the threshold-layer routines |
Total: 13 EC files, mirroring Pulsar's exact count.
Admit budget
0 admits across all files. Tracked by
scripts/checks/ec-admits.sh (ADMIT_BUDGET=0).
Trust footprint
The IMPLEMENTATION-BACKED theorem to cite for end-to-end N1 byte-equality correctness is
Corona_N1_Extracted.corona_n1_byte_equality_extracted
The full per-axiom inventory lives in AXIOM-INVENTORY.md.
The Lean correspondence lives in proofs/lean-easycrypt-bridge.md.
Compile
bash scripts/checks/ec-compile.sh
Requires easycrypt on PATH. Skips silently otherwise.