Closes LP-137 RED-FINAL §2.4 (issue N3): collapse the legacy two-DST
PEDERSEN_G_V1 / PEDERSEN_H_V1 path to a single canonical
PEDERSEN_SEEDED_GEN_V1 with counter-indexed generation, matching the
C++ canonical at luxcpp/crypto/pedersen/cpp/pedersen.hpp:47.
Both NewGenerators(rng) and DeterministicGenerators(seed) now flow
through pedersen_seed.NewGeneratorsFromSeed:
- NewGenerators reads 32 bytes from rng as the seed.
- DeterministicGenerators compresses arbitrary-length input via
SHA-256 to a 32-byte key, then dispatches.
- Both branches use HashToG1(key || u64_le(i), DST=SeededGenDST)
with i=0 for G and i=1 for H — byte-equivalent to C++ from_seed.
KAT vectors (pedersen_test.go::katCases) regenerated under the new
derivation. Two new tests:
- TestCanonicalSeededDST locks the on-wire DST string so any drift
fails loudly before it can break GPU↔CPU byte-equality.
- TestDeterministicMatchesFromSeed proves DeterministicGenerators
reduces to NewGeneratorsFromSeed(SHA-256(seed)) — the contract the
post-N3 collapse promises.
All 11 pedersen tests pass; existing TestNewGeneratorsFromSeed_GoldenVector
remains the cross-language anchor (matches luxcpp pedersen_kat.h G[0].x).
Co-authored-by: Abhishek Krishna <abhi@kcolbchain.com>
Lines 84/90 of pedersen.go still used legacy LUX_PEDERSEN_{G,H}. Sweep #196
left them unchanged; commitments produced by DeterministicGenerators were
not byte-equal to C++/Metal/CUDA/WGSL outputs. Replace with the canonical
PEDERSEN_G_V1 / PEDERSEN_H_V1 strings (matches NewGenerators at lines
50/54 and the seeded path at PEDERSEN_SEEDED_GEN_V1).
Regenerate the KAT golden vectors in pedersen_test.go for the new DSTs;
seed string "lux-pedersen-kat-v1" is content (passed as the seed bytes),
not a DST, so left intact. Cross-checks against the C++ canonical golden
(G=c563aa8a..0c6b7, H=e9ebf439..0f3186 for incrementing seed) continue
to pass via pedersen_seed_test.go.
Tests pass: go test ./pedersen/... -count=1 -short -race -timeout 30s.
Domain separation tags and identifiers in cryptographic code must be
readable in a scientific paper without product context. Strip the Lux
brand from in-code crypto identifiers; algorithm names ARE the namespace.
DSTs (golden vectors regenerated):
pedersen NewGenerators: LUX_PEDERSEN_{G,H} -> PEDERSEN_{G,H}_V1
pedersen NewGeneratorsFromSeed: LUX_PEDERSEN_SEEDED_GEN_V1 -> PEDERSEN_SEEDED_GEN_V1
pedersen golden G/H test vectors recomputed for the new DST.
Env vars (one canonical name only — no deprecated alias):
backend.envBackend: drop LUX_CRYPTO_BACKEND fallback, CRYPTO_BACKEND only
rust/build.rs: drop LUX_CRYPTO_DIR / LUX_CRYPTO_BUILD_DIR fallbacks
Rust c-abi link names:
lux-crypto-keccak: extern "C" name keccak256 (was lux_keccak256)
lux-crypto-secp256k1: secp256k1_ecrecover{,_batch} (was lux_*)
lux-crypto umbrella: drop all #[link_name = "lux_*"] attrs;
the canonical luxcpp/crypto C-ABI exports brand-neutral symbols
directly, the Rust function names mirror them one-for-one.
Go cgo aliases:
hash/blake3/blake3_c.go: drop the four #define aliases that mapped
crypto_* -> lux_crypto_*; the C header now declares brand-neutral
names directly.
Tests passing:
lux/crypto: 50 packages ok, 0 fail (GOWORK=off go test ./... -short)
rust workspace: 18 tests across 3 crates (CRYPTO_BUILD_DIR=... cargo test --release)
NewGeneratorsFromSeed(seed [32]byte) derives (G, H) deterministically via
RFC 9380 hash-to-curve (SVDW) on BN254 G1, with msg = seed || u64_le(index)
and DST = "LUX_PEDERSEN_SEEDED_GEN_V1". BN254 G1 has cofactor 1, so outputs
are subgroup-correct without clearing.
Existing crypto/rand-backed NewGenerators is unchanged.
Tests: 5 same-seed determinism cases, 5 cross-seed isolation cases, 1
homomorphism check on the seeded basis, 1 frozen golden vector for the
incrementing seed {0..31} so future C++/Rust KAT generators can be cross-
checked against Go byte-for-byte.
poly_mul: new package implementing polynomial multiplication over the
canonical FFT prime Q = 998244353 = 119 * 2^23 + 1. Schoolbook + NTT-based
negacyclic convolution paths; both byte-equal across the 10 KAT vectors
embedded in the test file. Reference for the C++ port and Metal kernel.
pedersen: extend with DeterministicGenerators(seed) and CommitBatch.
DeterministicGenerators yields a reproducible (G, H) pair from a seed so
the C++ and GPU layers share the same KAT inputs. CommitBatch is the
shape the GPU driver consumes. 11 KAT vectors locked in.
ipa: add CheckMultiProofBatch wrapping the existing single-proof verifier.
10 KAT batched proofs, plus tamper-detect and length-mismatch tests.
verkle: add Verify re-export and VerifyBatch wrapper. 10 single-leaf
KAT proofs verified end-to-end through the upstream go-verkle Verify.
luxfi/crypto becomes the single Go entry point for ALL Lux-family crypto.
Every public function in this module now dispatches between three
implementations through a runtime-selectable backend:
- vanilla: pure-Go reference (always available)
- cgo: native binding (blst, libsecp256k1, ckzg) where present
- gpu: batch acceleration via github.com/luxfi/accel
The dispatcher reads LUX_CRYPTO_BACKEND (auto|vanilla|cgo|gpu); auto
picks the most capable backend the binary was compiled and linked with.
New canonical packages:
backend/ runtime backend selector (env + programmatic)
internal/gpuhost/ accel session lifecycle, single per-process
keccak/ Keccak-256 with batch GPU dispatch
sha256/ SHA-256 with batch GPU dispatch
sha3/ SHA3 / SHAKE family
ripemd160/ RIPEMD-160 (Bitcoin/Lux address derivation)
ed25519/ Ed25519 with batch GPU verify
bn254/ canonical alias for bn256 (matches FIPS naming)
modexp/ canonical alias for bigmodexp
evm256/ EIP-196/197 precompile ABI wrappers
poseidon/ Poseidon2 hash via gnark-crypto
pedersen/ Pedersen commitments over BN254
ntt/ Number-Theoretic Transform reference
polymul/ negacyclic polynomial multiplication
Extended existing packages with batch GPU paths:
bls/batch.go BatchVerify routes through accel.BLSVerifyBatch
mldsa/batch.go BatchVerify (ML-DSA-65) via accel.DilithiumVerifyBatch
mlkem/batch.go BatchEncapsulate / BatchDecapsulate via Kyber kernels
secp256k1/batch.go BatchVerifySignature via accel.ECDSAVerifyBatch
GPU dispatch is gated on (a) backend.Default(), (b) batch size threshold,
and (c) accel.Available(). When any gate fails the call falls through to
the vanilla CPU path; output is byte-identical.
The legacy gpu/ stub is replaced with a thin probe surface (Available,
Backend, Devices, Version) that delegates to the same gpuhost session.
Tests show vanilla and gpu backends produce identical outputs across all
batch entry points (-race clean).
See AUDIT.md for the per-algorithm state matrix and honest gaps.
Hanzo AI