Pippenger's window method (banderwagon.MultiExp) branches on scalar
digits, leaking secret prover-side scalars to a Flush+Reload attacker.
Wrap MultiExp with multiplicative blinding (k_i -> k_i*r, post-multiply
by r^-1 via Fermat) so the cache trace depends on a fresh per-call r
instead of the underlying witness/blinding scalars.
Five prover-side call sites switched to the blinded path:
- prover.go:109,113,118,122 (a_R/a_L witness halves and z_L/z_R)
- config.go:64 IPAConfig.Commit (full witness polynomial; trades the
PrecompMSM precomputed-table speedup for protection of secret coeffs)
Verifier-side callers (verifier.go:50,70 and multiproof.go:241) keep
using the unblinded MultiScalar since they only consume public scalars.
r is sampled via crypto/rand and converted to Montgomery form so the
downstream Mul/Exp operate consistently with ScalarsMont:true.
r^-1 uses Fermat (r^(q-2)) for a constant-iteration inversion ladder
rather than the variable-time extended-Euclidean Inverse.
A post-MSM normalization restores the canonical (0,1,1) projective
form for the identity element, since gnark's scalarMulGLV produces
a non-canonical representation that confuses Element.Equal.
Tests in ipa/ipa/prover_blinding_test.go: 600 random correctness
checks across 6 input sizes (n=2,4,8,64,128,256), input-mutation
guard, length-mismatch error, and a timing-variance smoke test
(cv ~34%, indicates fresh r per call exercises the masking path).
- ci.yml: matrix arch={amd64,arm64} cgo={0,1} on hanzo-build runners
- test.yml: Go + Rust matrix on both archs
- release.yml: test+build matrix arm64+amd64, release on amd64
No QEMU. No GitHub-hosted builders. Native runners only.
The unified C ABI header in luxcpp/crypto was renamed from c-abi/lux_crypto.h
to c-abi/crypto.h as part of the brand-neutral sweep. Update doc comments to
reference the new filename.
No functional change; comments only.
Domain separation tags and identifiers in cryptographic code must be
readable in a scientific paper without product context. Strip the Lux
brand from in-code crypto identifiers; algorithm names ARE the namespace.
DSTs (golden vectors regenerated):
pedersen NewGenerators: LUX_PEDERSEN_{G,H} -> PEDERSEN_{G,H}_V1
pedersen NewGeneratorsFromSeed: LUX_PEDERSEN_SEEDED_GEN_V1 -> PEDERSEN_SEEDED_GEN_V1
pedersen golden G/H test vectors recomputed for the new DST.
Env vars (one canonical name only — no deprecated alias):
backend.envBackend: drop LUX_CRYPTO_BACKEND fallback, CRYPTO_BACKEND only
rust/build.rs: drop LUX_CRYPTO_DIR / LUX_CRYPTO_BUILD_DIR fallbacks
Rust c-abi link names:
lux-crypto-keccak: extern "C" name keccak256 (was lux_keccak256)
lux-crypto-secp256k1: secp256k1_ecrecover{,_batch} (was lux_*)
lux-crypto umbrella: drop all #[link_name = "lux_*"] attrs;
the canonical luxcpp/crypto C-ABI exports brand-neutral symbols
directly, the Rust function names mirror them one-for-one.
Go cgo aliases:
hash/blake3/blake3_c.go: drop the four #define aliases that mapped
crypto_* -> lux_crypto_*; the C header now declares brand-neutral
names directly.
Tests passing:
lux/crypto: 50 packages ok, 0 fail (GOWORK=off go test ./... -short)
rust workspace: 18 tests across 3 crates (CRYPTO_BUILD_DIR=... cargo test --release)
NewGeneratorsFromSeed(seed [32]byte) derives (G, H) deterministically via
RFC 9380 hash-to-curve (SVDW) on BN254 G1, with msg = seed || u64_le(index)
and DST = "LUX_PEDERSEN_SEEDED_GEN_V1". BN254 G1 has cofactor 1, so outputs
are subgroup-correct without clearing.
Existing crypto/rand-backed NewGenerators is unchanged.
Tests: 5 same-seed determinism cases, 5 cross-seed isolation cases, 1
homomorphism check on the seeded basis, 1 frozen golden vector for the
incrementing seed {0..31} so future C++/Rust KAT generators can be cross-
checked against Go byte-for-byte.
The luxcpp/crypto archives export bare-named C symbols (keccak256,
secp256k1_ecrecover, blake3, ed25519_sign, slhdsa_sign) consistently
across all 30+ algorithms. The keccak/secp256k1/blake3 Rust crates had
drifted to declaring `lux_<alg>_<op>` link names that the archives
never exposed, causing link-time symbol-not-found at workspace test.
- keccak: drop link_name="lux_keccak256", call bare keccak256
- secp256k1: drop link_name="lux_secp256k1_ecrecover{,_batch}", call bare
- blake3: archive only exports `blake3` today; remove the unimplemented
keyed_hash/derive_key/hash_xof Rust facade plus the broken
spec_vectors test that referenced a non-existent JSON file
- ed25519, slhdsa: unchanged (already matched archive)
cargo test --release --workspace: 0 link errors. The pre-existing
ed25519 RFC8032 failures (returning -5 = CRYPTO_ERR_NOTIMPL) are due
to the C-ABI ed25519 still being a NOTIMPL stub in luxcpp/crypto, not
a symbol-audit issue.
Fills the Rust binder gaps from CANONICAL_AUDIT.md (commit 9affea3). Each
crate is a thin extern-C binding to the corresponding luxcpp/crypto C-ABI
archive, mirroring the existing keccak/blake3/secp256k1/ed25519/slhdsa
pattern.
Per-crate layout: Cargo.toml + build.rs + src/lib.rs + tests/kat.rs.
build.rs resolves the luxcpp install dir via CRYPTO_DIR / CRYPTO_BUILD_DIR
with a fallback to ../../../../luxcpp/crypto/build-cto. Archives are linked
PRIVATE so blst/banderwagon/etc do not leak past the crate boundary.
Tests: 20 KATs pass across the 14 new crates against the live luxcpp
build at /Users/z/work/luxcpp/crypto/build-cto. Real-body algos (sha256,
ripemd160, blake2b, evm256, ipa, kzg, pedersen) are exercised against
known-answer vectors; algos whose c-abi shim returns CRYPTO_ERR_NOTIMPL
in this build (lamport, bls, mldsa, mlkem, ntt, poly_mul, aead) accept
either a successful round-trip or NOTIMPL coherently across all entry
points.
Workspace cargo build --release --workspace passes. The pre-existing
keccak/secp256k1/blake3 spec-vector tests fail at link time due to
unrelated lux_ prefix drift after the brand-neutral C-ABI rename; not
addressed in this batch.
The Banderwagon prime-order group used by Verkle / IPA had been vendored
internally under lux/crypto/ipa/banderwagon. Extract it to
lux/crypto/banderwagon as the canonical Lux public surface; rewrite all
internal ipa callers (prover, verifier, config, multiproof, common,
transcript, test_helper, tests) to import from the canonical home.
- Provenance comment on every file: github.com/crate-crypto/go-ipa
(Apache-2.0 / MIT dual). Adds LICENSE-GO-IPA-APACHE2 and
LICENSE-GO-IPA-MIT alongside the package.
- Element / Generator / Identity / Fr / MSMPrecomp / PrecompPoint /
CompressedSize / UncompressedSize / SetBytes / SetBytesUncompressed /
ElementsToBytes / BatchToBytesUncompressed / BatchNormalize /
MapToScalarField / BatchMapToScalarField / Add / Sub / Double / Neg /
ScalarMul / MultiExp now have one and only one home: lux/crypto/banderwagon.
- Verkle (parallel branch) will switch its banderwagon import to this
canonical surface.
- KAT vectors from the upstream go-ipa Verkle reference suite preserved
(TestEncodingFixedVectors, TestPointAtInfinityComponent) plus all
precomp MSM-vs-gnark random-round tests (1000 * NumCPU rounds).
Tests: go test ./banderwagon/... ./ipa/... — all PASS (banderwagon 27s,
ipa 16s, ipa/bandersnatch 24s, fp/fr 4s+2s, common 3s).
Replaces the prior `verkle/verkle.go` re-export shim (`type X =
upstream.X`, `var Fn = upstream.Fn` against `github.com/ethereum/go-verkle`)
with a full source vendor of `github.com/ethereum/go-verkle@v0.2.2` into
`/Users/z/work/lux/crypto/verkle/` under luxfi copyright. Every type and
function now has a concrete Go body in luxfi-owned files; no aliases
remain. Resolves the canonical-audit violation flagged in
CANONICAL_AUDIT.md (commit 9affea3).
Provenance:
Upstream: github.com/ethereum/go-verkle@v0.2.2 (public domain / Unlicense)
Per-file header notes vendor source and Lux Ecosystem License rebadge.
Files (13 source + 10 tests, ~7,900 LOC vendored):
verkle/config.go, config_ipa.go, conversion.go, debug.go, doc.go,
verkle/empty.go, encoding.go, hashednode.go, ipa.go, proof_ipa.go,
verkle/proof_json.go, tree.go, unknown.go (+ matching _test.go)
Surface preserved (all symbols consumed by lux/geth/trie, lux/geth/core/types):
Types: VerkleNode, InternalNode, LeafNode, Empty, Point, Fr,
VerkleProof, StateDiff, NodeResolverFn, IPAConfig, Proof
Const: NodeWidth
Funcs: ParseNode, New, ToDot, GetConfig, MakeVerkleMultiProof,
SerializeProof, HashPointToBytes, FromLEBytes, FromBytes,
DeserializeProof, MergeTrees, BatchNewLeafNode,
PreStateTreeFromProof
Methods: *InternalNode.{Insert,Commit,Hash,GetValuesAtStem,
DeleteAtStem}, IPAConfig.CommitToPoly, ...
go.mod: drop direct require on github.com/ethereum/go-verkle; promote
crate-crypto/go-ipa and davecgh/go-spew to direct (still pulled
through banderwagon primitives — to be swapped to luxfi/crypto/ipa
once the parallel banderwagon vendor lands at lux/crypto/banderwagon).
Tests (GOWORK=off go test ./verkle/ -count=1):
82 PASS, 4 SKIP, 2 FAIL.
TestParseNodeEoA and TestParseNodeSingleSlot fail identically against
upstream go-verkle@v0.2.2 (verified) -- these are pre-existing upstream
test fixtures gone stale; not caused by the vendor.
Consumer compatibility verified by external module replace+build
exercising every consumed symbol: ok.
Outstanding (tracked, not blocking):
- Switch IPA primitives import from `crate-crypto/go-ipa/{banderwagon,
common,ipa}` to `luxfi/crypto/ipa/*` once the banderwagon-vanilla
branch lands. Done in this commit would conflict with the parallel
work-in-progress.
- Two upstream-stale test fixtures (TestParseNodeEoA,
TestParseNodeSingleSlot) to be regenerated against current encoding
in a follow-up.
Branch: verkle-vanilla-2026-04-27
Author lux/crypto/blake3/ to mirror lux/crypto/keccak and lux/crypto/sha256:
- blake3.go: Hash, HashHex, HashBatch, New, NewKeyed, KeyedHash,
DeriveKey, Reader (XOF), Concat. Backed by github.com/zeebo/blake3
(BSD-3, pure Go with SSE4.1/AVX2/NEON), counted as vanilla per
CANONICAL_AUDIT.md directive.
- gpu.go: batchGPU stub matching keccak/sha256 dispatch surface; falls
through to CPU because luxfi/accel does not yet expose a real BLAKE3
kernel (its HashBlake3 currently aliases SHA-256). When accel ships
the kernel, wire it in here, no API change.
- blake3_test.go: 35/35 official BLAKE3 reference KAT vectors
(test_vectors.json embedded) for hash, keyed_hash, derive_key. Plus
batch parity, incremental==contiguous, XOF, hex, key-size validation.
- doc.go: package overview matching keccak/sha256 docs.
Closes the blake3 hard violation in CANONICAL_AUDIT.md (commit 9affea3).
The earlier draft listed secp256k1 as a hard violation. That was a
misread. /Users/z/work/lux/crypto/secp256k1/secp256k1.go (build tag
!cgo) is a complete vanilla Go canonical via decred/dcrd/dcrec/secp256k1/v4
covering Sign / RecoverPubkey / VerifySignature / DecompressPubkey /
CompressPubkey -- byte-for-byte parity verified with the cgo libsecp256k1
backend on KAT (deterministic RFC 6979 k, fixed seckey, fixed message;
sig + recovered pub identical between backends).
This matches the audit's own legend (line 16): established Go crypto
crates count as vanilla; decred secp256k1 is in the same class as
circl, gnark-crypto, x/crypto.
Hard violation count drops 4 -> 3. The remaining hard violations are
blake3 (missing), verkle (re-export wrapper), banderwagon (empty dir).
Backend status verified 2026-04-27:
vanilla (CGO_ENABLED=0): tests pass; sign 67us, recover 362us, verify 557us
cgo libsecp256k1: tests pass; sign 24us, recover 63us, verify 56us
cgo is faster (~3-10x) and stays as opt-in accelerator. Both produce
identical signatures.
Read-only enumeration of canonical paths across luxcpp/crypto and
lux/crypto. Documents 4 hard violations (blake3 missing, verkle as
upstream re-export, banderwagon empty, secp256k1 cgo-primary) plus
6 luxcpp C++/CPU body gaps and 14 Rust binder gaps.
P0 work to author: verkle, secp256k1, blake3, banderwagon vanilla Go
bodies. Source-to-port cited per file.
Adds lux-crypto-slhdsa crate binding to FIPS 205 SLH-DSA. Wraps the
luxcpp/crypto/slhdsa C-ABI (slhdsa_keygen/sign/verify) over the vendored
PQClean reference (sphincs-{sha2,shake}-{128,192,256}f-simple/clean,
CC0/public domain), six 'f' fast parameter sets:
Mode 2/3/5 -> SLH-DSA-SHA2-{128,192,256}f (NIST L1/L3/L5)
Mode 12/13/15 -> SLH-DSA-SHAKE-{128,192,256}f (NIST L1/L3/L5)
Surface: Mode enum with const pk_len/sk_len/sig_len matching FIPS 205
§10 catalogue (32/48/64 pk; 64/96/128 sk; 17088/35664/49856 sig).
keygen / sign / verify return Result<_, Error> with explicit
InvalidLength / InvalidSignature / InternalError discriminants.
Underlying byte-equal NIST KAT compliance is shown by the C++ side at
build-cto/slhdsa_kat_test (498 PASS lines across all six variants).
Rust roundtrip suite covers (keygen, sign, verify, tampered-sig,
tampered-pk, tampered-msg, short-pk) for the four 128f/192f variants
plus a sizes-match-FIPS205 invariant; 256f is gated --ignored
(sign() takes 30+s on M1).
cargo test -p lux-crypto-slhdsa: 6 passed, 2 ignored (long).
Add lux-crypto-ed25519 to the rust workspace. The crate links statically
against libed25519.a + libed25519_cpu.a from the matching luxcpp/crypto
ed25519-cpu-vendor branch (e1e6eac4) and exposes the canonical Ed25519
surface:
keygen(seed) -> (sk, pk)
sign(sk, msg) -> sig
verify(pk, msg, sig) -> Result<(), Error>
The canonical secret form is the 32-byte RFC 8032 §5.1.5 seed; the expanded
NaCl 64-byte form lives inside the C wrapper.
tests/rfc8032_vectors.rs walks all 8 RFC 8032 §7.1 / Bernstein sign.input
vectors (TEST 1, 2, 3, 1024, SHA(abc), donna #4-#6) and asserts:
- keygen pk byte-equal to RFC pk
- sign sig byte-equal to RFC sig
- verify accepts the published triple
- verify rejects bit-flipped sig and pk
plus deterministic_signing and random_roundtrip (16 random seeds, 4
mutation positions each). 3/3 tests pass.
Run with: CRYPTO_BUILD_DIR=$LUXCPP/crypto/build-ed25519 cargo test
All 23 lux-crypto-* crates now have:
- README.md with algorithm description, build instructions
(CRYPTO_DIR / CRYPTO_BUILD_DIR), source attribution
- workspace-inherited authors/homepage/repository/documentation
- crates.io-ready metadata (description, keywords, categories)
cargo publish --dry-run --no-verify passes for all 23 crates.
PUBLISHING.md documents the publish runbook: license decision required
before upload, cargo login flow, name reservation order, dry-run sweep,
ordered upload, native-archive dependency (Option C documented), docs.rs
follow-up, versioning policy, source attribution table.
This prepares the crates for a human with a crates.io token to run the
real cargo publish step. No upload happens automatically -- the LICENSE
decision (BSD-3-Clause vs Lux Ecosystem License) must be confirmed first.
Two new no_std crates wrapping the C-ABI from luxcpp/crypto/ntt and
luxcpp/crypto/poly_mul.
lux-crypto-ntt:
* forward / inverse — generic-prime NTT (caller-supplied modulus + root)
* Cyclone-FFT fast path engaged automatically when (modulus, root) ==
(Q=998244353, PRIMITIVE_ROOT=629671588)
* 6 spec-vector tests:
- forward+inverse roundtrip across n in {2,4,...,1024}
- q97/omega=28 generic-prime roundtrip (matches Go reference)
- input rejection: empty, non-pow2, modulus=0
lux-crypto-poly_mul:
* multiply / multiply_into — Z_Q[X]/(X^n+1) negacyclic convolution
* Pinned to Cyclone-FFT prime (the C-ABI rejects other rings)
* 4 spec-vector tests including the canonical 10-case KAT table
(sum/first/last byte-equal to luxfi/crypto/poly_mul Go reference)
and the (1+2X+3X^2+4X^3)*(5+6X+7X^2+8X^3) hand-written negacyclic case.
build.rs links statically against libntt_cpu.a / libpoly_mul_cpu.a
produced by luxcpp/crypto/ntt and luxcpp/crypto/poly_mul; CRYPTO_BUILD_DIR
or CRYPTO_DIR points at the cmake build / install layout.
Verified: cargo test -p lux-crypto-ntt -p lux-crypto-poly_mul
6/6 ntt tests PASS, 4/4 poly_mul tests PASS.
Canonical Rust binding for the Poseidon2 t=2 BN254 Merkle-Damgard
hasher landed in luxcpp/crypto/poseidon. Links statically against
libposeidon.a + libposeidon_cpu.a and exposes:
hash(input) -> [u8; 32]
hash_into(input, output) -> in-place fill of caller buffer
Byte-equal to upstream gnark-crypto v0.20.1 (NewMerkleDamgardHasher
over NewParameters(2, 6, 50)). 10 spec-vector integration tests
pass, including the canonical 32B/64B/96B block-boundary cases and
trivial avalanche/determinism checks.
Crate is no_std + forbid(unsafe_op_in_unsafe_fn) and follows the
existing per-algorithm crate layout.
Real Rust binding over the now-real luxcpp/crypto/blake3 C-ABI
(commit c4a1d2e0, "vendor BLAKE3 v1.5.0 reference C"). Exposes all four
canonical BLAKE3 modes:
hash(input) -> [u8; 32]
keyed_hash(key, input) -> [u8; 32]
derive_key(context_z, key_material) -> [u8; 32]
hash_xof(input, &mut output) -> ()
Statically links libblake3.a + libblake3_cpu.a from the build dir
(CRYPTO_BUILD_DIR or the canonical build-cto/ default).
Test (tests/spec_vectors.rs) parses upstream test_vectors.json (vendored
under luxcpp/crypto/blake3/test/vectors/) and asserts byte-equality
across all 35 cases x 4 modes = 140 assertions. cargo test PASS.
The lux-crypto umbrella crate's build.rs defaulted to ../../../../luxcpp/crypto/
build-canonical when neither CRYPTO_DIR nor CRYPTO_BUILD_DIR was set. That
directory is a partial build from before the 2026-04-26 brand-neutral C-ABI
rename (luxcpp commit e8690bb8 "drop lux_ prefix from C-ABI symbols"). Its
libsecp256k1_cpu.a still exports _lux_secp256k1_ecrecover (legacy) while the
Rust extern "C" block expects _secp256k1_ecrecover (post-rename, brand-neutral).
build-canonical also lacks banderwagon/sha256/ripemd160 archives.
All 17 sibling per-algorithm crates already default to build-cto; only the
umbrella was misaligned. Switching the umbrella default to build-cto makes the
workspace build out of the box.
Verified: cargo test --workspace --all-features reports 182 PASS, 0 fail
(matching the #97-retry baseline) with no env vars set, and also with explicit
CRYPTO_BUILD_DIR=/Users/z/work/luxcpp/crypto/build-cto.
Route github.com/crate-crypto/go-ipa and github.com/ethereum/go-verkle
through luxfi-maintained mirrors so all Lux crypto consumers converge on a
single canonical source. Pinned to luxfi/go-verkle v0.2.2 and
luxfi/go-ipa@d31adc04. See LUXFI-FORK.md in each fork for sync policy.
Tests verified: ./verkle/... and ./ipa/... pass.
slhdsa: 120 NIST FIPS 205 ACVP keygen vectors (revision FIPS205, vsId 53;
10 per parameter set x 12 sets), vendored from circl testdata
(public-domain NIST sample data). Each vector pins
(skSeed, skPrf, pkSeed) -> pk and is asserted byte-equal via the
circl backend our Go layer wraps. Round-trip check signs and
verifies once per parameter set.
lamport: 10 deterministic Lamport-SHA256 vectors derived from a documented
KDF chain (SHA-256 of "lamport-kat/v1\\0" || seed). Each vector
pins (seed, msg32) -> (PK digest, sig digest). The KDF contract is
the cross-layer determinism contract - the C++ body and Metal
driver must reproduce the same byte stream.
Test counts: slhdsa 24 (incl 120 KAT subtests), lamport 6 (incl 10 KAT).
Both packages PASS with GOWORK=off go test.
blake3: pure-Go body wrapping zeebo/blake3 (already in go.mod). Three modes
(hash/keyed/derive_key) plus XOF. KAT against the official BLAKE3
test_vectors.json (35 input lengths from 0 to 102400 bytes, 4 modes each
= 140 byte-equal assertions).
poseidon: extended Sum2 wrapper with Permutation2 (raw t=2 permutation) and
Compress2 (gnark-crypto Compress contract). KAT vectors generated from
gnark-crypto v0.20.1 (default params t=2, rF=6, rP=50, d=5) for 16
permutation cases.
Both layers assert byte-equal to the published spec, no oracle indirection.
poly_mul: new package implementing polynomial multiplication over the
canonical FFT prime Q = 998244353 = 119 * 2^23 + 1. Schoolbook + NTT-based
negacyclic convolution paths; both byte-equal across the 10 KAT vectors
embedded in the test file. Reference for the C++ port and Metal kernel.
pedersen: extend with DeterministicGenerators(seed) and CommitBatch.
DeterministicGenerators yields a reproducible (G, H) pair from a seed so
the C++ and GPU layers share the same KAT inputs. CommitBatch is the
shape the GPU driver consumes. 11 KAT vectors locked in.
ipa: add CheckMultiProofBatch wrapping the existing single-proof verifier.
10 KAT batched proofs, plus tamper-detect and length-mismatch tests.
verkle: add Verify re-export and VerifyBatch wrapper. 10 single-leaf
KAT proofs verified end-to-end through the upstream go-verkle Verify.
ed25519: documents RFC 8032 byte-equal Metal verify kernel (100 vectors)
+ N_threshold = 256 on M1 Max with 26.7x speedup at N=4096 vs equivalent-
shape CPU port. dGPU CUDA port pending in lux/crypto/ed25519/gpu/cuda/.
mldsa: documents structural-skeleton M1 kernel + dGPU residual. Per-thread
serial work on Apple Silicon (~122 us SHAKE256-dominated) vs ~42 us NEON
narrows expected M1 wall-clock speedup to ~7x at N=4096; CUDA H100/Ada
closes that gap (~33x ceiling).
mlkem: same shape as mldsa, ~75 us per-thread Metal vs ~26 us NEON.
SHA3/SHAKE256 chains are the M1 ceiling; dGPU port closes it.
- 3 new pure-Rust unit tests covering all Secp256k1Status::from_int
arms (0..=7 + invalid), all CryptoStatus::from_int arms (Ok variants
+ 5 typed error variants + Unknown), and all NIST mode dispatch
for mldsa/mlkem/slhdsa (Mode2, Mode3, Mode5).
- 9/9 tests passing via `cargo test --lib`.
- COVERAGE.md: pure-Rust dispatch helpers at 100% line; whole-crate
36.97% reflects FFI declaration weight (extern "C" blocks +
thin pub fn wrappers that forward to luxcpp/crypto C-ABI). The
cryptographic logic itself is tested in luxcpp/crypto/<alg>/test/.
- BENCHMARKS.md: explicit no-criterion-yet note; Rust crate adds
no measurable overhead to the FFI call so a Rust-side bench would
duplicate the C-side numbers within sampling noise.
- .gitignore: target/, *.profraw, *.profdata.
Adds Rust modules wrapping the canonical luxcpp/crypto C-ABI for:
- ML-DSA (FIPS 204) modes 2/3/5
- ML-KEM (FIPS 203) modes 2/3/5
- SLH-DSA (FIPS 205) modes 2/3/5
- Ed25519 keygen/sign/verify
- keccak256 single-shot
Each module exposes safe Rust wrappers with size validation and a typed
CryptoStatus enum from the unified lux_crypto.h return-code contract.
Brand-neutral surface (no LUX_ prefix on Rust constants); link_name
attributes map to the existing lux_<alg>_<op> archive symbols until the
next luxcpp rebuild flips the archives to brand-neutral.
build.rs links per-algorithm libcpp_cpu.a archives from the
build-canonical/<alg>/ subdirectories.
The -sys suffix is a Rust ecosystem convention for thin FFI bindings to
THIRD-PARTY C libraries (openssl-sys, libgit2-sys, etc.). We author the
C/C++ ourselves at luxcpp/crypto, so -sys would be misleading.
Brand-neutral rule: 'one and one way to do everything' — the crate is
lux-crypto, the lib name is lux_crypto. If a high-level safe wrapper is
ever needed, it lives inside this same crate as pub mod safe.
Mirrors the canonical pattern at github.com/luxfi/gpu (Rust binding to
luxfi/accel) — no -sys suffix on first-party crates.
Consumers update separately.
Phase-1 surface for Rust callers (Hanzo node, Lux node, Zoo node):
* secp256k1: lux_secp256k1_ecrecover + lux_secp256k1_ecrecover_batch
Build script locates luxcpp/crypto via LUX_CRYPTO_DIR / LUX_CRYPTO_BUILD_DIR
or defaults to a sibling-checkout layout. Links against libsecp256k1_cpu.a
and the platform C++ runtime.
Subsequent agents extend this with mldsa/mlkem/slhdsa/bls12381/etc.
luxfi/crypto becomes the single Go entry point for ALL Lux-family crypto.
Every public function in this module now dispatches between three
implementations through a runtime-selectable backend:
- vanilla: pure-Go reference (always available)
- cgo: native binding (blst, libsecp256k1, ckzg) where present
- gpu: batch acceleration via github.com/luxfi/accel
The dispatcher reads LUX_CRYPTO_BACKEND (auto|vanilla|cgo|gpu); auto
picks the most capable backend the binary was compiled and linked with.
New canonical packages:
backend/ runtime backend selector (env + programmatic)
internal/gpuhost/ accel session lifecycle, single per-process
keccak/ Keccak-256 with batch GPU dispatch
sha256/ SHA-256 with batch GPU dispatch
sha3/ SHA3 / SHAKE family
ripemd160/ RIPEMD-160 (Bitcoin/Lux address derivation)
ed25519/ Ed25519 with batch GPU verify
bn254/ canonical alias for bn256 (matches FIPS naming)
modexp/ canonical alias for bigmodexp
evm256/ EIP-196/197 precompile ABI wrappers
poseidon/ Poseidon2 hash via gnark-crypto
pedersen/ Pedersen commitments over BN254
ntt/ Number-Theoretic Transform reference
polymul/ negacyclic polynomial multiplication
Extended existing packages with batch GPU paths:
bls/batch.go BatchVerify routes through accel.BLSVerifyBatch
mldsa/batch.go BatchVerify (ML-DSA-65) via accel.DilithiumVerifyBatch
mlkem/batch.go BatchEncapsulate / BatchDecapsulate via Kyber kernels
secp256k1/batch.go BatchVerifySignature via accel.ECDSAVerifyBatch
GPU dispatch is gated on (a) backend.Default(), (b) batch size threshold,
and (c) accel.Available(). When any gate fails the call falls through to
the vanilla CPU path; output is byte-identical.
The legacy gpu/ stub is replaced with a thin probe surface (Available,
Backend, Devices, Version) that delegates to the same gpuhost session.
Tests show vanilla and gpu backends produce identical outputs across all
batch entry points (-race clean).
See AUDIT.md for the per-algorithm state matrix and honest gaps.
Hanzo AI