Adds the canonical noise-flooding threshold-decryption primitives that
upstream consumers (notably luxfi/threshold/protocols/tfhe) need to
implement true M-of-N FHE decryption without any party holding the
master key.
- ShareLWESecretKey: Shamir-splits the LWE secret coefficient-by-
coefficient over Z_q. No party ever sees the master.
- PartialDecryptLWE: party j computes d_j = c_1 · s_j + e_j with
fresh smudging noise from a discrete Gaussian.
- CombineLWE: integer-Lagrange (Bendlin-Damgård denominator clearing)
+ Δ^{-1} mod q to recover the plaintext polynomial.
- SmudgingSigma: tight noise calibration against the worst-case
integer Lagrange numerator, so Λ_max · σ · √t · 6 ≤ Q/16.
Decomplecting note: this LSSS-over-Z_q lives next to the existing
LSSS-over-RFC-3526-prime in pkg/threshold. The two are different
primitives — large-prime LSSS shares high-entropy secrets where the
secret space need not equal the FHE modulus; Z_q LSSS composes
directly with lattice arithmetic. Both stay in this package.
Decryption follows Bendlin-Damgård (TCC 2010, §4.2) and Asharov-Jain-
López-Alt-Tromer-Vaikuntanathan-Wichs (EUROCRYPT 2012, §4). Noise
flooding is the simulation-soundness mechanism.
Verified by round-trip tests at (t, n) ∈ {(2, 3), (5, 9), (11, 21)},
below-threshold negative test, share-doesn't-equal-master regression
guard, dedup guard, cross-parameter guard, and combine-determinism
test. All 8 new threshold tests pass.
Also adds public accessors:
- fhe.Parameters.ParamsLWE/ParamsBR — expose underlying rlwe.Parameters
so out-of-tree threshold callers can drive lattice primitives
against the same parameter set the encryptor uses.
- fhe.BitCiphertext.Bits / NewBitCiphertextFromBits — iterate per-bit
for threshold decryption without round-tripping MarshalBinary.
References:
- Bendlin, Damgård. Threshold Decryption and Zero-Knowledge Proofs
for Lattice-Based Cryptosystems. TCC 2010.
- Asharov, Jain, López-Alt, Tromer, Vaikuntanathan, Wichs. Multiparty
Computation with Low Communication, Computation and Interaction
via Threshold FHE. EUROCRYPT 2012.
- Mouchet, Troncoso-Pastoriza, Bossuat, Hubaux. Multiparty
Homomorphic Encryption from Ring-Learning-with-Errors. PETS 2021.
- Remove old Go FHE code (now in lux/fhe)
- Remove old Zama compatibility layers
- Update CI for TypeScript/JS SDK only
- This repo is now purely the @luxfhe npm package ecosystem
- Remove replace directive for lattice/v7 (now using published v7.0.0)
- Keep gpu replace as it requires local C++ compilation and the git repo
path (luxfi/mlx) doesn't match module path (luxfi/gpu)
- TODO: Rename github.com/luxfi/mlx to github.com/luxfi/gpu to fix module path
- Change Go version from 1.25.5 (nonexistent) to 1.23
- Revert Refresh on carry in ScalarAdd which caused Ubuntu failure
- Tests pass locally; carry is bootstrapped via HalfAdder operations
The ScalarAdd operation was reusing the input ciphertext directly as
the carry without refreshing its noise. This could lead to noise
accumulation in subsequent operations, causing incorrect results on
some platforms (notably Windows).
Changes:
- Add Refresh bootstrap on the carry in ScalarAdd when scalar bit 0 is 1
- Split self-subtraction test into true self-subtraction and independent
encryption subtraction for better coverage
- Merged tfhe-wasm into sdk/wasm/
- SDK now includes: c, python, rust, typescript, wasm
- Removed duplicate tfhe-wasm and tfhe-wasm-node repos
- Various optimizations and test improvements
BSD-3-Clause-Research License: Pure Go TFHE implementation with
patent-pending innovations including deterministic FHE for blockchain
consensus, transaction-batch amortized bootstrapping, and parallel
bootstrapping with work-stealing scheduler.
