mirror of
https://github.com/luxfi/keys.git
synced 2026-07-26 23:58:11 +00:00
Hanzo AI
251f2e45a0
Implements Bindel-Brendel-Fischlin (CCS 2021) + Cremers-Düzlü-Fiedler-
Fischlin-Janson (Asiacrypt 2023) stronger-binding hybrid signature for
Lux validator identity. Replaces the raw-concat plan in migration/
Step 4 — raw concat reduces to MIN security under non-honest-key
adversary (CDFFJ23 §4); BBF binds both pubkeys into m_bound so the
joint scheme is EUF-CMA under max(EUF-CMA_secp, sEUF-CMA_mldsa).
Construction:
m_bound = SHAKE256-384("lux-hybrid-sig-v1" || left_encode(8·|pk_c|)
|| pk_c || left_encode(8·|pk_pq|) || pk_pq
|| left_encode(8·|msg|) || msg)
sig_c = secp256k1.SignHash(sk_c, m_bound[:32])
sig_pq = mldsa65.SignCtx(sk_pq, m_bound, ctx="lux-hybrid-sig-v1")
Verify = AND( secp256k1.VerifyHash(...), mldsa65.VerifyCtx(...) )
Classical choice: secp256k1 (not ed25519, not X25519). The existing
Lux P/X validator identity already anchors on secp256k1
(keys.ValidatorKey.ECPrivateKey + PChainAddr); a hybrid identity is
a pure superset. X25519 is a KEM, not a signature scheme.
Files added:
- hybrid.go: HybridPublicKey / HybridPrivateKey / HybridSignature
types + HybridSign / HybridVerify / HybridBoundDigest /
HybridPublicKeyBytes.
- hybrid_test.go: 13 tests covering round-trip, both-must-verify,
msg-bound joint-pubkey binding, no-component-substitution
(CDFFJ23 attack), domain separation, msg tampering, deterministic
derivation, distinct paths produce distinct identities, legacy
ServiceIdentity is byte-distinct, backward-compat secp256k1 path,
nil safeties, bad-input rejection, wipe idempotence. All race-clean.
- service_identity.go: DeriveHybridIdentity (mnemonic, path) →
HybridIdentity with NodeID derived via single SHAKE256-384 over
wire-form hybrid pubkey (per cryptographer review, no BTC-style
double-hash needed). Classical leaf at m/44'/9000'/idx'/0'/0',
PQ leaf at m/44'/9000'/idx'/0'/1'. Domain-separated KDF prefixes
prevent collision with legacy ML-DSA-only ServiceIdentity at the
same path.
- proofs/easycrypt/Hybrid_BBF_Binding.ec: formal theory with three
headline lemmas: bbf_joint_pubkey_binding, bbf_strong_unforgeability,
bbf_min_secur_lower_bound. Concrete reduction bound
max(Adv^EUF-CMA_secp, Adv^sEUF-CMA_mldsa) + q_h²/2³⁸⁴.
Test run: `go test -race -count=1 ./...` PASS (1.96s for hybrid suite,
2.43s including pre-existing ServiceIdentity tests).