zeekay
ac0729b51d
Updates the certificate-layer spec and the DKG proof-boundary spec/vectors from their v0.5.0 grounding (docs/pulsar-final, 24 commits behind) to the real v0.6.3 tree (3a6c2ea). DOCS ONLY — no code touched. Every implementation claim re-grounded file:line in ref/go/pkg/pulsar/ at v0.6.3. The load-bearing change: the keygen residual is CLOSED for Claim (A). v0.6.0+ ships DEALERLESS RSS keygen (mithril_rss.go MithrilRSSKeygen — Mithril short Replicated Secret Sharing, ia.cr/2026/013; the dealer is dead at keygen too), whose threshold signatures verify byte-for-byte under stock circl mldsa65.Verify (mithril_rss_test.go:38 all 15 committees N<=6; mithril_rss_n8_test.go:16 T==N at n=8,n=16). The v0.6.3 accumulateSubset per-subset mod-q reduction (mithril_rss.go :122) fixes a uint32 overflow that wrapped the key once C(N,N-T+1)>=512, unblocking large committees (n=16,t=14, C(16,3)=560; reconstructed ||s2||inf~205 << gamma2). The Mithril 3-round HYPERBALL no-reconstruct signer (mithril_rss_hyperball.go SignHyperball, gates 5/6) signs the RSS key with NO party/coordinator ever forming the full s1/s2/y/w0/sk: each party emits only z_j = y_j + c*s1_(j); the summed z is a standard FIPS-204 response; the secret mask y is never serialised (commit2c1458f). Verifies under stock circl (mithril_rss_hyperball_test.go:41). PULSAR.md: full v0.6.3 architecture (dealerless RSS keygen, hyperball no-reconstruct signer, BCC/CSCP v0.4, malicious hardening v0.5, mlwe de-dup v0.6.1/.2, overflow fix v0.6.3); the version lineage (v0.3 algebraic-broadcast REMOVED -> ... -> v0.6.3 + hyperball); and the Avalanche-native sampled-cert committee math — sample MANY small dealerless RSS committees, r-of-m binomial tail, default Pulsar-HYBRID-PQ-v1 n=8,t=7,m=12,r=8 (one-committee p~2^-8.6, P_fail~2^-59.8; NOT n=64/t=5), unbiasable stake-weighted VRF sortition seeded by the prev finalized block, committeePlanHash bound into the Quasar subject, three tiers FAST/HYBRID_PQ/PQ_ROOT. DKG-PROOF-BOUNDARY.md + vectors: keygen residual restated (CLOSED via dealerless RSS for Claim A; full FIPS-204 KeyGen-distribution-equivalence is the labelled open-research residual). Keeps the 7 deliverables; adds RSS keygen + hyperball to the transcript spec, DST table, share-commitment format, vectors (3 new positive, 5 new negative), and the proof checklist (18 rows). Line numbers refreshed v0.5.0 -> v0.6.3 throughout. Claim discipline held: (A) standard-verifier-compatible is PROVEN (circl accepts; tests cited); (B) full FIPS-204 KeyGen-distribution-equivalence + malicious-secure CSCP/identifiable-abort are labelled residuals. Never claims FIPS/NIST-certified threshold ML-DSA, fully-malicious-secure-proven, or global-1000-validator DKG.
Test vectors
Two formats per NIST MPTC submission norms:
-
kat-v1.json— input/output vectors per MPTC §IO-Testing. Each entry is a single threshold ceremony with full(n, t, party_seeds, public_params, shares, commitments, preprocessing_transcript, message, per_party_messages, final_signature, verify_result, abort_evidence). -
kat-v1.rsp— CAVS-style response file for compatibility with legacy ACVP-inspired tooling. One signature per stanza, deterministic from a 48-byte seed.
transcripts/ holds full-protocol KATs for (n, t) sweeps —
transcripts/n3-t2.jsonl, transcripts/n7-t5.jsonl, etc. — each line
a complete protocol run.
Cross-validation against FIPS 204
The headline interchangeability claim (Class N1) requires every
final_signature in kat-v1.json to verify against unmodified FIPS 204
ML-DSA.Verify(pk, message, signature) returning accept. The
cross-validation harness at test/interoperability/ runs each KAT
through:
- the reference implementation in
ref/go/ - the FIPS 204 reference (Dilithium pq-crystals C reference)
- a third independent ML-DSA implementation (BoringSSL FIPS or OpenSSL 3.0 PQ provider, whichever is available)
A KAT mismatch with any of the three release-gates the next tag —
scripts/cut-submission.sh refuses to cut a tarball if the
cross-validation diff is non-empty.
Determinism
Every entry in kat-v1.json is reproducible from master_seed (a
48-byte hex value at the head of the file). scripts/gen_vectors.sh
must produce byte-identical output on any fresh checkout. Drift here
is a CI failure.
Status
- KAT generator (
ref/go/cmd/genkat) shipped; deterministic from 48-byte seed - v1 KAT set (
{dkg,keygen,sign,threshold-sign,verify}.json) - FIPS 204 cross-validation against
cloudflare/circl(19/19 N1 subtests attest/interoperability/) - Independent-impl cross-validation against pq-crystals Dilithium reference
- Full-protocol transcripts at
vectors/transcripts/for(n, t) ∈ {(3,2), (5,3), (7,5), (10,7), (16,11), (32,21)}