luxfi/threshold

Fork 0

mirror of https://github.com/luxfi/threshold.git synced 2026-07-27 04:01:59 +00:00

Files

T

6fa490e8ee docs: add docs/audit.md and fix broken README links (closes #5 ) (#7 )

* fix: add mutex to FROST sign rounds (concurrent map write at 8+ signers)

* fix: LSS keygen race condition — use MarshalBinary instead of Equal (dcrd ToAffine mutates)

* feat: add threshold ML-DSA scaffold per Celi et al. (USENIX '26)

First practical threshold signature scheme compatible with NIST FIPS 204
ML-DSA. Outputs byte-identical standard ML-DSA signatures, enabling drop-in
replacement of classical threshold ECDSA/Schnorr wallets with a PQ scheme
that keeps the standardized verification path.

Paper: Celi, del Pino, Espitau, Niot, Prest — Efficient Threshold ML-DSA,
USENIX Security Symposium 2026.

Files:
- papers/threshold-mldsa.tex — paper summary + integration notes (LaTeX)
- protocols/mldsa/doc.go — package doc
- protocols/mldsa/params.go — (T,N) × level parameter tables (44/65/87)
  from paper Tables 3, 10, 11
- protocols/mldsa/rss.go — replicated secret sharing with hardcoded optimal
  partitions for 2 ≤ T ≤ N ≤ 6 (Appendix B, Algorithm 6)
- protocols/mldsa/hrej.go — imbalanced hyperball rejection (Fig. 4)
  — mathematical spec stub, ring ops pending CIRCL integration
- protocols/mldsa/rss_test.go — 6 tests covering subsets, recovery
  completeness, balance bounds, parameter coverage

Config range: 2 ≤ T ≤ N ≤ 6 (2-of-3, 3-of-5, etc.)
Security: static dishonest-majority in ROM under MLWE + ML-DSA unforgeability.
Rounds: 3 per attempt, K parallel instances for ≥ 1/2 success probability.

* feat: mldsa-bench — PQ signing benchmarks for quasar + LP-045

Bench harness for 3 / 5 / 10 / 100 node PQ signing patterns:
  - individual: each validator signs, no aggregation (baseline)
  - committee:  k-of-n sample signs, the LP-045 cluster cert
  - hierarchical: n validators in M clusters (LP-045 two-layer)

Uses deterministic light mnemonic derivation — 100 validators from a
single 32-byte master seed, no interactive keygen, no mainnet keys.

Results on MacBook M3 / 10 cores / arm64 at ML-DSA-44:
  n=100 individual: 8.87 ms sign / 3.57 ms verify / 242 kB
  n=100 committee (k=32): 3.57 ms sign / 4.14 ms verify / 77 kB
  n=100 hierarchical (4 clusters): 14.7 ms sign / 5.35 ms verify

Committee sampling cuts signing cost 3× vs all-100 signing.
ML-DSA-65 is ~3× slower. Even at Level III, 100 validators sign in
<30 ms per block — fine for quasar finality at any realistic block time.

.gitignore: scope mldsa-bench binary ignore to repo root only
so the cmd/mldsa-bench/ source dir is tracked.

* feat: fixed-committee mode — scale-invariant PQ signing at N=1K/10K/100K

Adds -mode=fixed which samples a fixed k-size committee regardless of
total validator count N. Proves the scale-invariance claim in LP-045 +
the PQ-finality-without-BLS proof (~/work/lux/proofs).

Measured on MacBook M3 (arm64, 10 cores) at ML-DSA-44, k=128:
  N=1,000     sign=7.9ms  verify=3.2ms  cert=310 kB
  N=10,000    sign=7.4ms  verify=3.2ms  cert=310 kB
  N=100,000   sign=7.8ms  verify=3.4ms  cert=310 kB
  N=100,000 (ML-DSA-65): sign=10.8ms verify=5.9ms cert=424 kB

Same cost from 10^3 to 10^5 validators. Only the VRF-based sampling
touches N, and that is O(log N) in a weighted-reservoir implementation.

* docs: add docs/audit.md and fix broken README links (closes #5)

The README linked to `docs/audit.md`, `docs/api.md`, and
`docs/integration.md` — none of which exist. This confuses users
evaluating the library for production use.

- Add `docs/audit.md` that honestly states external-audit status is
  "not yet commissioned", lists upstream primitive audits that users
  can rely on, documents known limitations, and points at the
  responsible-disclosure contact. The audit-log table is left empty
  for future audits to be appended.
- Replace the two other dangling links (`api.md`, `integration.md`)
  with links to docs that actually exist in the repo today
  (`FROST.md`, `Broadcast.md`, `LUX_INTEGRATION.md`).

Closes #5.

---------

Co-authored-by: Hanzo AI <dev@hanzo.ai>
Co-authored-by: Abhishek Krishna <abhi@kcolbchain.com>

2026-05-19 11:31:11 -07:00

3.7 KiB

Raw Permalink Blame History

Security Audit Status

This document describes the current security-review posture of the luxfi/threshold library and tracks the status of external audits. It resolves #5 by making the audit state explicit instead of linking to a missing document.

TL;DR

Component	Status
External third-party audit	❌ Not yet commissioned
Internal review	✅ Ongoing — tracked in this repo
Upstream primitive audits	✅ See Upstream audits below
Responsible-disclosure process	✅ `security@lux.network`

Do not deploy this library to mainnet custodying user funds without performing — or commissioning — your own security review. The production-readiness badges in the README refer to test coverage, correctness testing, and internal review; they are not a substitute for an external cryptographic audit.

Scope of this repository

The library implements several threshold-signature protocols, each with distinct trust assumptions and failure modes:

CMP — ECDSA, 4-round online / 7-round presigning, identifiable aborts.
FROST — Schnorr/EdDSA, BIP-340 Taproot compatible.
LSS — ECDSA with dynamic resharing.
Doerner — 2-of-2 ECDSA.
Unified — chain-adapter layer.

Each protocol has its own security proof in the literature; correctness of this implementation against those proofs is the subject of internal review and will be the subject of external audit.

Upstream audits

Several building blocks are taken from — or closely track — implementations that have themselves been audited. Those audits cover the primitive, not its use in this library:

secp256k1 — curve operations use the audited decred/dcrd/dcrec package.
Paillier encryption / ZK proofs — adapted from taurushq-io/multi-party-sig, which follows the CMP20 specification.
Edwards-curve Ed25519 — filippo.io/edwards25519.
Blake3 — lukechampine.com/blake3.

If you are depending on one of these primitives in isolation, consult the upstream audit directly.

Internal review

100% line coverage on protocols/lss, protocols/frost, protocols/unified, protocols/doerner; 75%+ on protocols/cmp.
Concurrent-signing fuzz and race tests in internal/test/.
Known side-channel considerations (constant-time scalar arithmetic, no data-dependent branching on secret material) documented in code comments next to the relevant operations.

Known limitations

Network layer is out of scope. The library expects the caller to supply authenticated, confidential channels between parties. The provided internal/test.Network is for tests only.
Identifiable abort in CMP relies on all parties running the reference implementation. A malicious party running a modified implementation may cause an abort without being identifiable.
HSM-compatible in the README means the wire format is compatible with typical HSM APIs; no HSM vendor has certified this library.

Responsible disclosure

Report vulnerabilities privately to security@lux.network. Please do not open a public issue for suspected security bugs. We will acknowledge receipt within 72 hours and aim to confirm or reject the report within 10 business days.

Audit log

External audits will be listed here once completed.

Date	Auditor	Scope	Report
—	—	—	—

3.7 KiB Raw Permalink Blame History