hip-0084

HIP-84: Pulsar-M — Threshold ML-DSA DKG & Signing. Status Draft. Hanzo's own standard — read this before implementing against it.

HIP-0084: Pulsar-M — Threshold ML-DSA DKG & Signing

Abstract

Pulsar-M is the threshold ML-DSA primitive consumed by Q-Chain finality (HIP-0079). It produces signatures byte-equal to single-party FIPS 204 ML-DSA — the threshold-aggregated output verifies under the unmodified FIPS 204 ML-DSA.Verify routine. Targeting NIST MPTC Class N1 (signing) + N4 (ML keygen / DKG) per IR 8214C.

Pulsar-M is distinct from the cryptographic primitive specification at ~/work/lux/pulsar-m/spec/pulsar-m.tex. The spec PDF is the NIST submission package; this HIP is the deployment contract between Q-Chain (the consumer) and Pulsar-M (the producer).

Specification

Production defaults

| parameter | value | rationale | |-----------------------|--------------------------------------------|--------------------------------------------------------| | sig scheme | 0x52 Pulsar-M-65 | NIST PQ Cat 3, ML-DSA-65 verifier-compatible | | hash family | 0x01 SHA3_NIST (cSHAKE256/KMAC256/TupleHash256) | FIPS 202 + SP 800-185, FIPS-aligned | | committee size n | 64 | balance of latency, communication cost, fault tolerance| | BFT fault bound f | 21 | n = 3f + 1 | | threshold t | 43 | t = 2f + 1 | | corruption model | honest majority at threshold layer | Quorus-style; documented in spec §"Adversary model" | | DKG cadence | once per epoch | not per block — DKG is heavy, signing is light | | epoch length | network-configurable; default 1 hour | tune operationally | | online signing | preprocessing-enabled | offline rounds 1–2 + non-interactive online | | abort handling | identifiable abort, signed evidence | slashing-grade attribution |

High-value roots (governance, bridges, slashing, archival checkpoints) use 0x53 Pulsar-M-87 (NIST PQ Cat 5). Devnet / testnet may use 0x51 Pulsar-M-44 for fuzzing and CI; mainnet refuses 0x51.

DKG flow

1. Validator registers ML-DSA-65 identity on Z-Chain (HIP-0078).
2. Z-Chain updates validator_registry_root.
3. Epoch boundary triggers committee selection.
4. Lux randomness beacon supplies committee_seed.
5. validator_registry_root + committee_seed → committee (64 of N).
6. committee_root posted to Z-Chain.
7. Pulsar-M DKG:
     Round 1: Pedersen commitments per party
     Round 2: share + blind delivery, recipient verification
     Round 3: complaint / abort with signed evidence
8. Output: group_public_key, party shares (s_i, u_i)
9. dkg_transcript_root + group_public_key_hash posted to Z-Chain.
10. Z-Chain proves committee membership, transcript validity, key derivation.
11. Q-Chain begins accepting finality blocks under group_public_key_hash.

Online signing flow

For each Q-Block at height H:
  1. Driver computes canonical transcript hash (HIP-0079 §"Canonical transcript binding").
  2. Pulsar-M committee runs:
       Round 1: per-party commit (Gaussian-sampled mask)
       Round 2: per-party response (using share s_i, challenge c, mask)
  3. Aggregate: combine responses into FIPS 204 σ = (c̃, z, h).
  4. If rejection-sampling fails (||z|| > γ1 - β or ||r0|| > γ2 - β),
     restart with fresh masks. Restart is bounded; a committee that
     consistently fails restart has a misconfigured DKG and aborts
     identifiably.
  5. Signed σ is the Q-Block's threshold signature.

The 2-round threshold structure reuses Pulsar's R-LWE protocol skeleton (~/work/lux/pulsar), retargeted to Module-LWE per the spec PDF. Output is byte-equal to single-party FIPS 204 ML-DSA-65.

Identifiable abort

A party that deviates produces a verifiable complaint:

Complaint {
    epoch                 uint64
    party_id              uint32
    deviation_type        enum     // BAD_COMMIT / BAD_SHARE / BAD_RESPONSE / TIMEOUT
    evidence              []byte   // protocol-specific witness
    complainer_signature  []byte   // ML-DSA-65 sig from a non-deviating party
}

Complaints are submitted to Z-Chain. A valid complaint with quorum attribution slashes the deviating party's stake per the slashing protocol (out of scope for this HIP).

Wire format

The Q-Block (HIP-0079) carries pulsar_m_threshold_signature as the standard FIPS 204 ML-DSA-65 byte encoding (3309 bytes for 0x52, 4627 bytes for 0x53). No threshold-specific framing on the wire — the verifier is the unmodified FIPS 204 verifier.

The DKG ceremony's intermediate messages are encoded per the Pulsar-M technical specification (~/work/lux/pulsar-m/spec/pulsar-m.tex, §"Encodings", frozen at end-August 2026). DKG transcripts post to Z-Chain as a Merkle root over the canonical-encoded message log; individual messages are retrievable via DA layer.

Group public key

The group public key produced by Pulsar-M DKG is a valid FIPS 204 ML-DSA-65 public key — distributed uniformly over the public-key space, indistinguishable from a single-party ML-DSA.KeyGen output under M-LWE assumption (see spec PDF §"Output indistinguishability"). This is the entire point of the Pulsar-M family: the threshold ceremony produces a key the broader ecosystem accepts as ML-DSA-65.

NIST submission posture

This HIP describes the deployment of Pulsar-M into Lux infrastructure. The NIST MPTC submission is the spec PDF + Go reference implementation + KAT suite + experimental-evaluation report at ~/work/lux/pulsar-m, target package deadline 2026-Nov-16.

| MPTC dimension | Pulsar-M target | |-------------------------|--------------------------------------------------| | class | N (NIST-specified primitive) | | subclass | N1 (signing) + N4 (ML keygen / DKG) | | primitive | ML-DSA / FIPS 204 | | interchangeability | unmodified FIPS 204 verifier accepts σ | | hash family | SHAKE256 / cSHAKE256 / KMAC256 / TupleHash256 | | security target | NIST PQ Cat 3 (suggested); Cat 2 + Cat 5 also shipped | | primary parameter set | Pulsar-M-65 (mainnet); Pulsar-M-44 + -87 (additional) |

Baseline references:

Security considerations

parties per epoch. Adaptive corruption proof is a stretch goal for the round-1 MPTC submission and a hard requirement for round 2.

proactive resharing is the defence (epoch boundaries reset share material). Spec §"MOB" has the formal game.

separated by (sid, κ, T) so multi-attempt sign on same (pk, μ) doesn't leak across restarts. Spec §"RESTART-NL".

deterministic. Closes HIP-0077 red-review F10.

reference implementation enforces this via a no-secret-logs CI gate.

ports forward into Pulsar-M's reshare path.

Production safety

forbidden — too slow, too fragile, defeats the offline/online split.

participants don't match committee_root is rejected by Q-Chain acceptance check (HIP-0079 §"Acceptance rule" item 4).

group key not in group_public_key_hash is refused.

Adoption order

  1. Pulsar-M reference implementation (~/work/lux/pulsar-m/ref/go/)

completes through Sign + Verify with KAT cross-validation against FIPS 204 reference.

  1. KAT suite freezes at end-August 2026 (encoding-freeze gate).
  2. Pulsar-M mptc-preview-2026 tag cut.
  3. NIST MPTC package submitted 2026-Nov-16.
  4. Lux validator-side integration: consensus/protocol/quasar/

gains a Pulsar-M producer that satisfies the QWitnessProducer interface.

  1. Z-Chain integration: DKG transcripts post to Z-Chain via the

identity-registry path (HIP-0078 §"Z-Chain proof obligations").

  1. Q-Chain integration: Q-Block envelope (HIP-0079) consumes

Pulsar-M-65 signatures.

References