Implement Falcon-512 verifier (direct-NTT, validated by a real fixture)#1
Open
V-k-h wants to merge 2 commits into
Open
Implement Falcon-512 verifier (direct-NTT, validated by a real fixture)#1V-k-h wants to merge 2 commits into
V-k-h wants to merge 2 commits into
Conversation
Port step 1-2 of PORTING.md: zq (mod-12289 add/sub/mul) and the recursive NTT/INTT + mul_zq from s2morrow falcon_old (SPDX headers preserved). Validated under the repo toolchain (scarb 2.18/snforge 0.59): 9 known-answer NTT tests (n=4..512) + split_ntt pass. Verifier impl still a stub (schemes.json unchanged, implemented:false). Next: packing + verify + real fixture.
… fixture - packing.cairo: base-Q unpack (18 coeffs/felt) with canonical-range check (the "PK coeffs < Q on read" validation the reference lacked) - lib.cairo: real Falcon512Verifier — unpack h + (s2, msg_point), s1 = msg_point - s2*h via mul_zq (convention-independent), accept iff ||s1||^2+||s2||^2 <= 34034726 - tests/bench.cairo: paired bench_verify_/bench_baseline_ over a REAL fn-dsa Falcon-512 signature + a tampered-rejection correctness test - schemes.json: implemented=true, sig_felts=58 (pack(s2)++pack(msg_point)), pubkey_felts=29 - README: measured status; PORTING.md: implemented - results/: regenerated via `make all` — verify ~125.8M L2 gas / 1.09M steps (over the validate budget; production needs the unrolled/hint NTT) Looped NTT ported from s2morrow (StarkWare Industries, MIT; SPDX preserved).
Author
|
@ericnordelo ready for review — this fills in the
Happy to adjust the encoding or add the hint variant as a separate scheme if you'd prefer. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the
falcon_512stub with a real, working Falcon-512 (FN-DSA) verifier.What
crates/falcon_512/PORTING.mdand the smaller-trust-surface guidance there.
s1 = msg_point - s2*h(mod q) viamul_zq, accepts iff||s1||^2 + ||s2||^2 <= 34_034_726.msg_pointis carried in the signature (the deployeds2morrow interop path).
Correctness gate
Validated against a real fn-dsa Falcon-512 signature (standard SHAKE-256), generated
off-chain with the Falcon reference signer:
bench_verify_falcon_512accepts the genuine signature.falcon_512_rejects_tamperedrejects a tampered one.Encoding
public_key= 29 felts: base-Qpack(h)(18 coeffs/felt).signature= 58 felts:pack(s2)++pack(msg_point).Measured cost (over budget — the honest finding)
make allregeneratesresults/:cheaper unrolled or hint-based NTT (smaller gas, larger/harder-to-audit TCB, and it
currently trips the Sierra compiler under snforge). Documented in the crate README/PORTING.
Provenance
Looped NTT/
zqported from s2morrow (StarkWare Industries, MIT); SPDX headers preserved.Registry:
schemes.jsonflipped toimplemented: true,sig_felts: 58,pubkey_felts: 29.