LP-8200: F-Chain — FHE Bootstrap-Keys, Encrypted EVM, and Threshold Decryption

Implementation status (code-audited 2026-07-03): PARTIAL F-Chain genesis + FHEVMID confirmed (genesis/builder/builder.go:609, registry.go:66); TFHE/Bootstrap cert lanes confirmed (share.go:26-27); dealerless DKG (fhe/pkg/threshold/dealerless_dkg.go) and no-reconstruct AJL+12 decrypt (partial_decrypt.go:8-45) confirmed; decrypt gateway is 0x02..0083 (relayer.go:290) not 0x0700; encrypted-EVM execution and a standalone fhevm plugin binary remain unbuilt (runtime lives in chains/mpcvm/fhe).

Normative topology + fee model: LP-0130. F-Chain encrypted supply MUST prove conservation against X-side escrow (LP-0130 §2, I-5) — no independent asset supply. F fees are paid from a F-local fee balance funded via ImportTx from X; FHE / GPU worker rewards and threshold-decrypt committee payouts settle to X via the epoch fee root. Threshold-decrypt sessions are charged as M-Chain service fees deducted from F's originating request context (LP-0130 §7).

Abstract

F-Chain (FVM) is the Lux chain that runs fully-homomorphic encryption (FHE) compute. It owns three jobs: (1) encrypted EVM execution over TFHE ciphertexts, (2) the TFHE bootstrap-key generation ceremony, and (3) threshold-FHE decryption — the path by which authorized parties jointly reveal a plaintext without any single party ever holding the decryption key.

F-Chain owns all encrypted computation on Lux. It is the canonical successor to the FHE half of the removed T-Chain (LP-134; migration map LP-7050). It is a chain spec: the FHE primitives (TFHE gates, bootstrap, params) live in LP-066, the FHE runtime (dual Go/GPU stack, ciphertext format, typing, performance, encrypted- EVM opcodes, gas) is LP-167, and the GPU kernel fabric is LP-013. F-Chain runs on the shared mpcvm substrate (renamed from thresholdvm 2026-07-03), operationally distinct from M-Chain (LP-7100, MPC signing).

Range placement

Per the chain-letter IA lock (CHAIN-IA-2026-05-18.md), F-Chain lives in 8xxx alongside Z-Chain (LP-8000) — both are privacy / encrypted-execution chains. All crypto primitives (including FHE primitives) live in 4xxx; the FHE chain lives in 8xxx.

Motivation — why compute on encrypted data

Confidential DeFi, private balances, and sealed-bid mechanisms need computation over data that is never revealed in plaintext on-chain. FHE makes this possible: you can add and multiply ciphertexts and get the encryption of the sum/product, without decrypting. The two hard parts are (a) bootstrapping — refreshing a ciphertext's noise so you can keep computing — which is expensive and needs a shared evaluation key, and (b) decryption — which must never be a single party's power, or that party can unmask everyone. F-Chain exists to run both as first-class, quorum-driven chain activities.

Intuition — the three jobs

Bootstrap-key generation. TFHE's programmable bootstrap needs a bootstrapping/evaluation key. F-Chain runs a dealerless DKG so the collective public key is formed with no party holding the secret (composing the lattice/v7 multiparty collective-key-gen + coefficient-wise Shamir over the LSS substrate, LP-7103). The resulting evaluation key is published; fchain_fhe_root commits the evaluation-key state per epoch (LP-134).
Encrypted EVM execution. F-Chain runs EVM opcodes over TFHE ciphertexts (the encrypted-EVM opcode set + gas accounting is specified in the runtime, LP-167; the GPU kernels are LP-013 via the drain_fhe service). Confidential ERC-20 and private DeFi call into these.
Threshold-FHE decryption. To reveal a result, a t-of-n quorum runs a no-reconstruct threshold decryption: each party emits a partial decryption masked behind the public ciphertext component c1 (AJL⁺12-style noise-flooding + Bendlin–Damgård), and the secret key s is never formed. This is the canonical replacement for any earlier "threshold FHE" braided into T-Chain.

Chain parameters

Parameter	Value
Chain letter	`F`
VM ID / name	`fvm`
Consensus	Quasar (Nebula mode — computation graph)
Substrate	`~/work/lux/chains/mpcvm` (Go, shared with M-Chain)
GPU service	`drain_fhe` (LP-013, LP-132)
Cert lanes	`FChainTFHE` (compute attestation), `FChainBootstrap` (blind-rotate / bootstrap-key proof) (LP-134)
Decrypt gateway precompile	`0x0700` — fail-closed ACL gateway (no single-key decrypt)

Threshold-FHE decryption (canonical spec at the chain level)

The decrypt quorum runs over shares of the FHE secret key produced by the dealerless keygen above. The kernel guarantees:

No-reconstruct: s is only ever the coefficient of the public c1 in the summed masked partials; no party or coordinator forms the full s.
No-party-holds: dealerless keygen means no party ever held s even at setup.
Fail-closed gate: the 0x0700 precompile is an ACL gateway — a single-key decrypt request is refused structurally.

The algorithm, noise-flooding parameters, and the negative-control proofs live in the FHE runtime (LP-167) and luxfi/fhe/pkg/threshold; F-Chain specifies when the ceremony runs (session open, quorum, timeout) and how the result binds into consensus (FChainTFHE lane).

Composition

Z-Chain private disclosure. Z-Chain commits to a ciphertext on-chain (encrypted rollup state); authorized parties request threshold decryption via F-Chain; the plaintext is revealed only once the quorum is reached. This is the private-disclosure path (LP-8045 encrypted-execution interface).
Confidential ERC-20 / private DeFi. C-Chain contracts call an F-Chain precompile to operate on encrypted balances (LP-9400–9403).
Private cross-chain transfer. LP-068 composes F-Chain (FHE) with B-Chain (bridge) for private teleport.
Keygen ↔ M-Chain. The DKG that produces bootstrap-key shares reuses the same LSS substrate (LP-7103) as M-Chain custody, but the ceremony and the resulting key are F-Chain's.

Reference implementation

Substrate: ~/work/lux/chains/mpcvm (Go)
FHE runtime (canonical): LP-167 → ~/work/lux/fhe (Go reference + C++/GPU production), luxfi/fhe/pkg/threshold (no-reconstruct threshold decrypt)
TFHE primitive: LP-066; GPU kernels: LP-013
Encrypted-EVM interface: LP-8045 (Z-Chain encrypted execution layer)

Open questions

F-Chain genesis (bootstrap-key ceremony quorum, evaluation-key publication policy)
GPU/CPU split for blind-rotate workloads
L1 / L2 placement (per LP-018)
Z-Chain ↔ F-Chain message format for encrypted-state proofs

F-Chain — FHE Bootstrap-Keys, Encrypted EVM, and Threshold Decryption