← All proposals

LP-137: GPU-Native Crypto Stack

LP-137 specifies the GPU mode — the substrate, build topology, byte-equality contract, GPU-residency invariant, and C-ABI surface — that all per-algorithm crypto LPs share. Per-algorithm formal specs live in their own LPs (LP-026, LP-029, LP-066, LP-069, LP-070--077, LP-110--126, LP-131, LP-146--159). LP-137 carries no per-algorithm content.

Abstract

A GPU-native crypto substrate for the 9-chain Lux topology. Every primitive

ships a first-party CPU canonical (Go reference) and first-party

Metal/CUDA/WGSL kernels, all byte-equal to the same ground truth. Audited

upstreams (blst, c-kzg-4844, gnark-crypto, PQClean) appear only as test

oracles — never linked into shipped libraries — so the byte-equality test

retains its adversarial-distance property: a bug on either side fails the

test.

The stack covers 29 algorithms across hashes, AEAD, EC + pairings, post-

quantum signatures, lattice primitives, FHE building blocks, threshold

schemes, and composite remote-attestation parsers. It satisfies the

GPU-residency invariant: no chain-local hot path leaves attested GPU

memory in production. CPU touches reality only at packet ingress, cold-state

page service, attestation handshake, and watchdog.

1. Motivation

A fragmented crypto substrate makes the byte-equivalence contract impossible

to enforce. Three failure modes that LP-137 closes:

1. Oracle bypass. When CPU and test oracle come from the same upstream

family (e.g. both from blst or both from gnark-crypto), the byte-equality

test loses its adversarial-distance: an upstream bug passes through both

sides. First-party CPU + audited test oracle is the correct adversarial

structure — bug on either side fails the test.

2. Vendor symbol leak. Production binaries linking blst / mcl /

BoringSSL into the production graph re-expose vendor branding and tie

the security boundary to upstream release cycles. LP-137 pins those

libraries to test-only oracles at <alg>/test/cmake/.

3. Brand fragmentation. Per-org symbol prefixes (LUX_*,

LUXFI_*, HANZO_*) make the same algorithm look like five

different libraries. Algorithm names ARE the namespace.

2. Specification

2.1 Per-Algorithm Architecture

> CPU = first-party canonical, byte-equal Go reference.

> GPU = first-party Metal/CUDA/WGSL, byte-equal CPU.

> Audited upstreams = vendored TEST ORACLES ONLY.

                 +---------------------+
                 |  Reference (Go)     |
                 |  gnark-crypto, etc. |
                 +----------+----------+
                            |
                       byte-equal
                            |
                 +----------v----------+
                 |  CPU canonical      |
                 |  vendored audited   |  <-- ground truth
                 |  (mcl, blst, ...)   |
                 +----------+----------+
                            |
                       byte-equal
                            |
        +-------------------+-------------------+
        |                   |                   |
+-------v------+    +-------v------+    +-------v------+
|  Metal       |    |  CUDA        |    |  WGSL        |
|  first-party |    |  first-party |    |  first-party |
+--------------+    +--------------+    +--------------+

Per-algo target structure:

• luxcpp/crypto/<alg>/cpp/<alg>.cpp — first-party C++ CPU body.
• luxcpp/crypto/<alg>/c-abi/c_<alg>.cpp — production C-ABI shim

(dispatches to cpp/, never NOTIMPL once wired).

• luxcpp/crypto/<alg>/gpu/metal/<alg>.metal — first-party Metal kernel.
• luxcpp/crypto/<alg>/gpu/cuda/<alg>.cu — first-party CUDA kernel.
• luxcpp/crypto/<alg>/gpu/wgsl/<alg>.wgsl — first-party WGSL kernel.
• luxcpp/crypto/<alg>/test/cmake/<oracle>.cmake — pinned vendor oracle

(e.g. blst, c-kzg-4844, bitcoin-core/secp256k1) used at test-link only.

• luxcpp/crypto/<alg>/test/<alg>_metal_test.{cpp,mm} — N=100..1000

random-input determinism harness asserting byte-equality.

The four-kernel canonical template (formalized at

luxcpp/crypto/gpukit/):

expand_inputs   →   parallel_eval   →   reduce_or_batch_verify   →   commit_root

Step 1 hoists per-input scratch into device-resident arenas. Step 2 fans

one thread per input. Step 3 reduces partials (Merkle leaf hashes, MSM

windows, batch-pairing folds); parallel where associative, serial where not.

Step 4 emits the commitment in canonical order — single-thread by design,

the determinism oracle.

Lane-0-leader audit

42 if (tid != 0u) return; sites across the codebase classify as:

Zero parallelization-opportunity hits. Every lane-0-leader is structural,

not deferred work.

2.2 Repo + Org Layout

luxfi/gpu is canonical for Go GPU bindings. luxgpu/gpu (archived

upstream artifact) is unrelated and not used. luxcpp/aivm, luxcpp/mpcvm,

luxcpp/xvm migrated 2026-04-28 — three repos pushed with full tag

history; luxfi/<name> origin retained as second remote (no force-push, no

old-repo deletion).

2.3 Verified Performance

Reproduced on Apple M1 Max, macOS 26.4, median of >=10 runs.

Disputed / inflated claims (corrected)

2.4 Pedersen DST Canonical

Brand-neutral DSTs (algorithm name IS the namespace):

NewGenerators G          → PEDERSEN_G_V1
NewGenerators H          → PEDERSEN_H_V1
NewGeneratorsFromSeed    → PEDERSEN_SEEDED_GEN_V1

Hash-to-curve: BN254 G1 via RFC 9380 SVDW; cofactor 1, no clearing.

Seed format for FromSeed: msg_i = seed[32] || u64_le(i).

Golden vectors (seed = [0,1,…,31], brand-neutral DST):

G[0..31] = c563aa8a283f268b65b4210a0a78ee1341f76b59d94c1ac626effe1a5aa0c6b7
H[0..31] = e9ebf4392683dcb418584dd8ecd1e1dd16b486147e676dbf4b62779a340f3186

Pre-rename (LUX_* prefixed) values archived only — do not match canonical:

G_old = afba7c7a97100c5eb0ec96758698779b5d8d38d228bcdb7c85a4c1626ea5247a
H_old = abc19b5bad508d8e7b944a37812a342cdbaa5946f0b3fd854805820c006c6110

When the C++ pedersen-cpp-cpu branch ships, pedersen.cpp MUST hard-code

DST string PEDERSEN_SEEDED_GEN_V1 (no LUX_ prefix) and reproduce the

G/H bytes byte-for-byte. KAT harness:

pedersen/pedersen_seed_test.go::TestNewGeneratorsFromSeed_GoldenVector.

2.5 MSM Variable-Time + Caller Audit

Banderwagon Pippenger MSM is variable-time. Five prover-side SECRET

callers were blinded via MultiExpBlinded (Pedersen-style scalar

re-randomization before MSM, unblind after). Three verifier-side PUBLIC

callers remain unchanged — public scalars do not require constant-time MSM.

Categorization rule: any caller that consumes a secret scalar (witness, key

share, signing nonce) must use MultiExpBlinded. Verification with

public-input batched scalars uses MultiExp directly.

2.6 TFHE UNSAFE + Real Threshold Plan

Status: SECURITY BLOCKER. Current luxfi/threshold/protocols/tfhe is

NOT a threshold scheme. It is master-key replication wrapped in HMAC

theatre. Three independent failures:

1. KeyGenerator.GenerateKeys (tfhe.go:~374) — every party gets

UnderlyingKey: masterSK; Shamir not happening.

2. PartialDecrypter.PartialDecrypt (committee.go:~255) — returns

HMAC tag fingerprinting (party, session, ciphertext); no lattice

operation, no noise, no relation to ciphertext content.

3. Protocol.CombineShares (tfhe.go:~232) — calls single-party

decryptor.DecryptUint64 against the master-key copy and ignores

p.shares entirely.

Compensating controls (in force):

• Top-of-file UNSAFE warnings in tfhe.go and committee.go.
• Panic guards on all 4 entry points (KeyGenerator.GenerateKeys,

PartialDecrypter.PartialDecrypt, Protocol.CombineShares,

NewProtocol). All panic in production.

• Tests opt in via LUX_ALLOW_FAKE_TFHE_FOR_TESTING_ONLY=1 set in a

package-level TestMain.

• No environment-variable override for production.

Production callers (audit 2026-04-28):

Confidential lanes (#136) and FHE-policy on-chain (M-Chain × F-Chain

integration #114) MUST NOT be enabled while panic guards are in force —

they will tombstone the relevant MPC node. Intentional.

Real-implementation contract (Go, package tfhe):

// GenerateShares performs t-of-n distributed key generation.
// share_i is a Shamir polynomial evaluation at point x_i, NOT the master key.
GenerateShares(ctx, t, n int, sessionID [32]byte) (
    pk *fhe.PublicKey, shares map[party.ID]*SecretKeyShare, err error)

// PartialDecrypt produces party_i's lattice contribution.
// partial_i = a_i * s_i + e_i (BFV/CKKS partial-decryption sense).
// MUST NOT return an HMAC tag.
PartialDecrypt(ctx, share *SecretKeyShare, ct *fhe.BitCiphertext) (
    *PartialDec, error)

// CombineShares Lagrange-interpolates t partials at x = 0.
// MUST NOT call decryptor.DecryptUint64.
CombineShares(ctx, ct *fhe.BitCiphertext, partials []*PartialDec) (
    cleartext []byte, err error)

The *fhe.SecretKey field on SecretKeyShare is removed. There is no

master-key copy on any party.

Migration plan:

Total: 6–10 weeks gated on cryptographer availability.

2.7 Attestation Architecture

Two-layer split:

• C++ parsers (luxcpp/crypto/attestation/cpp/): parser-only. Decode

SEV-SNP, TDX, NVIDIA NRAS / RIM into structured fields. Signature

verification is the caller's responsibility.

• Go full-chain (luxd/cc/attest/): full chain verification. Production

SEV-SNP via go-sev-guest (signature + chain + revocation). TDX and

NRAS shipped as stubs awaiting host-side keys + RIM endpoint contracts.

Composite attestation root: 11 + 16 = 27 byte-equal C++ ↔ Go test cases.

require_* flags replaced O5-flagged "wildcards-on-zero" pattern: explicit

require_sev_snp, require_tdx, require_nv_nras booleans on the

CompositeAttestationConfig struct. Zero-byte fields no longer wildcard.

Real fixtures (B2 closure): attestation/test/fixtures/ carries genuine

SEV-SNP report blobs from AMD reference machines, TDX quotes from Intel

SGX-DCAP test vectors, and NV NRAS responses from documented NVIDIA test

endpoints. Second oracle (O2/O4 closure): kat-second-oracle-2026-04-28

adds a non-trivial second source so byte-equality cannot collapse to

self-comparison.

2.8 GH Auth + Brand Neutrality

GitHub auth: hanzo-dev only. Every git/gh operation prefixes

unset GH_TOKEN GITHUB_TOKEN so the keyring credential resolves to

hanzo-dev regardless of shell env. zeekay account exists

but is not active for LP-137 work.

Brand neutrality:

• DST strings: algorithm-named, not org-prefixed.

PEDERSEN_SEEDED_GEN_V1, not LUX_PEDERSEN_SEEDED_GEN_V1.

• C-ABI symbols: algorithm-prefixed.

bls12_381_pairing_check, not lux_bls_pairing.

• Header guards / macros / namespaces: algorithm-named throughout

luxcpp/crypto/<alg>/.

• Production binaries link zero _blst_* symbols (CI-asserted via

cevm/test/unittests/no_blst_in_production_test.sh). blst pinned to

crypto/bls/test/cmake/blst.cmake test oracle only.

3. Implementation Status (Final, 2026-04-28)

3.1 Per-Repo Final HEADs

Branches merged across the final sweep: 17. Branches deleted without merge

(obsolete): 3 (ci-only, ci-arm64-cto, bump-precompile already in main).

Pushes deferred: 0. Conflicts deferred: 0.

3.2 Verification Results (zero LP-137 regressions)

Run: `unset GH_TOKEN GITHUB_TOKEN && git fetch origin --prune && git

checkout main && git pull && GOWORK=off go build ./... && GOWORK=off

go test ./... -short -count=1 -timeout 120s`. C++: CI verification only

(workspace rule, no local C++ builds). Rust: `cargo build --release

--workspace`.

Verdict: LP-137 work introduces zero new regressions across the 12

repos. All build/test failures map to pre-existing classes already tracked

or explicitly called out in the directive.

3.3 Coverage Audit (luxcpp + luxgpu org)

• 33 sub-directories surveyed under ~/work/luxcpp/ (24 git repos + 9

non-git working dirs).

• 3 sub-repos migrated luxfi → luxcpp 2026-04-28: aivm, mpcvm, xvm.

Each created public, main + tags pushed, luxfi/<name> retained as

second remote (no force-push, no old-repo deletion).

• 0 sub-repos with unpushed local commits (every remoted repo at

ahead=0).

• 0 sub-repos under ~/work/luxgpu/ — directory does not exist; org

reserved for future C++ GPU kernel repos.

• 9 non-git working dirs (build, cmake, install, profiles,

scripts, third_party, mlx-c-api, zapdb, plus consensus

untracked-only). Transient or vendored; no version control needed.

• 1 uninitialized scaffold: ~/work/luxcpp/consensus (branch main

with zero commits). No work to preserve.

Final-cleanup sweep (per repo):

50 SKIPPED-CONFLICT branches retained on origin so owners can resolve

later. Skips fall into two classes: (a) content-equivalent in origin/main

(squash-merge SHA divergence), (b) sibling work touching same file regions

needing human resolution.

3.4 Per-Algorithm C-ABI State (post-merge)

After the final merge sweep, the c-abi state on luxcpp/crypto@bfbde88d:

Earlier 8 wired / 21 NOTIMPL snapshot on crypto@6eb3791c advanced via

the merge order documented in §3.5.

3.5 Merge DAG (Critical Path)

LP-137 architectural claims (Metal NTT dispatch, threshold-FHE committee,

policy-canonical TFHE import, GPU-accelerated Pedersen/poseidon/BLS,

byte-equal CPU oracles) become true on main only after these 8 branches

land. All 58 surveyed branches were conflict-free against their respective

main (git merge-tree produced clean trees in every case); blockage was

order + one build defect at lux/mpc apex (since fixed by

kms-nonce-bind-2026-04-28).

1. luxcpp/crypto deps-bootstrap-2026-04-27 (KZG + PQ vendoring)

2. luxcpp/crypto fork-swap-luxfi-deps-2026-04-27 (intx+evmmax luxfi

forks)

3. luxcpp/crypto pedersen-cuda-wgsl-2026-04-27

4. luxcpp/crypto aead-cuda-wgsl-2026-04-27

5. luxcpp/lattice feat/lp-137-types

6. lux/lattice feat/lp-137-types

7. lux/threshold feat/tfhe-committee-canonical

8. lux/mpc feat/policy-canonical-tfhe-import (apex)

3.6 Per-Chain Coverage (9 of 9)

CPU reference oracle line + branch coverage on the security-critical

byte-equivalence ground truth:

Aggregate (5 new VMs): 97.96% line on the CPU oracle. Median branch:

92.46% (exceeds 90% target). Total tests passing across the new VMs:

221+. C-Chain (cevm) adds 59. F-Chain (fhe) adds 2 174 gtest

cases.

GPU kernel sources (.metal, .cu, .wgsl) are not instrumentable by

llvm-cov — neither metal-cc, nvcc, nor wgpu-native emit LLVM coverage

maps. The CPU reference oracle is the byte-equivalence ground truth; every

GPU run is asserted byte-for-byte against it via each VM's determinism

test.

3.7 Substrate Geometric Mean

Phase-2 → Phase-3 evolution on Apple M1 Max (vs CPU reference):

Three measured production workloads beat CPU end-to-end:

• F-Chain NTT: 23.6× at N=4096, B=128
• B-Chain BLS aggregate: 9.5× mean across 5k–10k msgs
• C-Chain BLS aggregate same-msg: 16.51× with pubkey cache (n=1024)

Two architectural-correct chains lag on M1 (dGPU-pending):

• PlatformVM 0.025× — saved per-thread work matched by ~1 ms M1 dispatch

overhead; durable substrate for discrete CUDA where per-dispatch latency

is ~10 µs.

• AIVM 0.06× — locate+writeback split correct; M1 integrated GPU dispatch

overhead dominates.

3.8 Per-Primitive GPU Class

Across 29 crypto primitives + helpers + composite:

Of working primitives (denominator = 11 with shipped CPU body): 6 of 10

Metal-shipping = 60% pure GPU-native; with FHE-backed NTT and 4 category-C

intra-ceremony primitives whose cross-ceremony batch IS template-fit, the

residency-correct fraction is 8 of 10 = **80% GPU-native at the

architectural ceiling**.

29 of 29 remain template-fit at the algorithmic level. The bound is set by

NOTIMPL body authoring (13 of 29) and intx/blst/evmmax bootstrap (5 of 29),

not by parallelization shape.

3.9 Acceleration kernels

Per-target speedup kernels applied across the 29 primitives. Each kernel

has a dedicated LP describing the algorithm, the three-backend

implementation paths (Metal + CUDA + WGSL), the determinism harness, and

the crossover threshold. These LPs forward-reference the per-impl commit

on luxcpp/crypto@<sha> shipped by the parallel CTO agents.

Each LP records its threshold N* below which CPU is faster; the

substrate dispatcher routes through the per-kernel CROSSOVER table at

luxcpp/crypto/CROSSOVER.md. Where the underlying algorithm is variable-

time on a secret scalar (Pippenger, Karatsuba windowing, FROST nonce

generation), the LP enumerates the constant-time / blinded path the

prover-side caller MUST use.

4. History

LP-137 was implemented end-to-end across luxcpp/crypto, lux/crypto,

lux/mpc, lux/threshold, lux/hsm, luxcpp/lattice, lux/lattice by

2025-12-25. The source tree was lost in a laptop-theft data-loss

event in early 2026 and re-published from memory and audit recovery on

2026-04-27 / 2026-04-28. A consequence of that re-publication is that

every commit in every contributing repo carries a 2026-04 author timestamp,

which obscures the actual implementation order in git log. Rewriting

commit timestamps would be falsification — refused.

The legitimate fix is per-repo CHANGELOG.md written as authored prose,

narrating the Dec 2025 timeline by phase, with full-SHA citations into the

re-published commits, plus annotated semver tags whose tag-message bodies

state both the original-implementation date (2025-12-25) and the

re-publication date (2026-04-28).

Implementation phases (Dec 2025)

1. Foundation — brand-neutral DST sweep across luxcpp/crypto/*;

C-ABI rewrite to algorithm-named symbols.

2. AEAD — ChaCha20-Poly1305 + AES-256-GCM CPU bodies + Metal kernels;

aead_kat_test 110/110 + aead_test 27/27.

3. Hash family — SHA-256, RIPEMD-160, BLAKE2b CPU + Metal byte-equal

100 vectors each; BLAKE3 unfold-aliased-to-keccak bug fixed.

4. bn254 — full Fp/Fr/G1/Fp2/Fp6/Fp12/G2 tower, optimal-ate pairing,

SVDW hash-to-curve; bn254_kat_test 36/36 vs gnark v0.19.2.

5. Modular — modexp + evm256 (mulmod / addmod) c-abi; intx+evmmax

luxfi forks bootstrapped.

6. Pedersen — vector commitment + NewGeneratorsFromSeed with frozen

golden vector; brand-neutral DST landed.

7. Banderwagon — full Fp/Fr/Element/MSM (Pippenger); variable-time

doc; secret-scalar caller blinding via MultiExpBlinded.

8. KZG — EIP-4844 KAT vectors; CUDA + WGSL kernels.

9. IPA — Bulletproofs over Banderwagon; cross-proof batched verify;

prover-side blinding.

10. Lamport OTS — first-party CPU + Metal/CUDA/WGSL.

11. Lattice — NTT (Lattigo-byte-equal Montgomery) + poly_mul; Metal

BatchNTT skeleton (SIGSEGV fix tracked separately).

12. Composite attestation — SEV-SNP / TDX / NV NRAS parsers + composite

root C++↔Go byte-equal; require_* flags replaced wildcards-on-zero.

13. CI — hanzo-build native CI matrix (no QEMU); amd64 + arm64

parallel; brand-neutral.

Per-repo CHANGELOG + tag

Tag bodies state both the original-implementation date and the

re-publication date. CHANGELOGs are authored prose, not git log dumps.

5. Decisions Log

Irreversible architectural decisions:

• CPU first-party + audited test oracle — adversarial-distance

property preserved. Vendoring a CPU canonical from the same family as the

test oracle was rejected 2026-04-27.

• bn254 first-party (NOT mcl) — 2 498 LOC C++ body byte-equal gnark

v0.19.2 across 36 KAT vectors. mcl rejected for the same adversarial-

distance reason as #1.

• luxfi/gpu canonical for Go bindings — luxgpu/gpu archived; no

migration. luxgpu org reserved for future C++ GPU kernel source repos

only.

• Backdate refused — commit timestamps stay truthful. Dec 2025

narrative lives in per-repo CHANGELOG.md + annotated tag bodies, not in

git log.

• Brand neutrality — algorithm names ARE the namespace. No

org-prefixed DSTs, symbols, headers, or namespaces in production paths.

• **Pedersen DST: PEDERSEN_*_V1** — brand-neutral. LUX_PEDERSEN_*

archived; values do NOT match canonical.

• TFHE UNSAFE + panic guards — fail closed in production until real

Shamir+lattice+combine pipeline lands. No env-var override.

• CPU + GPU dispatch on lux/accel — NOT GPU-only. Stays in luxfi

org; not a luxgpu candidate.

• Tests opt-in for fake TFHE — LUX_ALLOW_FAKE_TFHE_FOR_TESTING_ONLY=1

in package-level TestMain; production crashes loudly without it.

• **require_* over wildcards-on-zero** — explicit boolean flags on

CompositeAttestationConfig. O5 closure.

• Second oracle for adversarial-distance —

kat-second-oracle-2026-04-28 adds non-trivial second source so

byte-equality cannot collapse to self-comparison. O2/O4 closure.

6. Outstanding Follow-Ups

• #234 lux/mpc 264a5a7-pattern breakages — pkg/policy/fhe_threshold_decryptor.go

+ pkg/api/handlers_approval.go depend on luxfi/threshold or fhethr

APIs not yet shipped; cmd/mpcd buildHSMSignerConfig; ansel1/merry

stale go.sum.

• #228 bn254 WGSL Miller — kernel body landed; CI verification

pending.

• #226-class luxfi/log + corona Sign API drift — lux/threshold

protocols/corona test signature mismatch; one fail in 58.

• #205 follow-up: ipa-banderwagon Go binding — banderwagon ships in

luxcpp + Rust crate but not yet as Go subpackage. Causes 2 setup-failed

tests in lux/crypto (ipa, verkle).

• fhe/gpu transitive build — pre-existing across lux/evm +

lux/chains/evm + lux/evmgpu. Directive-acknowledged. luxfi/gpu MLX

cgo + luxfi/precompile/anchor + luxfi/precompile/vrf unshipped on this

dev box; CI provides them.

• Rust workspace CRYPTO_DIR — workspace requires

CRYPTO_DIR/CRYPTO_BUILD_DIR env to point at luxcpp install for

native sha256/secp256k1 archives. Documented in Cargo.toml comments;

CI provides env.

• G2′ gpu.BatchNTT SIGSEGV — luxcpp/lattice/src/metal/metal_ntt.mm

crashes at every (N, B). Without batch mode, single-poly Metal NTT is

12× slower than CPU on M1 Max. Effort: ~1 week Objective-C++ debug.

• G3 batch-bootstrap Metal kernel — single largest FHE-on-M1 win;

prerequisite for FHE in any block-time-bounded path. Effort: ~6 weeks

+ Metal kernel author + gadget chain rewritten in standard form.

Blocks confidential lanes (#136) and FHE-policy on-chain (#114) on hot

path.

• G6 luxfi/fhe/lazy_carry.go — pure-Go optimization, ~1.7×

speedup, zero GPU dependency. Best near-term FHE win after G2 declared

dead.

• H100 / Ada self-hosted runners — CUDA wall-clock numbers not

collected on Apple host. dGPU crossover for FHE expected ~1 800× over

M1 CPU per cuFHE literature; cannot be measured on Apple hardware. All

CUDA estimates remain literature-cited until Linux CUDA CI runs.

7. References

• luxcpp/crypto CHANGELOG: /Users/z/work/luxcpp/crypto/CHANGELOG.md,

tag v1.3.0

• lux/crypto CHANGELOG: /Users/z/work/lux/crypto/CHANGELOG.md,

tag v1.18.2

• lux/mpc CHANGELOG: /Users/z/work/lux/mpc/CHANGELOG.md,

tag v1.10.2

• lux/threshold CHANGELOG: /Users/z/work/lux/threshold/CHANGELOG.md,

tag v1.6.4

• lux/hsm CHANGELOG: /Users/z/work/lux/hsm/CHANGELOG.md, tag

v1.1.3

• Per-VM BENCHMARKS.md: luxcpp/{platformvm,xvm,aivm,bridgevm,mpcvm,cevm,fhe}/BENCHMARKS.md
• Per-VM COVERAGE.md: luxcpp/{platformvm,xvm,aivm,bridgevm,mpcvm,cevm,fhe,crypto}/COVERAGE.md

+ lux/crypto/rust/lux-crypto/{COVERAGE,BENCHMARKS}.md

• Determinism harnesses: <vm>/test/<vm>_determinism_test.{cpp,mm}

per VM

• Quasar 9-chain binding test:

luxcpp/cevm/test/unittests/quasar_9chain_integration_test.mm

• gpukit canonical four-kernel embodiment:

luxcpp/crypto/gpukit/README.md

• Production-link assertion:

cevm/test/unittests/no_blst_in_production_test.sh — `nm <bin> | grep

blst | wc -l == 0` from cevm v0.46.0 onward.

Related LPs:

• LP-009: GPU-Native EVM
• LP-013: FHE on GPU / F-Chain
• LP-066: Threshold FHE umbrella spec
• LP-067: Confidential ERC-20
• LP-076: Universal Threshold Framework
• LP-132: QuasarGPU Execution Adapter
• LP-134: Lux Chain Topology
• LP-135: QuasarSTM 4.0
• LP-9010: DEX Precompile

8. Security Considerations

Original Red findings (resolution status)

TFHE: SECURITY BLOCKER (in force)

luxfi/threshold/protocols/tfhe panic-guards every entry point. Confidential

lanes (#136) and FHE-policy on-chain (M-Chain × F-Chain integration #114)

are gated CLOSED until the real Shamir+lattice+combine pipeline lands.

Migration plan in §2.6.

Production-link blst symbol invariant

no-blst-in-production-check runs after every cevm build:

build/lib/libevm.dylib
build/lib/libevm.so
build/lib/cevm_precompiles/libcevm_precompiles.a
build/lib/evm/libevm-precompiles.a
build/lib/evm/libevm-kernel-metal.a
build/lib/evm/libevm-gpu.a
build/lib/evm/libevm-metal-hosts.a
build/lib/evm/libprecompile-service.a

Every binary above must report zero _blst_* symbols. PASS from cevm

v0.46.0 onward.

Subgroup policy

enum class SubgroupPolicy {
    AssumeChecked,
    CheckAndReject,
    ClearIfHashToCurve   // ONLY for hash-to-curve outputs
};

Validator pubkeys are checked and rejected, never modified.

Hash-to-curve outputs go through cofactor clearing exactly where the

specification requires it.

9. Backward Compatibility

None. LP-137 is a foundational release. Forward-only semver per fork pin

in go.mod. Annotated semver tags (v1.3.0 luxcpp/crypto, v1.18.2

lux/crypto, v1.10.2 lux/mpc, v1.6.4 lux/threshold, v1.1.3 lux/hsm)

are the granular implementation timeline; per-repo CHANGELOG.md is the

authored narrative.

Copyright

Copyright (C) 2026, Lux Industries Inc. CC0-1.0.