# Corona Consensus

URL: https://docs.hanzo.ai/docs/zap/advanced/corona

> Threshold lattice-based signing for distributed agents

Corona is a threshold lattice-based signing protocol for post-quantum secure multi-party signatures.

## Overview

Corona enables t-of-n threshold signing where:

- **t** parties must cooperate to produce a valid signature
- No single party can sign alone
- Signature is indistinguishable from non-threshold signature
- Post-quantum secure using lattice cryptography

## Protocol Parameters

```c
struct CoronaParams {
  m @0 :UInt16 = 8;                # Matrix rows
  n @1 :UInt16 = 7;                # Matrix columns
  dbar @2 :UInt16 = 48;            # Commitment dimension
  kappa @3 :UInt16 = 23;           # Challenge weight (Hamming weight)
  phi @4 :UInt16 = 256;            # Ring dimension (2^8)
  keySize @5 :UInt16 = 32;         # Key size in bytes (256 bits)
  q @6 :UInt64 = 0x1000000004A01;  # 48-bit NTT-friendly prime modulus
  xi @7 :UInt32 = 30;              # Rounding parameter
  nu @8 :UInt32 = 29;              # Rounding parameter
}
```

## Signing Protocol

Corona uses a two-round protocol:

### Round 1: Commitment

Each party i:

1. Samples random vector r\_i from discrete Gaussian
2. Computes commitment D\_i = A \* r\_i
3. Computes MACs for all other parties
4. Broadcasts D\_i with MACs

```c
struct CoronaRound1Output {
  partyId @0 :UInt32;
  sessionId @1 :UInt64;
  dMatrix @2 :PolyMatrix;          # M x (Dbar+1) commitment matrix D_i
  macs @3 :List(CoronaMac);      # MACs for other participating parties
  timestamp @4 :Timestamp;
}
```

### Round 2: Response

Each party i:

1. Receives all D\_j from other parties
2. Verifies MACs
3. Computes challenge c = H(D\_1 || ... || D\_k || message)
4. Computes response z\_i = r\_i + c \* s\_i (where s\_i is secret share)
5. Broadcasts z\_i

```c
struct CoronaRound2Output {
  partyId @0 :UInt32;
  sessionId @1 :UInt64;
  zShare @2 :PolyVector;           # N-dimensional response vector z_i
  timestamp @3 :Timestamp;
}
```

### Finalization

Combiner aggregates responses:

1. Verifies each z\_i against D\_i
2. Computes z = sum(z\_i)
3. Computes correction term delta
4. Outputs signature (c, z, delta)

```c
struct CoronaSignature {
  c @0 :Poly;                      # Challenge polynomial (sparse)
  z @1 :PolyVector;                # Aggregated response vector
  delta @2 :PolyVector;            # Correction term
  signers @3 :List(UInt32);        # IDs of parties that contributed
  sessionId @4 :UInt64;            # Signing session identifier
}
```

## Party Interface

```c
interface CoronaParty {
  # Get party information
  getInfo @0 () -> (info :CoronaPartyInfo);

  # Execute Round 1 of signing protocol
  signRound1 @1 (request :CoronaSignRequest) -> (output :CoronaRound1Output);

  # Execute Round 2 of signing protocol
  signRound2 @2 (
    request :CoronaSignRequest,
    round1Outputs :List(CoronaRound1Output)
  ) -> (output :CoronaRound2Output);

  # Finalize signature (combiner only)
  finalize @3 (
    request :CoronaSignRequest,
    round2Outputs :List(CoronaRound2Output)
  ) -> (response :CoronaSignResponse);

  # Verify a signature
  verify @4 (request :CoronaVerifyRequest) -> (response :CoronaVerifyResponse);
}
```

## Coordinator Interface

```c
interface CoronaCoordinator {
  # Initialize a new signing session
  initSession @0 (message :Data, participants :List(UInt32)) -> (sessionId :UInt64);

  # Collect Round 1 outputs from all parties
  collectRound1 @1 (sessionId :UInt64) -> (outputs :List(CoronaRound1Output));

  # Collect Round 2 outputs from all parties
  collectRound2 @2 (sessionId :UInt64) -> (outputs :List(CoronaRound2Output));

  # Get final signature for a session
  getSignature @3 (sessionId :UInt64) -> (response :CoronaSignResponse);

  # Cancel a signing session
  cancelSession @4 (sessionId :UInt64) -> ();

  # List active sessions
  listSessions @5 () -> (sessions :List(UInt64));
}
```

## Usage Example

### Rust

```rust
use zap_protocol::corona::{Party, Coordinator, SignRequest};

// Setup parties (typically on different nodes)
let party0 = Party::new(0, 3, 2)?;  // Party 0 of 3, threshold 2
let party1 = Party::new(1, 3, 2)?;
let party2 = Party::new(2, 3, 2)?;

// Connect to coordinator
let coord = Coordinator::connect("zap://coordinator:9001").await?;

// Initiate signing
let session_id = coord.init_session(
    b"Message to sign",
    vec![0, 1, 2]
).await?;

// Round 1 (parallel on each party)
let r1_outputs = coord.collect_round1(session_id).await?;

// Round 2 (parallel on each party)
let r2_outputs = coord.collect_round2(session_id).await?;

// Get signature
let signature = coord.get_signature(session_id).await?;

// Verify
let valid = party0.verify(&signature, b"Message to sign")?;
assert!(valid);
```

### Go

```go
import "github.com/zap-proto/go/corona"

// Setup
party := corona.NewParty(0, 3, 2)  // Party 0 of 3, threshold 2

// Connect to coordinator
coord, _ := corona.ConnectCoordinator(ctx, "zap://coordinator:9001")

// Sign
sessionID, _ := coord.InitSession(ctx, []byte("Message to sign"), []uint32{0, 1, 2})

// Wait for signature
signature, _ := coord.GetSignature(ctx, sessionID)

// Verify
valid, _ := party.Verify(ctx, signature, []byte("Message to sign"))
```

## Party Status

```c
enum CoronaPartyStatus {
  idle @0;
  signingRound1 @1;
  signingRound2 @2;
  combining @3;
  busy @4;
  offline @5;
}
```

## Error Handling

Sessions can be aborted:

```c
struct CoronaAbort {
  sessionId @0 :UInt64;
  reason @1 :Text;
  partyId @2 :UInt32;
}
```

Reasons for abort:

- Timeout waiting for party responses
- MAC verification failure
- Response verification failure
- Network partition

## Security Properties

1. **Unforgeability**: Signatures cannot be forged without t parties
2. **Robustness**: Malicious parties are detected and excluded
3. **PQ-Security**: Based on Module-LWE hardness assumption
4. **Simulation Security**: No party learns others' secret shares

## Performance

| Operation      | Time (3-of-5) |
| -------------- | ------------- |
| Key generation | \~100ms       |
| Round 1        | \~50ms/party  |
| Round 2        | \~50ms/party  |
| Finalization   | \~100ms       |
| Total signing  | \~400ms       |
| Verification   | \~30ms        |

## Use Cases

1. **Multi-Sig Wallets**: Require multiple approvals for transactions
2. **Agent Coordination**: Multiple agents sign consensus decisions
3. **Distributed Key Custody**: No single point of failure
4. **Regulatory Compliance**: Enforce multi-party authorization