Crate aethel_core

Expand description

§aethel-core — Post-Quantum Ephemeral Identifier Engine

aethel-core implements the Polymorphic Lattice Projection (PLP) standard for decoupled post-quantum ephemeral identity. It replaces static W3C DIDs with non-deterministic, ephemeral identity projections that leave zero static public keys, full stop — this crate has no blockchain, ledger, or on-chain component of any kind; the property holds regardless of where a caller chooses to publish anything.

§Core Components

plp — Polymorphic Lattice Projection engine: ring arithmetic, ZK sigma protocol, and rejection sampling over Module-LWE (M-LWE).
htss — 5D Hypercube Threshold Secret Sharing: Shamir 3-of-5 over F_q, dimension-disjoint routing across Q_5 (32 nodes, 80 edges).
saap (crate-private; its prove and verify pathway is retired, D-13) — Selective Attribute Attestation Protocol: BDLOP vector commitment scheme with ZK selective disclosure and norm-bound verification.
sampling — Enclave constant-time rejection sampling: 16-iteration padded loop, CMOV selection, volatile zeroization, and CBD η=2 sampler.
puf (research, non-default puf feature) — SRAM PUF + BCH(1023,512,55) fuzzy extractor: GF(2^10) arithmetic, Berlekamp-Massey, Chien Search, and pure Rust WASM implementation. Not part of the default build or the aethel:core WIT world.
ct_verify — Valgrind/ctgrind constant-time verification harness.

§Security Properties

Unlinkability: Adv_Adversary_Link(b_τ1, b_τ2) ≤ Negl(λ) under M-LWE hardness.
Post-Quantum Soundness: Reduces to Decision M-LWE_{k,k+1,η,q} over R_q.
Zero Static Keys: No public key is ever written to persistent storage or ledger.
Constant-Time: All secret-dependent operations execute in fixed time (I_max=16).

§Parameters (AETHEL-SAAP-LEVEL1)

Ring: R_q = Z_q[X]/(X^256 + 1), q = 8_380_417
Module rank: k = 4
Noise: CBD η=2, rejection bound γ₁=131072, β=78

§Feature Flags

std (default): Standard library support, heap allocation.
component: Builds the WebAssembly Component Model adapter (src/component.rs) implementing the aethel:core WIT world. This is the only WebAssembly surface; a wasm-bindgen cdylib used to sit alongside it and was retired (see the note at the bottom of this file).
enclave: Enables constant-time enclave execution paths and volatile zeroization.
puf (research, non-default): Compiles the puf module. SRAM PUF is out of scope for the aethel:core WIT world and has no WASM export of its own; this feature exists for research use only, not for production identity derivation.

§Unsafe Code

The default build (no puf, no enclave) contains exactly 5 unsafe blocks, all in sampling, each carrying a // SAFETY: comment explaining the invariant it relies on (volatile zeroization writes and constant-time byte-slice reinterpretation of same-sized, non-aliasing structs). Enabling puf or enclave additionally compiles 2 more unsafe blocks in puf::ffi, an FFI wrapper around a C enclave shim that is not shipped by default.

§The 0x307 crate family

aethel-core is one of six open-source crates from 0x307, held to one audit and stability standard.

Crate	Tier	What it does
pqc-sig	Production	ML-DSA, SLH-DSA and FN-DSA signatures (FIPS 204/205/206)
pqc-kem	Production	ML-KEM (FIPS 203), the X25519 + ML-KEM-768 hybrid, X-Wing, and sealed boxes
aethel-core (this crate)	Production	Post-quantum anonymous identity: a separate identifier per context, context-bound ML-DSA signing
aethel-sdk	Preview	The SDK over aethel-core, and the place to start
aethel-vault	Preview	Agent-held wallet: policy-gated x402 / EIP-3009 signing with ML-DSA-65 spend records
pqc-privacy	Lab	Research bundle, kept off every identity and payment path

Production crates are thin, standards-bound libraries meant to be depended on today. Preview crates work and are published, with APIs still settling. Lab crates are research, never on an identity or payment path.

Runnable examples: 0x307/examples, one program per crate, pinned to the published versions.

Audit status: None of these crates has been independently audited, and none holds a CMVP / FIPS 140-3 validation. “FIPS 203/204/205/206” means the algorithms follow those standards, not that the code is certified. Known issues for this crate are in SECURITY.md. Versioning and yanks: STABILITY.md.

Re-exports§

pub use htss::HypercubeNetwork;
pub use htss::NodeAddress;
pub use htss::SecretSharer;
pub use htss::ZkProofSegment;
pub use identity_error::IdentityError;
pub use plp::EphemeralProjection;
pub use plp::MasterIdentity;
pub use plp::Prover;
pub use plp::Verifier;
pub use plp::ZkIdentityProof;
pub use signing::verify;
pub use signing::verify_with_purpose;
pub use signing::Identity;
pub use wire::verify_projection;

Modules§

credential: SAAP as specified: a BDLOP credential and three linked relations.
ct_verify: Valgrind/ctgrind constant-time verification harness.
htss: Threshold secret sharing (Shamir 3-of-5) plus a local hypercube routing simulation.
identity_error: Rust-side mirror of the aethel:core WIT world’s identity-error variant. Rust-side mirror of the identity-error variant defined in the aethel:core WIT world (wit/aethel-core.wit).
plp: Polymorphic Lattice Projection (PLP) engine.
sampling: Enclave constant-time rejection sampling and CBD η=2 sampler.
signing: Identity key generation, purpose-separated (context-bound) signing, and the native Identity → PLP projection/proof bridge (A-1). Identity key generation, message signing, and the PLP projection/proof bridge, inside L1.
wire: aethel-plp-1 — versioned wire envelope for PLP projections and proofs (A-4), plus the byte-only wire::verify_projection entry point. aethel-plp-1 — versioned, self-describing wire envelope for PLP projections and proofs (A-4).

Structs§

SaapProof: Complete SAAP proof transcript.

Enums§

AethelError: Top-level error type for aethel-core operations.
SaapValidationError: Typed verification failure reasons.

Constants§

COMPONENT_SHA256: SHA-256 of the canonical aethel_core.component.wasm this crate builds.
EIAB_MAGIC: Magic header bytes for the Ephemeral Identity Attestation Bundle (EIAB).
FIXED_ITERATION_CEILING: Fixed iteration ceiling for constant-time enclave loop.
GIT_REVISION: The commit this build’s component was produced from.
MODULE_K: Module rank k (AETHEL-SAAP-LEVEL1).
MODULUS_Q: Prime modulus q = 8_380_417 ≈ 2^23, q ≡ 1 (mod 512).
PARAM_BETA: Rejection sampling bound β = 78.
PARAM_ETA: Centered Binomial Distribution parameter η = 2.
PARAM_GAMMA1: Masking vector bound γ₁ = 2^17 = 131_072.
REJECTION_BOUND: Rejection threshold γ₁ - β = 130_994.
RING_N: Ring degree N for the cyclotomic polynomial X^N + 1.