feat(tfhe): real Bendlin-Damgård M-of-N threshold decryption

[hanzo-dev]

Closes #20.

Summary

Rips out the prior unsafe-by-design fake implementation at protocols/tfhe/ — which stored the master key on every party and HMAC-tagged a "partial" that the combine ignored before falling through to single-party decrypt — and replaces it with the canonical noise-flooding M-of-N threshold-FHE scheme.

This was the critical-path blocker for the encrypted-mempool work tracked at #20 and architected in ~/work/lux/papers/lux-encrypted-mempool/lux-encrypted-mempool.tex.

Security model

Each party j holds only a Shamir share of the LWE secret. To decrypt, party j computes d_j = c_1 · s_j + e_j with fresh discrete-Gaussian smudging noise; combine sums Λ_j · d_j with integer Lagrange numerators (Bendlin-Damgård denominator clearing, TCC 2010 §4.2) and divides by Δ = total! mod q to recover the plaintext bit. The lattice secret-sharing polynomial is (t-1)-private; any subset < t learns nothing. Simulation soundness is the standard noise-flooding reduction (AJLTVW EUROCRYPT 2012).

What's gone

• ALLOW_FAKE_TFHE_FOR_TESTING_ONLY env var, guardUnsafe(), all "UNSAFE: refused security review" headers, unsafe_test_helper_test.go
• Every-party-stores-master keygen
• HMAC-tag "PartialDecrypt"
• Ignore-the-partials "CombineShares" that ran single-party decrypt

What's new

• SecretKeyShare now carries an fhethreshold.LWEShare (real Shamir share), NOT a *fhe.SecretKey. The master key never appears in any party's state.
• KeyGenerator.GenerateKeys runs the trusted-dealer ceremony, Shamir-splits via fhethreshold.ShareLWESecretKeyFHE, and zeroes the dealer-side master before returning.
• Protocol.CreateBitDecryptionShare / CreateDecryptionShare produce real partial decryptions with fresh smudging noise per call.
• Protocol.CombineBitShares / CombineShares run the canonical integer-Lagrange combine.
• Wire layer (committee.go) preserved intact — it authenticates "who sent this share, and for which (session, ciphertext)", which is orthogonal to the lattice math.
• EnvelopePartialDecrypter is a separate primitive for the FChain policy-1-bit-verdict path where the committee's job is to ratify "≥t parties saw the same ciphertext" without decrypting.

Parameter choices

• PN10QP27 (Q ≈ 2^27) supports up to 2-of-3 securely.
• PN11QP54 (Q ≈ 2^54) supports up to 11-of-21 (the canonical Bendlin-Damgård benchmark setting).
• Smudging σ is auto-calibrated against the worst-case integer Lagrange numerator, Λ_max · σ · √t · 6 ≤ Q/16. fhethreshold.SmudgingSigma returns σ < 1 if the parameter set is too small — callers should escalate.

Test plan

24 tests, all green. go vet clean. go build ./... clean.

• TestThresholdDecrypt_RoundTrip_{2of3, 5of9, 11of21} — both true and false plaintexts recover correctly
• TestThresholdDecrypt_BelowThresholdRejected — single-party combine fails with ErrInsufficientShares
• TestSecretKeyShare_DoesNotEqualMaster — reflection-walks every share and confirms (1) no *fhe.SecretKey field is present and (2) no share's LWE coeffs equal the master's standard-form coefficients
• TestGenerateKeys_WipesMaster — the production keygen path returns no master
• TestThresholdDecrypt_DeterministicCombine — combine is deterministic in its inputs
• TestThresholdRNG_DefaultPathReturnsError — accidental use of the legacy RNG path without the master ceremony fails loudly
• Wire layer kept: TestCommittee_HappyPath_2of3, TamperedMAC, WrongCiphertext, WrongSession, DuplicatePartyID, EnvelopePath, PublicKeyPath_NoMACVerify
• TestCommittee_LatticePath_RoundTrip — aggregator → Protocol.CombineShares end-to-end with a real ciphertext

Decomplecting note

The Z_q LSSS lives next to the existing 2048-bit RFC 3526 LSSS in luxfi/fhe/pkg/threshold. They are different primitives — large-prime LSSS shares high-entropy secrets where the secret space need not equal the FHE modulus (e.g., the SHA-256 hash of a serialized SKLWE used for verifiable secret sharing); Z_q LSSS composes directly with lattice arithmetic. Both stay in that package.

The wire-authentication layer (KeyShare → MAC) is preserved intact — it answers a different question (provenance) than the lattice combine (decryption), and the two should not be braided.

References

• Bendlin, Damgård. Threshold Decryption and Zero-Knowledge Proofs for Lattice-Based Cryptosystems. TCC 2010.
• Asharov, Jain, López-Alt, Tromer, Vaikuntanathan, Wichs. Multiparty Computation with Low Communication, Computation and Interaction via Threshold FHE. EUROCRYPT 2012.
• Mouchet, Troncoso-Pastoriza, Bossuat, Hubaux. Multiparty Homomorphic Encryption from Ring-Learning-with-Errors. PETS 2021.