# ONE Market E14 - DKG, Fixed-Width Cryptographic Core and Independent Qualification

E14 extends the E13 external-evidence and RFC 9591 baseline with three strictly separated reference capabilities:

1. a contributory Feldman-style DKG for P-256 with five participants and threshold three, where every qualified participant contributes an independent polynomial;
2. a fixed-width secret-scalar core used by the FROST(P-256, SHA-256) reference profile, together with a deterministic source-level admission audit;
3. a multi-review qualification gate requiring independently controlled organizations, control domains, jurisdictions, complete review scope and transparency-log inclusion.

## Assurance classes

```text
DKG
FELDMAN_CONTRIBUTORY_DKG_REFERENCE_ORCHESTRATED_VALIDATION_NOT_ROBUST_DKG_AUDITED

Secret scalar discipline
FIXED_WIDTH_P256_SCALAR_REFERENCE_SOURCE_DISCIPLINE_NOT_LAB_CERTIFIED

FROST provider
RFC9591_P256_DKG_FIXED_WIDTH_REFERENCE_PROVIDER_NOT_HSM_NOT_AUDITED

Source audit
SOURCE_LEVEL_CONSTANT_TIME_DISCIPLINE_NOT_LAB_SIDE_CHANNEL_CERTIFICATION

Review qualification
MULTI_REVIEW_QUALIFICATION_ADMISSION_REFERENCE_EXTERNAL_REVIEWS_NOT_PERFORMED
```

These labels are normative. The implementation does not claim maliciously robust DKG, hardware-certified constant-time behavior, HSM custody, or completed external review.

## Contributory DKG

`internal/dkgp256` creates one polynomial per participant, verifies every private share against public Feldman commitments, disqualifies a contributor on any invalid share, aborts below threshold, aggregates only qualified commitments and shares, and produces a canonical transcript digest.

The reference orchestrator observes and validates all shares directly. It is not a complaint-resolving network DKG protocol and has not been independently audited.

## Fixed-width scalar profile

`internal/ctscalar` keeps P-256 secret scalars in a fixed number of machine words and avoids a variable-width secret-scalar representation. `internal/frostp256ct` retains Go's dedicated P-256 point implementation and uses the fixed-width core for scalar operations and wide hash reduction.

`internal/ctaudit` checks source structure and prohibited escape paths. It does not prove compiler output, cache behavior, timing, power consumption, electromagnetic leakage, or fault-injection resistance.

## Independent qualification

`internal/reviewqual` requires at least three reports, three organizations, three control domains, two jurisdictions, complete mandatory scope, artifact/source binding and transparency-log inclusion. Production policy rejects reports marked as fixtures.

## Verification

```bash
PYTHONHASHSEED=1414 python3 verification/verify_e14.py
```

Expected status:

```text
PASS_WITH_DKG_CT_SOURCE_DISCIPLINE_AND_EXTERNAL_REVIEW_OPEN
```

The verifier executes all inherited and E14 Go tests, `go vet`, selected race-detector suites, deterministic binary builds, the deterministic demonstration, six TLC configurations, ten SMT obligations, source-manifest generation and bidirectional traceability.
