papers/lux-magnetar-pq/lux-magnetar-pq.tex

\documentclass[11pt,a4paper]{article}
\usepackage{../shared/luxcover}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\usepackage{amsmath,amssymb,amsfonts,amsthm}
\usepackage{graphicx}
\usepackage{hyperref}
\usepackage{booktabs}
\usepackage{algorithm}
\usepackage{algpseudocode}
\usepackage{listings}
\usepackage{xcolor}
\usepackage{tikz}
\usepackage{float}
\usepackage{enumitem}
\usepackage{array}
\usepackage{multirow}
\usepackage{tabularx}
\input{../shared/lstlang}
\usetikzlibrary{arrows.meta,positioning,shapes.geometric,fit,calc}

\hypersetup{colorlinks=true,linkcolor=black,citecolor=blue,urlcolor=blue}

\lstset{
  basicstyle=\ttfamily\scriptsize,
  breaklines=true,
  frame=single,
  numbers=left,
  numberstyle=\tiny\color{gray},
  keywordstyle=\color{blue!70!black}\bfseries,
  commentstyle=\color{green!50!black}\itshape,
  stringstyle=\color{red!60!black},
  showstringspaces=false,
}

\newtheorem{theorem}{Theorem}
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{definition}{Definition}
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{remark}{Remark}
\newtheorem{corollary}[theorem]{Corollary}

\title{Magnetar: Per-Validator Standalone FIPS 205 SLH-DSA for Lux Public-BFT Consensus}

\author{
Zach Kelling\thanks{Corresponding author: [email protected]}\\
\textit{Lux Industries, Inc.}\\
\texttt{[email protected]}
}

\date{2026 \\ \normalsize Artefact: \texttt{luxfi/magnetar} v1.0.0}

\begin{document}

\luxcoverpage

\begin{abstract}
We specify \emph{Magnetar}, the hash-based post-quantum signature
primitive of the Lux Polaris cert profile. Magnetar's headline
primitive is a \emph{per-validator standalone} construction: each
validator $i$ holds an independent FIPS 205 SLH-DSA keypair
$(sk_i, pk_i)$ \cite{fips205}, produces a single-party deterministic
signature $\sigma_i$ on the consensus message, and the consensus
layer collects $N$ signatures into a \emph{ValidatorAggregateCert}
that verifies under any unmodified FIPS 205 verifier. There is no
distributed key generation, no dealer, no aggregator, and no
threshold reconstruction step. Each $\sigma_i$ is byte-identical to
what a single-party FIPS 205 $\textsc{SignDeterministic}$ would
produce on $(sk_i, \mu, \mathit{ctx})$ --- this is the
\emph{byte-identity claim} pinned by
$\textsc{TestMagnetar\_Wire\_FIPS205Verifiable}$
(\texttt{ref/go/pkg/magnetar/wire\_test.go}:166--220), which routes
through the \texttt{ValidatorSign} primary primitive, strips the
canonical MAGS/MAGG wire envelope to recover the raw FIPS 205
payload, and feeds it to
\texttt{cloudflare/circl/sign/slhdsa.Verify} \cite{circl} with no
Magnetar code path on the verifier side. All three SHAKE parameter
sets (SHAKE-192s, SHAKE-192f, SHAKE-256s) pass under
\texttt{-count=1} and \texttt{-race}.

\textbf{Why per-validator and not threshold.} SLH-DSA is hash-based
and admits no FROST-style linear share-aggregation identity
\cite{cosmin2021,sphincs,fips205}. Cozzo-Smart (EUROCRYPT 2019) and
Bonte-Smart-Tan (2023) establish that every internal SHAKE/SHA-2
evaluation in an HBS scheme is a non-linear function of the secret
seed; producing a single FIPS 205-shaped signature from $t$ shares
requires either reconstructing the seed (a dealer or aggregator in
the trusted computing base) or running a full multi-party
computation over the SHA-256/SHAKE hash tree (open research, on
the order of $10^4$ hash invocations per signature under MPC). For
\emph{public-BFT} consensus the architecturally correct primitive
is therefore $N$ standalone signatures collected at the consensus
layer; the per-validator-standalone construction shipped here is
the canonical hash-based instantiation of that pattern.

\textbf{Composition.} The $N \times |\sigma|$ on-wire cost of a
$K=21$ Lux Polaris quorum at SHAKE-192s is $\sim 332$~KiB. The
Z-Chain Groth16 rollup compresses this to $\sim 192$~B before the
certificate hits long-term storage. The rollup is a separate
primitive (lux-zchain spec); the Magnetar wire codec presents the
parallel-slices \texttt{(Signers, PubKeys, Sigs)} shape that maps
directly onto the rollup witness layout.

The companion artefact is \texttt{luxfi/magnetar} v0.5.2
\cite{magnetar}, with the wire codec MAGS/MAGG and the stateless
\texttt{VerifyBytes} dispatcher landing in commit \texttt{1c84519}
on 2026-05-31. The reference implementation is pure Go, backed by
\texttt{cloudflare/circl/sign/slhdsa} v1.6.3 \cite{circl} for the
underlying FIPS 205 primitive, with the same constant-time posture
the circl maintainers ship. Magnetar joins Pulsar (Module-LWE)
\cite{lp073pulsarpaper} and Corona (Module-LWE) \cite{lp104corona}
as the three threshold legs of the Lux Polaris maximum-assurance
post-quantum cert profile; the three primitives span two
algorithmically distinct families --- lattice (Module-LWE: Pulsar
and Corona, at distinct parameter sets) and hash-based (Magnetar)
--- so no single algorithmic break collapses the conjunction.

\textbf{THBS-SE: permissionless threshold companion.} For
deployments that genuinely need a \emph{single} FIPS 205-shaped
signature from a $t$-of-$n$ committee --- e.g.\ verifier-side
constant-cost certificates, smart-contract verification with
fixed gas cost, cross-chain bridging into systems that recognise
only one signature per message --- Magnetar v1.0 ships
\emph{THBS-SE} (Threshold Hash-Based Signatures with
Selected-Element Reconstruction; \S\ref{sec:thbsse}). THBS-SE is
a permissionless $t$-of-$n$ construction with a PUBLIC COMBINER
role: any peer can run Combine; no host is in the TCB by policy
at sign time. The construction enforces the hard invariant ``a
revealed value is allowed only if it is also present in the
final SLH-DSA signature'' (named
Theorem~\ref{thm:thbsse-selected-element-reveal}) and emits
FIPS 205 wire bytes byte-identical to single-party
$\textsc{SignDeterministic}$ on the reconstructed seed
(Theorem~\ref{thm:thbsse-byte-identity}). Eight test gates and a
deterministic $(n=7, t=4)$ KAT pin the construction. v1.0 ships
an honest open item on transient seed reconstruction at the
public combiner; the strict refinement (no seed reconstruction
even transiently) is the v1.1 strict-atom-assembly lift tracked
at \texttt{BLOCKERS.md::MAGNETAR-STRICT-ATOM-V11}.\footnote{Operator-controlled
MPC custody uses TEE-attestation-gated variants in
\texttt{luxfi/threshold/protocols/\{slhdsa,mldsa,rlwe\}-tee}
shipped via the \texttt{lux/mpc} sibling tree; out of scope for
this paper.}
\end{abstract}

\tableofcontents
\newpage

\input{sections/01-introduction}
\input{sections/02-preliminaries}
\input{sections/03-construction}
\input{sections/04-security}
\input{sections/04b-thbsse}
\input{sections/05-implementation}
\input{sections/06-evaluation}
\input{sections/07-comparison}
\input{sections/09-related-work}
\input{sections/10-conclusion}

\bibliographystyle{plain}
\bibliography{references}

\section*{Reproducibility}
\textbf{Source code.} \texttt{github.com/luxfi/magnetar} at tag
\texttt{v1.0.0}.\\
\textbf{Build.} \texttt{cd ref/go \&\& GOWORK=off go build ./... \&\&
GOWORK=off go test -short ./pkg/magnetar/...}. The race-detector
($-$race) is supported but skips the SLH-DSA heavy paths via the
\texttt{raceEnabled} build-tag pattern; race-on runs cover the cheap
unit tests (transcript, types, wire codec, THBS-SE share
arithmetic).\\
\textbf{Headline regressions.}
\texttt{go test -count=1 -run TestMagnetar\_Wire\_FIPS205Verifiable
./ref/go/pkg/magnetar/...} pins byte-identity for the per-validator
standalone primitive;
\texttt{go test -count=1 -run TestThbsSE\_Wire\_FIPS205Verifiable
./ref/go/pkg/magnetar/...} pins the same identity for the THBS-SE
public combiner. Both run across all three SHAKE parameter sets.\\
\textbf{Hardware tested.} Apple Silicon M1 Max, macOS 15.4, Go
1.26.3 darwin/arm64.\\
\textbf{Dependencies.} \texttt{github.com/cloudflare/circl v1.6.3}
(FIPS 205 SLH-DSA reference, BSD-3-Clause) and
\texttt{golang.org/x/crypto v0.32.0} (cSHAKE256 over FIPS 202 / NIST
SP 800-185). No private dependencies.\\
\textbf{Standards referenced.} FIPS 205 (SLH-DSA), FIPS 202 (SHA-3 /
SHAKE / cSHAKE), NIST SP 800-185 (KMAC / TupleHash / cSHAKE
customisation), NIST IR 8214C \cite{nistir8214c} (Multi-Party
Threshold Cryptography scope).\\
\textbf{Companion documents.} \texttt{SPEC.md} (normative
construction), \texttt{THBS-SPEC.md} (THBS-SE construction spec),
\texttt{DEPLOYMENT-RUNBOOK.md} (operator runbook),
\texttt{BLOCKERS.md} (v1.1 roadmap), \texttt{CHANGELOG.md}
(release-by-release framing).\\
\textbf{Contact.} [email protected].

\end{document}