papers/lux-magnetar-pq/sections/01-introduction.tex

\section{Introduction}
\label{sec:intro}

Post-quantum threshold signatures are the load-bearing primitive of any
blockchain consensus design that wants to survive a cryptographically
relevant quantum adversary. The classical workhorses --- BLS aggregate
\cite{bls,boneh2001short} and ECDSA with CGGMP21
\cite{cggmp21} --- fail catastrophically under Shor's algorithm, and the
threshold replacements available for the post-quantum era do not all
ground their security in the same underlying mathematical assumption.
Defense in depth at the cryptographic primitive layer requires not just
``a PQ scheme,'' but a portfolio of PQ schemes whose security
assumptions are \emph{algorithmically independent}: a break of any one
family does not propagate to the others.

The Lux Polaris cert profile \cite{lp020} encodes this discipline in
production. Polaris is the maximum-assurance Quasar finality profile
that pairs three independent threshold lanes:
\begin{itemize}[leftmargin=2em,nosep]
  \item \textbf{Pulsar} --- threshold Module-LWE
        \cite{lp073pulsarpaper,ringtail}, the lattice lane in
        $\mathbb{Z}_q[X]/(X^{256}+1)$ with a 48-bit prime;
  \item \textbf{Corona} --- threshold Module-LWE
        \cite{lp104corona,ringtail}, a structurally distinct
        lattice instantiation that does not share Pulsar's module
        parameter choice; and
  \item \textbf{Magnetar} (this paper) --- per-validator standalone
        FIPS 205 SLH-DSA \cite{fips205}, the hash-based lane whose
        security rests on SHA-3 / Keccak collision resistance and
        preimage resistance rather than on any structured lattice
        assumption.
\end{itemize}
The three legs are deliberately drawn from \emph{different mathematical
families}: a polynomial-time algorithm against module-lattice problems
would break Pulsar and Corona simultaneously but leave Magnetar intact;
a polynomial-time preimage attack on Keccak would break Magnetar but
leave the lattice lanes intact; a single quantum oracle that defeats
both families is, on current evidence, an inconsistent ask. Polaris
finality requires \emph{all three} lanes to verify, so an adversary must
break the conjunction --- a strictly harder task than breaking any
single primitive.

Magnetar is the third leg. This paper specifies the construction at
\texttt{github.com/luxfi/magnetar} v1.0.0 --- the per-validator
standalone public-BFT primary primitive, the THBS-SE permissionless
threshold companion, the canonical MAGS/MAGG wire codec, and the
stateless \texttt{VerifyBytes} dispatcher --- and the
Polaris-composition discipline that binds Magnetar to Pulsar and
Corona under a common transcript.\footnote{Operator-controlled MPC
custody uses TEE-attestation-gated variants in
\texttt{luxfi/threshold/protocols/\{slhdsa,mldsa,rlwe\}-tee} shipped
via the \texttt{lux/mpc} sibling tree; those variants are out of
scope here.}

\subsection{What Magnetar is}
\label{sec:intro:what}

Magnetar's primary cryptographic primitive is \emph{per-validator
standalone FIPS 205 SLH-DSA} \cite{fips205}. SLH-DSA is the NIST
hash-based signature standard (formerly SPHINCS+ \cite{sphincs}); it
is stateless, requires no trapdoor or structured ring, and inherits
its security from the standard properties of cryptographic hash
functions (collision resistance, preimage resistance,
second-preimage resistance, and the Boneh--Shoup
\cite{boneh-shoup-textbook} sub-exponential preimage bound under
quantum adversaries).

The Magnetar public-BFT construction departs deliberately from the
threshold templates of FROST \cite{frost,rfc9591}, Pulsar
\cite{lp073pulsarpaper}, or Corona \cite{lp104corona}. SLH-DSA has
\emph{no linear share-aggregation identity}: there is no algebraic
operation analogous to FROST's $z = \sum_i z_i$ that produces a valid
SLH-DSA signature from per-party contributions on the same message.
The literature is uniform on this point. Cozzo and Smart
\cite{cosmin2021} (EUROCRYPT 2019, ``Sharing the LUOV'') establish
that every internal SHAKE/SHA-2 evaluation in a hash-based signature
is a non-linear function of the seed, so any genuine $t$-of-$n$
scheme producing a single FIPS 205-shaped signature requires either
(i) reconstructing the seed inside some combiner process at sign
time, or (ii) running a full MPC over the entire SHA-256/SHAKE hash
tree (open research, with cost proportional to the $\sim 10^4$ hash
invocations per SLH-DSA-SHAKE-192s signature). Bonte, Smart and Tan
(2023, ``Threshold SPHINCS+'') confirm the infeasibility analysis.
THBS-SE (\S\ref{sec:thbsse}) is Magnetar's chosen instantiation of
(i) with a \emph{public combiner} role: anyone can be the combiner;
no host is in the TCB at sign time; the seed reconstruction is
transient and local to the combiner's own substrate.

The architecturally correct primitive for \emph{public-BFT consensus}
under these constraints is therefore $N$ standalone signatures
collected at the consensus layer. Each validator $i$ runs FIPS 205
$\textsc{KeyGen}$ once, persists $(sk_i, pk_i)$, and contributes a
single-party $\textsc{Sign}_{\mathrm{det}}(sk_i, \mu, \mathit{ctx})$
to each consensus message. The consensus layer collects the $N$
signatures into a \texttt{ValidatorAggregateCert} carrying the
parallel triples
$(\mathit{Signers}, \mathit{PubKeys}, \mathit{Sigs})$ and a known
validator registry binding each $\mathit{Signers}[i]$ to its
registered $pk_i$. The quorum decision (``count $\ge$ threshold'')
lives at the consumer, not in the primitive; the primitive reports
the validated count.

\paragraph{Byte-identity to single-party FIPS 205.} Each $\sigma_i$
emitted by \texttt{magnetar.ValidatorSign} (with \texttt{rng=nil}) is
byte-identical to what a centralized FIPS 205
$\textsc{SignDeterministic}$ would emit on the same
$(sk_i, \mu, \mathit{ctx})$. This is the load-bearing operational
property: every SLH-DSA verifier in the wild
(\texttt{cloudflare/circl/sign/slhdsa} \cite{circl}, the NIST FIPS
205 reference, openssl-pq builds, libsignal-pq) accepts a Magnetar
signature byte-for-byte after the consensus wire envelope is
stripped. The byte-identity is empirically pinned by
$\textsc{TestMagnetar\_Wire\_FIPS205Verifiable}$ at
\texttt{ref/go/pkg/magnetar/wire\_test.go:166--220}: the test
generates a keypair via \texttt{PerValidatorKeypair}, signs via
\texttt{ValidatorSign}, frames both via the MAGS / MAGG wire codec,
strips the 11-byte canonical header to recover the raw FIPS 205
payload bytes, and feeds them to
\texttt{cloudflare/circl/sign/slhdsa.Verify} with no Magnetar code
path on the verifier side. The test passes for SHAKE-192s,
SHAKE-192f, and SHAKE-256s under \texttt{-count=1} and \texttt{-race}.

\paragraph{Public-BFT contract.} The per-validator standalone
primitive carries the property the cryptographic-diversity argument
of \S\ref{sec:intro:whyhash} requires:
\begin{enumerate}[leftmargin=2em,nosep]
  \item No DKG, no dealer, no shared seed. Each validator generates
        its own keypair on its own host with its own RNG. Losing
        $sk_i$ is a local failure --- the validator drops out of the
        quorum until rotating to a fresh keypair --- not a
        threshold-secret reconstruction event.
  \item No aggregator-in-TCB. The consensus layer never holds
        anyone's secret. \texttt{ValidatorBatchVerify} and
        \texttt{VerifyAggregateCert} are pure public-input functions.
  \item No new verification code. Relying parties run any unmodified
        FIPS 205 verifier against the wire payload; the Magnetar
        envelope is opaque to them.
  \item Wire shape that maps directly to Z-Chain Groth16 rollup
        witness layout. The \texttt{ValidatorAggregateCert}
        parallel-slices form
        $(\mathit{Mode}, \mathit{Signers}, \mathit{PubKeys},
        \mathit{Sigs})$ is the wire shape the rollup prover consumes
        verbatim.
\end{enumerate}

The wire-size cost is $N \times |\sigma|$ before the rollup. For
SHAKE-192s ($|\sigma| = 16{,}224$~B) at a $K=21$ Polaris quorum that
is $\sim 332$~KiB. The Z-Chain Groth16 rollup compresses this to
$\sim 192$~B before the certificate hits long-term storage. The
rollup is a separate primitive specified at the lux-zchain layer;
Magnetar emits the rollup-friendly parallel-slices shape but does
not own the rollup.

\subsection{Why hash-based}
\label{sec:intro:whyhash}

Lattice cryptography (Module-LWE, Ring-LWE, NTRU) is the consensus
post-quantum direction for performance reasons --- ML-KEM
\cite{fips203}, ML-DSA \cite{fips204}, and FALCON \cite{falcon} all
operate in milliseconds, ship signatures in the few-KB range, and
parallelise well. But the lattice family rests on a single set of
related-problem assumptions (Module-LWE, Ring-LWE, NTRU, Module-SIS)
whose hardness is conjectured but whose ultimate security margin is the
subject of ongoing cryptanalytic refinement. The cryptanalytic surface
includes BKZ block-size cost models \cite{bdgl2016,laarhoven2015}, dual
sieves \cite{albrechtestimator}, structured-lattice algebraic attacks
on cyclotomic rings, and quantum-amplified sieves whose constants
remain in modest motion. A polynomial-time algorithm for any of these
problems would invalidate the entire lattice signature ecosystem
simultaneously.

Hash-based signatures rest on assumptions that are \emph{older, more
broadly studied, and structurally orthogonal}. FIPS 205 SLH-DSA's
security reduces to:
\begin{itemize}[leftmargin=2em,nosep]
  \item collision resistance of the hash function family
        (SHA-3 / SHAKE for the FIPS 205 SHAKE modes Magnetar targets);
  \item preimage resistance of the same;
  \item the absence of unforeseen structural weaknesses in the WOTS+
        and FORS one-time / few-time signature schemes that build on
        the hash function.
\end{itemize}
These properties have been studied for decades. SHA-3 in particular
emerged from a multi-year open competition \cite{keccak-keccak}; its
internal structure (Keccak's sponge construction over a permutation)
is qualitatively distinct from Merkle--Damg{\aa}rd, BLAKE, and the
keyed-permutation Romulus and Ascon families. A quantum attack that
defeats SHA-3 is one that defeats hash functions \emph{as a class}, a
strictly stronger ask than defeating any one family.

The trade-off is performance: SLH-DSA signatures are 16--36~KB, signing
takes hundreds of milliseconds to seconds on commodity hardware, and
the construction is the slowest of the FIPS-standardised PQ schemes.
For a \emph{single} hot-path signature this would be a non-starter.
For the \emph{Polaris third lane} it is precisely the trade-off we
want: Polaris's BLS lane sets the latency floor, Pulsar sets the
per-block PQ floor, and Magnetar shoulders the diversity insurance ---
it does not need to be the fastest, only to be \emph{independent} of
the other two.

\subsection{What is novel}
\label{sec:intro:novel}

The cryptographic primitives in this paper are not new. FIPS 205
\cite{fips205} is the NIST-standardised SLH-DSA. A per-validator
standalone signature is just a single-party FIPS 205 signature, and
$N$-of-$N$ collection at a consensus layer is the canonical pattern
for ML-DSA (already in production via the \texttt{QuasarCert.MLDSAProof}
field) and BLS aggregate.

What \texttt{luxfi/magnetar} contributes is the \emph{composition}:
\begin{enumerate}[leftmargin=2em,nosep]
  \item An explicit-semantic public-BFT API surface at
        \texttt{ref/go/pkg/magnetar/standalone.go} ---
        \texttt{PerValidatorKeypair}, \texttt{ValidatorSign},
        \texttt{ValidatorBatchVerify}, \texttt{ValidatorAggregateCert},
        \texttt{BuildAggregateCert}, \texttt{VerifyAggregateCert} ---
        that decomplects the public-BFT signing primitive from the
        TEE-only threshold forms below. One signing primitive
        $\to$ one keypair $\to$ no shared state $\to$ no
        aggregator-in-TCB. The quorum decision lives at the
        consumer.
  \item A canonical wire codec (MAGS for signatures, MAGG for
        group keys; 11-byte fixed header carrying magic, version,
        mode, and big-endian payload length) at
        \texttt{ref/go/pkg/magnetar/wire.go}, with a stateless
        dispatcher \texttt{VerifyBytes(groupKey, msg, sig)} that
        accepts wire bytes from the threshold daemon and verifies
        under FIPS 205 with no out-of-band state. The codec is
        siblinged with Pulsar's PULS/PULG and Corona's CORS/CORG
        canonical wire framings, so the consensus-layer dispatcher
        is uniform across the three Polaris lanes.
  \item A byte-identity gate
        $\textsc{TestMagnetar\_Wire\_FIPS205Verifiable}$ that pins
        per-validator $\sigma_i$ to single-party
        \texttt{cloudflare/circl/sign/slhdsa.Verify} across all three
        FIPS 205 SHAKE parameter sets. The verifier-side code path
        is the unmodified circl reference; no Magnetar code runs
        there. This is the empirical Class-N1-analog property
        translated to the standalone construction.
  \item Hash-function domain separation across every Magnetar
        cSHAKE256 invocation --- cSHAKE256 with function name
        ``Magnetar'' and per-purpose customisation strings ---
        so cross-context replay attacks reduce to cSHAKE256
        collision resistance.
  \item A Polaris cert-profile composition: Magnetar joins Pulsar
        and Corona as the third lane of the maximum-assurance
        profile, sharing the LSS lifecycle adapter contract
        \cite{luxlssmpc} and the Prism transcript-binding
        discipline \cite{lp073pulsarpaper}. The
        \texttt{ValidatorAggregateCert} parallel-slices shape is
        designed to feed the Z-Chain Groth16 rollup that compresses
        $N \times |\sigma|$ to a constant-size certificate.
  \item THBS-SE (Threshold Hash-Based Signatures with
        Selected-Element Reconstruction), the permissionless
        threshold companion to the per-validator standalone path,
        specified in \S\ref{sec:thbsse}. THBS-SE is a $t$-of-$n$
        construction in which the public combiner role is open to
        any peer (validator, block proposer, RPC node, passive
        watcher); no host is in the TCB at sign time. The
        construction enforces the hard invariant ``a revealed value
        is allowed only if it is also present in the final SLH-DSA
        signature'' --- party-local share material never includes
        the SLH-DSA seed, only Shamir leaves over $\mathrm{GF}(257)$
        --- and produces FIPS 205 wire bytes byte-identical to
        single-party $\textsc{SignDeterministic}$ on the
        reconstructed seed.
\end{enumerate}

\subsection{Trust model summary}
\label{sec:intro:trust}

The per-validator standalone primitive has a clean trust model: it is
the trust model of single-party FIPS 205 SLH-DSA, replicated
independently $N$ times. We state it explicitly.

\paragraph{In the TCB at sign time:} validator $i$'s own host. Each
validator holds its own $sk_i$ locally; losing $sk_i$ to an attacker
allows that attacker to sign as validator $i$ until $pk_i$ is rotated
out of the validator-set registry. This is the same exposure as a
classical secp256k1 validator key, and the same operational
mitigations apply (HSM-backed key storage, key rotation, slashing
evidence for double-signing).

\paragraph{NOT in the TCB:} the consensus layer, the
\texttt{ValidatorAggregateCert} aggregator path, the
\texttt{VerifyAggregateCert} verifier, the wire codec, or any other
validator. The aggregation and verification primitives are pure
public-input functions over $(\mathit{PubKeys}, \mathit{Sigs},
\mathit{Signers}, \mu, \mathit{registry})$. There is no shared
secret to compromise.

\paragraph{Cross-validator independence.} Because each validator
holds an independent keypair, compromising $sk_i$ for validator $i$
gives the attacker exactly one quorum vote. Forging a quorum requires
compromising $\ge \mathit{threshold}$ distinct validator hosts, which
is the same Byzantine-fault threshold the rest of the consensus
stack is sized to. No threshold-secret reconstruction event exists
to be raced against; an attacker who steals $\mathit{threshold} - 1$
keypairs cannot recover or forge with the remaining honest keypairs.

\paragraph{Quantum threat.} The per-validator standalone primitive
inherits FIPS 205's post-quantum security budget: $\sim 2^{192}$
classical / $\sim 2^{128}$ quantum at SHAKE-192s, and
$\sim 2^{256}$ classical / $\sim 2^{128}$ quantum at SHAKE-256s. A
quantum adversary that can mount a $2^{128}$-Grover attack against
a single validator's SHA-3 evaluations would need $\sim 2^{128}$
quantum operations per validator to forge that validator's
signatures, and would still control only one quorum vote per
forgery target.

\paragraph{THBS-SE trust model.} The permissionless threshold
companion (\S\ref{sec:thbsse}) carries a distinct trust model: a
public combiner reconstructs the SLH-DSA seed transiently in its
own memory for the duration of one
$\textsc{SignDeterministic}$ call (sub-second wall-clock at
SHAKE-192s) and zeroizes. The combiner role is open to any peer;
no long-lived secret material exists outside party-local Shamir
leaves; no host is in the TCB by policy. This is materially
stronger than a TEE-attested privileged-aggregator model and
materially weaker than a strict ``no transient seed at any moment''
invariant. The strict-atom-assembly path (the v1.1 lift tracked in
\texttt{BLOCKERS.md::MAGNETAR-STRICT-ATOM-V11}) closes the gap by
reconstructing only the message-selected FORS leaves and WOTS+
chain bases from per-atom shares, bypassing
\texttt{slh\_sign\_internal} entirely; that work requires a
Magnetar-internal reimplementation of FIPS 205 \S\S 5--8 and is
out of scope for v1.0.

\subsection{What this paper specifies}
\label{sec:intro:paper}

Section~\ref{sec:preliminaries} reviews FIPS 205 SLH-DSA, the
threshold-signature syntax used by THBS-SE, and the security
games. Section~\ref{sec:construction} gives the per-validator
standalone construction byte-exact in pseudocode, keyed to the Go
canonical at \texttt{ref/go/pkg/magnetar/standalone.go} and
\texttt{wire.go} byte-for-byte. Section~\ref{sec:security} states
the security argument: byte-identity to single-party FIPS 205, the
$N$-of-$N$ verification semantics, the existential unforgeability
inheritance from FIPS 205 UF-CMA per validator, and the named
THBS-SE selected-element-reveal invariant theorem.
Section~\ref{sec:thbsse} specifies THBS-SE: the slot binding, the
commit-and-reveal rounds, the public combiner, the slashable
equivocation and malformed-share evidence shapes, and the
byte-identity theorem that ties the public-combiner output to
single-party FIPS 205 $\textsc{SignDeterministic}$.
Section~\ref{sec:implementation} surveys the reference
implementation. Section~\ref{sec:evaluation} reports parameter sets
and per-signature latency from the production test suite.
Section~\ref{sec:comparison} locates Magnetar alongside Pulsar and
Corona in the Polaris cert profile.
Section~\ref{sec:related} surveys the threshold-SLH-DSA literature
and the broader threshold-hash-based-signature work.
Section~\ref{sec:conclusion} closes.

\medskip\noindent\textbf{Artefact status.} At the time of writing,
the artefact is \texttt{luxfi/magnetar} v1.0.0. The per-validator
standalone primary primitive shipped at v0.5.0 and is unchanged at
v1.0; THBS-SE is the v1.0 closer of the permissionless-threshold
story and replaces the v0.x reveal-and-aggregate path. The
byte-identity regression tests
$\textsc{TestMagnetar\_Wire\_FIPS205Verifiable}$ and
$\textsc{TestThbsSE\_Wire\_FIPS205Verifiable}$ pin both primitives
to unmodified \texttt{cloudflare/circl/sign/slhdsa.Verify} across
all three SHAKE parameter sets under \texttt{-count=1} and
\texttt{-race}. The Tier-A documentation shape (10-document package
mirroring Pulsar's structure, with the v0.x submission scaffolds
ported forward and the v1.0 normative content in
\texttt{SPEC.md} + \texttt{THBS-SPEC.md}) is in-tree. Mechanised
proof artefacts for THBS-SE, the strict-atom-assembly v1.1 lift,
and external cryptographer audit of the v1.0 surface are the
remaining gates to full Tier A.