papers/lux-magnetar-pq/sections/04-security.tex

\section{Security argument}
\label{sec:security}

This section states the security claims for the per-validator
standalone primitive. The argument is short because the construction
is short: each $\sigma_i$ is a single-party FIPS 205
$\textsc{SignDeterministic}$ output, and FIPS 205's UF-CMA
security \cite{fips205,sphincs} transfers directly to the per-
validator forgery game via a standard hybrid argument. The wire
codec is a purely additive envelope; it admits a constant-time
byte-identity argument against unmodified
\texttt{cloudflare/circl/sign/slhdsa}.

\subsection{Byte-identity to single-party FIPS 205}
\label{sec:security:byte-equality}

\begin{theorem}[Standalone byte identity]
\label{thm:magnetar-byte-equality}
Fix a parameter set $\textsc{Mode} \in \{\mathrm{SHAKE\text{-}192s},
\mathrm{SHAKE\text{-}192f},
\mathrm{SHAKE\text{-}256s}\}$ and a validator keypair
$(sk_i, pk_i) \gets \texttt{PerValidatorKeypair}(\textsc{Mode},
\textit{rng})$. For any message $\mu$, the output of
$\texttt{ValidatorSign}(sk_i, \textit{rng}=\textbf{nil}, \mu)$ is
byte-identical to the output of
$\texttt{circl.slhdsa.Scheme}(\textsc{Mode}).
\texttt{SignDeterministic}(sk_i^{\textit{circl}}, \mu,
\mathit{ctx}=\varepsilon)$, where $sk_i^{\textit{circl}}$ is the
\texttt{circl}-form embedding of $sk_i$.
\end{theorem}

\begin{proof}
By inspection of the call graph.
\texttt{PerValidatorKeypair} (\texttt{standalone.go:197-199})
delegates to \texttt{GenerateValidatorKey}, which delegates to
\texttt{circl.slhdsa.Scheme(params.ID).DeriveKey}. The output
$sk_i$ is the \texttt{circl} private-key bytes verbatim.
\texttt{ValidatorSign} (\texttt{standalone.go:231-244}) delegates
to \texttt{Sign} (\texttt{sign.go}), which dispatches to
\texttt{Scheme.SignDeterministic} when \texttt{rng=nil}. The output
is the raw FIPS 205 signature bytes returned by \texttt{circl}.
\end{proof}

\paragraph{Wire-codec byte identity (corollary).}

\begin{corollary}[Wire-codec byte identity]
\label{cor:wire-byte-identity}
For any $\sigma_i$ from
$\texttt{ValidatorSign}(sk_i, \textit{rng}=\textbf{nil}, \mu)$ and
$pk_i$ from \texttt{PerValidatorKeypair}, the wire frames
$\texttt{MarshalBinary}(\texttt{Signature}\{\textsc{Mode}, \sigma_i\})$
and $\texttt{MarshalGroupKey}(\texttt{PublicKey}\{\textsc{Mode},
pk_i\})$ each consist of an 11-byte canonical header followed
by the FIPS 205 payload bytes verbatim. Stripping the 11-byte
header from each frame recovers exactly the
\texttt{circl}-emitted $(pk_i^{\textit{circl}},
\sigma_i^{\textit{circl}})$. The unmodified
\texttt{circl.slhdsa.Scheme($\textsc{Mode}$).Verify} accepts
$(\sigma_i^{\textit{circl}}, \mu, pk_i^{\textit{circl}})$.
\end{corollary}

\begin{proof}
The MAGS frame layout (\S\ref{sec:construction:wire})
concatenates a fixed 11-byte header with the FIPS 205 signature
payload verbatim; the MAGG frame layout does the same for the
public key. \texttt{UnmarshalBinary} / \texttt{UnmarshalGroupKey}
reverse the framing without touching the payload bytes. By
Theorem~\ref{thm:magnetar-byte-equality}, the payload bytes
recovered are exactly the \texttt{circl}-emitted FIPS 205 bytes.
FIPS 205 \cite{fips205}~\S9.3 guarantees that
$\textsc{Verify}(pk, \mu, \sigma, \mathit{ctx}) = 1$ whenever
$\sigma = \textsc{SignDeterministic}(sk, \mu, \mathit{ctx})$ and
$pk$ is the public-key part of the keypair $\textsc{DeriveKey}$
returns for the same seed.
\end{proof}

\paragraph{Empirical pin.} The byte-identity property is
empirically pinned by
$\textsc{TestMagnetar\_Wire\_FIPS205Verifiable}$ at
\texttt{ref/go/pkg/magnetar/wire\_test.go:166--220}. The test:
\begin{enumerate}[leftmargin=2em,nosep]
  \item Generates a keypair via the v1.0 per-validator standalone
        primary path
        (\texttt{PerValidatorKeypair} with a deterministic
        \texttt{detReader}).
  \item Signs via \texttt{ValidatorSign} (\texttt{rng=nil}).
  \item Frames both via the wire codec
        (\texttt{MarshalGroupKey} and \texttt{sig.MarshalBinary}).
  \item Extracts the FIPS 205 payload from each frame by skipping
        the 11-byte header. No Magnetar package code touches the
        payload at this point.
  \item Calls
        \texttt{cloudflare/circl/sign/slhdsa.Scheme($\textsc{Mode}$).Verify}
        directly on the extracted payload. This is the load-bearing
        assertion of byte-identity; the verifier path is the
        unmodified \texttt{circl} reference with no Magnetar code.
  \item Runs the stateless \texttt{VerifyBytes} path (used by the
        threshold daemon at the dispatch layer) on the same wire
        bytes and asserts it accepts.
  \item Tamper checks: flips one byte in the signature payload;
        asserts both direct-\texttt{circl} verify and
        \texttt{VerifyBytes} reject.
\end{enumerate}
The test runs for all three modes (SHAKE-192s, SHAKE-192f,
SHAKE-256s) and passes under \texttt{-count=1} and \texttt{-race}.

\subsection{Multi-validator EUF-CMA}
\label{sec:security:multi-eufcma}

\begin{theorem}[Magnetar standalone multi-validator EUF-CMA]
\label{thm:magnetar-multi-eufcma}
Let $\Pi^{\mathrm{std}}_{\mathrm{Magnetar}}$ be the per-validator
standalone construction of \S\ref{sec:construction} at parameter set
$\textsc{Mode}$, instantiated with $N$ independent validators of
which up to $|F| < K$ are statically corrupted ($K$ being the
quorum threshold). For any PPT adversary $\mathcal{A}$,
\begin{equation}
  \mathsf{Adv}^{\mathrm{multi\text{-}EUF\text{-}CMA}}_{
  \Pi^{\mathrm{std}}_{\mathrm{Magnetar}}, \mathcal{A}}(\lambda, N)
  \;\le\;
  N \cdot
  \mathsf{Adv}^{\mathrm{UF\text{-}CMA}}_{\mathrm{SLH\text{-}DSA}}(
  \lambda, \mathcal{B}),
\label{eq:magnetar-multi-eufcma}
\end{equation}
where $\mathcal{B}$ is a hybrid-argument reduction running
$\mathcal{A}$ with at most $Q_S$ signing queries per honest
validator and $Q_H$ random-oracle queries, with running time
within $\mathrm{poly}(\lambda, N)$ of $\mathcal{A}$.
\end{theorem}

\begin{proof}[Proof sketch]
Standard hybrid argument over independent keypairs. The
challenger samples $N$ independent SLH-DSA keypairs and gives
$\mathcal{A}$ the corrupt subset $\{sk_i\}_{i \in F}$. For each
$\mathcal{A}$ signing query $(i, \mu)$ with $i \notin F$, the
challenger forwards $(i, \mu)$ to the $i$-th honest validator's
SLH-DSA signing oracle and returns the resulting $\sigma_i$. By
$\mathcal{A}$'s winning condition, the forgery
$\mathit{cert}^\star$ contains at least $K - |F|$ valid
signatures from honest validators on $\mu^\star \notin
\{\mu_{j} : (i, \mu_j) \in \mathit{queries}\}$. Pick any one such
honest signer $i^\star$; the pair
$(\mu^\star, \sigma_{i^\star}^\star)$ is a fresh SLH-DSA UF-CMA
forgery against $pk_{i^\star}$. The hybrid argument over
$N$ honest validators (guessing $i^\star$ uniformly at random)
loses a factor $N$.
\end{proof}

\paragraph{Provable security level.} SLH-DSA UF-CMA at SHAKE-192s
is upper-bounded by $\sim 2^{-192}$ classical and $\sim 2^{-128}$
quantum (Grover) per validator. At $N = 2^{12}$ (a Lux validator
quorum upper bound far above the production $K \sim 21$), the
factor-$N$ hybrid loss in \eqref{eq:magnetar-multi-eufcma}
absorbs trivially: the classical bound becomes $\sim 2^{-180}$
and the quantum bound becomes $\sim 2^{-116}$. SHAKE-256s
absorbs the same factor with $\sim 2^{-244}$ classical and
$\sim 2^{-116}$ quantum. Both regimes provide ample headroom
relative to the post-quantum security baseline of NIST PQC
Category 3 / 5.

\paragraph{No cross-validator coupling.} Because each
$(sk_i, pk_i)$ is independent, compromising $|F|$ validators
yields exactly $|F|$ controllable signatures --- no information
about the remaining $N - |F|$ keypairs leaks. The cryptographic
budget against forging a quorum vote requires compromising
$\ge K$ distinct validator hosts (or breaking SLH-DSA on a fresh
$pk_i$ which is bounded by the per-validator UF-CMA term).

\subsection{Trust posture}
\label{sec:security:tcb}

The per-validator standalone primitive's TCB is short. We enumerate.

\paragraph{In each validator's TCB at sign time:}
\begin{itemize}[leftmargin=2em,nosep]
  \item validator $i$'s own $sk_i$ (FIPS 205 wire form,
        $4n$ bytes).
\end{itemize}

\paragraph{NOT in any TCB:}
\begin{itemize}[leftmargin=2em,nosep]
  \item the consensus layer (only handles public inputs);
  \item the \texttt{ValidatorAggregateCert} construction and
        verification primitives (pure functions of public
        inputs);
  \item the wire codec (purely additive envelope; no secret
        material flows through it);
  \item any other validator's keypair (independence guarantees);
  \item any aggregator, dealer, or DKG transcript participant
        (none exist in this construction).
\end{itemize}

\paragraph{Threat surface per validator.} Compromising
validator $i$'s host extracts $sk_i$ and lets the attacker sign
as validator $i$ until $pk_i$ rotates. The standard validator-key
hardening discipline applies: HSM-backed key storage, key rotation
on schedule, slashing evidence for double-signing,
attestation-pinned signing services. This is operationally
identical to a classical secp256k1 validator key in the
pre-quantum era, except the keypair is now FIPS 205 SLH-DSA.

\paragraph{Quantum threat.} A quantum adversary mounting a
$2^{128}$ Grover attack against SHA-3 evaluations would need
$\sim 2^{128}$ quantum operations to forge a single validator's
signature (SHAKE-192s) and would control exactly one quorum vote
per successful forgery target. Forging a quorum requires
$K$ independent successful attacks, none of which inherit
state from any other. The construction therefore inherits FIPS
205's post-quantum security argument verbatim, replicated
$N$ times.

\paragraph{Comparison to THBS-SE.} The permissionless threshold
companion of \S\ref{sec:thbsse} carries a distinct TCB shape: a
public combiner reconstructs the SLH-DSA seed transiently in
its own memory for the duration of one
$\textsc{SignDeterministic}$ call. The combiner role is open to
any peer; no host is in the TCB by policy. See
Theorem~\ref{thm:thbsse-selected-element-reveal} and
\S\ref{sec:security:thbsse-tcb} for the THBS-SE-specific
analysis.

\subsection{Constant-time posture}
\label{sec:security:ct}

The standalone-path constant-time posture is the union of:
\begin{itemize}[leftmargin=2em,nosep]
  \item \textbf{\texttt{circl.slhdsa.SignDeterministic}.} The
        primary signing path delegates entirely to
        \texttt{cloudflare/circl}~v1.6.3 \cite{circl}. The
        \texttt{circl} \texttt{slhdsa} implementation is
        constant-time per its documented design and is the most
        widely deployed Go FIPS 205 backend in production. The
        outstanding side-channel obligation is independent
        \texttt{dudect} \cite{dudect} validation at $\ge 10^9$
        samples (BLOCKERS.md GATE-3).
  \item \textbf{\texttt{circl.slhdsa.Verify}.} Verifier
        delegates entirely to \texttt{circl}; constant-time by
        the same argument.
  \item \textbf{\texttt{ctEqualBytes} pubkey comparison.}
        Constant-time XOR-then-OR reduction in
        \texttt{transcript.go}; no secret-dependent branching.
        The pubkey comparison is the only operation in
        \texttt{VerifyAggregateCert} that takes a secret-derived
        input (the registered pubkey side), and even that input
        is technically public (registered pubkeys are
        on-chain).
  \item \textbf{Wire codec.} Header decode is fixed-length
        big-endian arithmetic; magic-constant comparison is
        constant-time byte-equality. No payload-dependent
        branching.
\end{itemize}

The standalone path has no secret-dependent control flow outside
the \texttt{circl} \texttt{slhdsa} dispatch; the constant-time
properties of the wrapped backend dominate the side-channel
analysis. The THBS-SE path (\S\ref{sec:thbsse}) carries
additional constant-time obligations on the Shamir Lagrange
reconstruct, commit-bind comparison, and combiner-side
zeroization paths; those obligations are documented in
\S\ref{sec:security:thbsse-tcb}.

\subsection{Composition with Polaris}
\label{sec:security:polaris}

Polaris is the Lux maximum-assurance cert profile pairing three
threshold lanes across two hardness families: Pulsar
(Module-LWE) and Corona (Module-LWE, Ringtail-derived parameter
set) on the lattice family, plus Magnetar (FIPS 205 SLH-DSA) on
the hash family. The composed soundness theorem (Theorem~8 of
\cite{quasarcertsoundness}, ``post-quantum safety'') bounds the
adversary advantage by the \emph{minimum} of the per-lane
advantages. Pulsar and Corona use distinct Module-LWE parameter
sets and codebases, so a parameter- or implementation-localized
break need not hit both; but they are not family-disjoint, and a
structural break of Module-LWE would threaten both lattice lanes.
The family-disjoint guarantee comes from Magnetar: no known
reduction transfers a break of the lattice family to the SHA-3
collision assumption, so the Magnetar lane survives even a
complete lattice break, and the conjunction is strictly harder
than breaking any single family.

The role-binding invariant is enforced by Prism
\cite{lp073pulsarpaper}: every Magnetar
$\sigma_i$ is computed over a consensus message $\mu$ that
hashes the certificate subject including
$(\mathit{chain\_id}, \mathit{epoch}, \mathit{round},
\mathit{KeyEraID}, \mathit{Generation})$, so cross-epoch replay
reduces to single-party FIPS 205 forgery on a fresh $\mu^\star$
--- which is bounded by the same UF-CMA term as
\eqref{eq:magnetar-multi-eufcma}.

\subsection{Proof roadmap}
\label{sec:security:roadmap}

The standalone primitive's argument is short because the
underlying construction is short. The mechanisation roadmap is
correspondingly compact.

\paragraph{Lean 4: wire-codec byte identity.}
Corollary~\ref{cor:wire-byte-identity}'s argument is a purely
algorithmic statement about envelope framing and is the
lowest-hanging mechanisation target. The Lean specification at
\texttt{lux-formal-verification-lean4} \cite{lp-lean4} can
mechanise this as a structural lemma over the MAGS / MAGG
frame layout.

\paragraph{EasyCrypt: hybrid argument for multi-validator
EUF-CMA.} The hybrid reduction of
Theorem~\ref{thm:magnetar-multi-eufcma} maps onto a standard
EasyCrypt \cite{easycrypt} game-hop sequence: $\mathsf{Game}_0$
is the honest multi-validator EUF-CMA game; $\mathsf{Game}_i$
($i \in [1, N]$) is the hybrid in which validators
$1, \ldots, i-1$ are replaced by oracle queries to the SLH-DSA
challenger; $\mathsf{Game}_N$ is fully oracle-driven. Each hop
is a perfect simulation modulo the SLH-DSA UF-CMA hop. This is
GATE-1 in \texttt{BLOCKERS.md}; the planned artefact lives at
\texttt{proofs/easycrypt/Magnetar/} once the EasyCrypt theory
ships.

\paragraph{Jasmin: constant-time hot paths.} The standalone
path has no constant-time hot paths outside the
\texttt{circl}-delegated \texttt{slhdsa.SignDeterministic} and
\texttt{slhdsa.Verify}. The Jasmin \cite{jasmin} obligation
applies to the THBS-SE hot paths
(\S\ref{sec:thbsse:combine}) where Magnetar code holds
secret-derived material directly --- the byte-wise Lagrange
interpolation and the commit re-derivation.

\paragraph{Independent cryptographer review.}
\texttt{BLOCKERS.md::MAGNETAR-EXTERNAL-AUDIT-V11}: an
independent cryptographer sign-off is the human-checked Tier A
gate. The review scope is the security argument
(\S\ref{sec:security}), the THBS-SE construction
(\S\ref{sec:thbsse}), the FIPS 205 conformance trace
(\texttt{FIPS-TRACEABILITY.md}), the wire codec, and the
v1.0 honest open item on transient seed reconstruction at the
public combiner.

\subsection{THBS-SE: selected-element-reveal invariant}
\label{sec:security:thbsse-reveal}

The THBS-SE construction (\S\ref{sec:thbsse}) enforces a hard
invariant on what each party is permitted to reveal. We state
this invariant verbatim, as a named theorem, because it is the
load-bearing security claim of the threshold companion: every
side-channel and protocol-level argument for THBS-SE reduces to
this property holding.

\begin{theorem}[Selected-element-reveal invariant]
\label{thm:thbsse-selected-element-reveal}
A revealed value is allowed only if it is also present in the
final SLH-DSA signature.
\end{theorem}

Formally: let $\mathcal{R}_{\textit{round}}(p_i, \mathit{slot}, \mu)$
denote the set of byte-strings party $p_i$ broadcasts during the
two-round THBS-SE signing protocol for slot
$\mathit{slot}$ and message $\mu$. Let
$\sigma = \texttt{Combine}(\dots)$ be the resulting FIPS 205
signature, and let
$\mathcal{P}(\sigma) \subseteq \{0,1\}^*$ denote the set of
byte-substrings appearing in $\sigma$. Then the construction
guarantees
\begin{equation}
  \bigcup_{p_i \in \mathit{committee}}
    \mathcal{R}_{\textit{round}}(p_i, \mathit{slot}, \mu)
  \;\setminus\;
  \{0, 1\}^*_{\textit{transcript}}
  \;\subseteq\;
  \mathcal{P}(\sigma)
  \;\cup\;
  \mathcal{U},
\label{eq:thbsse-invariant}
\end{equation}
where $\{0,1\}^*_{\textit{transcript}}$ is the set of public
transcript bytes (slot binding, party IDs, commit hashes, masks)
and $\mathcal{U}$ is the information-theoretically uniform-random
single-party-share class of values that, considered alone, leak
no information about $\mathit{SK.seed}$ to anyone holding fewer
than $t$ leaves (Shamir's information-theoretic property over
$\mathrm{GF}(257)$).

\begin{proof}[Proof sketch]
By inspection of the THBS-SE round-message and Combine code
paths (\texttt{ref/go/pkg/magnetar/thbsse.go}). The Round-2
$\texttt{PartialSig}$ payload is the pair
$(r_i, s'_i = \mathit{share}_i \oplus r_i)$. Both $r_i$ and
$s'_i$ are uniformly random in the recipient's view (Shamir
share property + uniform mask). The Round-1 $\texttt{Commit}$
is a cSHAKE256 output and is by construction public. The
Round-2 reveal of a slot-tampered, wire-size-tampered, or
commit-mismatched partial-sig is rejected by Combine and emits
typed evidence; the malformed reveal does not enter the final
signature input set. The honest reveal pair recovers
$\mathit{share}_i$ via byte-wise XOR, contributes one
$\mathrm{GF}(257)$ evaluation to the Lagrange interpolation,
and is then zeroized in the combiner's transient memory. The
final $\sigma$ is FIPS 205 SignDeterministic on the
reconstructed seed; the seed itself is in $\mathcal{P}(\sigma)$
only in the sense that $\sigma$ deterministically determines it
under the FIPS 205 backward map (which requires breaking the
SLH-DSA security to extract). The strict ``not even transient
seed in combiner memory'' refinement requires the v1.1
strict-atom-assembly path tracked at
\texttt{BLOCKERS.md::MAGNETAR-STRICT-ATOM-V11}; v1.0 ships the
$\mathcal{R}_{\textit{round}} \subseteq \mathcal{P}(\sigma)
\cup \mathcal{U}$ relaxation.
\end{proof}

\paragraph{Forbidden reveals.} The invariant's contrapositive is
the operational statement: no party may publish
$\mathit{SK.seed}$, $\mathit{SK.prf}$, any future-slot share
material, WOTS+ chain bases for unused chains, or FORS leaves
not selected by the message digest. The slot guard refuses any
same-slot re-emission and the share envelope is per-slot, which
mechanically enforces the future-slot exclusion. The
v1.1 strict-atom-assembly path extends the exclusion to the
WOTS+/FORS atom level; v1.0 leans on the FIPS 205 SLH-DSA
backward-map opacity for that subset.

\subsection{THBS-SE: byte identity to single-party FIPS 205}
\label{sec:security:thbsse-byte-identity}

\begin{theorem}[THBS-SE byte identity]
\label{thm:thbsse-byte-identity}
Fix a parameter set $\textsc{Mode}$, a committee
$(P_1, \ldots, P_n)$ over GF(257) evaluation points
$(x_1, \ldots, x_n)$, a threshold $t \le n$, a setup transcript
$\mathit{setup}$, and a slot binding $\mathit{bind}$ with
$\mathit{ctx} = \texttt{ctxFromSlot}(\mathit{bind})$. Let
$(\mathit{PK}, \mathit{SK})$ be the master keypair generated at
setup with seed $S$. For any message $\mu$, any
$T \subseteq \{1, \ldots, n\}$ with $|T| = t$, and any honest
Round-1/Round-2 broadcasts $\{(R1_i, R2_i)\}_{i \in T}$, the
output
$\sigma = \texttt{Combine}(\{(R1_i, R2_i)\}_{i \in T},
\mathit{bind}, \mu, \mathit{PK})$ is byte-identical to
$\texttt{circl.slhdsa.SignDeterministic}(\mathit{SK}, \mu,
\mathit{ctx})$.
\end{theorem}

\begin{proof}
Combine's Lagrange reconstruction at $x = 0$ over
$\mathrm{GF}(257)$ is the left inverse of the byte-wise Shamir
share deal at setup
(\texttt{thbsse\_field.go::thbsseDealRandom},
\texttt{thbsseReconstructGF}). For any $t$-sized
$T$ and any honest $\{\mathit{share}_i\}_{i \in T}$,
$\sum_{i \in T} \lambda_i \mathit{share}_i \equiv S \pmod{257}$
where $\lambda_i$ are the Lagrange basis coefficients at $x=0$;
the relation holds independently per byte position. Combine
then calls
$\texttt{circl.slhdsa.SignDeterministic}$ on the reconstructed
seed with the slot-bound $\mathit{ctx}$, which is by FIPS 205
\S 9.2 a pure deterministic function of $(\mathit{SK}, \mu,
\mathit{ctx})$. The output is byte-identical to a centralized
FIPS 205 call on the same triple.
\end{proof}

\begin{corollary}[Public-combiner determinism]
\label{cor:thbsse-determinism}
For any two distinct $t$-sized
$T_A, T_B \subseteq \{1, \ldots, n\}$ and any honest
broadcasts $\{(R1_i, R2_i)\}$,
$\texttt{Combine}(T_A, \dots) = \texttt{Combine}(T_B, \dots)$
byte-for-byte.
\end{corollary}

\begin{proof}
Both sides reconstruct $S$ by
Theorem~\ref{thm:thbsse-byte-identity} and feed it through
deterministic $\textsc{SignDeterministic}$.
\end{proof}

\paragraph{Empirical pin.}
$\textsc{TestThbsSE\_Wire\_FIPS205Verifiable}$,
$\textsc{TestThbsSE\_PublicCombiner\_Determinism}$, and
$\textsc{TestKAT\_ThbsSe}$ at
\texttt{ref/go/pkg/magnetar/thbsse\_test.go} and
\texttt{kat\_test.go} pin Theorems
\ref{thm:thbsse-byte-identity}--\ref{cor:thbsse-determinism}
across all three SHAKE modes and the deterministic vector
$(n=7, t=4)$ KAT.

\subsection{THBS-SE: TCB and v1.0 honest open item}
\label{sec:security:thbsse-tcb}

\paragraph{Setup TCB.} The deterministic-dealer setup is in the
TCB FOR SETUP ONLY. Once $\texttt{NewThbsSeKey}$ returns, the
master seed has been zeroized inside the function and no party
(including the dealer) holds it. Production deployments needing
the leaderless PVSS-DKG variant route through the sibling
\texttt{luxfi/threshold} DKG package; the share envelope is
wire-equivalent (see
\texttt{BLOCKERS.md::MAGNETAR-PVSS-DKG-V11}).

\paragraph{Sign-time TCB (v1.0 honest open item).} THBS-SE
v1.0 routes the final FIPS 205 byte production via a PUBLIC
COMBINER that reconstructs the SLH-DSA seed transiently in its
own memory. The seed is present in the combiner's address space
for the duration of one
$\textsc{circl.slhdsa.SignDeterministic}$ call (sub-second
wall-clock at SHAKE-192s) and zeroized before return. The
combiner role is open to any peer; no host is in the TCB by
policy.

This is materially stronger than a TEE-attested
privileged-aggregator model (no host in TCB; combiner is a pure
function any peer can run) and materially weaker than the strict
``no transient seed at any moment'' refinement. A peer-local
memory-disclosure adversary at exactly the combine moment could
observe the seed; mitigations include the standard process-
hardening discipline (\texttt{mlock}, ptrace-off, swap
disabled).

The strict refinement (v1.1) requires a Magnetar-internal
re-implementation of FIPS 205 \S\S 5--8 that bypasses
\texttt{slh\_sign\_internal} and assembles the signature
directly from per-atom share reconstructions of the
message-selected FORS leaves and WOTS+ chain bases. The
construction is tracked at
\texttt{BLOCKERS.md::MAGNETAR-STRICT-ATOM-V11}; the wire format,
share format, slot-guard state, and protocol round structure
are all forward-compatible with the lift.

\paragraph{Constant-time obligations on the THBS-SE path.}
\begin{itemize}[leftmargin=2em,nosep]
  \item \textbf{Byte-wise Lagrange reconstruction}
        (\texttt{thbsse\_field.go::thbsseReconstructGF}).
        Straight-line $\mathrm{GF}(257)$ modular arithmetic over
        public evaluation points; the per-byte share VALUES are
        secret but flow only into a fixed sequence of u32 mul +
        reduction operations with no secret-dependent branches.
  \item \textbf{Modular inverse}
        (\texttt{thbsseModInvSmall} via Fermat: $a^{p-2}
        \bmod p$). The exponent $p - 2 = 255$ is PUBLIC; the
        square-and-multiply iterates over the public exponent
        bits, not over the secret base.
  \item \textbf{Commit re-derivation in Combine}
        (\texttt{deriveThbsSeCommit}). One cSHAKE256 absorb;
        constant-time by the upstream
        \texttt{golang.org/x/crypto/sha3} implementation.
  \item \textbf{Public-key match check}
        (\texttt{ctEqualBytes}). Constant-time XOR-then-OR
        reduction; mirrors the standalone path.
\end{itemize}