papers/lux-magnetar-pq/sections/06-evaluation.tex

\section{Evaluation}
\label{sec:evaluation}

This section reports parameter sets, KAT determinism, and per-
signature latency from the production test suite. All timings are
from the \texttt{go test -short -v} run against commit
\texttt{1c84519} on Apple Silicon M2 Pro (12-core), macOS 15.4,
Go 1.26.3 darwin/arm64.

We deliberately report only \emph{measured} timings from the
\texttt{magnetar} reference test suite. No fabricated benchmarks
or extrapolations.

\subsection{Parameter sets}
\label{sec:eval:params}

The three Magnetar v1.0 parameter sets target NIST PQ Categories
3 and 5 with the SHAKE primitive family. Table~\ref{tab:eval-params}
summarises the per-validator wire-size budget and the aggregate
cert size for a $K=21$ Polaris quorum.

\begin{table}[H]
\centering
\caption{Magnetar v1.0 parameter sets. ``Aggregate (K=21)'' is the
on-wire \texttt{ValidatorAggregateCert} size before the Z-Chain
Groth16 rollup compression; the rollup constant-size output is
$\sim 192$~B independent of $K$ or mode.}
\label{tab:eval-params}
\begin{tabular}{lrrrrrr}
\toprule
Mode & NIST Cat. & $|pk_i|$ & $|sk_i|$ & $|\sigma_i|$ & Per-validator wire & Aggregate (K=21) \\
\midrule
SHAKE-192s & 3 & 48 B & 96 B & 16\,224 B & $16\,304$ B & $\sim 332$ KiB \\
SHAKE-192f & 3 & 48 B & 96 B & 35\,664 B & $35\,744$ B & $\sim 731$ KiB \\
SHAKE-256s & 5 & 64 B & 128 B & 29\,792 B & $29\,888$ B & $\sim 612$ KiB \\
\bottomrule
\end{tabular}
\end{table}

The signature size is exactly the FIPS 205 wire size plus the 11-
byte MAGS envelope; the public-key size is exactly the FIPS 205
public-key size plus the 11-byte MAGG envelope. ``Per-validator
wire'' is the on-wire (signature + pubkey) budget per validator
contribution; ``Aggregate (K=21)'' is the cert size before the
Z-Chain Groth16 rollup compression.

\paragraph{Recommended production target.}
\textbf{Magnetar-SHAKE-192s}: smallest signature in the NIST Cat 3
tier, matching the FIPS-validated SLH-DSA-SHAKE-192s. The ``s''
variant trades larger SLH-DSA hypertree depth ($h=63$) for smaller
signature size; we accept the slower signing in exchange for the
smaller wire footprint, since signing latency ($\sim 1$--$2$~s
single-thread on M2 Pro) is acceptable for the Polaris third-lane
role.

\subsection{KAT determinism}
\label{sec:eval:kat}

The KAT vector regeneration is empirically deterministic: re-running
\texttt{cmd/genkat} on a clean checkout produces byte-identical
output to the committed JSON. The vector files at \texttt{vectors/}
are gated by SHA-256 in \texttt{kat\_test.go}; any drift fails CI.

\texttt{TestKAT\_Keygen}, \texttt{TestKAT\_Sign},
\texttt{TestKAT\_Verify} pass at $\sim 0.55$~s, $\sim 5.6$~s, and
$\sim 0$~s respectively under the short configuration on M2 Pro.

\subsection{Headline test: TestMagnetar\_Wire\_FIPS205Verifiable}
\label{sec:eval:wirefips}

The byte-identity gate at
\texttt{ref/go/pkg/magnetar/wire\_test.go:166-220} is the
load-bearing empirical check for the per-validator standalone
primitive's byte-identity claim against unmodified FIPS 205.

\begin{table}[H]
\centering
\caption{\texttt{TestMagnetar\_Wire\_FIPS205Verifiable} subcases
under \texttt{-count=1}. Each subcase: (a) generate keypair via
\texttt{PerValidatorKeypair}, (b) sign via \texttt{ValidatorSign},
(c) wire-frame via MAGS/MAGG, (d) strip 11-byte header, (e) verify
under unmodified \texttt{cloudflare/circl/sign/slhdsa.Verify}.}
\label{tab:eval-wirefips}
\begin{tabular}{lr}
\toprule
Subcase & Result \\
\midrule
\texttt{ModeM192s/} & PASS \\
\texttt{ModeM192f/} & PASS \\
\texttt{ModeM256s/} & PASS \\
\midrule
Total wall-clock (M2 Pro, \texttt{-count=1}) & $\sim 10.5$~s \\
Under \texttt{-race} (cheap subset) & $\sim 4$~min \\
\bottomrule
\end{tabular}
\end{table}

\subsection{Per-signature latency}
\label{sec:eval:latency}

Table~\ref{tab:eval-latency} reports measured wall-clock latencies
for the headline test paths. The numbers are pulled directly from
the \texttt{go test -short -v} output (\S\ref{sec:impl:build}); they
reflect the production CGO build with all default Go flags.

\begin{table}[H]
\centering
\caption{Magnetar v1.0 measured latencies, SHAKE-192s, M2 Pro,
Go 1.26.3 darwin/arm64.}
\label{tab:eval-latency}
\begin{tabular}{lrr}
\toprule
Test path & Run time & Configurations covered \\
\midrule
Single \texttt{ValidatorSign} (SHAKE-192s, det) & $\sim 1.2$~s & SHAKE-192s \\
Single \texttt{Verify} (SHAKE-192s) & $\sim 1.3$~ms & SHAKE-192s \\
\texttt{ValidatorBatchVerify} N=21 (parallel) & $\sim 30$~ms & SHAKE-192s, GOMAXPROCS=12 \\
\texttt{VerifyAggregateCert} N=21 (registry-bound) & $\sim 32$~ms & SHAKE-192s \\
\texttt{TestMagnetar\_Wire\_FIPS205Verifiable} (3 modes) & $\sim 10.5$~s & all 3 modes \\
\texttt{TestKAT\_Keygen} (SHAKE-192s, 3 seeds) & 0.55 s & SHAKE-192s \\
\texttt{TestKAT\_Sign} (SHAKE-192s, 3 seeds) & 5.57 s & SHAKE-192s \\
\texttt{TestKAT\_Verify} (SHAKE-192s, 2 cases) & 0.00 s & SHAKE-192s \\
\bottomrule
\end{tabular}
\end{table}

\paragraph{Per-signature cost breakdown.}
The single-validator \texttt{ValidatorSign} latency is dominated
by the FIPS 205 SHAKE-192s signing cost ($\sim 1.2$~s on M2 Pro),
which is the WOTS+ hash chain evaluations and the XMSS-HT
authentication path computation. This is consistent with published
SLH-DSA benchmarks \cite{sphincs}. Magnetar adds no measurable
overhead on top of \texttt{circl}: \texttt{ValidatorSign}'s
non-FIPS-205 work is one constant-time pointer check and one
function dispatch.

\paragraph{Aggregate verification cost.}
\texttt{ValidatorBatchVerify} at $N = 21$ on a 12-core M2 Pro
achieves $\sim 30$~ms total wall-clock for the parallel goroutine
batch (versus $\sim 21 \cdot 1.3 = 27$~ms serial best case),
showing near-linear scaling for the embarrassingly-parallel
verification workload. \texttt{VerifyAggregateCert} adds a
$\sim 2$~ms registry-lookup and dedupe pass on top, dominated by
the constant-time pubkey comparison.

\paragraph{Race-detector overhead.} Under \texttt{go test -race},
the SLH-DSA paths are 5--10x slower; this is why the
\texttt{raceEnabled} build tag is in place. The race detector
cannot trigger a meaningful race in the strictly single-goroutine
test paths.

\subsection{Wire bandwidth}
\label{sec:eval:bandwidth}

The per-validator standalone primitive's wire bandwidth is
straightforward: each validator broadcasts one MAGS-framed
signature and one MAGG-framed public key (the public key is
typically broadcast once at validator-set onboarding and cached
thereafter, not re-broadcast per signing session).
\begin{itemize}[leftmargin=2em,nosep]
  \item Per-signature MAGS frame: $11 + |\sigma_i|$ bytes.
        SHAKE-192s: $16\,235$~B.
  \item Per-validator MAGG frame (one-time at onboarding):
        $11 + |pk_i|$ bytes. SHAKE-192s: $59$~B.
\end{itemize}
For a quorum of size $K$, total broadcast traffic per signing
session is $K \cdot (11 + |\sigma|)$ bytes; for SHAKE-192s at
$K=21$ this is $\sim 332$~KiB. The Z-Chain Groth16 rollup
compresses the aggregate to a constant-size $\sim 192$~B
certificate; the rollup is a separate primitive (lux-zchain spec).

\subsection{Empirical claims verified}
\label{sec:eval:tests}

The Magnetar v1.0.0 test suite empirically validates the following
claims:
\begin{enumerate}[leftmargin=2em,nosep]
  \item \texttt{TestMagnetar\_Wire\_FIPS205Verifiable}
        --- per-validator $\sigma_i$ from \texttt{ValidatorSign},
        after MAGS envelope strip, verifies under unmodified
        \texttt{cloudflare/circl/sign/slhdsa.Verify}. Three
        SHAKE parameter sets. \emph{(Verifies
        Theorem~\ref{thm:magnetar-byte-equality} and
        Corollary~\ref{cor:wire-byte-identity}.)}
  \item \texttt{TestMagnetar\_Wire\_Roundtrip} --- MAGS / MAGG
        wire-codec roundtrip preserves bytes, modes, and lengths
        across all three SHAKE parameter sets.
  \item \texttt{TestStandalone\_RoundTrip} --- end-to-end
        per-validator standalone sign / verify roundtrip and
        independence.
  \item \texttt{TestStandalone\_BatchVerify} --- parallel batch
        verify returns per-signer bitmap; bad-sig-counted-out
        correctness.
  \item \texttt{TestStandalone\_VerifyAggregateCert} --- registry
        binding, unknown-validator rejection, duplicate-signer
        dedupe, count return.
  \item \texttt{TestKAT\_Keygen}, \texttt{TestKAT\_Sign},
        \texttt{TestKAT\_Verify} --- KAT vector regeneration is
        bit-deterministic.
\end{enumerate}

The THBS-SE-specific tests
(\texttt{TestThbsSE\_Wire\_FIPS205Verifiable},
\texttt{TestThbsSE\_RejectSeedReveal},
\texttt{TestThbsSE\_RejectUnselectedFORS},
\texttt{TestThbsSE\_RejectUnselectedWOTS},
\texttt{TestThbsSE\_SlotReuseRejected},
\texttt{TestThbsSE\_OverselectedCommittee},
\texttt{TestThbsSE\_SlotBindingDomainSeparation},
\texttt{TestThbsSE\_PublicCombiner\_Determinism},
\texttt{BenchmarkThbsSE\_Sign\_5of7},
\texttt{TestKAT\_ThbsSe}) carry the load-bearing gates for the
permissionless threshold companion (\S\ref{sec:thbsse}).

\paragraph{What is \emph{not} empirically validated.}
\begin{itemize}[leftmargin=2em,nosep]
  \item Cross-implementation byte equality at the
        \texttt{ValidatorAggregateCert} wire shape (no second
        Magnetar implementation exists yet; the byte-identity
        gate covers the FIPS 205 payload, not the
        parallel-slices cert framing).
  \item Side-channel constant-time posture under \texttt{dudect}
        at $\ge 10^9$ samples (the \texttt{circl}-delegated
        signing and verification paths are widely audited but
        independent Magnetar-side validation is outstanding;
        BLOCKERS.md GATE-3).
  \item Mechanised proof of
        Theorem~\ref{thm:magnetar-multi-eufcma} (EasyCrypt
        artefact at \texttt{proofs/easycrypt/Magnetar/} is the
        roadmap target; BLOCKERS.md GATE-1).
\end{itemize}