papers/lux-magnetar-pq/sections/07-comparison.tex

\section{Comparison to Pulsar and Corona}
\label{sec:comparison}

Magnetar is positioned alongside Pulsar (M-LWE) \cite{lp073pulsarpaper}
and Corona (M-LWE) \cite{lp104corona} as the three independent legs of
the Lux Polaris cert profile. This section makes the comparison
explicit: what is structurally shared, what is structurally distinct,
and why all three are necessary.

\subsection{Different threshold mechanics per primitive}
\label{sec:cmp:mechanics}

Pulsar and Corona ship true threshold constructions: their lattice
algebra admits FROST-style linear share aggregation (Pulsar over
the module $R_q^{n_{\mathrm{vec}}}$, Corona over the single ring
$R_q$). At sign time a quorum of $\ge t$ parties exchanges
two rounds of messages and produces a single aggregate signature
that verifies under the joint group public key, with no party
ever reconstructing the master secret. The trust model is
public-BFT-safe: no dealer, no aggregator-in-TCB.

Magnetar cannot do this at the public-BFT primary layer. SLH-DSA
has no linear share-aggregation identity (Cozzo--Smart EUROCRYPT
2019; Bonte--Smart--Tan 2023). The canonical hash-based primitive
for public-BFT consensus is therefore $N$ independent standalone
signatures collected at the consensus layer. This paper's primary
primitive is exactly that pattern; the THBS-SE permissionless
threshold companion (\S\ref{sec:thbsse}) is the closer when a
single FIPS 205-shaped signature from a $t$-of-$n$ committee is
required.

The Polaris cert profile composition accepts this asymmetry: it
binds three independent per-lane signatures (one Pulsar threshold
signature, one Corona threshold signature, one Magnetar
\texttt{ValidatorAggregateCert}) against the same Prism transcript.
All three must verify for Polaris to advance.

\subsection{Mathematical independence}
\label{sec:cmp:independence}

The three primitives rest on \emph{algorithmically distinct}
security assumptions:
\begin{itemize}[leftmargin=2em,nosep]
  \item \textbf{Pulsar} (M-LWE): security reduces to Module-LWE
        \cite{mlwe,dilithium} on
        $R_q = \mathbb{Z}_q[X]/(X^{256}+1)$ with $q \approx 2^{48}$.
        The module structure (working over an 8-row $\times$ 7-column
        matrix of polynomials) is specific to the
        Pulsar/Dilithium family.
  \item \textbf{Corona} (M-LWE): security reduces to Module-LWE
        \cite{regev2009,lp104corona} on
        $R_q = \mathbb{Z}_q[X]/(X^N+1)$ with $q$ a 48-bit
        NTT-friendly prime. Corona has \emph{no} module structure
        --- it operates on a single ring rather than on a vector
        of polynomials. A break of Module-LWE that exploits the
        module structure does not necessarily transfer to Corona.
  \item \textbf{Magnetar} (SLH-DSA): security reduces to collision
        resistance and preimage resistance of SHA-3 (Keccak)
        \cite{keccak-keccak}, the WOTS+ one-time signature
        construction, and the FORS few-time signature construction
        \cite{sphincs,fips205}. There is no lattice anywhere in
        Magnetar.
\end{itemize}

A polynomial-time algorithm against module-lattice problems would
break Pulsar; a polynomial-time algorithm against ideal-lattice
problems on the Module-LWE lattice would break Corona; a polynomial-time
collision finder on SHA-3 would break Magnetar. These three break
conditions are believed independent. The Polaris finality predicate
requires all three lanes to verify, so a Polaris adversary must
break the conjunction --- strictly harder than breaking any single
primitive.

\paragraph{Why three lanes, not two.} Pulsar and Corona are both
lattice schemes; a single algorithmic break of lattice cryptography
would invalidate both simultaneously. The cryptographic-diversity
argument requires a leg from outside the lattice family. Hash-based
is the natural choice: it is the only \emph{NIST-standardised}
PQ signature family that is not lattice-based, and SLH-DSA's
security assumptions are arguably the best-understood of any
PQ signature scheme.

\subsection{Performance comparison}
\label{sec:cmp:perf}

Table~\ref{tab:cmp-perf} compares the three lanes on the
operationally relevant dimensions. Pulsar and Corona timings are
approximate, drawn from their respective evaluation sections
\cite{lp073pulsarpaper}~\S6 and \cite{lp104corona}~\S6.

\begin{table}[H]
\centering
\caption{Polaris three-lane comparison.
``Per-sig latency'' is end-to-end on commodity Apple Silicon.
``Wire bytes'' is the per-party broadcast budget per signing session;
for Magnetar this is the full standalone signature
(each validator broadcasts its own $\sigma_i$).}
\label{tab:cmp-perf}
\begin{tabular}{lrrrr}
\toprule
Lane & Family & Per-sig latency & Wire bytes/party/sig & Sig size \\
\midrule
Pulsar & Module-LWE (threshold)  & $\sim 250$~ms & $\sim 25$~KB & $\sim 33$~KB \\
Corona & Module-LWE (threshold)    & $\sim 600$~ms & $\sim 18$~KB & $\sim 56$~KB \\
Magnetar & SLH-DSA (standalone) & $\sim 1\,200$~ms & $\sim 16$~KB & $\sim 16$~KB \\
\bottomrule
\end{tabular}
\end{table}

Magnetar's per-signature latency is the slowest of the three; this
is FIPS 205's intrinsic cost. The wire-bytes-per-party at Magnetar
is the full $|\sigma_i|$ because each validator broadcasts its own
signature in the standalone primitive (versus Pulsar / Corona
which transmit only round-1 commits and round-2 reveals during
the threshold protocol). Magnetar's mitigation for the aggregate
size is the Z-Chain Groth16 rollup which compresses $K \times
|\sigma|$ to a constant $\sim 192$~B.

The signature size at $\sim 16$~KB (SHAKE-192s) is competitive: only
$\sim 2\times$ smaller than Pulsar's M-LWE signature and
substantially smaller than Corona's M-LWE signature. SHAKE-192f
trades a $\sim 3\times$ larger signature ($35$~KB) for $\sim 10\times$
faster signing, which may be the right trade-off for higher-rate
deployments; this is a per-deployment configuration choice.

\subsection{Lifecycle composition}
\label{sec:cmp:lifecycle}

All three lanes plug into the same LSS \cite{luxlssmpc} lifecycle
adapter at the public-BFT path, with the Magnetar adapter
specialised to the per-validator standalone shape:
\begin{itemize}[leftmargin=2em,nosep]
  \item \texttt{lss/protocols/lss\_pulsar.go} adapts Pulsar's
        $\textsc{Reshare}$ and $\textsc{Refresh}$ to the LSS
        generation-aware orchestration. Committee-wide shared
        secret refresh.
  \item \texttt{lss/protocols/lss\_corona.go} adapts Corona's
        Module-LWE resharing. Same shape as Pulsar.
  \item \texttt{lss/protocols/lss\_magnetar.go} adapts the
        per-validator standalone primitive. Per-validator
        $\textsc{KeyRotate}$ (no committee-wide ceremony), with
        the validator-set registry update serving as the
        generation transition.
\end{itemize}

The activation cert composition: a Polaris generation transition
requires three independent per-lane operations in lockstep.
For Pulsar and Corona this is committee-wide threshold resharing;
for Magnetar it is per-validator key rotation broadcasts. All
three must complete before the Polaris cert profile advances.

\subsection{Trust posture: what differs across lanes}
\label{sec:cmp:caveat-differ}

The trust posture at the public-BFT path differs sharply between
lanes:
\begin{itemize}[leftmargin=2em,nosep]
  \item \textbf{Pulsar} (threshold): no dealer, no aggregator-in-TCB.
        The threshold protocol's $\textsc{Combine}$ phase is a pure
        public-input function over the round-1 / round-2 transcript;
        no party reconstructs the master secret at sign time.
  \item \textbf{Corona} (threshold): same trust posture as Pulsar.
        $\textsc{Combine}$ is a pure public-input function.
  \item \textbf{Magnetar} (standalone): no shared secret at all.
        Each validator's $sk_i$ lives only on validator $i$'s own
        host. Compromising one validator yields one quorum vote,
        not a master-secret reconstruction.
\end{itemize}

All three are public-BFT-safe. Magnetar's standalone TCB is
strictly per-validator (one $sk_i$ per validator); Pulsar's and
Corona's threshold TCBs are committee-wide shared-secret
distributions where the privacy guarantee is information-
theoretic against any $t-1$-subset.

For deployments that need a single FIPS 205-shaped signature from
a committee (verifier-side constant-cost certificates,
smart-contract verification with fixed gas), Magnetar's THBS-SE
(\S\ref{sec:thbsse}) ships a permissionless public-combiner
construction. Pulsar and Corona's threshold mechanics extend
directly to single-signature output via their native lattice
share-aggregation identities; THBS-SE is Magnetar's
construction-level analogue for the hash-based lane.

\subsection{Where each lane is the right answer}
\label{sec:cmp:fit}

For deployments that adopt only a single PQ lane (rather than the
full Polaris three-lane composition):
\begin{itemize}[leftmargin=2em,nosep]
  \item \textbf{Pulsar} is the right answer when sub-second
        signing latency is the dominant constraint and the lattice
        assumption is acceptable. Pulsar's per-party wire bandwidth
        is high during the threshold protocol, but its hot-path
        latency is the lowest.
  \item \textbf{Corona} is the right answer when validator
        committees scale beyond $K \sim 100$ and Corona's
        single-ring Module-LWE parameter regime is preferred to
        Pulsar's module-vector tuning (some deployments may prefer
        the simpler ring for audit clarity).
  \item \textbf{Magnetar} is the right answer when the
        threat model includes ``the lattice family might be broken
        algorithmically'' (a long-tail risk) or when the deployment
        needs a primitive whose security can be argued from
        hash-function assumptions alone. Magnetar's per-validator
        independence is the right posture for permissionless
        validator sets where coordinating a committee-wide DKG /
        threshold protocol is impractical.
\end{itemize}

For \textbf{maximum assurance} (the Lux Polaris production
deployment), all three lanes run in parallel. The triple-redundancy
is the correct response to the long-tail cryptographic risks of
the PQ transition era.