mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
75a04faa36
Resolves high-severity review findings: anachronistic dates aligned to citation floors; arithmetic corrected to match formulas; internal contradictions collapsed to the body-supported value; LP self-references aligned to filenames; liquidity-surface repo paths scrubbed; AI-slop trimmed. PDFs rebuilt separately.
375 lines
18 KiB
TeX
375 lines
18 KiB
TeX
\section{Related work}
|
|
\label{sec:related}
|
|
|
|
This section locates Magnetar within the broader threshold signature
|
|
literature. We organise by primitive family: (i) the sparse
|
|
threshold-hash-based-signature literature, (ii) the per-validator
|
|
aggregate-signature pattern for PQ consensus, (iii) the
|
|
lattice-family threshold schemes (Pulsar, Corona, Threshold Raccoon,
|
|
Hermine, Threshold ML-DSA), (iv) the classical Schnorr-family
|
|
threshold (FROST / RFC 9591), (v) threshold ECDSA (CGGMP21), and
|
|
(vi) the threshold-cryptography standards landscape (NIST IR 8214C).
|
|
|
|
\subsection{Threshold hash-based signatures}
|
|
\label{sec:related:hash}
|
|
|
|
Hash-based threshold signatures are the smallest sub-field of
|
|
threshold cryptography literature, both because the FIPS 205
|
|
standard is recent (2024) and because the underlying primitive has
|
|
no linear share-aggregation identity.
|
|
|
|
\paragraph{Cozzo and Smart (EUROCRYPT 2019) \cite{cosmin2021}.}
|
|
``Sharing the LUOV'' establishes the foundational obstruction:
|
|
every internal SHAKE/SHA-2 evaluation in a hash-based signature is
|
|
a non-linear function of the secret seed, so producing a single
|
|
FIPS 205-shaped signature from $t$ shares requires either seed
|
|
reconstruction at some combiner or full MPC over the hash tree.
|
|
THBS-SE (\S\ref{sec:thbsse}) is Magnetar's chosen instantiation of
|
|
the seed-reconstruction route, but with a PUBLIC combiner role
|
|
(anyone can be the combiner) that bypasses the standard
|
|
``combiner-in-TCB'' criticism.
|
|
|
|
\paragraph{Bonte, Smart and Tan (2023)
|
|
\cite{bonte2023threshold}.} ``Thresholdizing Hash-Based
|
|
Signatures'' extends the Cozzo-Smart infeasibility analysis to
|
|
the strict ``no transient seed reconstruction at any moment''
|
|
regime. THBS-SE v1.0 explicitly does NOT close that strict
|
|
refinement; the strict-atom-assembly v1.1 path
|
|
(\texttt{BLOCKERS.md::MAGNETAR-STRICT-ATOM-V11}) is the planned
|
|
closer.
|
|
|
|
\paragraph{McGrew et al. (IACR ePrint 2019/793) \cite{mcgrew2019}.}
|
|
The selected-element threshold-HBS pattern --- parties hold shared
|
|
WOTS+ chain heads and FORS leaves, release shares only of the
|
|
selected elements per signature. The construction shape inspired
|
|
THBS-SE's name (Selected-Element Reconstruction). The McGrew
|
|
construction requires either a trusted dealer or a custom HBS
|
|
verifier; THBS-SE's v1.0 reference uses a deterministic-dealer
|
|
setup (with production deployments routing through the sibling
|
|
leaderless PVSS-DKG in \texttt{luxfi/threshold}) and produces
|
|
byte-identical FIPS 205 wire bytes that the unmodified
|
|
\texttt{circl} verifier accepts.
|
|
|
|
\paragraph{Komlo--Stebila--Sullivan (MPTC 2025 draft).} A NIST MPTC
|
|
draft on distributed FORS evaluation for threshold SLH-DSA;
|
|
preliminary results align with the layer-(C) sign-time MPC
|
|
direction. Magnetar tracks this work as a candidate future
|
|
reference for a public-DKG THBS.
|
|
|
|
\paragraph{Buterin--Drake on hash-based BLS replacements.} Various
|
|
informal proposals (Ethereum research forums) have considered
|
|
SLH-DSA as a replacement for BLS in proof-of-stake consensus. The
|
|
arguments are about \emph{aggregation} more than \emph{threshold}:
|
|
non-interactive aggregation of $N$ SLH-DSA signatures is itself
|
|
non-trivial because the per-signature WOTS+ chains do not
|
|
aggregate, but \emph{collection} of $N$ signatures into a single
|
|
on-chain record is straightforward. Magnetar's per-validator
|
|
standalone primitive (\S\ref{sec:construction}) is exactly the
|
|
collection pattern, with the Z-Chain Groth16 rollup providing
|
|
constant-size compression on top.
|
|
|
|
\subsection{Per-validator aggregate signatures for PQ consensus}
|
|
\label{sec:related:per-validator-aggregate}
|
|
|
|
The per-validator-aggregate pattern Magnetar instantiates for
|
|
SLH-DSA is the same pattern already in production for ML-DSA in
|
|
the Lux Quasar stack.
|
|
|
|
\paragraph{Lux \texttt{QuasarCert.MLDSAProof}.} The Lux consensus
|
|
\texttt{QuasarCert} carries a parallel \texttt{MLDSAProof} field
|
|
collecting $K$ standalone ML-DSA signatures from quorum
|
|
validators. The wire shape is byte-equivalent to Magnetar's
|
|
\texttt{ValidatorAggregateCert}; the cryptographic primitive is
|
|
FIPS 204 ML-DSA \cite{fips204} rather than FIPS 205 SLH-DSA.
|
|
Magnetar's standalone primitive is the explicit hash-based
|
|
analog of this pattern; the two share the
|
|
$(\mathit{Signers}, \mathit{PubKeys}, \mathit{Sigs})$
|
|
parallel-slices wire shape and the Z-Chain Groth16 rollup
|
|
witness layout.
|
|
|
|
\paragraph{Ethereum SSZ aggregate-signature records.} The
|
|
Ethereum consensus spec carries per-validator BLS signatures
|
|
collected into \texttt{AggregateAndProof} records before
|
|
in-block aggregation. The collection pattern is the same as
|
|
Magnetar's; the cryptographic primitive (BLS) is classical and
|
|
admits non-interactive aggregation that hash-based primitives
|
|
do not. Magnetar substitutes the Z-Chain Groth16 rollup for
|
|
BLS's algebraic aggregation; the rollup achieves the same
|
|
constant-size on-chain footprint with a different cryptographic
|
|
backing.
|
|
|
|
\subsection{Lattice-family threshold signatures}
|
|
\label{sec:related:lattice}
|
|
|
|
The lattice threshold-signature literature is comparatively rich;
|
|
we summarise the constructions most relevant to Magnetar's
|
|
positioning.
|
|
|
|
\paragraph{Pulsar (Lux LP-073) \cite{lp073pulsarpaper}.}
|
|
The companion paper. Pulsar is a two-round Module-LWE threshold
|
|
signature over
|
|
$R_q = \mathbb{Z}_q[X]/(X^{256}+1)$ with $q \approx 2^{48}$. The
|
|
construction shares the master secret $\mathbf{s} \in
|
|
R_q^{n_{\mathrm{vec}}}$ via Shamir over the ring, and runs a
|
|
two-round MAC-authenticated protocol with linear share
|
|
aggregation. Pulsar's public-BFT-safe threshold mechanics
|
|
contrast with Magnetar's per-validator standalone path: Pulsar
|
|
distributes a single shared secret across the committee with
|
|
no party holding the master key; Magnetar keeps a separate
|
|
keypair per validator. Pulsar and Magnetar share the LSS
|
|
lifecycle adapter contract and the cSHAKE256 transcript
|
|
discipline.
|
|
|
|
\paragraph{Corona (Lux LP-104)
|
|
\cite{lp104corona,ringtail}.}
|
|
The other companion. Corona is a Module-LWE threshold variant at
|
|
the Ringtail-derived parameter set (module matrix
|
|
$A \in R_q^{8\times7}$ over $R_q = \mathbb{Z}_q[X]/(X^{256}+1)$).
|
|
Same public-BFT-safe threshold mechanics as Pulsar. Corona's
|
|
trade-off vs. Pulsar: a different Module-LWE parameter regime and
|
|
codebase (Ringtail-derived rather than ML-DSA-65), larger
|
|
signatures, slightly slower signing.
|
|
|
|
\paragraph{Threshold Raccoon (Eurocrypt 2024) \cite{thresholdraccoon}.}
|
|
Standard-lattice threshold signatures from MLWE/MSIS at $\sim 13$~KiB
|
|
signature size and $\sim 40$~KiB per-user communication. Targets up
|
|
to 1024 signers. Includes a DKG, identifiable abort, and non-
|
|
interactive aggregation. Compared to Magnetar:
|
|
\begin{itemize}[nosep,leftmargin=2em]
|
|
\item Threshold Raccoon is \emph{lattice-based} (threshold);
|
|
Magnetar is \emph{hash-based} (per-validator standalone).
|
|
They serve different cryptographic-diversity roles.
|
|
\item Threshold Raccoon's signature size at SHAKE-192-equivalent
|
|
security is $\sim 13$~KiB, comparable to Magnetar's
|
|
$\sim 16$~KB.
|
|
\end{itemize}
|
|
|
|
\paragraph{Hermine (NIST MPTC 2025) \cite{hermine}.} Threshold
|
|
lattice signatures with DKG, identifiable aborts, and proactive
|
|
refresh. A direct peer of Threshold Raccoon at the NIST MPTC
|
|
standardisation track. Same family-positioning trade-off versus
|
|
Magnetar.
|
|
|
|
\paragraph{Threshold ML-DSA (USENIX 2025) \cite{tmldsa2025}.} The
|
|
Celi--del~Pino--Espitau--Niot--Prest construction targets
|
|
threshold ML-DSA with masked shares and amortised rejection
|
|
sampling. The rejection-sampling circularity
|
|
(App.~A \cite{quasarcertsoundness}) and AGM/trapdoor assumptions
|
|
in the proof keep this construction outside the Lux Quasar
|
|
production scope. Lux uses per-validator standalone ML-DSA
|
|
signatures (the \texttt{QuasarCert.MLDSAProof} pattern of
|
|
\S\ref{sec:related:per-validator-aggregate}), complementary to
|
|
Magnetar's hash-based standalone role.
|
|
|
|
\paragraph{Two-round threshold ML-DSA \cite{boneh2018,damgard2021,
|
|
dttf2024}.} Boneh, Eskandarian, Kim, Shih sketched a generic
|
|
threshold construction over MLWE; Damg{\aa}rd, Orlandi, Takahashi,
|
|
Tibouchi produced the first concrete two-round threshold ML-DSA
|
|
with rejection-sampling correctness; subsequent work
|
|
\cite{dttf2024} extended this with algebraic one-more LWE
|
|
assumptions. These constructions share the lattice family with
|
|
Pulsar and Corona; Magnetar is orthogonal.
|
|
|
|
\subsection{Schnorr-family threshold (FROST)}
|
|
\label{sec:related:schnorr}
|
|
|
|
\paragraph{FROST / RFC 9591 \cite{frost,rfc9591,komlogoldberg20}.}
|
|
Two-round threshold Schnorr with linear share aggregation, the
|
|
elliptic-curve canonical reference for two-round threshold
|
|
protocols. RFC 9591 standardises the wire format for FROST over
|
|
secp256k1, P-256, and ristretto255. FROST's linear share-aggregation
|
|
identity $z = \sum_i z_i$ is the
|
|
template that Pulsar and Corona port to the lattice setting;
|
|
Magnetar cannot use this template because SLH-DSA has no analogous
|
|
identity, which is precisely why THBS-SE
|
|
(\S\ref{sec:thbsse}) replaces the linear-aggregation step with
|
|
slot-bound commit-and-reveal + public-combiner seed reconstruction.
|
|
FROST is \emph{classical} (broken by Shor's algorithm); it is the
|
|
classical fast-path lane in Lux's Quasar production stack
|
|
\cite{lp020}, complementary to the three PQ lanes (Pulsar, Corona,
|
|
Magnetar). The Lens kernel (Lux LP-103 \cite{lp103}) extends FROST
|
|
with the same LSS lifecycle as the PQ lanes.
|
|
|
|
\subsection{Threshold ECDSA (CGGMP21)}
|
|
\label{sec:related:cggmp}
|
|
|
|
\paragraph{CGGMP21 \cite{cggmp21}.} The production ECDSA threshold
|
|
standard. Requires Paillier encryption for the multiplicative-to-
|
|
additive conversion and ships an extensive ZK proof suite to
|
|
handle malicious aborts. Complexity is approximately an order of
|
|
magnitude higher than FROST or Pulsar at the same $(t, n)$.
|
|
|
|
CGGMP21 and Magnetar are not redundant: CGGMP21 signs ECDSA-format
|
|
bridge transactions for Ethereum-compatible counterparties;
|
|
Magnetar signs PQ-format consensus blocks for the Lux Quasar
|
|
pipeline. The two coexist by jurisdiction in the Lux production
|
|
stack.
|
|
|
|
\subsection{BLS aggregate}
|
|
\label{sec:related:bls}
|
|
|
|
\paragraph{BLS12-381 \cite{bls,boneh2001short,lp075}.} The classical
|
|
aggregate-signature standard for blockchain consensus. The
|
|
aggregate is 48 bytes regardless of $K$; verification is one
|
|
elliptic-curve pairing. BLS is the classical fast-path lane in
|
|
Lux's Quasar production stack. It is not post-quantum --- Shor's
|
|
algorithm inverts ECDLP --- so the Polaris cert profile pairs it
|
|
with the three PQ lanes (Pulsar, Corona, Magnetar) to provide
|
|
post-compromise PQ insurance.
|
|
|
|
The structural pattern Magnetar implements --- $N$ per-validator
|
|
signatures collected at the consensus layer, compressed by a
|
|
rollup or aggregation primitive --- is the same pattern BLS uses
|
|
in production. The cryptographic primitive differs (BLS pairing
|
|
vs FIPS 205 hash-based), and the compression mechanism differs
|
|
(BLS algebraic aggregation vs Z-Chain Groth16 rollup over the
|
|
parallel-slices cert).
|
|
|
|
\subsection{Standards landscape}
|
|
\label{sec:related:standards}
|
|
|
|
\paragraph{NIST IR 8214C \cite{nistir8214c}.} The NIST Multi-Party
|
|
Threshold Cryptography (MPTC) project surveys threshold ECDSA,
|
|
threshold Schnorr, threshold ML-DSA, and threshold ML-KEM.
|
|
Threshold SLH-DSA is explicitly noted in IR 8214C \S 5 as ``a
|
|
candidate for future addition.'' Magnetar's contribution to the
|
|
MPTC scope:
|
|
\begin{itemize}[nosep,leftmargin=2em]
|
|
\item A production-grade reference implementation of the
|
|
per-validator standalone primitive shipping FIPS 205
|
|
byte-identity (the v1.0.0 artefact at
|
|
\texttt{luxfi/magnetar}).
|
|
\item A permissionless-threshold companion (THBS-SE,
|
|
\S\ref{sec:thbsse}) with an honest disclosure of its
|
|
v1.0 ship state (transient seed reconstruction at the
|
|
public combiner) and a documented v1.1 strict-atom-
|
|
assembly closure path. The decomposition is precise
|
|
about what ``threshold SLH-DSA'' means at each layer:
|
|
public combiner with transient seed (v1.0), strict
|
|
per-atom assembly with no seed reconstruction (v1.1),
|
|
or full hash-tree MPC (open research).
|
|
\end{itemize}
|
|
|
|
\paragraph{FIPS 205 \cite{fips205}.} The standard Magnetar
|
|
implements. The standard does not specify a threshold mode;
|
|
threshold constructions live outside the standard. Magnetar's
|
|
byte-identity claim binds against the FIPS 205 wire format and
|
|
the unmodified FIPS 205 verifier; this is what ``threshold
|
|
SLH-DSA'' should mean in deployment (the threshold or
|
|
collection layer is invisible to verifiers).
|
|
|
|
\subsection{Comparison table}
|
|
\label{sec:related:table}
|
|
|
|
Table~\ref{tab:comparison} summarises the structural comparison.
|
|
|
|
\begin{table}[H]
|
|
\centering
|
|
\small
|
|
\caption{Threshold / per-validator signature schemes compared.
|
|
``Sig size'' is the on-wire signature; ``Comm'' is per-party
|
|
broadcast bytes per signing session; ``Family'' identifies the
|
|
underlying mathematical structure; ``PQ'' marks post-quantum
|
|
security.}
|
|
\label{tab:comparison}
|
|
\begin{tabular}{lrlcccc}
|
|
\toprule
|
|
Scheme & Sig size & Family & Posture & DKG & Reshare & PQ \\
|
|
\midrule
|
|
\textbf{Magnetar standalone} (\S\ref{sec:construction}) & 16 KB & hash-based & per-validator & N/A & per-key rotate & yes \\
|
|
\textbf{Magnetar THBS-SE} (\S\ref{sec:thbsse}) & 16 KB & hash-based & threshold (public combiner) & dealer (v1.0) / PVSS (v1.1) & v1.1+ & yes \\
|
|
Threshold SPHINCS+ \cite{cosmin2021} & 17 KB & hash-based & threshold (combiner-honest) & no & no & yes \\
|
|
Pulsar \cite{lp073pulsarpaper} & 33 KB & M-LWE & threshold & yes & yes & yes \\
|
|
Corona \cite{lp104corona} & 56 KB & M-LWE & threshold & yes & yes & yes \\
|
|
Threshold Raccoon \cite{thresholdraccoon} & 13 KiB & M-LWE & threshold & yes & no & yes \\
|
|
Hermine \cite{hermine} & 13 KiB & M-LWE & threshold & yes & yes & yes \\
|
|
2R-Th-Dilithium \cite{damgard2021} & 30 KB & M-LWE & threshold & no & no & yes \\
|
|
Threshold ML-DSA \cite{tmldsa2025} & 5 KB & M-LWE & threshold & no & no & yes${}^\star$ \\
|
|
FROST / RFC 9591 \cite{rfc9591} & 64 B & Schnorr & threshold & yes & no${}^\dagger$ & no \\
|
|
CGGMP21 ECDSA \cite{cggmp21} & 64 B & ECDSA & threshold & yes & yes & no \\
|
|
BLS aggregate \cite{bls} & 48 B & pairing & $K$-of-$K$ aggregate & no & no & no \\
|
|
\bottomrule
|
|
\multicolumn{7}{l}{\footnotesize ${}^\star$ Threshold ML-DSA's PQ guarantee is
|
|
conditional on the rejection-sampling resolution; see App.~A
|
|
\cite{quasarcertsoundness}.} \\
|
|
\multicolumn{7}{l}{\footnotesize ${}^\dagger$ FROST refresh is provided by
|
|
the Lens kernel (LP-103 \cite{lp103}) via the LSS adapter
|
|
contract.}
|
|
\end{tabular}
|
|
\end{table}
|
|
|
|
\subsection{Where Magnetar's contribution lives}
|
|
\label{sec:related:contribution}
|
|
|
|
The cryptographic primitives in Magnetar are not new. FIPS 205
|
|
\cite{fips205} is the NIST-standardised SLH-DSA. The per-validator
|
|
standalone collection pattern is in production for ML-DSA via the
|
|
Lux \texttt{QuasarCert.MLDSAProof} field. The Shamir-VSS
|
|
seed-reconstruction pattern is folklore (formalised in the
|
|
Cozzo-Smart obstruction \cite{cosmin2021}). The McGrew threshold-HBS
|
|
selected-element-name is from 2019 \cite{mcgrew2019}. What
|
|
Magnetar contributes is the \emph{composition}:
|
|
\begin{enumerate}[leftmargin=2em,nosep]
|
|
\item A byte-identity-pinned per-validator standalone primary
|
|
primitive that produces FIPS 205-conformant signatures
|
|
validated empirically by
|
|
$\textsc{TestMagnetar\_Wire\_FIPS205Verifiable}$ at all
|
|
three SHAKE parameter sets.
|
|
\item A permissionless THBS-SE threshold companion with a
|
|
PUBLIC COMBINER role: anyone can be the combiner, no host
|
|
is in the TCB by policy at sign time. The construction
|
|
enforces the named selected-element-reveal invariant
|
|
(Theorem~\ref{thm:thbsse-selected-element-reveal}) and
|
|
produces byte-identical FIPS 205 wire bytes
|
|
(Theorem~\ref{thm:thbsse-byte-identity}). v1.0 ships an
|
|
honest transient-seed-reconstruction open item; v1.1
|
|
closes the strict invariant via per-atom assembly.
|
|
\item A canonical MAGS / MAGG wire codec siblinged with
|
|
Pulsar's PULS / PULG and Corona's CORS / CORG framings,
|
|
giving the consensus-layer dispatcher a uniform shape
|
|
across the three Polaris lanes.
|
|
\item An explicit-semantic standalone API
|
|
(\texttt{PerValidatorKeypair}, \texttt{ValidatorSign},
|
|
\texttt{VerifyAggregateCert}) and an explicit-semantic
|
|
THBS-SE API
|
|
(\texttt{NewThbsSeKey}, \texttt{ThbsSeRound1},
|
|
\texttt{Combine}, \texttt{VerifyThbsSeEvidence}) that
|
|
decomplect the public-BFT and permissionless-threshold
|
|
primitives into distinct entry points.
|
|
\item A Polaris cert-profile composition that pairs the
|
|
hash-based standalone lane with two lattice threshold
|
|
lanes (Pulsar M-LWE, Corona M-LWE) to provide
|
|
cryptographic-family diversity against any single-family
|
|
algorithmic break.
|
|
\end{enumerate}
|
|
|
|
The crypto exists. The composition that turns it into the
|
|
hash-based leg of a three-lane Polaris cert profile, with both a
|
|
public-BFT primary primitive and a permissionless-threshold
|
|
companion, is Magnetar's contribution.
|
|
|
|
\section*{Acknowledgments}
|
|
|
|
The Lux Core Team acknowledges:
|
|
\begin{itemize}[nosep,leftmargin=2em]
|
|
\item The FIPS 205 / SPHINCS+ authors \cite{sphincs,fips205}
|
|
for the underlying primitive.
|
|
\item The Cloudflare \texttt{circl} team \cite{circl} for the
|
|
production-grade Go SLH-DSA reference that Magnetar
|
|
wraps; the byte-identity claim binds against the
|
|
\texttt{circl}-emitted FIPS 205 bytes.
|
|
\item Cozzo, Smart, Bonte, and Tan for the threshold-HBS
|
|
infeasibility analyses that grounded the architectural
|
|
decision to use per-validator standalone for public BFT.
|
|
\item McGrew, Fluhrer, Gazdag, Kampanakis, Morton, and
|
|
Westerbaan for the selected-element threshold-HBS
|
|
pattern (THBS) Magnetar instantiates for the TEE-only
|
|
custody path.
|
|
\item Shamir \cite{shamir1979} for the secret-sharing
|
|
primitive used in the appendix threshold forms.
|
|
\item The Pulsar (Lux LP-073) and Corona (Lux LP-104) authors
|
|
for the companion lattice-family threshold constructions
|
|
whose architectural pattern Magnetar's appendix forms
|
|
inherit.
|
|
\end{itemize}
|