papers/lux-magnetar-pq/sections/10-conclusion.tex

\section{Conclusion}
\label{sec:conclusion}

\subsection{What Magnetar v1.0.0 is}
\label{sec:conclusion:is}

Magnetar v1.0.0 is the production library implementation of two
hash-based post-quantum signature primitives for the Lux Polaris
cert profile:
\begin{itemize}[leftmargin=2em,nosep]
  \item \textbf{Per-validator standalone primary primitive.}
        \texttt{PerValidatorKeypair}, \texttt{ValidatorSign},
        \texttt{ValidatorBatchVerify},
        \texttt{ValidatorAggregateCert},
        \texttt{BuildAggregateCert}, \texttt{VerifyAggregateCert}
        at \texttt{ref/go/pkg/magnetar/standalone.go}. No DKG, no
        dealer, no aggregator-in-TCB. The architecturally correct
        primitive for public-BFT hash-based PQ consensus.
  \item \textbf{THBS-SE permissionless threshold companion.}
        \texttt{NewThbsSeKey}, \texttt{ThbsSeRound1},
        \texttt{Combine}, \texttt{VerifyThbsSeEvidence},
        \texttt{VerifyThbsSeShareEvidence} at
        \texttt{ref/go/pkg/magnetar/thbsse.go} (with internal share
        arithmetic in \texttt{thbsse\_field.go}). Slot-bound
        commit-and-reveal with a PUBLIC COMBINER role: anyone
        can run Combine; no host is in the TCB by policy at sign
        time. Produces byte-identical FIPS 205 wire bytes.
  \item \textbf{FIPS 205 byte identity for both primitives.} Each
        $\sigma_i$ from \texttt{ValidatorSign} and each $\sigma$
        from \texttt{Combine} is byte-identical to single-party
        FIPS 205 $\textsc{SignDeterministic}$, pinned empirically
        by $\textsc{TestMagnetar\_Wire\_FIPS205Verifiable}$ and
        $\textsc{TestThbsSE\_Wire\_FIPS205Verifiable}$ across
        SHAKE-192s, SHAKE-192f, and SHAKE-256s.
  \item \textbf{Canonical MAGS / MAGG wire codec.} Stateless
        \texttt{VerifyBytes} / \texttt{VerifyBytesCtx} dispatchers
        accept wire bytes and route through unmodified
        \texttt{cloudflare/circl/sign/slhdsa}. Sibling of
        Pulsar's PULS/PULG and Corona's CORS/CORG framings.
  \item \textbf{Polaris third-lane integration.} Joins Pulsar
        (M-LWE) and Corona (M-LWE) as the hash-based leg of the
        maximum-assurance Polaris cert profile, providing
        cryptographic-family diversity against any single-family
        algorithmic break.
  \item \textbf{Reference implementation.} Pure Go, backed by
        \texttt{cloudflare/circl v1.6.3} \cite{circl} as the
        FIPS 205 primitive. Deterministic KAT vectors regenerable
        bit-identically from a clean checkout, including
        \texttt{thbsse-sign.json} at $(n=7, t=4)$ across three
        modes and three messages.
\end{itemize}

\subsection{What Magnetar v1.0.0 is not}
\label{sec:conclusion:not}

Honest characterisation of the open gates (tracked at
\texttt{BLOCKERS.md}):
\begin{itemize}[leftmargin=2em,nosep]
  \item \textbf{Strict invariant for THBS-SE
        (\texttt{MAGNETAR-STRICT-ATOM-V11}).} v1.0 ships a public
        combiner that reconstructs the SLH-DSA seed transiently
        in its own memory for the duration of one
        $\textsc{SignDeterministic}$ call. The strict
        ``no transient seed at any moment'' refinement requires a
        Magnetar-internal re-implementation of FIPS 205
        \S\S 5--8 that bypasses \texttt{slh\_sign\_internal} and
        assembles the signature directly from per-atom share
        reconstructions of the message-selected FORS leaves and
        WOTS+ chain bases. The construction shape is
        forward-compatible; only Combine's internals change.
  \item \textbf{Leaderless PVSS-DKG setup
        (\texttt{MAGNETAR-PVSS-DKG-V11}).} v1.0 ships a
        deterministic-dealer setup for KAT determinism;
        production deployments needing the leaderless variant
        route through the sibling \texttt{luxfi/threshold} DKG
        package today, with a Magnetar-native
        \texttt{NewThbsSeKeyFromDealerlessDKG} constructor
        landing at v1.1.
  \item \textbf{Mechanised proofs
        (\texttt{MAGNETAR-PROOF-TRACK-V11}).} The legacy
        EasyCrypt scaffolding modeling the abandoned v0.x
        seed-recombine path has been removed; the v1.0 proof
        track ports to the THBS-SE construction shape (commit-
        bind, byte-wise Shamir over $\mathrm{GF}(257)$, Lagrange
        reconstruct, FIPS 205 dispatch) and lands at v1.1
        alongside the Lean bridge for the algebraic content.
  \item \textbf{Constant-time empirical verification
        (\texttt{MAGNETAR-DUDECT-V11}).} v1.0's CT story is
        ``inherit CIRCL''; the v1.1 \texttt{dudect} harness lands
        alongside the strict-atom-assembly path, at which point
        the per-atom WOTS+ chain compute and FORS sign step
        become the new CT-critical surfaces.
  \item \textbf{Independent audit
        (\texttt{MAGNETAR-EXTERNAL-AUDIT-V11}).} The v0.x
        internal sign-off applied to a construction surface much
        of which has been removed at v1.0. The v1.1 external
        audit should target the THBS-SE construction shape, the
        strict-atom-assembly path, and the leaderless PVSS-DKG
        setup.
\end{itemize}

\subsection{Closing}
\label{sec:conclusion:closing}

The Lux PQ transition is structured around the principle that no
single primitive carries the post-quantum future of the chain.
Pulsar (M-LWE), Corona (M-LWE), and Magnetar (SLH-DSA) are three
independent constructions that share neither hash function family,
nor secret-sharing mechanism, nor underlying mathematical
assumption beyond ``the standard cryptographic-hash assumptions
hold.'' The Polaris cert profile binds all three lanes against a
common transcript and accepts only when all three verify.

Magnetar's role in this composition is the hash-based insurance
leg: the lane that is intact when the entire lattice family is
broken by some unforeseen algorithmic advance. It is the slowest
of the three lanes, which is acceptable; the insurance does not
need to be fast.

The per-validator standalone construction documented in
\S\ref{sec:construction} is the architecturally correct hash-based
primitive for public-BFT consensus, given the load-bearing fact
(Cozzo-Smart EUROCRYPT 2019 \cite{cosmin2021},
Bonte-Smart-Tan 2023 \cite{bonte2023threshold}) that SLH-DSA admits
no FROST-style linear share-aggregation identity. The THBS-SE
construction documented in \S\ref{sec:thbsse} is the
permissionless-threshold closer for deployments that need a single
FIPS 205-shaped signature from a $t$-of-$n$ committee, sitting at
the public-combiner point in the design space --- materially
stronger than TEE-attested privileged-aggregator constructions,
materially weaker than the strict ``no transient seed at any
moment'' refinement that the v1.1 strict-atom-assembly path will
close.

The cryptographic primitives are not new. The composition that
turns them into a public-BFT primary primitive plus a
permissionless-threshold companion in the hash-based leg of a
three-lane Polaris cert profile --- with byte-identity to the
unmodified FIPS 205 verifier and a canonical wire codec --- is
Magnetar's contribution.