mirror of
https://github.com/luxfi/magnetar.git
synced 2026-09-24 00:25:23 +00:00
zeekay
c47faff81d
ref/go/pkg/magnetar/: pure-Go threshold FIPS 205 SLH-DSA over byte-wise Shamir VSS of the SLH-DSA scheme seed. Mirrors Pulsar's v0.1 reveal-and-aggregate pattern, ported to SLH-DSA's scheme-seed-as-secret model. Construction: - DKG (dkg.go): Shamir+sum over GF(257), per-recipient envelopes carry both the recipient's share AND the dealer's full contribution so every party can compute the joint master public key locally. Round-2 digest binds the ordered envelope set for identifiable abort (ComplaintEquivocation). - Threshold-sign (threshold.go, combine.go): two-round commit-and- reveal of (mask, masked_share). Aggregator XORs to recover shares, Lagrange-interpolates the byte-sum, mixes with committee_root via cSHAKE256, and calls slhdsa.SignDeterministic on the reconstructed seed. Output signature is byte-identical to single-party FIPS 205. - Three parameter sets: SHAKE-192s (recommended), SHAKE-192f, SHAKE-256s. Backend: github.com/cloudflare/circl v1.6.3 (sign/slhdsa). Pure Go, no CGo. circl.Scheme().DeriveKey(seed) is the byte-deterministic seed -> keypair path that Magnetar Shamir-shares over. Headline test (n1_byte_equality_test.go): - TestN1_ByteEquality_ThresholdMatchesCentralized validates the Class-N1-analog claim: threshold-produced signatures are byte-identical to single-party SignDeterministic on the reconstructed master seed across (3,2), (5,3), (7,4) configs. - TestN1_ByteEquality_DifferentQuorumsSameSignature validates quorum-independence: distinct quorums yield identical bytes. Test discipline: - Non-race full suite: 34 top-level tests, all PASS in ~56s. - Race-detector run: SLH-DSA hash-tree is 5-10x slower under race on commodity hardware; SLH-DSA-heavy tests self-skip via raceEnabled build-tag constant (race_on_test.go / race_off_test.go) so race tests focus on the cheap concurrency-relevant primitives (shamir, transcript, types) — these pass in ~1.4s under -race -timeout 240s. Honest v0.1 trust caveat: aggregator process is TCB for the brief window the master seed is reconstructed in memory. Same caveat as Pulsar v0.1 reveal-and-aggregate. Documented in SPEC.md and DEPLOYMENT-RUNBOOK.md (separate commits). All secret-bearing buffers are explicitly zeroized at every return path in combine.go.
7 lines
485 B
Plaintext
7 lines
485 B
Plaintext
github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
|
|
github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
|
|
golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
|
|
golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
|
|
golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
|
|
golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|