zeekay
c47faff81d
ref/go/pkg/magnetar/: pure-Go threshold FIPS 205 SLH-DSA over byte-wise Shamir VSS of the SLH-DSA scheme seed. Mirrors Pulsar's v0.1 reveal-and-aggregate pattern, ported to SLH-DSA's scheme-seed-as-secret model. Construction: - DKG (dkg.go): Shamir+sum over GF(257), per-recipient envelopes carry both the recipient's share AND the dealer's full contribution so every party can compute the joint master public key locally. Round-2 digest binds the ordered envelope set for identifiable abort (ComplaintEquivocation). - Threshold-sign (threshold.go, combine.go): two-round commit-and- reveal of (mask, masked_share). Aggregator XORs to recover shares, Lagrange-interpolates the byte-sum, mixes with committee_root via cSHAKE256, and calls slhdsa.SignDeterministic on the reconstructed seed. Output signature is byte-identical to single-party FIPS 205. - Three parameter sets: SHAKE-192s (recommended), SHAKE-192f, SHAKE-256s. Backend: github.com/cloudflare/circl v1.6.3 (sign/slhdsa). Pure Go, no CGo. circl.Scheme().DeriveKey(seed) is the byte-deterministic seed -> keypair path that Magnetar Shamir-shares over. Headline test (n1_byte_equality_test.go): - TestN1_ByteEquality_ThresholdMatchesCentralized validates the Class-N1-analog claim: threshold-produced signatures are byte-identical to single-party SignDeterministic on the reconstructed master seed across (3,2), (5,3), (7,4) configs. - TestN1_ByteEquality_DifferentQuorumsSameSignature validates quorum-independence: distinct quorums yield identical bytes. Test discipline: - Non-race full suite: 34 top-level tests, all PASS in ~56s. - Race-detector run: SLH-DSA hash-tree is 5-10x slower under race on commodity hardware; SLH-DSA-heavy tests self-skip via raceEnabled build-tag constant (race_on_test.go / race_off_test.go) so race tests focus on the cheap concurrency-relevant primitives (shamir, transcript, types) — these pass in ~1.4s under -race -timeout 240s. Honest v0.1 trust caveat: aggregator process is TCB for the brief window the master seed is reconstructed in memory. Same caveat as Pulsar v0.1 reveal-and-aggregate. Documented in SPEC.md and DEPLOYMENT-RUNBOOK.md (separate commits). All secret-bearing buffers are explicitly zeroized at every return path in combine.go.
Magnetar — Threshold SLH-DSA (FIPS 205)
Research-stage construction. Threshold hash-based PQ signature primitive over FIPS 205 SLH-DSA. Not production-ready. Not part of any current NIST submission. See
DESIGN.mdfor the research direction andSUBMISSION-STATUS.mdfor the path to NIST MPTC v0.3.
Status
| Field | Value |
|---|---|
| Standard | FIPS 205 SLH-DSA (single-party) |
| Threshold construction | Open research — no fixed protocol |
| Implementation | None |
| Submission package | Roadmap: NIST MPTC v0.3 target |
| Cert-profile role | Polaris profile in luxfi/quasar (cross-family PQ diversity) |
Where this is used
The Magnetar leg of the Polaris cert profile in
luxfi/quasar — the
maximum-assurance cross-family profile that pairs lattice PQ
(Pulsar M-LWE + Corona R-LWE) with hash-based PQ (Magnetar
SLH-DSA). Polaris is the production migration target for when
Magnetar matures.
Until Magnetar exists in production form, the Polaris profile is reserved but not deployable; production chains run the Pulsar or Aurora profile.
Why hash-based threshold matters
SLH-DSA's security rests on collision/preimage resistance of the underlying hash (SHA-2 or SHAKE), with no lattice assumption. A threshold profile of SLH-DSA gives cross-family defense in depth: even if a future cryptanalytic break hits the entire lattice family (both M-LWE and R-LWE), Magnetar's hash-based threshold leg keeps the cert sound.
Why it's hard
See DESIGN.md for the construction-level challenges. Summary:
SLH-DSA does not decompose into a linear-aggregation identity the
way ML-DSA does, so the FROST-style aggregation pattern that powers
Pulsar/Corona doesn't transfer. Threshold SLH-DSA in the literature
requires MPC over hash computations + per-signature MPC ceremony,
which dominates deployment economics.
Cross-references
luxfi/quasar— umbrella spec; Magnetar isPRIMITIVES.mdrowluxfi/pulsar— sibling threshold M-LWE primitive (production)luxfi/corona— sibling threshold R-LWE primitive (production)
License
BSD-3-Clause. See LICENSE.
Maintainer
[email protected] — Lux Industries, Inc.