mirror of
https://github.com/luxfi/magnetar.git
synced 2026-07-27 02:53:47 +00:00
main
4
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Hanzo AI
|
3951c5a46c |
v0.4.2: TRUE threshold HBS (pkg/thbs) + public-BFT-safe aggregate-sigs
Introduce TWO new signing modes plus a clarifying rename of the legacy
v0.1 path.
1. pkg/thbs/ — TRUE threshold hash-based signatures in the McGrew et al.
sense (IACR ePrint 2019/793 / IRTF draft-mcgrew-hash-sigs line). For
HBS schemes the signature reveals SELECTED secret elements (WOTS+
chain heads selected by the message-digest base-w digits + FORS
secret leaves selected by the FORS index digest). Threshold signing
here Shamir-shares each secret element across the committee; for
each message parties release shares ONLY for the SELECTED elements;
the combiner Lagrange-reconstructs just those elements; the
verifier sees an ordinary HBS-style signature.
Subpackage layout:
- thbs.go — types per the requested API shape (DKGConfig,
PublicKey, PrivateShare, PartialSignature,
FinalSignature, Evidence, EquivocationError).
- dealer.go — v1 dealer-backed DKG. The dealer Shamir-shares each
secret element across the committee via per-byte
GF(257); the dealer seed is zeroised before return.
v2 will replace with public DKG.
- wots.go — WOTS+ (Winternitz w=16, FIPS 205-style base-w digit
+ checksum decomposition; cSHAKE-256 hash chains).
- fors.go — FORS (k subtrees, height a, per-leaf binary Merkle).
- tree.go — public Merkle tree over WOTS+ leaf-roots.
- slot.go — anti-equivocation slot guard. Same-slot-different-
digest emits Evidence{party, slot, digest_a/b,
share_a/b} for the slashing layer.
- sign.go — SignShare + Aggregate + Verify.
- shamir.go — byte-wise Shamir over GF(257); elements are shared
directly, not seeds.
- hash.go — cSHAKE-256 with the "Magnetar-THBS" function-name
and per-tag domain separation.
24 unit tests pin every invariant: no-seed-exposure,
selected-elements-only for both WOTS+ and FORS, t-of-n threshold,
anti-equivocation, cross-slot/cross-message rejection, tamper
detection.
Honest v1 scope (documented in THBS-SPEC.md):
- Setup is DEALER-BACKED. v2 replaces with public DKG.
- Helper data shipped alongside the public key (McGrew et al.
permit this).
- Verifier is a CUSTOM HBS verifier; v3 will produce FIPS 205-byte-
identical output.
Hard invariant enforced by the package shape:
OK: reconstructElement(slot, elementID, shares)
Forbidden: ReconstructSeed, ReconstructPrivateKey,
ExpandPrivateKey, DeriveAllFutureElements
The only Reconstruct symbol in thbs/*.go is the unexported
reconstructElement in shamir.go.
2. pkg/magnetar/aggregate.go — public-BFT-safe N-of-N collected
signatures. Each validator holds its OWN SLH-DSA keypair (no DKG,
no shared seed). Primitives: GenerateValidatorKey, SignBundle,
VerifyBundle, AggregateSignatures, VerifyAggregated. 10 tests.
3. pkg/magnetar/combine.go — Combine renamed to
CombineWithSeedReconstruction throughout the package + callers
(e2e_test, threshold_test, n1_byte_equality_test, fuzz_test,
genkat, ct/dudect bridge) to make the TEE-only trust caveat
explicit at the API surface. KAT byte-equality preserved: the
function body is unchanged.
Refs: McGrew, Fluhrer, Gazdag, Kampanakis, Morton, Westerbaan,
"Coalition and Threshold Hash-Based Signatures" (IACR ePrint 2019/793);
Bonte, Smart, Tan, "Threshold SPHINCS+", PKC 2024 (the negative result
informing our v1-ships-a-custom-HBS-verifier scope choice).
|
||
|
Hanzo AI
|
30e71f1271 |
proofs: EC theories for Magnetar N1 + N4 (admit 0/0 across 13 files)
Tier A EC theory shells mirroring Pulsar v1.0.7's structure, adapted to SLH-DSA reveal-and-aggregate. Class N1-analog byte-equality theorem magnetar_n1_byte_equality is proved against the protocol-level Magnetar_Threshold module type; the concrete extracted corollary magnetar_n1_byte_equality_extracted composes the wrapper-bridge lemmas. Entire dependency cone is admit 0/0. Files (13): Magnetar_N1.ec — protocol-level spec + theorem Magnetar_N4.ec — reshare pk-preservation Magnetar_N1_Memory.ec — byte-memory frame lemmas Magnetar_N1_Signature_Codec.ec — FIPS 205 sig codec Magnetar_N1_Combine_Layout.ec — Combine wire layout Magnetar_N1_Sign_Layout.ec — single-party Sign wire layout Magnetar_N1_Combine_Refinement.ec — Combine byte-walk (1 axiom) Magnetar_N1_Sign_Refinement.ec — single-party byte-walk (1 axiom) Magnetar_N1_Combine_Wrapper.ec — Combine wrapper bridge Magnetar_N1_Sign_Wrapper.ec — Sign wrapper bridge Magnetar_N1_Extracted.ec — concrete extracted corollary lemmas/SLHDSA_Functional.ec — in-house FIPS 205 functional lemmas/Magnetar_CT.ec — BGL leakage-model CT lemmas Structural simplification vs Pulsar: SLH-DSA SignDeterministic is straight-line (no rejection-sampling kappa loop), so Magnetar has 2 atomic byte-walk axioms (combine + sign monolithic) instead of Pulsar v8's 14-axiom cascade. The Shamir/Lagrange algebra is shared with Pulsar's bridge (cross-cited; byte-wise GF(257) is identical). Bridge doc (proofs/lean-easycrypt-bridge.md) cross-cites the 4 Pulsar Shamir axioms and adds 2 Magnetar-specific entries (mix_to_seed_first_arg_injective + derive_pk_is_slhdsa_pk_from_seed). |
||
|
Hanzo AI
|
8fe20b3b88 |
docs: README + SUBMISSION-STATUS + BLOCKERS + CHANGELOG updates for v0.3.0
Promote Magnetar from Tier B (production library + submission scaffold) to Tier A documentation shape complete. - README.md: flipped status to "Tier A documentation shape complete". Updated "What v0.3.0 ships" / "does NOT yet ship" to reflect closed BLK-5/BLK-8 + open gates per CRYPTOGRAPHER-SIGN-OFF.md. - SUBMISSION-STATUS.md: Phase 4 (submission package) CLOSED for doc shape; Phase 5 (cryptographer review) PARTIAL (internal v0.3.0, external roadmap v0.6.0). Updated headline to "Tier A documentation shape complete; full Tier A formal-methods + measurement + lifecycle gates open." - BLOCKERS.md: closed BLK-8 (submission package documentation shape) at v0.3.0 with full 12-document inventory; partially closed BLK-9 (internal review landed; external roadmap v0.6.0). BLK-4 (v0.4 lifecycle additions), BLK-6 (cross-validation harness), BLK-7 (proof artifacts) remain open and tracked to CRYPTOGRAPHER-SIGN-OFF.md Gates. - CHANGELOG.md: new file. v0.3.0 entry documents the Tier A documentation shape: 9 new submission docs + 2 new scripts. v0.2.0 entry (back-filled) documents the Tier B production library landing. Honesty notes preserved. - .gitignore: added proofs/ exclusion. EC theory shells are work-in-progress targeted for v0.5.0 commit; at v0.3.0 PROOF-CLAIMS.md §3.1 explicitly states "no EC theories ship at v0.3.0" — keeping them out of the working-tree-clean gate. |
||
|
Hanzo AI
|
7f91286ee3 |
feat: v0.1 reveal-and-aggregate threshold-SLH-DSA implementation
ref/go/pkg/magnetar/: pure-Go threshold FIPS 205 SLH-DSA over byte-wise Shamir VSS of the SLH-DSA scheme seed. Mirrors Pulsar's v0.1 reveal-and-aggregate pattern, ported to SLH-DSA's scheme-seed-as-secret model. Construction: - DKG (dkg.go): Shamir+sum over GF(257), per-recipient envelopes carry both the recipient's share AND the dealer's full contribution so every party can compute the joint master public key locally. Round-2 digest binds the ordered envelope set for identifiable abort (ComplaintEquivocation). - Threshold-sign (threshold.go, combine.go): two-round commit-and- reveal of (mask, masked_share). Aggregator XORs to recover shares, Lagrange-interpolates the byte-sum, mixes with committee_root via cSHAKE256, and calls slhdsa.SignDeterministic on the reconstructed seed. Output signature is byte-identical to single-party FIPS 205. - Three parameter sets: SHAKE-192s (recommended), SHAKE-192f, SHAKE-256s. Backend: github.com/cloudflare/circl v1.6.3 (sign/slhdsa). Pure Go, no CGo. circl.Scheme().DeriveKey(seed) is the byte-deterministic seed -> keypair path that Magnetar Shamir-shares over. Headline test (n1_byte_equality_test.go): - TestN1_ByteEquality_ThresholdMatchesCentralized validates the Class-N1-analog claim: threshold-produced signatures are byte-identical to single-party SignDeterministic on the reconstructed master seed across (3,2), (5,3), (7,4) configs. - TestN1_ByteEquality_DifferentQuorumsSameSignature validates quorum-independence: distinct quorums yield identical bytes. Test discipline: - Non-race full suite: 34 top-level tests, all PASS in ~56s. - Race-detector run: SLH-DSA hash-tree is 5-10x slower under race on commodity hardware; SLH-DSA-heavy tests self-skip via raceEnabled build-tag constant (race_on_test.go / race_off_test.go) so race tests focus on the cheap concurrency-relevant primitives (shamir, transcript, types) — these pass in ~1.4s under -race -timeout 240s. Honest v0.1 trust caveat: aggregator process is TCB for the brief window the master seed is reconstructed in memory. Same caveat as Pulsar v0.1 reveal-and-aggregate. Documented in SPEC.md and DEPLOYMENT-RUNBOOK.md (separate commits). All secret-bearing buffers are explicitly zeroized at every return path in combine.go. |