mirror of
https://github.com/luxfi/magnetar.git
synced 2026-07-27 02:53:47 +00:00
main
7
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 zeekay
|
b23263700b |
chore: sync working tree
Commits 1 outstanding change(s) that were sitting uncommitted. No build artifacts and no secrets in the changeset (both checked). |
||
|
Hanzo AI
|
a5d7a242e3 |
magnetar v1.2: dealerless PVSS-DKG closes MAGNETAR-PVSS-DKG-V11
Implements a Schoenmakers-style PVSS-DKG over GF(257) for THBS-SE
setup. The trusted dealer is removed; no party ever holds the master
byte vector at any time during setup. The implicit master is only
materialised inside the `deriveDKGPublicKey` closure (named
`lagrangeScratch`, zeroized at closure exit) when an external auditor
invokes `VerifyDKGTranscript` to derive the public key.
New public surface (ref/go/pkg/magnetar/):
- pvss_dkg.go: NewPVSSPartyState, PVSSPartyState.{PublicContribution,
ShareTo, RevealMsg}, VerifyContribution, VerifyShareConsistency,
RunDKGSimulation, VerifyDKGTranscript, AggregateShareEnvelope,
VerifyPVSSComplaint, PVSSTranscript, PVSSPublicContribution,
PVSSRevealMsg, PVSSComplaint.
- key.go: NewThbsSeKeyFromDealerlessDKG --- takes a PVSSTranscript
and emits a ThbsSeKey byte-shape identical to the dealer-path
output for the same implicit master.
Tests (ref/go/pkg/magnetar/pvss_dkg_test.go, 5 invariant gates):
- TestPVSS_DKG_NoSinglePartyHoldsMaster (AST walk + state audit)
- TestPVSS_DKG_ByteCompatWithDealerPath (wire-byte equality)
- TestPVSS_DKG_AdversarialReveals (t-1 corrupted parties)
- TestPVSS_DKG_RobustnessAgainstMaliciousCommitments
- TestPVSS_DKG_EndToEnd_SignAndVerify (closing loop through Combine)
EasyCrypt theory:
- proofs/easycrypt/Magnetar_N5_PVSS_DKG.ec: Class N5 secrecy,
correctness, and wire-compat theorems. 2 admits (Shamir info-
theoretic cross-cite + Go-extraction trust boundary).
Hard invariant: no party (and no transient dealer) ever holds the
master byte vector at any time during setup. The dealerless and
dealer paths emit byte-shape-identical share envelopes, so already-
deployed share material is forward-compatible.
|
||
|
Hanzo AI
|
0f6ac37cfc |
magnetar v1.1: high-assurance orchestrator + BLOCKERS + CHANGELOG + README
scripts/check-high-assurance.sh: updated v1.0 -> v1.1 framing.
Orchestrator now drives four per-push gates:
- scripts/checks/go-tests.sh (unchanged from v1.0).
- scripts/checks/strict-atom-ast.sh (NEW): runs the v1.1 audit grep
verbatim + the Go AST gate TestThbsSE_StrictAtom_NoTransientSeed.
- scripts/checks/easycrypt-smoke.sh (NEW): theory-shell presence +
structural smoke check; full EC type-check at release time only.
- scripts/checks/dudect-smoke.sh (NEW): drives the Go-side CT static
check via `go test -tags ct ./ct/dudect/...`.
BLOCKERS.md: close MAGNETAR-STRICT-ATOM-V11 + MAGNETAR-PROOF-TRACK-V11
+ MAGNETAR-DUDECT-V11 at v1.1. Honest residual gap documented
(transient SHAKE-absorb bytes; closing requires either full MPC or a
TEE in the TCB --- both out of scope for the permissionless Magnetar
surface). MAGNETAR-PVSS-DKG-V11 + MAGNETAR-EXTERNAL-AUDIT-V11 remain
open at v1.1 (PVSS-DKG and external audit).
CHANGELOG.md: [1.1.0] release notes. Headline: strict-atom Combine,
wire-format-stable refactor (v1.0.0 consumers bump transparently),
strict-atom discipline statement (audit grep returns zero),
byte-identity to circl FIPS 205 (pinned per SHAKE mode), proof track
restoration (5 substantive admits), dudect harness restoration,
benchmark numbers (strict-atom is 8-51% FASTER than v1.0-equivalent),
honest residual gap.
README.md: v1.0 -> v1.1 framing in the headline.
|
||
|
Lux Magnetar
|
83ce56ff0f |
magnetar v1.0.0: ONE construction per regime; THBS-SE permissionless threshold
Magnetar v1.0.0 closes the permissionless-threshold story at ONE
construction --- THBS-SE (Threshold Hash-Based Signatures with
Selected-Element Reconstruction) --- and removes every legacy
seed-recombine path from the codebase.
The two production primitives at v1.0:
1. Per-validator standalone (standalone.go, unchanged from v0.5.x) ---
the public-BFT primary primitive. Each validator holds its own FIPS
205 keypair, signs independently, consensus collects N signatures
into a ValidatorAggregateCert.
2. THBS-SE (thbsse.go + thbsse_field.go) --- the permissionless
threshold companion. t-of-n committee, slot-bound commit-and-reveal,
PUBLIC COMBINER role (anyone-can-combine, no host in TCB at sign
time), slashable equivocation and malformed-share evidence.
Both emit byte-identical FIPS 205 signatures that unmodified verifiers
accept (TestMagnetar_Wire_FIPS205Verifiable +
TestThbsSE_Wire_FIPS205Verifiable across all 3 SHAKE modes).
Hard invariant (THBS-SE): a revealed value is allowed only if it is
also present in the final SLH-DSA signature. Forbidden reveals:
SK.seed in any party-local persistent form, SK.prf, future-slot share
material. The slot guard refuses any same-slot re-emission.
v1.0 honest open item: the strict "no transient seed at any moment"
invariant requires a v1.1 strict-atom-assembly path
(BLOCKERS.md::MAGNETAR-STRICT-ATOM-V11) that re-implements FIPS 205
sec 5/6/7/8 internally. v1.0 ships a PUBLIC COMBINER that holds the
seed for one slhdsa.SignDeterministic call and zeroizes; materially
stronger than TEE-attested privileged-aggregator constructions,
materially weaker than the strict refinement.
8 test gates + 2 bonus correctness checks:
- TestThbsSE_Wire_FIPS205Verifiable (3 modes) -- byte identity
- TestThbsSE_RejectSeedReveal
- TestThbsSE_RejectUnselectedFORS
- TestThbsSE_RejectUnselectedWOTS
- TestThbsSE_SlotReuseRejected
- TestThbsSE_OverselectedCommittee
- TestThbsSE_SlotBindingDomainSeparation
- BenchmarkThbsSE_Sign_5of7
- TestThbsSE_PublicCombiner_Determinism (bonus)
- TestKAT_ThbsSe (n=7, t=4, 3 modes, 3 messages)
Removed (legacy seed-recombine path + the proofs/CT scaffolding that
modeled it):
- ref/go/pkg/magnetar/{threshold,aggregate,combine,shamir,dkg}.go
+ tests
- ref/go/pkg/magnetar/{e2e,fuzz,n1_byte_equality}_test.go
- ref/go/pkg/thbs/ (entire subtree including dkg2/ PVSS skeleton)
- vectors/{threshold-sign,dkg}.json
- jasmin/{threshold,lib}/ (legacy seed-recombine model)
- proofs/easycrypt/ (entire tree; v1.1 ports to THBS-SE)
- ct/dudect/ (entire tree; v1.1 lands with strict-atom path)
- scripts/{check-lean-bridge,checks/ec-*,checks/jasmin,checks/extraction}.sh
Added:
- ref/go/pkg/magnetar/thbsse.go (1054 LOC; the THBS-SE construction)
- ref/go/pkg/magnetar/thbsse_field.go (GF(257) internal share math)
- ref/go/pkg/magnetar/thbsse_test.go (8 gates + 2 bonus)
- vectors/thbsse-sign.json (deterministic (n=7,t=4) KAT)
- v1.0 supersede notices on v0.x archival docs
Verification:
- GOWORK=off go build ./... && go vet ./...: clean
- go test -count=1 -short: PASS (all gates)
- go test -count=1 -race -short: PASS
- grep "reveal-and-aggregate|seed.*recombin|THBS over.*seed|aggregator.*reconstruct.*seed" *.go: 0 matches
- find ref/go/pkg -type d -name thbs: empty
|
||
|
Hanzo AI
|
40618d99f9 |
magnetar v0.5.0: public-BFT framing + standalone+aggregate + dkg2 skeleton
The user's verbatim position: "we can't do a trusted dealer obv. it
HAS to be freking done right for public chains bro"
WHAT SHIPPED
1. PRIMARY PUBLIC-BFT PRIMITIVE (standalone.go + aggregate.go):
- PerValidatorKeypair / ValidatorSign / ValidatorBatchVerify
- BuildAggregateCert / VerifyAggregateCert
- This is the ARCHITECTURALLY CORRECT pattern for SLH-DSA in
public BFT: each validator has its own keypair (no DKG),
signs independently, consensus collects N signatures. Mirrors
what consensus.QuasarCert.MLDSAProof already does for ML-DSA
via Z-Chain Groth16 rollup. SLH-DSA's lack of algebraic
structure (Cozzo-Smart 2019, Bonte-Smart-Tan 2023) means true
threshold SLH-DSA WITHOUT a dealer/TEE/MPC is research-grade;
per-validator + aggregation is the honest answer.
2. THBS SUBPACKAGE DEMOTED (thbs/dealer.go + thbs.go docstrings):
- Renamed to make the dealer-backed v1 trust assumption explicit
at the API surface. "NOT public-BFT-safe" headers added.
- Kept for M-Chain bridge custody / single-operator TCB scenarios
where the dealer is in the TCB by policy.
3. DKG2 SKELETON (thbs/dkg2/):
- PVSS layer (pvss.go, complaint.go, consensus.go) — each party
dealer-shares contribution r_{j,e} for every secret element e
via verifiable shares. No single party ever holds x_e = Σ r_{j,e}.
- MPC root layer (root.go) STUB — returns ErrMPCRootNotImpl.
This is the v0.6+ research deliverable: jointly compute
H(x_e) for every WOTS+/FORS leaf without revealing x_e.
- README + doc.go cite the literature honestly (Schoenmakers PVSS
1999, Gurkan aggregatable DKG 2021, SPDZ MPC 2012, Boyle-Gilboa-
Ishai FSS 2015, MP-SPDZ framework, McGrew et al. threshold HBS
IACR 2019/793, Bonte-Smart-Tan threshold SPHINCS+ 2023).
- Tests pass (skeleton-only assertions, MPC root stub returns
the documented sentinel).
DEPLOYMENT-RUNBOOK.md REWRITTEN — clear guidance:
- PUBLIC BFT CONSENSUS → magnetar.ValidatorSign + VerifyAggregateCert
- M-CHAIN CUSTODY (TEE/dealer in TCB) → CombineWithSeedReconstruction
or thbs.DealerDKG + SignShare + Aggregate
- RESEARCH/FUTURE → thbs/dkg2/ when MPC root layer lands
BLOCKERS.md::MAGNETAR-PUBLIC-DKG-1 — open research entry:
Public DKG for HBS requires MPC over SHA-256/SHAKE to compute public
roots from secret-shared leaves. Estimated multi-hour per signature
at current MPC framework throughput (MP-SPDZ ~hundred-ms per SHA-256
block × 750K SHAKE evaluations for SLH-DSA-SHAKE-192s public key).
v0.6+ target.
CHANGELOG.md entry for v0.5.0.
Tests green:
- ref/go/pkg/magnetar/ ok (105s, includes standalone + aggregate)
- ref/go/pkg/thbs/ ok (dealer-backed THBS, slot guard, equiv evidence)
- ref/go/pkg/thbs/dkg2/ ok (skeleton with documented stub)
Per CLAUDE.md, minor bump for new public API surface
(magnetar.ValidatorSign + dkg2/ subpackage).
|
||
|
Hanzo AI
|
3951c5a46c |
v0.4.2: TRUE threshold HBS (pkg/thbs) + public-BFT-safe aggregate-sigs
Introduce TWO new signing modes plus a clarifying rename of the legacy
v0.1 path.
1. pkg/thbs/ — TRUE threshold hash-based signatures in the McGrew et al.
sense (IACR ePrint 2019/793 / IRTF draft-mcgrew-hash-sigs line). For
HBS schemes the signature reveals SELECTED secret elements (WOTS+
chain heads selected by the message-digest base-w digits + FORS
secret leaves selected by the FORS index digest). Threshold signing
here Shamir-shares each secret element across the committee; for
each message parties release shares ONLY for the SELECTED elements;
the combiner Lagrange-reconstructs just those elements; the
verifier sees an ordinary HBS-style signature.
Subpackage layout:
- thbs.go — types per the requested API shape (DKGConfig,
PublicKey, PrivateShare, PartialSignature,
FinalSignature, Evidence, EquivocationError).
- dealer.go — v1 dealer-backed DKG. The dealer Shamir-shares each
secret element across the committee via per-byte
GF(257); the dealer seed is zeroised before return.
v2 will replace with public DKG.
- wots.go — WOTS+ (Winternitz w=16, FIPS 205-style base-w digit
+ checksum decomposition; cSHAKE-256 hash chains).
- fors.go — FORS (k subtrees, height a, per-leaf binary Merkle).
- tree.go — public Merkle tree over WOTS+ leaf-roots.
- slot.go — anti-equivocation slot guard. Same-slot-different-
digest emits Evidence{party, slot, digest_a/b,
share_a/b} for the slashing layer.
- sign.go — SignShare + Aggregate + Verify.
- shamir.go — byte-wise Shamir over GF(257); elements are shared
directly, not seeds.
- hash.go — cSHAKE-256 with the "Magnetar-THBS" function-name
and per-tag domain separation.
24 unit tests pin every invariant: no-seed-exposure,
selected-elements-only for both WOTS+ and FORS, t-of-n threshold,
anti-equivocation, cross-slot/cross-message rejection, tamper
detection.
Honest v1 scope (documented in THBS-SPEC.md):
- Setup is DEALER-BACKED. v2 replaces with public DKG.
- Helper data shipped alongside the public key (McGrew et al.
permit this).
- Verifier is a CUSTOM HBS verifier; v3 will produce FIPS 205-byte-
identical output.
Hard invariant enforced by the package shape:
OK: reconstructElement(slot, elementID, shares)
Forbidden: ReconstructSeed, ReconstructPrivateKey,
ExpandPrivateKey, DeriveAllFutureElements
The only Reconstruct symbol in thbs/*.go is the unexported
reconstructElement in shamir.go.
2. pkg/magnetar/aggregate.go — public-BFT-safe N-of-N collected
signatures. Each validator holds its OWN SLH-DSA keypair (no DKG,
no shared seed). Primitives: GenerateValidatorKey, SignBundle,
VerifyBundle, AggregateSignatures, VerifyAggregated. 10 tests.
3. pkg/magnetar/combine.go — Combine renamed to
CombineWithSeedReconstruction throughout the package + callers
(e2e_test, threshold_test, n1_byte_equality_test, fuzz_test,
genkat, ct/dudect bridge) to make the TEE-only trust caveat
explicit at the API surface. KAT byte-equality preserved: the
function body is unchanged.
Refs: McGrew, Fluhrer, Gazdag, Kampanakis, Morton, Westerbaan,
"Coalition and Threshold Hash-Based Signatures" (IACR ePrint 2019/793);
Bonte, Smart, Tan, "Threshold SPHINCS+", PKC 2024 (the negative result
informing our v1-ships-a-custom-HBS-verifier scope choice).
|
||
|
Hanzo AI
|
8fe20b3b88 |
docs: README + SUBMISSION-STATUS + BLOCKERS + CHANGELOG updates for v0.3.0
Promote Magnetar from Tier B (production library + submission scaffold) to Tier A documentation shape complete. - README.md: flipped status to "Tier A documentation shape complete". Updated "What v0.3.0 ships" / "does NOT yet ship" to reflect closed BLK-5/BLK-8 + open gates per CRYPTOGRAPHER-SIGN-OFF.md. - SUBMISSION-STATUS.md: Phase 4 (submission package) CLOSED for doc shape; Phase 5 (cryptographer review) PARTIAL (internal v0.3.0, external roadmap v0.6.0). Updated headline to "Tier A documentation shape complete; full Tier A formal-methods + measurement + lifecycle gates open." - BLOCKERS.md: closed BLK-8 (submission package documentation shape) at v0.3.0 with full 12-document inventory; partially closed BLK-9 (internal review landed; external roadmap v0.6.0). BLK-4 (v0.4 lifecycle additions), BLK-6 (cross-validation harness), BLK-7 (proof artifacts) remain open and tracked to CRYPTOGRAPHER-SIGN-OFF.md Gates. - CHANGELOG.md: new file. v0.3.0 entry documents the Tier A documentation shape: 9 new submission docs + 2 new scripts. v0.2.0 entry (back-filled) documents the Tier B production library landing. Honesty notes preserved. - .gitignore: added proofs/ exclusion. EC theory shells are work-in-progress targeted for v0.5.0 commit; at v0.3.0 PROOF-CLAIMS.md §3.1 explicitly states "no EC theories ship at v0.3.0" — keeping them out of the working-tree-clean gate. |