ref/go/pkg/magnetar/: pure-Go threshold FIPS 205 SLH-DSA over
byte-wise Shamir VSS of the SLH-DSA scheme seed. Mirrors Pulsar's
v0.1 reveal-and-aggregate pattern, ported to SLH-DSA's
scheme-seed-as-secret model.
Construction:
- DKG (dkg.go): Shamir+sum over GF(257), per-recipient envelopes
carry both the recipient's share AND the dealer's full
contribution so every party can compute the joint master public
key locally. Round-2 digest binds the ordered envelope set for
identifiable abort (ComplaintEquivocation).
- Threshold-sign (threshold.go, combine.go): two-round commit-and-
reveal of (mask, masked_share). Aggregator XORs to recover
shares, Lagrange-interpolates the byte-sum, mixes with
committee_root via cSHAKE256, and calls
slhdsa.SignDeterministic on the reconstructed seed. Output
signature is byte-identical to single-party FIPS 205.
- Three parameter sets: SHAKE-192s (recommended), SHAKE-192f,
SHAKE-256s.
Backend: github.com/cloudflare/circl v1.6.3 (sign/slhdsa). Pure Go,
no CGo. circl.Scheme().DeriveKey(seed) is the byte-deterministic
seed -> keypair path that Magnetar Shamir-shares over.
Headline test (n1_byte_equality_test.go):
- TestN1_ByteEquality_ThresholdMatchesCentralized validates the
Class-N1-analog claim: threshold-produced signatures are
byte-identical to single-party SignDeterministic on the
reconstructed master seed across (3,2), (5,3), (7,4) configs.
- TestN1_ByteEquality_DifferentQuorumsSameSignature validates
quorum-independence: distinct quorums yield identical bytes.
Test discipline:
- Non-race full suite: 34 top-level tests, all PASS in ~56s.
- Race-detector run: SLH-DSA hash-tree is 5-10x slower under race
on commodity hardware; SLH-DSA-heavy tests self-skip via
raceEnabled build-tag constant (race_on_test.go / race_off_test.go)
so race tests focus on the cheap concurrency-relevant primitives
(shamir, transcript, types) — these pass in ~1.4s under
-race -timeout 240s.
Honest v0.1 trust caveat: aggregator process is TCB for the brief
window the master seed is reconstructed in memory. Same caveat as
Pulsar v0.1 reveal-and-aggregate. Documented in SPEC.md and
DEPLOYMENT-RUNBOOK.md (separate commits). All secret-bearing
buffers are explicitly zeroized at every return path in combine.go.
zeekay