# NIST MPTC Submission Status --- Magnetar > ## CURRENT STATUS (authoritative; supersedes the v0.x body below) > > - **Production primitive: per-validator standalone** (`standalone.go`) > --- SOUND. N independent FIPS 205 signatures; no shared seed, no > reconstruction. This is what Magnetar offers for production > public-BFT signing. > - **Opt-in production: TEE-attested combiner pool** --- sound under an > attested-hardware trust model (trust-relocation, NOT MPC). > - **Permissionless THBS-SE: RESEARCH-ONLY.** The public combiner > reconstructs the FIPS 205 master every signature > (`ASSEMBLE-INVARIANT.md`). NOT no-leak. Not a standardizable > threshold-SLH-DSA claim. > - **Mechanized proofs: NONE.** The prior EC/Lean track was vacuous and > has been deleted/scaffolded (`PROOF-CLAIMS.md` §2). > - **PVSS-DKG open-reveal leak: FIXED** (`RunDKG`; regression-gated). > - The byte-identity-to-FIPS-205 property is correctness/interop, NOT a > confidentiality claim. > > True no-reconstruction threshold SLH-DSA is OPEN RESEARCH. Magnetar's > answer for production is the standalone path, which sidesteps it. > See `BLOCKERS.md` and `CRYPTOGRAPHER-SIGN-OFF.md`. > > Everything below this banner is a stale v0.x archival snapshot > (reveal-and-aggregate, "Tier A documentation shape", v0.4/v0.5 > roadmap). It is retained for provenance only and is NOT the current > status; where it conflicts with this banner, the banner wins. ## Today (v0.3.0) **Tier A documentation shape complete; full Tier A formal-methods + measurement + lifecycle gates open.** Specifically (carried forward from v0.2.0 and extended at v0.3.0): - **Construction selected.** v0.1 reveal-and-aggregate over the SLH-DSA scheme seed (Shamir VSS in GF(257), Lagrange reconstruction at sign time). Mirrors Pulsar's v0.1 reveal-and-aggregate pattern. See `SPEC.md`. - **Reference implementation shipped.** `ref/go/pkg/magnetar/` — pure Go on top of `cloudflare/circl/sign/slhdsa`. Single-party + DKG + threshold-sign + Combine. Three parameter sets (SHAKE-192s / SHAKE-192f / SHAKE-256s). ~2186 LOC production Go, 76.8% test coverage. - **KAT vectors shipped.** `vectors/{keygen,sign,verify, threshold-sign,dkg}.json` — deterministic regeneration via `ref/go/cmd/genkat`. - **Class-N1 evidence shipped.** `n1_byte_equality_test.go` — threshold-produced signatures are byte-identical to single-party `slhdsa.SignDeterministic` on the reconstructed master seed across (3,2), (5,3), (7,4) configurations; verifies under unmodified FIPS 205. - **Honest trust-model disclosure shipped.** `DEPLOYMENT-RUNBOOK.md` documents the v0.1 reveal-and-aggregate aggregator-as-TCB caveat with the same rigor as Pulsar's. - **Tier A documentation shape complete (v0.3.0).** Full 12-document submission package shape, mirroring Pulsar's structure: `SUBMISSION.md`, `NIST-SUBMISSION.md`, `SPEC.md`, `PATENTS.md`, `PROOF-CLAIMS.md`, `AXIOM-INVENTORY.md`, `FIPS-TRACEABILITY.md`, `TRUSTED-COMPUTING-BASE.md`, `CRYPTOGRAPHER-SIGN-OFF.md`, `DEPLOYMENT-RUNBOOK.md`, `BLOCKERS.md`, `SUBMISSION-STATUS.md`. - **Internal cryptographer sign-off shipped (v0.3.0).** `CRYPTOGRAPHER-SIGN-OFF.md` — APPROVED WITH GATES, mirroring Pulsar's exact structure. Five open gates tracked. - **Submission orchestration shipped (v0.3.0).** `scripts/cut-submission.sh` (8-step tarball cut with KAT-determinism verification) + `scripts/check-high-assurance.sh` (per-push gate). What is **NOT** yet shipped (the gates to full Tier A — tracked in `CRYPTOGRAPHER-SIGN-OFF.md` Gates section): - **GATE-1: EC theory shells for the threshold overlay**. The single-party FIPS 205 layer is NIST-anchored; the threshold overlay is novel. Cross-citation to Pulsar's Lean ↔ EC bridges for the GF(257) Shamir / Lagrange algebraic identities; new EC theory shells needed for the cSHAKE256 mix + `KeyFromSeed → SignDeterministic` dispatch. **Roadmap v0.5.0; multi-month research.** - **GATE-2: Lean ↔ EC bridge**. Cross-citation closure to Pulsar's bridges. **Roadmap v0.5.0.** - **GATE-3: dudect 10⁹ samples on the threshold overlay**. **Roadmap v0.6.0.** - **GATE-4: external cryptographer audit**. **Roadmap v0.6.0.** - **GATE-5: v0.4 lifecycle additions**. ML-KEM-768 wrapping of DKG Round-1 envelopes (closes passive-network-observer channel) + Reshare protocol (Refresh + ReshareToNewSet) for Class N4-analog evidence. **Roadmap v0.4.0.** ## Why this is not Pulsar (still, at Tier B) Pulsar v0.1 reached NIST MPTC submission-readiness on three structural advantages that Magnetar v0.1 partially shares and partially does not: 1. **Linear-aggregation identity.** SHARED: at the SHARE level, Shamir-shares over GF(257) admit linear Lagrange reconstruction exactly as Pulsar's do. Magnetar inherits this property. 2. **Fixed FIPS standard to anchor against.** SHARED: Magnetar's Class-N1-analog claim is "byte-equal to single-party FIPS 205 SLH-DSA on the reconstructed seed," directly analogous to Pulsar's Class N1 byte-equality claim against FIPS 204 ML-DSA. 3. **Mature academic basis.** PARTIALLY SHARED: the reveal-and- aggregate pattern itself has the same security story for SLH-DSA as it does for ML-DSA — the aggregator is TCB; this is honest v0.1 design space. What's NOT shared: there is no peer-reviewed paper specifically targeting threshold-SLH-DSA reveal-and- aggregate. Magnetar inherits the construction-equivalence argument from Pulsar's v0.1 design rather than citing a fresh threshold-SLH-DSA paper. This is acknowledged in `SPEC.md` §6 and remains an open citation gap. ## Path to NIST MPTC v0.3 Estimated 2-3 months of formal-methods work + 1-2 months of submission-package authoring + parallel independent review. ### Phase 1 — Construction selection (DONE, v0.2.0) - ✅ Surveyed candidates (Komlo-style FROST-of-SLH-DSA, full-MPC, reveal-and-aggregate) - ✅ Selected reveal-and-aggregate (mirrors Pulsar v0.1 pattern; honest TCB caveat) - ✅ Documented in `SPEC.md` ### Phase 2 — Reference implementation (DONE, v0.2.0) - ✅ Implemented in Go (`ref/go/pkg/magnetar/`) - ✅ Three parameter sets (SHAKE-192s, SHAKE-192f, SHAKE-256s) - ✅ KAT vectors + deterministic regeneration - ✅ N1 byte-equality test passes across (3,2), (5,3), (7,4) configurations ### Phase 3 — Proof artifacts (OPEN, BLK-7) - EasyCrypt theories for threshold reconstruction correctness - Lean bridges (where applicable — SLH-DSA is hash-based, so the bridge story differs from lattice schemes; expect to cite SLH-DSA's existing libjade constant-time analysis for the single-party layer) - Jasmin constant-time analysis of the threshold layer (DKG / Combine / Round1 / Round2) - Output target: `proofs/`, `jasmin/` ### Phase 4 — Submission package (CLOSED v0.3.0 for documentation shape; full Tier A formal-methods gates open) Mirror Pulsar's 12-doc structure adapted to Magnetar's specifics: - ✅ `SUBMISSION.md`, `NIST-SUBMISSION.md`, `SPEC.md` (landed v0.3.0) - ✅ `PATENTS.md`, `PROOF-CLAIMS.md`, `AXIOM-INVENTORY.md`, `FIPS-TRACEABILITY.md`, `TRUSTED-COMPUTING-BASE.md` (landed v0.3.0) - ✅ `CHANGELOG.md` (landed v0.3.0), `DEPLOYMENT-RUNBOOK.md` (landed v0.2.0) - ✅ `CRYPTOGRAPHER-SIGN-OFF.md` (landed v0.3.0, APPROVED WITH GATES) - ✅ `scripts/cut-submission.sh` + `scripts/check-high-assurance.sh` (landed v0.3.0) - ⏳ `docs/{evaluation,nist-mptc-category,design-decisions, patent-claims,family-architecture,threat-model, ietf-draft-skeleton}.md` — supporting docs (parallel to Pulsar's `docs/`; deferred to v0.4 — not required for Tier A documentation shape) ### Phase 5 — Independent cryptographer review (PARTIAL: internal v0.3.0; external roadmap v0.6.0) - ✅ **Internal review (v0.3.0)**: `CRYPTOGRAPHER-SIGN-OFF.md` signed off by the internal cryptographer agent. Verdict: APPROVED WITH GATES. Five gates tracked. - ⏳ **External engagement (roadmap v0.6.0)**: independent lab audit covering construction + implementation + EC theories (when they land v0.5.0) + dudect (when it lands v0.6.0). ## Target **NIST MPTC v0.3** — first submission window after Pulsar v0.1 (2026-11-16). Exact NIST date TBA by NIST; Lux internal target is **2027 Q3**. ## Cross-references - `SPEC.md` — construction specification (v0.2.0 landed) - `BLOCKERS.md` — Tier B → A path - `DEPLOYMENT-RUNBOOK.md` — v0.1 trust-model disclosure (v0.2.0 landed) - `README.md` — repo purpose + status - [`luxfi/quasar`](https://github.com/luxfi/quasar) — Polaris cert profile depends on Magnetar maturing - [`luxfi/pulsar`](https://github.com/luxfi/pulsar) — template submission package to mirror at Phase 4 - [`luxfi/lps/ROADMAP-CRYPTO-STACK.md`](https://github.com/luxfi/LPs/blob/main/ROADMAP-CRYPTO-STACK.md) — multi-year crypto stack plan ## Honest non-claims (at Tier A documentation shape; v0.3.0) Magnetar v0.3.0 today is NOT: - A submitted NIST MPTC entry (the tarball cut tool is in place via `scripts/cut-submission.sh`; cut target is the `submission-2026-11-16` window; Lux internal target is 2027 Q3) - A production cryptographic primitive **without** the v0.1 reveal-and-aggregate trust caveat (aggregator is TCB; see `DEPLOYMENT-RUNBOOK.md`) - A formally verified scheme **at the threshold overlay layer** (FIPS 205 single-party is NIST-anchored; threshold overlay EC theory shells are roadmap v0.5.0) - Externally audited (internal cryptographer sign-off only at v0.3.0; external lab engagement is roadmap v0.6.0) - A drop-in replacement for Pulsar (Pulsar M-LWE is the production cert-profile target; Magnetar is the cross-family diversity leg in the Polaris profile) This repo now exists as a **production library + Tier A documentation shape complete** for v0.1 reveal-and-aggregate threshold SLH-DSA, with the honest trust caveat documented operationally. The path to **full Tier A** (mechanized refinement + dudect + v0.4 lifecycle + external audit) is tracked on the v0.4 / v0.5 / v0.6 roadmap, with closure plans documented in `CRYPTOGRAPHER-SIGN-OFF.md` Gates section.