magnetar/CHANGELOG.md

Changelog --- Magnetar

All notable changes to the Magnetar SLH-DSA library and NIST MPTC submission package are tracked in this file.

The format follows Keep a Changelog; Magnetar adheres to Semantic Versioning.

[1.2.0] --- Dealerless PVSS-DKG setup: no trusted dealer

Headline

v1.2 closes MAGNETAR-PVSS-DKG-V11. The THBS-SE setup path no longer requires a trusted dealer holding the master byte vector even transiently. A new NewThbsSeKeyFromDealerlessDKG constructor accepts a PVSSTranscript from an n-party Schoenmakers-style PVSS-DKG run over GF(257) and assembles a ThbsSeKey byte-shape identical to the dealer-path output.

The implicit master M = sum_{i in Q} m_i mod 257 byte-wise is NEVER materialised in any party's memory during setup. The only point at which M is transiently assembled is inside the deriveDKGPublicKey closure (named lagrangeScratch, zeroized at closure exit) when an auditor invokes VerifyDKGTranscript to derive the public key.

New public surface

• NewPVSSPartyState --- one party's Round-1 state.
• PVSSPartyState.PublicContribution --- broadcast payload.
• PVSSPartyState.ShareTo(j) --- private share row for recipient j.
• PVSSPartyState.RevealMsg --- Round-2 reveal payload.
• VerifyContribution / VerifyShareConsistency --- public-form per-party verifiers.
• RunDKGSimulation --- single-process n-party simulation harness.
• PVSSTranscript --- canonical wire-shape record of a full DKG run.
• VerifyDKGTranscript --- public-form auditor entry point; returns (qualified set, derived PK, error).
• NewThbsSeKeyFromDealerlessDKG --- the headline closure: takes a PVSSTranscript and emits a canonical ThbsSeKey.
• PVSSComplaint / VerifyPVSSComplaint --- public-form slashing evidence for malicious Round-2 reveals.

Wire compatibility

• Wire format (MAGS / MAGG envelopes) is UNCHANGED at v1.2. The dealerless setup produces share envelopes byte-shape identical to what the dealer path produces for the same implicit master; already-deployed share material is forward-compatible.
• THBS-SE share format, slot-guard state, equivocation evidence shape, and protocol round structure are UNCHANGED.
• API additions: NewThbsSeKeyFromDealerlessDKG is a new constructor in the same magnetar package; the existing NewThbsSeKey dealer-path constructor is retained for KAT reproducibility and foundation-HSM bootstrap.
• v1.1.0 consumers bump to v1.2.0 transparently --- the new constructor is additive.

Hard invariant (load-bearing v1.2)

NO PARTY (and no transient dealer) EVER HOLDS THE MASTER BYTE VECTOR AT ANY TIME DURING SETUP.

Enforced by:

• TestPVSS_DKG_NoSinglePartyHoldsMaster (full DKG exercise + AST-walk guard on pvss_dkg.go against master-naming).
• TestPVSS_DKG_ByteCompatWithDealerPath (wire-byte equality between dealerless and dealer paths for the same implicit master).
• TestPVSS_DKG_AdversarialReveals (t-1 corrupted parties cannot recover the master from their partial-sum view).
• TestPVSS_DKG_RobustnessAgainstMaliciousCommitments (malicious parties detected at Round 2 and excluded from Q; clean termination via ErrPVSSQuorumLost when |Q| < t).
• TestPVSS_DKG_EndToEnd_SignAndVerify (dealerless-DKG-produced ThbsSeKey flows into ThbsSeRound1 / Combine unchanged and emits a signature that verifies under unmodified cloudflare/circl/sign/slhdsa.Verify).

EasyCrypt theory

proofs/easycrypt/Magnetar_N5_PVSS_DKG.ec --- Class N5 secrecy, correctness, and wire-compat theorems for the PVSS-DKG path. 2 admits (Shamir info-theoretic cross-cite + Go-extraction trust boundary).

Composition

The dealerless setup composes with the v1.1 strict-atom Combine path: a ThbsSeKey produced by NewThbsSeKeyFromDealerlessDKG flows through Combine unchanged. The signature emitted is byte-equal to what Combine would emit on a dealer-path ThbsSeKey for the same implicit master.

[1.1.0] --- 2026-05-31 --- Strict-atom Combine: no named transient seed binder

Headline

v1.1 closes MAGNETAR-STRICT-ATOM-V11. The THBS-SE permissionless threshold Combine path no longer materialises the FIPS 205 master under a named seed / skSeed / skPrf variable in the public combiner's scope. The path is implemented at ref/go/pkg/magnetar/thbsse_assemble.go::assembleSignatureBytes backed by ref/go/pkg/magnetar/slhdsa_internal.go::slhSignAtom (Magnetar-internal FIPS 205 sec 5--sec 8 walk for the SHAKE family).

Wire-format-stable refactor

• Wire format (MAGS / MAGG envelopes) is UNCHANGED at v1.1. KAT vectors regenerate to the same bytes.
• THBS-SE share format, slot-guard state, equivocation evidence shape, and protocol round structure are UNCHANGED.
• API: Combine, NewThbsSeKey, ThbsSeRound1, etc. have the SAME signatures. The strict-atom path is an internal refactor of Combine's tail.
• v1.0.0 consumers bump to v1.1.0 transparently.

Strict-atom discipline (load-bearing v1.1 invariant)

The v1.1 audit grep that defines compliance:

grep -rE "SK\.seed|SK\.prf|sk_seed|sk_prf" ref/go/pkg/magnetar/thbsse_assemble.go

MUST return zero matches. Enforced by:

• TestThbsSE_StrictAtom_NoTransientSeed (AST walk + raw-byte grep).
• scripts/checks/strict-atom-ast.sh (shell gate replicating the audit grep verbatim).
• ct/dudect/strict_atom_combine_ct_test.go:: TestStrictAtom_CT_NoSecretDependentBranch (AST walk asserting no secret-tagged identifier feeds an if/switch condition or an index expression).

See ASSEMBLE-INVARIANT.md for the load-bearing prose statement.

Byte-identity to circl FIPS 205

The Magnetar-internal FIPS 205 sec 5--sec 8 walk is byte-equal to cloudflare/circl/sign/slhdsa.SignDeterministic for the SHAKE families. Pinned by TestSlhdsaInternal_ByteEqualToCirclSign per mode (SHAKE-192s, SHAKE-192f, SHAKE-256s).

Proof track restoration

The v0.x EasyCrypt scaffolding (modelled the abandoned v0.x reveal-and-aggregate path; removed at v1.0) is replaced with v1.1 strict-atom theories:

• proofs/easycrypt/Magnetar_N1_StrictAtom.ec --- Class N1-analog strict-atom byte-equality theorem.
• proofs/easycrypt/Magnetar_N1_SHAKE_Expand.ec --- FIPS 205 SHAKE expansion lemmas.
• proofs/easycrypt/Magnetar_N1_Atom_Refinement.ec --- internal refinement to circl.
• proofs/easycrypt/Magnetar_N4_KeyDeriveStable.ec --- pk stability under Lagrange reconstruction.
• proofs/easycrypt/lemmas/SLHDSA_Functional.ec --- FIPS 205 SHAKE primitive black-box specs.
• proofs/easycrypt/lemmas/Magnetar_CT.ec --- abstract-level CT lemma.
• proofs/lean/Crypto/Magnetar/StrictAtom.lean --- Lean bridge carrying the algebraic identities.

Axiom budget: 5 substantive + 1 abstract-vacuous CT admit. Per proofs/README.md.

dudect harness restoration

The v0.x dudect harness (modelled deleted seed-recombine surfaces; removed at v1.0) is replaced with a v1.1 Go-side CT static check at ct/dudect/strict_atom_combine_ct_test.go. Per-push smoke gate at scripts/checks/dudect-smoke.sh.

Benchmark (Apple M1 Max, single-goroutine, 5-of-7)

Strict-atom v1.1 ns/op vs v1.0-equivalent baseline (circl-dispatched SignDeterministic on the Shamir-reconstructed seed):

Mode	v1.0-equivalent	v1.1 strict-atom	Delta
Magnetar-SHAKE-192s	2.93 s/op	1.43 s/op	-51%
Magnetar-SHAKE-192f	113 ms/op	63 ms/op	-44%
Magnetar-SHAKE-256s	2.22 s/op	2.04 s/op	-8%

The strict-atom path is FASTER because the Magnetar-internal SHAKE walk avoids circl's per-call PrivateKey unmarshal + state struct initialisation overhead.

Honest residual gap

The bytes of the FIPS 205 master DO exist transiently inside the SHAKE-expansion output buffer (derivedMaterial) and the Lagrange-reconstruction input (derivedExpandInput) for the duration of the SHAKE absorb. A coredump or /proc/self/mem dump at exactly the right wall-clock instant would observe them. Closing this gap requires either full MPC over the SHAKE-256 hash tree (open research) or a TEE-attested host in the TCB (luxfi/threshold/protocols/slhdsa-tee). The strict-atom discipline is the strictest available without crossing into either regime; see ASSEMBLE-INVARIANT.md.

[1.0.0] --- 2026-05-31 --- ONE construction per regime; legacy seed-recombine paths killed

Architectural decomplecting (HONEST framing)

This release closes Magnetar's permissionless-threshold story at ONE construction --- THBS-SE (Threshold Hash-Based Signatures with Selected-Element Reconstruction) --- and removes every legacy seed-recombine path from the codebase. Magnetar v1.0 ships exactly two primitives:

• Per-validator standalone (ref/go/pkg/magnetar/standalone.go, unchanged from v0.5.x) --- the public-BFT primary primitive. Each validator holds its own FIPS 205 keypair, signs independently, consensus collects N signatures into a ValidatorAggregateCert.
• THBS-SE (ref/go/pkg/magnetar/thbsse.go + thbsse_field.go) --- the permissionless threshold companion. t-of-n committee, slot-bound commit-and-reveal, public combiner role (anyone can run Combine), slashable equivocation + malformed-share evidence.

Both emit byte-identical FIPS 205 signatures that unmodified verifiers accept.

Hard invariant (THBS-SE)

A revealed value is allowed ONLY if it is also present in the final SLH-DSA signature.

• ALLOWED reveals: the per-round mask r_i, the masked share s'_i = share_i XOR r_i, the public commit hash, the final FIPS 205 signature bytes.
• FORBIDDEN reveals: SK.seed, SK.prf, future-slot share material. The slot guard refuses any same-slot re-emission and the share envelope is per-slot.

v1.0 honest open item

The strict invariant ("no party or combiner EVER reconstructs SK.seed, even transiently in memory") requires the v1.1 strict-atom-assembly path tracked at BLOCKERS.md::MAGNETAR-STRICT-ATOM-V11. v1.0 ships a PUBLIC COMBINER (anyone-can-combine) that holds the seed for the duration of one slhdsa.SignDeterministic call and then zeroizes. This is materially stronger than a TEE-attested privileged-aggregator model (no host in TCB; the combiner is a pure function any peer can run) and materially weaker than the strict invariant (a peer-local memory-disclosure adversary at exactly the combine moment could observe the seed). The strict-atom path requires a Magnetar-internal re-implementation of FIPS 205 sec 5/6/7/8 that bypasses slh_sign_internal; cloudflare/circl's slhdsa does not expose those internals.

Added

• ref/go/pkg/magnetar/thbsse.go --- the THBS-SE construction:
  • NewThbsSeKey(params, threshold, committee, rng) -> (*ThbsSeKey, error) --- deterministic-dealer setup that produces (PK, [share_i], setup_transcript). The dealer is in the TCB FOR SETUP ONLY; once NewThbsSeKey returns no party including the dealer holds the master seed. Production deployments run the leaderless PVSS-DKG path via the sibling luxfi/threshold DKG package and feed the result into the wire-equivalent share envelope.
  • ThbsSeRound1(params, share, binding, msg, guard, rng) -> (r1, r2, error) --- per-party Round-1 commit + Round-2 reveal pair. Idempotent replay on the same (slot, msg); emits *ThbsSeEquivocationError with a wire-shaped ThbsSeEvidence blob on a same-slot, distinct-message second attempt.
  • Combine(input ThbsSeCombineInput) -> (*Signature, []ThbsSeShareEvidence, error) --- the PUBLIC combiner. Pure function of its inputs. Any peer with the public ThbsSeKey, the slot binding, the message, and

    = t valid Round-1/Round-2 pairs can produce the FIPS 205 signature. Emits typed ThbsSeShareEvidence for malformed shares (slot-mismatch, wire-size, commit-mismatch).

  • ThbsSeSlotGuard + Record / Has --- per-party persistent slot-use guard. Local-state defense against equivocation.
  • VerifyThbsSeEvidence / VerifyThbsSeShareEvidence --- pure third-party evidence verifiers. No committee state required.
  • Slot binding: every signature is bound to (chain_id, epoch, slot, height, committee_id, message_domain) via cSHAKE256 transcript + FIPS 205 ctx string.
• ref/go/pkg/magnetar/thbsse_field.go --- the GF(257) byte-wise share arithmetic the THBS-SE construction consumes internally. Unexported helpers: thbsseDealRandom, thbsseDealRandomGF, thbsseReconstructGF, thbsseShareToBytes, thbsseShareFromBytes. The only exported names are MaxCommittee257, EvalPointFromID, and the THBS-SE error values.
• ref/go/pkg/magnetar/thbsse_test.go --- the 8 mandated test gates plus a determinism check and a binding-distinct-signature check:
  • TestThbsSE_Wire_FIPS205Verifiable (3 SHAKE modes)
  • TestThbsSE_RejectSeedReveal
  • TestThbsSE_RejectUnselectedFORS
  • TestThbsSE_RejectUnselectedWOTS
  • TestThbsSE_SlotReuseRejected
  • TestThbsSE_OverselectedCommittee (n=7, t=3, 4 honest + 3 withholders)
  • TestThbsSE_SlotBindingDomainSeparation
  • BenchmarkThbsSE_Sign_5of7 (3 SHAKE modes)
  • bonus: TestThbsSE_PublicCombiner_Determinism (disjoint t-subsets produce byte-equal signatures)
• vectors/thbsse-sign.json --- deterministic KAT vectors at (n=7, t=4) x 3 SHAKE modes x 3 messages. Replayed by TestKAT_ThbsSe.

Removed

• ref/go/pkg/magnetar/threshold.go + threshold_test.go --- legacy reveal-and-aggregate threshold sign path.
• ref/go/pkg/magnetar/aggregate.go + aggregate_test.go --- legacy aggregate-sign (subsumed by standalone.go's ValidatorAggregateCert).
• ref/go/pkg/magnetar/combine.go --- legacy CombineWithSeedReconstruction entry point.
• ref/go/pkg/magnetar/shamir.go + shamir_test.go --- legacy byte-wise Shamir helpers; the THBS-SE-internal subset lives in thbsse_field.go.
• ref/go/pkg/magnetar/dkg.go + dkg_test.go --- legacy DKG primitives; the leaderless PVSS-DKG path now lives in the sibling luxfi/threshold DKG package.
• ref/go/pkg/magnetar/e2e_test.go, fuzz_test.go, n1_byte_equality_test.go --- legacy tests tied to the deleted threshold path. Equivalent coverage lives in thbsse_test.go + kat_test.go::TestKAT_ThbsSe.
• ref/go/pkg/thbs/ (entire subtree) --- the legacy true-HBS threshold path including the dkg2/ PVSS skeleton.
• vectors/threshold-sign.json + vectors/dkg.json --- legacy KATs.
• jasmin/threshold/ + jasmin/lib/ --- legacy Jasmin model of the seed-recombine path. The v1.0 Jasmin scope (single-party SLH-DSA via formosa-crypto libjade upstream when it lands) is documented in jasmin/README.md.
• proofs/easycrypt/ (entire tree) --- legacy EasyCrypt theories modeling the deleted combine.go / threshold.go. The v1.0 proof track (proofs/README.md) ports to the THBS-SE construction shape in v1.1.
• ct/dudect/ (entire tree) --- legacy dudect harness over the deleted Combine / Verify API surfaces. The v1.0 CT story is "inherit CIRCL"; the v1.1 harness lands alongside the strict-atom-assembly path.

Verification

cd ref/go && GOWORK=off go build ./... && GOWORK=off go test -count=1 -short -timeout 600s ./pkg/magnetar/...

The 8 test gates pass at -count=1 -short -race. The BenchmarkThbsSE_Sign_5of7/Magnetar-SHAKE-192f benchmark clocks at < 100 ms/op on Apple M1 Max.

[Unreleased]

(Nothing pending at this writing.)

[0.5.0] — 2026-05-21 — Per-validator standalone is the primary public-BFT primitive; THBS demoted to TEE-only

Architectural decomplecting (HONEST framing)

This release re-architects Magnetar for public-BFT-safety. The previous v0.4.x messaging conflated two distinct trust models: threshold-HBS (custody, requires dealer/aggregator-in-TCB) and N-of-N collected signatures (public-BFT, no TCB). v0.5.0 ships the canonical separation:

• PRIMARY public-BFT primitive: per-validator standalone SLH-DSA via magnetar.PerValidatorKeypair + magnetar.ValidatorSign + magnetar.VerifyAggregateCert (ref/go/pkg/magnetar/standalone.go). Per-validator keypair, no DKG, no dealer, no aggregator-in-TCB. The consensus layer collects N validator signatures and counts valid signers; the quorum policy decision lives at the consumer. Z-Chain Groth16 rollup compresses N × |σ| to ~192 bytes.
• CUSTODY (TEE required): magnetar.CombineWithSeedReconstruction (reveal-and-aggregate) OR thbs.DealerDKG + thbs.SignShare + thbs.Aggregate (true threshold HBS). The dealer / aggregator is in the TCB by policy — both REQUIRE TEE attestation.
• RESEARCH (v0.6+): thbs/dkg2/ skeleton ships the PVSS layer; MPC-root layer is OPEN RESEARCH tracked at BLOCKERS.md::MAGNETAR-PUBLIC-DKG-1.

The honest architectural truth: SLH-DSA is hash-based and has no algebraic structure that admits FROST-style threshold aggregation (Cozzo-Smart EUROCRYPT 2019; Bonte-Smart-Tan 2023; NIST IR 8214). True-threshold SLH-DSA without TEE/dealer requires full MPC over the SHA-256/SHAKE hash tree — research-grade. For Lux's PUBLIC-BFT consensus, per-validator standalone is the right primitive; for M-Chain custody (where a TEE-attested host can be in the TCB by policy), the threshold form is correct.

Added

• ref/go/pkg/magnetar/standalone.go — the public-BFT-safe PRIMARY primitive surface:
  • PerValidatorKeypair(params, rng) → (sk, pk, error) — standalone FIPS 205 keypair generator. Semantic alias for GenerateValidatorKey; explicit name for the public-BFT path.
  • ValidatorSign(sk, rng, message) → ([]byte, error) — canonical public-BFT signing primitive. Returns raw FIPS 205 signature bytes. Deterministic when rng is nil (FIPS 205 SignDeterministic).
  • ValidatorBatchVerify(params, pubs, msgs, sigs) → ([]bool, error) — parallel-CPU batch verify returning per-signer bitmap. Routes through the same goroutine fork-join pattern as luxfi/crypto/slhdsa.VerifyBatch.
  • ValidatorAggregateCert{Mode, Signers, PubKeys, Sigs} — parallel-slices wire envelope for N per-validator signatures over a single message. Sibling shape to AggregatedSignature (aggregate.go) but maps directly to Z-Chain Groth16 rollup witness layout.
  • BuildAggregateCert(params, signers, pubKeys, sigs) — constructor with shape + mode validation and defensive copies.
  • VerifyAggregateCert(cert, message, knownValidators) → (count, err) — verifies every signature against the registered public key and returns the count of valid signers. Unknown / pubkey- mismatched signers are counted as INVALID (not fatal — defense against impersonation that does not abort the entire batch).
• ref/go/pkg/magnetar/standalone_test.go — 7 tests covering round-trip + determinism + independence, parallel batch verify, bad-sig-counted-out, unknown-validator rejection, duplicate-validator dedupe-and-count-once, GPU/parallel provenance assertion, all-invalid returns-zero, and shape checks.
• ref/go/pkg/thbs/dkg2/ — research-grade SKELETON of a public DKG for threshold HBS. v1 ships the PVSS layer; the MPC-root layer is OPEN RESEARCH tracked at BLOCKERS.md::MAGNETAR-PUBLIC-DKG-1. Files:
  • doc.go — package doc, scope, literature (Schoenmakers PVSS, Damgård-Pastro-Smart-Zakarias SPDZ, Boyle-Gilboa-Ishai FSS, Wang-Ranellucci-Katz MPC).
  • pvss.go — Deal / Verify wire shape with ErrSkeletonOnly / ErrMPCRootNotImpl sentinels preventing production consumption.
  • complaint.go — Complaint round wire shape (BadShare, MissingDelivery, CommitmentMalformed) + dealer Defense.
  • consensus.go — qualified-set agreement + Run orchestrator + RootMPC stub. Every public function returns ErrSkeletonOnly or ErrMPCRootNotImpl.
  • README.md — public-facing scope, literature, v0.6+ checklist.
  • dkg2_test.go — sentinel-pinning tests.
• BLOCKERS.md::MAGNETAR-PUBLIC-DKG-1 — open-research entry for public DKG over HBS. PVSS skeleton shipped; MPC-root layer open. 9-step v0.6+ checklist.

Changed

• ref/go/pkg/thbs/thbs.go — package doc rewritten to honestly demote the threshold form to "DEALER-BACKED v1 — NOT public-BFT- safe". Directs callers to magnetar.ValidatorSign for public BFT and to thbs.DealerDKG only for M-Chain custody where the dealer is in the TCB by TEE attestation. Cites the BLOCKERS.md::MAGNETAR-PUBLIC-DKG-1 research path.
• ref/go/pkg/thbs/dealer.go — renamed DKG → DealerDKG and DKGAll → DealerDKGAll. The function bodies are unchanged; the rename honestly reflects that v1 has a dealer. Callers in thbs_test.go updated. DKGConfig / DKGOptions retained (config struct shape applies to both v1 dealer and a future v2 public DKG).
• DEPLOYMENT-RUNBOOK.md §0 — rewritten to direct PUBLIC BFT CONSENSUS users to magnetar.ValidatorSign + magnetar.VerifyAggregateCert as the primary primitive; demotes CombineWithSeedReconstruction and thbs.DealerDKG to the M-Chain custody / TEE-attested path; cites thbs/dkg2/ as the v0.6+ research path. New §9 documents the ValidatorSign/VerifyAggregateCert primary primitive in detail.
• BLOCKERS.md — header updated to v0.5.0 framing; new MAGNETAR-PUBLIC-DKG-1 research entry.

Honest framing

• The threshold form of Magnetar (both CombineWithSeedReconstruction and thbs.DealerDKG) is FUNDAMENTALLY not public-BFT-safe. This is not a Magnetar choice; it is a property of hash-based signatures. The literature is clear (Cozzo-Smart, Bonte-Smart-Tan, NIST IR 8214). The honest fix is the architectural pivot in v0.5.0: use the threshold form for custody (where TEE attestation puts the dealer/aggregator in the TCB by policy) and use per-validator standalone for public consensus.
• The Lux consensus stack ALREADY does the right thing for ML-DSA via QuasarCert.MLDSAProof (per-validator standalone ML-DSA signatures collected into a multi-signer cert). The ValidatorSign + VerifyAggregateCert API makes the same pattern explicit and canonical for SLH-DSA.
• The thbs/dkg2/ skeleton is honestly research-grade. It exists to make the v0.6+ research direction concrete without pretending to ship a working public DKG. Every function returns a sentinel error pointing at the BLOCKERS entry. A production caller CANNOT accidentally consume the unfinished pipeline.

[0.4.2] — 2026-05-21 — THBS v1 + Public-BFT-safe aggregate-signatures API

This release introduces TWO new signing modes:

1. THBS v1 — true threshold hash-based signatures (McGrew et al.): parties hold secret-shared FORS/WOTS+ elements; for each message they release shares ONLY for the SELECTED elements; combiner reconstructs the final signature; verifier sees an ordinary HBS-style signature. No aggregator-as-TCB. Dealer-backed v1; public DKG = v2; FIPS 205 wire-compatibility = v3.
2. Aggregate-signatures mode — public-BFT-safe N-of-N collected signatures (each validator holds its own keypair). This was the originally-planned content of v0.4.2.

Added

• pkg/thbs/ — TRUE threshold hash-based signatures (McGrew, Fluhrer, Gazdag, Kampanakis, Morton, Westerbaan, IACR ePrint 2019/793 / IRTF draft-mcgrew-hash-sigs). Subpackage layout:
  • thbs.go — types per the user-spec API shape (DKGConfig, PublicKey, PrivateShare, PartialSignature, FinalSignature, Evidence, EquivocationError).
  • dealer.go — v1 dealer-backed DKG. The dealer Shamir-shares each secret WOTS+ chain head and each FORS secret leaf across the committee via per-byte GF(257). Dealer seed is zeroised before return. v2 will replace with public DKG.
  • wots.go — WOTS+ primitive (Winternitz w=16, FIPS 205-style base-w digit + checksum decomposition; hash chains under cSHAKE-256 with domain-separated slot/chain/position binding).
  • fors.go — FORS primitive (k subtrees, height a, per-leaf binary Merkle paths).
  • tree.go — top-level public Merkle tree over WOTS+ leaf-roots (XMSS-style; v1 single tree, v3 will hypertree).
  • slot.go — anti-equivocation slot guard. Each (party, slot) used at most once; same-slot-different-digest emits Evidence.
  • sign.go — SignShare + Aggregate + Verify. SignShare releases shares for ONLY the selected elements (WOTSChains chain heads + FORSK FORS leaves). Aggregate Lagrange-reconstructs the selected elements (per-element, never a seed). Verify reproduces the public Merkle root from the assembled HBS-style signature.
  • shamir.go — per-byte Shamir over GF(257) tuned for THBS: elements (not seeds) are shared, byte-equal reconstruction is guaranteed because each byte is in [0, 256).
  • hash.go — cSHAKE-256 with the "Magnetar-THBS" function name and per-tag domain separation (chain, leaf, fors-node, share-MAC, dealer-PRF, etc.).
  • thbs_test.go — 24 unit tests pinning every invariant the spec requires: TestTHBS_DKG_NoSeedExposure, TestTHBS_WOTS_ReconstructsOnlySelectedChainValues, TestTHBS_FORS_ReconstructsOnlySelectedLeaves, TestTHBS_Aggregate_FinalSignatureVerifies, TestTHBS_Aggregate_NoFutureSigningMaterial, TestTHBS_AntiEquivocation_DetectsDoubleSign, TestTHBS_Threshold_TminusOne_Fails, TestTHBS_Threshold_T_Succeeds, TestTHBS_DifferentQuorumsSameSignature, TestTHBS_RejectsTamperedShare, TestTHBS_RejectsCrossSlotShare, TestTHBS_RejectsInconsistentDigest, TestTHBS_RejectsWrongMessageVerify, plus 11 supporting tests.
• THBS-SPEC.md — honest v1 scope (dealer-backed, helper data, custom HBS verifier), the v2 (public DKG) and v3 (FIPS 205 byte-compatibility) roadmaps, and the McGrew et al. citation.
• pkg/magnetar/aggregate.go — public-BFT-safe N-of-N collected-signatures API. Each validator holds its OWN SLH-DSA keypair (no DKG, no shared seed). Construction primitives:
  • GenerateValidatorKey(params, rng) → (sk, pk) — per-validator standalone keypair.
  • SignBundle(params, sk, validatorID, msg) → *SignedBundle — single-validator sign producing a wire envelope.
  • VerifyBundle(params, bundle, msg) → bool — single-validator verify against the embedded public key.
  • AggregateSignatures(params, bundles, msg) → *AggregatedSignature — collects N bundles, dedupes by ValidatorID, shape-checks.
  • VerifyAggregated(params, agg, knownValidators) → (count, err) — per-bundle verify with parallel-CPU dispatch; returns the count of valid signers (policy decision lives at the consumer).
  • Parallel-CPU dispatch mirrors luxfi/crypto/slhdsa.VerifyBatch goroutine fork-join pattern. LastVerifyAggregatedTier() exposes the dispatch provenance for the BatchVerify test.
• pkg/magnetar/aggregate_test.go — 10 tests covering single- validator round-trip, 5-of-5 aggregation, bad-signature-counted- out (not fatal), unknown-validator rejection, duplicate-validator dedupe, pubkey-mismatch rejection, BatchVerify provenance (asserts parallel-CPU dispatch on a 5-bundle batch), empty-bundle / shape- check fail-fast cases, and per-validator key independence.

Changed

• pkg/magnetar/combine.go — Combine renamed to CombineWithSeedReconstruction to make the TEE requirement explicit in the API. Docstring updated to scream "REQUIRES TEE for public deployment. NOT public-BFT-safe. For public BFT, use AggregateSignatures." The function's existing implementation is preserved byte-for-byte (used by M-Chain custody where TEE is in the TCB; KAT byte-equality is preserved). File header cites Cozzo-Smart 2019 / Bonte-Smart-Tan 2023 / FIPS 205 §6 as the impossibility argument that motivates the rename.
• All in-package call sites — e2e_test.go, threshold_test.go, n1_byte_equality_test.go, fuzz_test.go, ref/go/cmd/genkat/main.go, ct/dudect/combine_ct.go — updated to the new name. KAT vectors are byte-identical (the function body did not change).
• pkg/magnetar/doc.go — package docstring rewritten to lead with the two-mode chooser and explain the impossibility argument for why CombineWithSeedReconstruction requires TEE.
• DEPLOYMENT-RUNBOOK.md — added §0 "Choose your mode" decision tree and §10 "Public-BFT aggregate mode" documenting the new API. §1 retitled to scope the v0.1 reveal-and-aggregate caveat explicitly to CombineWithSeedReconstruction.

Why this matters

SLH-DSA (FIPS 205) is hash-based — WOTS+, FORS, and Merkle hypertrees over a secret seed. The literature (Cozzo-Smart 2019, Bonte-Smart-Tan 2023, NIST IR 8214) establishes that there is no efficient threshold MPC that produces a single FIPS 205-shaped signature without reconstructing the master seed. The Magnetar v0.1 CombineWithSeedReconstruction path embraces this: byte-equality with single-party FIPS 205 is the headline N1 claim, but the cost is that the aggregator host is in the TCB for the brief seed-reconstruction window.

For Lux's public-BFT validator quorum, that TCB requirement is too strong — no individual validator host should be trusted with the group seed. The AggregateSignatures path is the honest SOTA answer: each validator signs independently, the consensus layer collects N signatures, verification iterates per-signer. Wire size grows linearly with N (compressible via a Z-Chain Groth16 rollup to ~192 bytes, a separate primitive). This release does not change the custody story — M-Chain mpcvm in TEE-attested mode continues to use CombineWithSeedReconstruction. It adds the public-BFT path that was previously missing.

[0.3.0] — 2026-05-18 — Tier A documentation shape complete

The full 12-document Tier A submission package shape now ships, mirroring Pulsar's structure. Internal cryptographer sign-off landed (APPROVED WITH GATES). Submission orchestration scripts landed.

Added

• SUBMISSION.md — NIST MPTC cover sheet. Headline N1 claim: Magnetar threshold signatures are byte-identical to single-party FIPS 205 slhdsa.SignDeterministic on the reconstructed master seed. Honest delta vs Pulsar (no EC/Lean/Jasmin yet for the threshold overlay).
• NIST-SUBMISSION.md — one-page executive summary mapped to NIST IR 8214C requirements.
• PATENTS.md — royalty-free patent grant + defensive termination. Defensive scope extends to FIPS 205, FIPS 204, FIPS 203, successors. Claims limited to Magnetar-novel lifecycle additions.
• PROOF-CLAIMS.md — narrow Class-N1 byte-equality claim; §3 enumerates 7 explicit non-claims (mechanized refinement of threshold overlay, post-quantum hardness beyond FIPS 205, byte-equality with FIPS 204/R-LWE, dudect statistical CT, covert channels, protocol-level adversarial robustness beyond reveal-and-aggregate, external Lean theorems).
• AXIOM-INVENTORY.md — construction-level + implementation-level axioms with closure plans for the proof-tier roadmap.
• FIPS-TRACEABILITY.md — FIPS 205 §10.1/10.2/10.3 → code map. FIPS 202 + SP 800-185 cSHAKE256/KMAC256 customisation tags pinned in transcript.go. Threshold overlay traces to SPEC.md §3/§4/§6.
• TRUSTED-COMPUTING-BASE.md — implementation TCB inventory. cloudflare/circl/sign/slhdsa at the single-party FIPS 205 layer. Aggregator process in TCB for the brief seed-reconstruction window (v0.1 reveal-and-aggregate caveat). Comparison vs Pulsar and Corona.
• CRYPTOGRAPHER-SIGN-OFF.md — internal cryptographer agent review. Conducted by direct reading of all 12 production Go source files + test surface; verified build + vet + tests + coverage (76.8%). Verdict: APPROVED WITH GATES. Five open gates: GATE-1 (EC theory shells, v0.5.0), GATE-2 (Lean ↔ EC bridge, v0.5.0), GATE-3 (dudect 10⁹ samples, v0.6.0), GATE-4 (external audit, v0.6.0), GATE-5 (v0.4 lifecycle additions).
• scripts/cut-submission.sh — 8-step tarball cut. Verifies clean tree + branch=main, runs high-assurance gate, regenerates KATs via ref/go/cmd/genkat and verifies byte-identical with committed vectors/*.json, runs core tests, tars (excluding .git / .claude / bench/results), SHA-256s, tags. Idempotent (refuses tag/tarball re-cut unless --force). Dry-run mode for review.
• scripts/check-high-assurance.sh — per-push gate. Runs go build + go vet + secret-log grep + short test suite. HONEST about absent gates (no EC/Lean/Jasmin theories for threshold overlay; libjade covers FIPS 205 single-party but is not redistributed). Honest scope documented in the script header.

Changed

• README.md — flipped status to "Tier A documentation shape complete". Updated "What v0.3.0 ships" / "does NOT yet ship" to reflect the closed BLK-5/BLK-8 + the open gates per CRYPTOGRAPHER-SIGN-OFF.md.
• SUBMISSION-STATUS.md — promoted to Tier A documentation shape; Phase 4 (submission package) marked CLOSED for doc shape; Phase 5 (cryptographer review) marked PARTIAL (internal v0.3.0, external roadmap v0.6.0).
• BLOCKERS.md — closed BLK-8 (submission package documentation shape) at v0.3.0; partially closed BLK-9 (internal review landed; external roadmap v0.6.0). BLK-4 / BLK-6 / BLK-7 remain open.

Honesty notes

• The five open gates in CRYPTOGRAPHER-SIGN-OFF.md are documentation + formal-methods + measurement + lifecycle gates; none requires an algorithm or code change at v0.3.0.
• PROOF-CLAIMS.md §3 enumerates 7 explicit non-claims; this is the honest disclosure that the submission package surfaces to NIST reviewers.
• EC theory shells, Lean ↔ EC bridges, and Jasmin sources for the threshold overlay are NOT in this submission. Pulsar at v1.0.7 has 13/13 EC files compiling with admit 0/0; Magnetar's comparable closure is roadmap v0.5.0 with cross-citation to Pulsar's GF(257) Shamir / Lagrange bridges as the closure plan.

[0.2.0] — 2026-05-18 — Tier B: production library + submission scaffold

First production-library release. Implements v0.1 reveal-and-aggregate threshold SLH-DSA over FIPS 205 with KAT-deterministic vectors and the honest trust-model disclosure.

Added

• ref/go/pkg/magnetar/ — production Go reference implementation (~2186 LOC). Single-party + DKG + threshold-sign + Combine over the SLH-DSA scheme seed. Three FIPS 205 parameter sets: SHAKE-192s (recommended, NIST PQ Cat 3), SHAKE-192f (Cat 3 fast), SHAKE-256s (Cat 5).
• ref/go/cmd/genkat — deterministic KAT generator. Produces byte-stable JSON output at five profiles (keygen, sign, verify, threshold-sign, dkg). Re-running on a clean checkout produces byte-identical vectors.
• vectors/{keygen,sign,verify,threshold-sign,dkg}.json — committed KAT vectors. KAT replay tests (kat_test.go) validate the package implementation reproduces every entry verbatim.
• n1_byte_equality_test.go — empirical N1 byte-equality harness. Threshold-Combine output byte-identical to centralized FIPS 205 slhdsa.SignDeterministic on the reconstructed master seed. Tested at (3,2), (5,3), (7,4) committee/threshold configurations.
• SPEC.md — construction specification: notation, hash domain separation, DKG protocol, threshold signing, Class-N1-analog byte-equality claim, trust model, identifiable abort, parameter sets.
• DEPLOYMENT-RUNBOOK.md — operator-facing trust-model disclosure. v0.1 reveal-and-aggregate aggregator-as-TCB caveat documented with TEE / mlock / ptrace-off hardening matrix.
• BLOCKERS.md — Tier B → A path enumeration (9 blockers, 3 closed at v0.2.0).
• SUBMISSION-STATUS.md — NIST MPTC submission status; phased plan to submission-readiness.
• README.md — repo purpose + status (v0.2.0 = Tier B).

Closed (Tier C → Tier B)

• BLK-1: construction selected (v0.1 reveal-and-aggregate over the SLH-DSA scheme seed; mirrors Pulsar's v0.1 pattern).
• BLK-2: academic basis (Shamir 1979 + reveal-and-aggregate industry pattern; open citation gap noted).
• BLK-3: spec defined (SPEC.md).
• BLK-5: KAT vectors shipped + deterministic regeneration.

Honesty notes

• The v0.1 reveal-and-aggregate trust caveat: the aggregator process holds the reconstructed master SLH-DSA scheme seed in memory for the duration of one Combine call. Same trust model as Pulsar v0.1; documented honestly in DEPLOYMENT-RUNBOOK.md with the TEE / mlock / ptrace-off hardening matrix.
• v0.1 DKG envelopes are plaintext (KAT-deterministic). A passive network observer can collect shares. v0.4 closes this channel with ML-KEM-768 envelope wrapping (matching Pulsar CR-8).

[0.1.0] — 2026-05-18 — Tier C: research-stage

Initial Magnetar research-stage commit.

Added

• DESIGN.md — initial design notes for threshold SLH-DSA.
• README.md — research-stage status.
• LICENSE — BSD-3-Clause.

---

Footer

This CHANGELOG covers the Magnetar library + NIST MPTC submission package. Sibling submissions:

• luxfi/pulsar — M-LWE threshold ML-DSA-65 (FIPS 204 byte-equal), Tier A reference at v1.0.7.
• luxfi/corona — R-LWE threshold signature (Boschini ePrint 2024/1113), Tier A documentation shape at v0.6.0.