mirror of
https://github.com/luxfi/magnetar.git
synced 2026-07-27 02:53:47 +00:00
Hanzo AI
35d79c2d8a
Canonical wire codec for Signature and PublicKey (group public key on
the wire) plus stateless VerifyBytes / VerifyBytesCtx, mirroring the
pulsar PULS/PULG and corona CORS/CORG patterns. Closes the audit gap
that left magnetar without a stable wire surface that independent
verifiers (other mpcd, bridge nodes, L1 verifier contracts) could
consume.
Wire frame layout (big-endian throughout):
Signature: 'M' 'A' 'G' 'S' || ver(2) || mode(1) || len(4) || FIPS-205 sig
GroupKey: 'M' 'A' 'G' 'G' || ver(2) || mode(1) || len(4) || FIPS-205 pk
Magic distinct from PULS/PULG (0x50554C53/47) and CORS/CORG
(0x434F5253/47). 11-byte fixed header. Bounded length-prefix:
declared length is pinned to the canonical FIPS 205 size for the mode
BEFORE allocation, so a malformed header can never trigger an
oversized allocation. Trailing-bytes policy is STRICT — exactly one
well-formed encoding of any (mode, bytes) pair exists.
Class N1 analog property: the MAGS payload IS the FIPS 205 sigEncode
output verbatim; the MAGG payload IS the FIPS 205 (PK.seed || PK.root)
bytes verbatim. Stripping the 11-byte header recovers bytes that
cloudflare/circl's slhdsa.Verify accepts with no magnetar code path
on the verifier side. TestMagnetar_Wire_FIPS205Verifiable pins this
across all three magnetar modes (SHAKE-192s / -192f / -256s) by
signing via the v0.5 per-validator standalone primary primitive
(PerValidatorKeypair + ValidatorSign with rng=nil → FIPS 205
SignDeterministic) and verifying via cloudflare/circl directly.
Tests added (wire_test.go, 47 sub-cases total):
- TestMagnetar_Wire_Roundtrip — byte-equal sig roundtrip x3 modes
- TestMagnetar_Wire_GroupKeyRoundtrip — symmetric pk roundtrip
- TestMagnetar_Wire_FIPS205Verifiable — HEADLINE byte-identity claim
- TestMagnetar_Wire_RejectMalformed — 12 negative paths including
cross-protocol PULS / CORS magic rejection
- TestMagnetar_Wire_RejectTrailingBytes — strict canonical
- TestMagnetar_Wire_GroupKeyRejectMalformed — symmetric GK negatives
including cross-protocol PULG / CORG magic rejection
- TestMagnetar_Wire_RejectCrossWire — feeds full-shape pulsar/corona
frames into magnetar parser, asserts ErrWireMagicMismatch
- TestMagnetar_Wire_VerifyBytes_RejectsCrossSlot — sig-slot vs
gk-slot domain separation in the stateless verifier
- TestMagnetar_Wire_ModeMismatch_Rejected — gk Mode != sig Mode
must produce false (M256s gk + M192s sig combination)
- TestMagnetar_Wire_MarshalSafetyChecks — nil + bad-length emit
- TestMagnetar_Wire_VerifyBytesCtx_RoundTrip — ctx-aware path used
by the EVM precompile slot binding
Suite is GREEN under -count=1 (10.5 s) and -race (4 min). No
backwards compatibility — wire format is canonical from v0.5.1
forward. Version-bump rule documented in wire.go header.