mirror of https://github.com/luxfi/magnetar.git synced 2026-07-27 02:53:47 +00:00

Files

T

Antje Worring df4c537c16 magnetar: remove proof-by-rename + circular proofs; honest threshold status

True no-reconstruction threshold SLH-DSA is impossible in the no-dealer /
no-preprocessing model a public, leaderless, permissionless chain needs
(Kondi-Kumar-Vanegas: extractable hash-based signatures cannot be thresholded
by black-box hash use). Stop pretending otherwise.

De-cheat:
  - DELETE the circular/vacuous proofs that manufactured false assurance:
    Magnetar_N1_Atom_Refinement.ec, Magnetar_N1_SHAKE_Expand.ec,
    Magnetar_N4_KeyDeriveStable.ec, lemmas/{Magnetar_CT,SLHDSA_Functional}.ec.
    The headline "strict-atom byte-equality" theorem was `apply <axiom that
    restates the theorem>`; the Lean side was `sorry`/`:= True`.
  - Re-open MAGNETAR-STRICT-ATOM (BLOCKERS): the public combiner DOES
    reconstruct the full FIPS 205 master every signature; the v1.1 "closure"
    only renamed identifiers. PROOF-CLAIMS / AXIOM-INVENTORY / TCB docs now say
    what the code does.
  - Re-label the name-grep "strict-atom" / "CT" checks as identifier-hygiene
    lint, NOT security or constant-time properties.
  - PVSS-DKG open-reveal (publishes the master to any observer) is gated as a
    TEST-ONLY path with HONEST LIMITATIONS; production does not rely on it.
  - Remove dead htRootCompute; staticcheck clean.

Honest three-leg posture (SPEC 1.0, BLOCKERS):
  - Permissionless production = INDEPENDENT FIPS 205 sigs + the weighted quorum
    certificate (luxfi/consensus), optionally STARK/FRI-compressed (luxfi/p3q).
    No key sharing, no reconstruction.
  - Trusted-hardware custody = TEE-attested combiner (trust-relocation, NOT MPC).
  - THBS-SE = RESEARCH-ONLY (transient seed reconstruction at the combiner);
    the T-SLH-DSA-MPC track (MPC over SHAKE) is the other research escape hatch.

Tests green (CGO=1, 71s). Net -923 lines.

2026-06-21 13:06:57 -07:00

3.8 KiB

Raw Blame History

Magnetar THBS-SE Combine: what the assemble path actually does

This document used to be the "load-bearing prose statement of the strict-atom discipline that closes MAGNETAR-STRICT-ATOM-V11". That framing was wrong. MAGNETAR-STRICT-ATOM-V11 is NOT closed (see BLOCKERS.md). This document now states plainly what ref/go/pkg/magnetar/thbsse_assemble.go does.

The fact

assembleSignatureBytes RECONSTRUCTS the full FIPS 205 master at the public combiner, every signature:

It Lagrange-interpolates the t share envelopes byte-by-byte into a buffer derivedExpandInput.
It SHAKE-expands that into a single buffer derivedMaterial = skSeed || skPrf || pkSeed (FIPS 205 §10.1).
It drives a FIPS 205 §5--§8 signing walk that reads positional slices of derivedMaterial (the §5/§6/§7/§8 PRF input and the §11.2 PRF_msg key).

For the duration of one Sign call, the entire private key is resident in the combiner's process memory. The combiner is PUBLIC (any peer can run it), so this is a reconstruction at an untrusted party.

The "strict-atom" naming convention is not a security property

The earlier revision avoided the identifier seed (and skSeed, skPrf, ...) and routed access through closures over positional slices of derivedMaterial. It then claimed this "secures" something that a seed []byte local did not, and called it a discipline that "closes" the no-leak gap.

That is false. Renaming the buffer changes the spelling, not the data. derivedMaterial holds skSeed || skPrf || pkSeed exactly as a variable named seed would. A memory-disclosure adversary (coredump, /proc/self/mem, a compromised combiner process) observes the master during the Sign call either way. There is no confidentiality property to rely on, and the "strict-atom invariant" buys none.

This is a fundamental property of hash-based signatures, not a fixable implementation detail: there is no algebraic structure to aggregate, so producing one FIPS 205-shaped signature from shares requires either reconstructing the seed at some party (this path) or full MPC over the SHAKE hash tree (open research; multi-second, multi-megabyte per signature). See standalone.go's banner for the literature (Cozzo-Smart 2019, Bonte-Smart-Tan 2023, NIST IR 8214).

What the path actually gives

ONE property, and it is a CORRECTNESS/INTEROP property, not a confidentiality one:

The emitted signature is byte-identical to circl/slhdsa.SignDeterministic on the reconstructed master, so any unmodified FIPS 205 verifier accepts it.

Pinned by TestSlhdsaInternal_ByteEqualToCirclSign and TestThbsSE_StrictAtom_Combine_ByteIdentityToCircl.

The scratch buffers (prfAbsorb, prfMsgAbsorb) and the derived buffers (derivedExpandInput, derivedMaterial) are zeroized after use. That is defense-in-depth against lingering heap copies, NOT a guarantee the master was never resident — it was.

Deployment positioning (see BLOCKERS.md and the product decision)

Permissionless THBS-SE (this path): RESEARCH-GRADE. Master is reconstructed at an untrusted public combiner. Do not present as production or as "no host in the TCB at sign time".
Production default: per-validator standalone (standalone.go) — N independent FIPS 205 signatures, no reconstruction anywhere.
Opt-in trusted-hardware: the TEE-attested combiner pool in luxfi/threshold/protocols/slhdsa-tee. That relocates the reconstruction into a measured enclave; it ADDS a host to the TCB (trust-relocation), it is not MPC.

The lint

TestThbsSE_AssembleIdentHygiene (Go) and scripts/checks/strict-atom-ast.sh are an IDENTIFIER-HYGIENE LINT over thbsse_assemble.go. They assert no variable is spelled seed/skSeed/... . That is a style/naming check. It is not, and does not claim to be, a no-leak proof.

3.8 KiB Raw Blame History