mirror of
https://github.com/luxfi/magnetar.git
synced 2026-07-27 02:53:47 +00:00
Antje Worring
df4c537c16
True no-reconstruction threshold SLH-DSA is impossible in the no-dealer /
no-preprocessing model a public, leaderless, permissionless chain needs
(Kondi-Kumar-Vanegas: extractable hash-based signatures cannot be thresholded
by black-box hash use). Stop pretending otherwise.
De-cheat:
- DELETE the circular/vacuous proofs that manufactured false assurance:
Magnetar_N1_Atom_Refinement.ec, Magnetar_N1_SHAKE_Expand.ec,
Magnetar_N4_KeyDeriveStable.ec, lemmas/{Magnetar_CT,SLHDSA_Functional}.ec.
The headline "strict-atom byte-equality" theorem was `apply <axiom that
restates the theorem>`; the Lean side was `sorry`/`:= True`.
- Re-open MAGNETAR-STRICT-ATOM (BLOCKERS): the public combiner DOES
reconstruct the full FIPS 205 master every signature; the v1.1 "closure"
only renamed identifiers. PROOF-CLAIMS / AXIOM-INVENTORY / TCB docs now say
what the code does.
- Re-label the name-grep "strict-atom" / "CT" checks as identifier-hygiene
lint, NOT security or constant-time properties.
- PVSS-DKG open-reveal (publishes the master to any observer) is gated as a
TEST-ONLY path with HONEST LIMITATIONS; production does not rely on it.
- Remove dead htRootCompute; staticcheck clean.
Honest three-leg posture (SPEC 1.0, BLOCKERS):
- Permissionless production = INDEPENDENT FIPS 205 sigs + the weighted quorum
certificate (luxfi/consensus), optionally STARK/FRI-compressed (luxfi/p3q).
No key sharing, no reconstruction.
- Trusted-hardware custody = TEE-attested combiner (trust-relocation, NOT MPC).
- THBS-SE = RESEARCH-ONLY (transient seed reconstruction at the combiner);
the T-SLH-DSA-MPC track (MPC over SHAKE) is the other research escape hatch.
Tests green (CGO=1, 71s). Net -923 lines.
65 lines
4.7 KiB
Plaintext
65 lines
4.7 KiB
Plaintext
(* -------------------------------------------------------------------- *)
|
|
(* Magnetar --- PVSS-DKG setup *)
|
|
(* SCAFFOLD: 0 mechanized content. This file proves NOTHING. *)
|
|
(* -------------------------------------------------------------------- *)
|
|
(* *)
|
|
(* HONEST STATUS *)
|
|
(* ============ *)
|
|
(* *)
|
|
(* This file is a SCAFFOLD. The earlier revision declared three *)
|
|
(* "theorems": *)
|
|
(* *)
|
|
(* - pvss_dkg_secrecy --- conclusion `... true`, by `trivial`. *)
|
|
(* - pvss_dkg_correctness --- by `admit`. *)
|
|
(* - pvss_dkg_wire_compat --- conclusion `X = X`, by `trivial`. *)
|
|
(* - pvss_dkg_composition... --- conclusion `true`, by `trivial`. *)
|
|
(* *)
|
|
(* A lemma whose conclusion is `true` or `X = X` proves nothing about *)
|
|
(* the construction; `admit` discharges nothing. All have been removed. *)
|
|
(* *)
|
|
(* THE SECRECY CLAIM WAS NOT ONLY UNPROVEN --- IT WAS FALSE FOR THE *)
|
|
(* CODE AS WRITTEN *)
|
|
(* ------------------------------------------------------------------ *)
|
|
(* *)
|
|
(* The "secrecy theorem" asserted that an adversary controlling (t-1) *)
|
|
(* parties learns nothing about the master M = sum_i m_i. But the DKG *)
|
|
(* reference path (`pvss_dkg.go`) historically ran in OPEN-REVEAL mode: *)
|
|
(* `RunDKGSimulation` called `RevealMsg()` for EVERY party *)
|
|
(* unconditionally, and `RevealMsg()` publishes `PolyCoeffs[b][0] = *)
|
|
(* m_i[b]` --- the constant term, i.e. the contribution itself. With *)
|
|
(* every m_i public, M = sum_i m_i is reconstructible by ANY observer, *)
|
|
(* not merely by t-1 colluding insiders. A secrecy proof about code *)
|
|
(* that broadcasts the secret is meaningless. *)
|
|
(* *)
|
|
(* The production DKG default has since been changed to *)
|
|
(* COMPLAINT-CONDITIONAL reveal (`RunDKG`): a party publishes its *)
|
|
(* coefficients ONLY against a recorded complaint; an honest run emits *)
|
|
(* NO constant-term reveal. The open-reveal entry point is retained *)
|
|
(* behind a loud TEST-ONLY barrier (`RunDKGSimulationOpenReveal`) that *)
|
|
(* cannot be reached from the production constructor. See *)
|
|
(* `pvss_dkg.go` and `TestPVSS_DKG_ProductionTranscriptHidesMaster`. *)
|
|
(* *)
|
|
(* Even with the code fixed, the secrecy statement remains UNPROVEN *)
|
|
(* here: it reduces to byte-wise Shamir information-theoretic secrecy *)
|
|
(* over GF(257), which is a standard textbook result but is NOT *)
|
|
(* mechanized in this file (the prior `shamir_uniform_view` axiom did *)
|
|
(* not even constrain the constant term --- its body was a vacuous *)
|
|
(* existential). Mechanizing it is OPEN; tracked in PROOF-CLAIMS.md. *)
|
|
(* *)
|
|
(* WHAT HAS EMPIRICAL SUPPORT (Go tests, NOT proofs) *)
|
|
(* ------------------------------------------------ *)
|
|
(* *)
|
|
(* - Wire-compat between the dealerless and dealer share envelopes: *)
|
|
(* `TestPVSS_DKG_ByteCompatWithDealerPath`. *)
|
|
(* - t-1 corrupt parties cannot recover the master from their *)
|
|
(* partial-sum view (complaint-conditional path): *)
|
|
(* `TestPVSS_DKG_AdversarialReveals`. *)
|
|
(* - Production transcript does not reveal sum m_i: *)
|
|
(* `TestPVSS_DKG_ProductionTranscriptHidesMaster`. *)
|
|
(* *)
|
|
(* These are tests, not mechanized theorems. *)
|
|
(* *)
|
|
(* This file intentionally declares no `theorem`, no `lemma`, and no *)
|
|
(* `axiom`; its axiom/admit count is exactly ZERO. *)
|
|
(* -------------------------------------------------------------------- *)
|