LP-4540: Magnetar — Threshold Hash-Based Signatures (FIPS-205 SLH-DSA)

Implementation status (code-audited 2026-07-03): SHIPPED (Track A) magnetar/SPEC.md: Track A is a stake-weighted quorum of INDEPENDENT stock FIPS-205 signers (not a threshold key); Track B (true threshold SLH-DSA) is fail-closed and not enabled.

Abstract

Magnetar is the hash-based signature leg of the Lux post-quantum stack. Its whole reason to exist is assumption diversity: Corona (LP-4440) and Pulsar (LP-4450) are both Module-LWE, so they share a single lattice hardness assumption — a break in Module-LWE would take both down at once. Magnetar rests only on the collision / preimage resistance of a hash function (FIPS-205 SLH-DSA), a genuinely different, non-lattice assumption. If lattices fall, Magnetar still stands.

Magnetar ships in two tracks with very different maturity:

Track A (production) — a stake-weighted quorum of independent stock SLH-DSA signers. Not a threshold key; no shared secret, no dealer, no DKG. This is the deployable lane.
Track B (research, fail-closed) — a true no-reconstruct t-of-n threshold SLH-DSA key. Unproven; refuses to run until the open obstruction is resolved.

Motivation — why a hash-based leg at all

A post-quantum certificate that leans on one hardness assumption is one cryptanalytic result away from failure. The Lux cert profiles therefore compose assumption-diverse legs. Corona and Pulsar give lattice coverage; Magnetar adds a leg whose security reduces to hashing alone. Because SLH-DSA (FIPS-205) is the most conservative NIST PQ signature — no algebraic structure, no new number-theoretic assumption — it is the natural diversifier at the maximum cert profile.

Intuition — why threshold SLH-DSA is hard

Lattice signatures (ML-DSA, Pulsar, Corona) admit linear-secret-sharing threshold variants because the secret enters signing linearly over a ring — a party's contribution is an additive share of a ring element, and shares sum. Hash-based signatures have no such homomorphism: signing consumes one-time WOTS⁺ / few-time FORS secret material, and the verifier only checks that the opened one-time material hashes up to the single published PK.root. There is no ring in which to add shares.

One structural fact makes any distributed construction possible at all: FIPS-205 verification never recomputes the PRF-of-seed a single-party signer uses to derive its leaf secrets — it only checks opened one-time material against PK.root. So the leaf secrets may be jointly-random rather than PRF-images, which is exactly what a distributed leaf-opening approach exploits.

Track A — weighted quorum of independent signers (production)

Track A is trustless and available today. It is not a threshold key.

Each validator holds its own SLH-DSA key and produces its own ordinary FIPS-205 signature over the finalized message.
A MagnetarQuorumCert aggregates a stake-weighted set of these independent signatures, binding them to the validator-set / committee root. Acceptance requires a weighted quorum whose signatures each verify under stock, unmodified FIPS-205 verify.
No pairings, no KZG, no trusted setup, no classical-DLOG commitment — the whole path stays inside the strict-PQ profile (ForbidPairings, ForbidKZG, ForbidTrustedSetup all hold). Every assumption is post-quantum.

Track A is admitted at the PQ-heavy / maximum cert profile as a rollup / weighted quorum only — never as a threshold key. Security reduces directly to (i) SLH-DSA EUF-CMA for each independent signer (FIPS-205), and (ii) the stake-weight quorum rule of the consensus layer. There is no additional cryptographic assumption beyond the hash.

Track B — true no-reconstruct threshold SLH-DSA (research, fail-closed)

Track B is a genuine t-of-n threshold SLH-DSA key with no reconstruction of a master seed at any point. It is research, not a production lane, and MUST remain fail-closed until proven.

Built and byte-exact today:

Distributed FORS-leaf opening — parties jointly open the FORS leaf material so the assembled signature is byte-identical to FIPS-205 forsSign output and verifies under stock Algorithm 17. The opening is leaf-width-only and forms no master seed.

The open obstruction:

Reducing the full stateless scheme to no-reconstruct turns it into a byzantine-safe distributed burn-state problem: WOTS⁺ is strictly one-time and FORS is few-time, so parties must jointly guarantee no one-time secret is ever reused across signings — without ever reconstructing the seed that would let them check locally. That distributed burn-state discipline, not the leaf opening, is the unsolved part.
A generic MPC-over-SHAKE construction (evaluating the FIPS-205 keyed hashes inside an MPC) is possible in principle but astronomically expensive (~10¹¹ gates) — meaningful only as a maximum-assurance fallback, not a deployable lane.
The buildable no-reconstruct alternative is stateful hash-based signatures (XMSS^MT / LMS), which trade statelessness for tractable distributed state.

Fail-closed contract: SignNoReconstruct returns ErrNoReconstructUnproven, NoReconstructProven() returns false, and Magnetar admission at the PQ-heavy profile refuses any Track-B threshold cert. Only Track A is admitted.

Security

Track A:

Each signature: SLH-DSA EUF-CMA under FIPS-205 (hash-based, no group-theoretic assumption).
Quorum: the stake-weighted quorum rule of the consensus layer.
No additional cryptographic assumption. Fully post-quantum, and assumption-disjoint from the Module-LWE legs (Corona / Pulsar).

Track B (unproven, research):

Distributed FORS-leaf opening reduces to FORS few-time unforgeability (FIPS-205 §7) plus a distributed protocol that never forms the master seed.
The full stateless scheme additionally requires a byzantine-safe distributed burn-state guarantee for WOTS⁺ one-time material (FIPS-205 §6.1) — not proven; the reason Track B is fail-closed.

Composition with the rest of the stack

Cert profiles — Magnetar is the hash leg admitted at the PQ-heavy / maximum profile alongside the lattice legs (see the Aurora / Polaris cert-profile LPs). POLARIS_MAX = Beam ∧ Pulsar ∧ Corona ∧ Magnetar.
Quorum machinery — Quasar's scheme-generic WeightedQuorumCert already dispatches SLH-DSA to stock verify; the MagnetarQuorumCert (Track A) composes it plus a cross-family SLH-DSA-only gate.
Registry — registers through crypto/threshold.RegisterScheme next to the lattice legs; Track A adds no shared-secret state.

Precompile slot — OPEN (owner review)

FLAG — unresolved slot discrepancy. Two slot references exist for Magnetar and MUST be reconciled by the owner before this LP goes Final:

This LP / LP-0120 reserve a dedicated Magnetar precompile at 0x012207 (with the SLH-DSA-192f tier: signature ~35,664 B, verify ~1.92 ms, per LP-4520).

The prior Magnetar note (folded in from the legacy top-level LP-181) states Magnetar-verify reuses the single-party SLH-DSA verify precompile at 0x012203 per independent signature, with the quorum / weight logic running in the consensus acceptance rule (i.e. no dedicated Magnetar precompile).

These are contradictory. The canonical Lux PQ slot map elsewhere reads 0x012204 Pulsar, 0x012205 P3Q (kind-byte sig dispatch), 0x012206 Corona, 0x012220 starkfri. Resolution options: (a) Track A needs no new precompile — it verifies N independent sigs through the existing SLH-DSA verifier 0x012203, so 0x012207 is unnecessary and should be released; or (b) 0x012207 is retained for a batched Magnetar-quorum verifier. Do not treat either slot as canonical until the owner decides.

Reference implementation

SLH-DSA primitive: crypto/slhdsa (FIPS-205) — keys, sign, verify; GPU batch path crypto/slhdsa/gpu.go::VerifyBatchGPU.
Magnetar (Track A quorum + Track B research): slots into crypto/threshold/magnetar/, registered via crypto/threshold.RegisterScheme. No standalone magnetar/ package.
KAT vectors: pinned on first ceremony.

Relationship to other LPs

Foundation: LP-4700 (threshold model), LP-7103 (secret sharing).
Algorithm primitive: LP-4500 (SLH-DSA) + LP-4520 (SLH-DSA-192 tier).
Lattice siblings (assumption-diverse from Magnetar): Corona LP-4440, Pulsar LP-4450.
Cert profiles: Aurora / Polaris (see LP-4900 / LP-4910).

Open questions

Precompile slot (see FLAG above).
Track B: byzantine-safe distributed burn-state for WOTS⁺/FORS one-time material — the open obstruction. Until resolved, Track B stays fail-closed.

Provenance

Canonicalises the Magnetar concept in the 4xxx crypto range. The correct dual-track model (Track A weighted-quorum production lane; Track B no-reconstruct research, fail-closed) was folded in from the legacy top-level LP-181, which is now a supersession stub → this LP. The earlier "Public-DKG MPC threshold key" framing was inaccurate — a true threshold SLH-DSA key is exactly the fail-closed Track B, not the production path.

Magnetar — Threshold Hash-Based Signatures (FIPS-205 SLH-DSA)