aere-network/aere-docs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
main
aere-docs/AERE-STARK-CORE-ADVANCE-SUMMARY.md
Aere Network e4cead319d Initial public release 
Aere Network public source. Everything here can be checked against the live
chain (chain id 2800, https://rpc.aere.network).

Scope note, stated up front rather than buried: consensus on chain 2800 is
classical secp256k1 ECDSA QBFT. The post-quantum work in this repository is at
the signature, precompile, account and transport layers. Nothing here makes the
consensus post-quantum, and no document in it should be read as claiming so.
2026-07-20 01:01:36 +03:00

5.2 KiB
Raw Permalink Blame History

Spec 2: PQ STARK-verify precompile 0x0AE8 core (port spec + one validated sub-component)

Scope caveat (2026-07-19 finding). The port work here is conformance-confirmed against Plonky3 0.4.3-succinct (Aere's OWN BabyBear + FRI STARK stack), NOT against SP1 6.1.0. SP1 6.1.0 is a Hypercube release (KoalaBear multilinear: BaseFold + Jagged + sumcheck-zerocheck + LogUp-GKR), so FRI and DEEP-ALI do not apply to it and this skeleton does not verify SP1 6.1.0 proofs. The ~11-16 person-week estimate below is the cost of a BabyBear+FRI verifier; replacing the SP1 BN254 Groth16 wrap is a separate ~22 to 32 person-week retarget. See AERE-STARK-SP1-RECURSION-AIR-PORT-SPEC-SUMMARY.md.

Date: 2026-07-19. Task: advance the native PQ STARK-verify precompile 0x0AE8 honestly. The top-level verifier stays a fail-closed skeleton that verifies NOTHING; the deliverable is a detailed porting spec plus ONE genuinely-tractable, independently-tested sub-component.

Deliverables

  1. Porting spec: aerenew/docs/AERE-STARK-VERIFIER-PORT-SPEC.md (new). Component-by-component port plan, bottom-up dependency order: (a) BabyBear field p = 2^31 - 2^27 + 1 and F_{p^4} ~0.5 wk, low risk (pin W) (b) Poseidon2 over BabyBear (the hash) ~1.5-2 wk, error-prone constants (c) Merkle / FRI vector commitment (MMCS) ~1-1.5 wk (d) FRI folding + query-index derivation + LDT ~2-3 wk, hard (index slice done, see 2) (e) AIR eval + SP1 recursion vk binding ~3-4 wk, HARDEST (f) Fiat-Shamir transcript (Poseidon2 duplex) ~0.5-1 wk, pervasive Each has: what it does, interface, the test vectors that validate it + their source, effort estimate, hardest parts, and [VERIFY] flags. Total ~11-16 person-weeks (3-4 months + audit) for one specialist. Stated plainly as a multi-week port; hardest = (e) recursion AIR, then (d) fold arithmetic, then (b) Poseidon2 constants.

  2. Implemented + tested sub-component: FRI query-index derivation (constant-free slice of (d)). Chosen over Poseidon2 because it is fixed by public Plonky3 spec with NO secret round constants, so it can be validated offline with running, PASSING tests. Poseidon2 conformance needs the exact Plonky3 constants (offline it would only prove self-consistency, the "two wrong copies agree" trap), so it is left as a fully-specified [VERIFY] port target in the spec. Implements: sampleBits(canonicalU32, bits) (low-bits reduction of a challenger sample) and walk(index, logMaxHeight, logFinalPolyLen) (per-layer folding-index walk: index, sibling=index^1, index_pair=index>>1, parity; terminating in the final-poly domain). Files:

    • aerenew/pqc-fork/pq-stark/fri_query_index_reference.py (Python reference)
    • aerenew/pqc-fork/pq-stark/fri_query_index_reference.mjs (Node, independent second language)
    • aerenew/pqc-fork/pq-stark/FriQueryIndexSelfTest.java (standalone Java, no Besu classpath)
    • aerenew/pqc-fork/pq-stark/test_fri_query_index.py (harness: goldens + invariants + alt-algo
      • cross-language agreement) -> aerenew/pqc-fork/results/kat-results-fri-query-index.json
    • FriQueryIndex helper added to Sp1StarkVerifierPrecompiledContract.java, wired into Fri.checkQuery (still returns UNAVAILABLE) behind the fail-closed top level.

REAL test result (ran here)

  • python test_fri_query_index.py -> PASS=100021 FAIL=0. Python + Node + Java produce byte-identical results on the shared vector set (cross-language: java, node, python).
  • java FriQueryIndexSelfTest -> PASS=80018 FAIL=0 (standalone, validates the exact Java helper that ships in the precompile).
  • Validates the index LOGIC vs the public Plonky3 p3-fri spec across three independent implementations. Does NOT prove conformance to a real SP1 v6.1.0 trace -> that is [MEASURE] (needs the Poseidon2 challenger + an exported proof; exact command in port spec section 8).

Fail-closed confirmation

Top level unchanged: StarkConstraints.evaluateAtZeta still returns UNAVAILABLE, so verify() returns UNAVAILABLE -> computePrecompile returns EMPTY for every input. Added a belt-and-braces guard so an empty/short query-index array can never fall through to a vacuous ACCEPT. The Solidity adapter still reverts on every proof. Honesty banners ("DO NOT ACTIVATE ON MAINNET / verifies nothing yet") intact. On-chain ZK verifiers remain classical BN254 Groth16 (Shor-breakable), stated plainly.

Flags

  • [VERIFY] sample_bits masks LOW bits (LSB) of as_canonical_u32 vs p3-challenger
  • [VERIFY] arity-2 fold (sibling=index^1, index_pair=index>>1) vs p3-fri verifier.rs
  • [VERIFY] logMaxHeight = log_max_degree + log_blowup; num_fold_rounds = logMaxHeight - logFinalPolyLen
  • [VERIFY] BabyBear F_{p^4} non-residue W (skeleton cites x^4 - 11), Poseidon2 width 16 / 13 internal rounds / M4 / diagonal / 141 round constants (all in the spec, NOT invented)
  • [MEASURE] bit-reversal index-to-domain-point mapping vs a real Plonky3 trace
  • [MEASURE] end-to-end derive_query_indices vs a real SP1 v6.1.0 inner proof
  • [MEASURE] Poseidon2-BabyBear conformance vs p3-baby-bear KAT (whole permutation, port target)

Extra grounded fact (checked in the harness, not part of the FRI component): Poseidon2 S-box is x^7 because 7 is the smallest d>1 coprime to p-1 = 2^27 * 3 * 5.