From 3e49753b314db05c6a70d142260423c226df01db Mon Sep 17 00:00:00 2001 From: Aere Network Date: Sun, 25 Oct 2026 22:52:21 +0200 Subject: [PATCH] Dated: below block 24,148,752 the anchor certificate seals proved signing, not decision; from that block (AIP-22 stage R) a certificate carrying the quorum of one round proves it. SPEC rows 5 and 3.4 and the anchor table carry stage R as set on chain 2800 --- AUDITS.md | 2 +- README.md | 2 +- RUN-A-NODE.md | 2 +- SECURITY.md | 2 +- SPEC.md | 7 +++---- anchor/README.md | 3 ++- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/AUDITS.md b/AUDITS.md index 22e67ef..4cc0373 100644 --- a/AUDITS.md +++ b/AUDITS.md @@ -41,7 +41,7 @@ The post-quantum anchor is designed so you do not have to take our word for it: 13,014,000 every 32nd block (every 128th from block 17,225,968 to block 20,746,736) carries a post-quantum certificate (Falcon-512, and from block 17,047,600 also SLH-DSA-SHA2-128s, at every 128th block since block 20,746,736), and the block hash covers it. Since block 20,715,632 that -certificate requires at least seven valid seals of each scheme, as many as the quorum of the ten validators (six from block 14,961,456, six of nine validators then); the seals prove those validators signed the block, not that it was decided (AIP-22 erratum, 2026-10-01). The verifier is +certificate requires at least seven valid seals of each scheme, as many as the quorum of the ten validators (six from block 14,961,456, six of nine validators then); below block 24,148,752 the seals proved those validators signed the block, not that it was decided (AIP-22 erratum, 2026-10-01), and from that block a certificate that carries the quorum of one round proves the decision. The verifier is public, the signatures are in the headers, and the check runs against any node — ours or your own. ## Reporting a vulnerability diff --git a/README.md b/README.md index 00c6946..6cdf42a 100644 --- a/README.md +++ b/README.md @@ -19,7 +19,7 @@ mechanism: the QBFT header anchor in `anchor/` and `patches/0003`. Since 2026-08 32nd block (an anchor block; every 128th from block 17,225,968 to block 20,746,736, see below) must carry, under its block hash, a certificate of valid post-quantum validator seals, and a node does not finalize an anchor block without it: at least three Falcon-512 seals at first (f+1 of nine), six of nine, as many as the 2f+1 quorum, from block 14,961,456 (August 21, -2026), and **seven of ten per scheme, as many as the 2f+1 quorum of the ten validators, since block 20,715,632** (2026-09-29, AIP-22 stage 1; the seals prove those validators signed the block, not that it was decided, per the AIP-22 erratum of 2026-10-01); since block 17,047,600 (2026-09-04) the certificate is +2026), and **seven of ten per scheme, as many as the 2f+1 quorum of the ten validators, since block 20,715,632** (2026-09-29, AIP-22 stage 1; below block 24,148,752 the seals proved those validators signed the block, not that it was decided, per the AIP-22 erratum of 2026-10-01, and from that block a certificate that carries the quorum of one round proves the decision); since block 17,047,600 (2026-09-04) the certificate is **hybrid**, Falcon-512 AND SLH-DSA-SHA2-128s seals. From block 17,225,968 (schedule set on all nine validators on 2026-09-05) the anchor fell on every 128th block instead of every 32nd, with both schemes at every anchor; since block 20,746,736 (AIP-22 stage 2) Falcon-512 is required at every diff --git a/RUN-A-NODE.md b/RUN-A-NODE.md index 1353554..5b1f4c6 100644 --- a/RUN-A-NODE.md +++ b/RUN-A-NODE.md @@ -142,7 +142,7 @@ running a configuration the chain does not. Since block 13,014,000 every 32nd header of chain 2800 (every 128th from block 17,225,968 to block 20,746,736) carries a sixth element in its QBFT `extraData`: a certificate of validator post-quantum seals, universal since block 13,889,296, enforced at a minimum of three seals per anchor block (f+1 -of nine) from 2026-08-14, of six from block 14,961,456 and of seven, as many as the quorum of the ten validators (the seals prove those validators signed the block, not that it was decided, per the AIP-22 erratum of 2026-10-01), from block 20,715,632, for each scheme once the certificate became hybrid (Falcon-512 +of nine) from 2026-08-14, of six from block 14,961,456 and of seven, as many as the quorum of the ten validators (below block 24,148,752 the seals proved those validators signed the block, not that it was decided, per the AIP-22 erratum of 2026-10-01, and from that block a certificate that carries the quorum of one round proves the decision), from block 20,715,632, for each scheme once the certificate became hybrid (Falcon-512 and SLH-DSA-SHA2-128s) at block 17,047,600; since block 20,746,736 SLH-DSA seals are required at every 128th block only. A node rejects an anchor block whose certificate holds fewer valid seals than the schedule requires at its height. (Correction 2026-08-19: diff --git a/SECURITY.md b/SECURITY.md index e0a3145..5f1ae2d 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -38,7 +38,7 @@ pointer is . every 32nd block (every 128th from block 17,225,968 to block 20,746,736) carries a post-quantum certificate under the block hash (Falcon-512, and from block 17,047,600 also SLH-DSA-SHA2-128s, at every 128th block since block 20,746,736), requiring at least seven valid seals of each scheme - since block 20,715,632, as many as the quorum of the ten validators (six from block 14,961,456, six of nine validators then); the seals prove those validators signed the block, not that it was decided (AIP-22 erratum, 2026-10-01). Blocks between anchors rest on ECDSA. We correct + since block 20,715,632, as many as the quorum of the ten validators (six from block 14,961,456, six of nine validators then); below block 24,148,752 the seals proved those validators signed the block, not that it was decided (AIP-22 erratum, 2026-10-01), and from that block a certificate that carries the quorum of one round proves the decision. Blocks between anchors rest on ECDSA. We correct over-claims publicly when we find them, and we have done so before. ## Fixes diff --git a/SPEC.md b/SPEC.md index 097495e..c5fcdaf 100644 --- a/SPEC.md +++ b/SPEC.md @@ -232,7 +232,7 @@ negative control shows a majority quorum forks) (source: | 2 | `vote` | empty RLP list when no vote; else `RLP[recipient(20 bytes), voteValue]` with the add/drop byte values defined in upstream Besu's `Vote` class | | 3 | `round` | int scalar | | 4 | `committedSeals` | RLP list of ECDSA (secp256k1) commit signatures | -| 5 | the anchor certificate (Aere, optional; carried only at anchor heights) | present ONLY in the stored-header encoding and ONLY when non-empty. Its form is chosen by height alone and is defined HERE, once (rewritten 2026-10-14; until then this row named only the first form): **v1**, from block 13,014,000: RLP list of `[validatorIndex intScalar, falconSignature bytes]` pairs, indices strictly increasing; **v2**, from block 17,047,600 (`aere.pq.anchorV2Block`): `RLP[2, [[scheme intScalar, validatorIndex intScalar, signature bytes], ...]]`, scheme 1 = Falcon-512, 2 = SLH-DSA-SHA2-128s, rows in canonical order; **v3**, from `H_r` (`aere.pq.commitRoundBlock`, AIP-22 stage R, patch 0010; NOT set on chain 2800 as of 2026-10-14; 6,157,024 on testnet 28001 since 2026-10-14): `RLP[3, round intScalar, [[scheme, validatorIndex, signature], ...]]`, every seal over the commit message of that one round (section 2.6), the round written once, before the list, so that a v2 reader refuses a v3 certificate instead of counting its seals. The digest of the carried certificate, under the block hash, is element 0 (section 3.3) | +| 5 | the anchor certificate (Aere, optional; carried only at anchor heights) | present ONLY in the stored-header encoding and ONLY when non-empty. Its form is chosen by height alone and is defined HERE, once (rewritten 2026-10-14; until then this row named only the first form): **v1**, from block 13,014,000: RLP list of `[validatorIndex intScalar, falconSignature bytes]` pairs, indices strictly increasing; **v2**, from block 17,047,600 (`aere.pq.anchorV2Block`): `RLP[2, [[scheme intScalar, validatorIndex intScalar, signature bytes], ...]]`, scheme 1 = Falcon-512, 2 = SLH-DSA-SHA2-128s, rows in canonical order; **v3**, from `H_r` (`aere.pq.commitRoundBlock`, AIP-22 stage R, patch 0010; block 24,148,752 on chain 2800, where it was not yet set as of 2026-10-14; 6,157,024 on testnet 28001 since 2026-10-14): `RLP[3, round intScalar, [[scheme, validatorIndex, signature], ...]]`, every seal over the commit message of that one round (section 2.6), the round written once, before the list, so that a v2 reader refuses a v3 certificate instead of counting its seals. The digest of the carried certificate, under the block hash, is element 0 (section 3.3) | Three encodings exist, and which elements they carry is consensus-critical (source: same file, `encode(...)`): @@ -508,7 +508,7 @@ that also carries a valid Falcon seal [MEASURED 2026-09-05, 400 consecutive anch `anchor/consensus/common/.../PqAnchorV2.java`, `PqSchemeSchedule.java`; the public verifier `tools/verify-anchor.mjs`). The enforced minimum number of valid seals is a height schedule: 0 from 13,014,000 (warm-up), 3 from 13,034,000 (f+1 of the nine validators of that time; enforced on the fleet since -2026-08-14), 6 from block 14,961,456 (of nine then, as many as the 2f+1 quorum at that size, and below the ten-validator quorum of seven from 2026-09-11), and **7 from block 20,715,632** (AIP-22 stage 1, as many as the 2f+1 quorum of the ten validators, the same count QBFT itself requires; the seals prove those validators signed the block, not that it was decided, per the AIP-22 erratum of 2026-10-01) (source: `anchor/README.md`, "Scope boundary"; `RUN-A-NODE.md`, the anchor section). +2026-08-14), 6 from block 14,961,456 (of nine then, as many as the 2f+1 quorum at that size, and below the ten-validator quorum of seven from 2026-09-11), and **7 from block 20,715,632** (AIP-22 stage 1, as many as the 2f+1 quorum of the ten validators, the same count QBFT itself requires; below block 24,148,752 the seals proved those validators signed the block, not that it was decided, per the AIP-22 erratum of 2026-10-01, and from that block a certificate that carries the quorum of one round proves the decision) (source: `anchor/README.md`, "Scope boundary"; `RUN-A-NODE.md`, the anchor section). The defensible sentence, and the only form this document endorses: *every anchor block (every 32nd block; every 128th from 17,225,968 to 20,746,736) does not @@ -824,8 +824,7 @@ order (source: `anchor/consensus/qbft/.../PqAnchorSealsRule.java`, `validate`): `IMPORT-PROOF-STARE-2026-08-15.md`]. 9. Any exception during checking rejects (fail-closed). -**From `H_r`, the v3 rules (patch 0010, AIP-22 stage R; added 2026-10-14; inert while `H_r` is not -set, which is the state of chain 2800 at this date).** At an anchor height `a >= H_r` the carried +**From `H_r`, the v3 rules (patch 0010, AIP-22 stage R; added 2026-10-14; inert while `H_r` is not set, which was the state of chain 2800 at that date; there `H_r` is block 24,148,752).** At an anchor height `a >= H_r` the carried certificate must be v3 (section 2.3) and R1 and R2 judge it with one pure function, `PqAnchorV3.judge` (source: `anchor/consensus/common/.../PqAnchorV3.java`; the same codes are returned by the second client, the public verifier and the shared conformance vectors), whose diff --git a/anchor/README.md b/anchor/README.md index 0d40524..d2716e7 100644 --- a/anchor/README.md +++ b/anchor/README.md @@ -23,7 +23,7 @@ should not be confused: 14,961,456 (August 21, 2026): the enforced minimum became **six**, which at that time was as many as the 2f+1 quorum of the nine-validator set, the same count QBFT itself required to agree on the block. From 2026-09-11 the set was ten and QBFT's quorum seven, so the same six was above f+1 and below the quorum: the threshold had not moved, the set had. **From block 20,715,632 (AIP-22 stage 1, - armed 2026-09-29) the enforced minimum is seven, again as many as the 2f+1 quorum of the ten-validator set.** The seals prove those validators signed the block, not that it was decided (AIP-22 erratum, 2026-10-01). + armed 2026-09-29) the enforced minimum is seven, again as many as the 2f+1 quorum of the ten-validator set.** Below block 24,148,752 the seals proved those validators signed the block, not that it was decided (AIP-22 erratum, 2026-10-01), and from that block a certificate that carries the quorum of one round proves the decision. The schedule is `aere.pq.anchorMinSeals=13014000:0,13034000:3,14961456:6,17102384:0,17102416:6,20715632:7`, uniform on all ten validators; the startup guard refuses any threshold above N - f = 7, the highest count reachable with the fault @@ -196,6 +196,7 @@ This matters more than the file list, so it is stated before it. | Post-quantum validator identity and the v3 key registry (AIP-22 stage 3, `aere.pq.identityBlock`, `aere.pq.registryV3`) | yes (added 2026-09-23) | **yes**, since block 20,836,228 (2026-09-30) | | Sealing keys read from the v3 epochs, key rotation under an id (AIP-22 stage 3b, `aere.pq.registryV3.keysFrom`, `aere.falcon.keys.next`) | yes (added 2026-09-23) | **keys read from the v3 epoch since block 20,836,228**; no key rotated on chain 2800 | | The post-quantum commit seal bound to the consensus round (COMMIT-2) and the v3 anchor certificate (AIP-22 stage R, `aere.pq.commitRoundBlock`, patch 0010) | yes (added 2026-10-14) | **yes**, since block 24,148,752 (2026-10-24); on testnet 28001 since block 6,157,024 | +| The post-quantum commit seal bound to the consensus round (COMMIT-2) and the v3 anchor certificate (AIP-22 stage R, `aere.pq.commitRoundBlock`, patch 0010) | yes (added 2026-10-14) | **yes**, since block 24,148,752 (2026-10-24); on testnet 28001 since block 6,157,024 | | Message authorship from VERIFIED post-quantum seals, with the startup guards AERE-PQC-FIN-01/02/03 (AIP-22 stage 4, `aere.pq.finalityBlock`) | yes (added 2026-09-23) | **yes**, since block 24,300,000 (2026-10-25); on testnet 28001 since block 3,117,000 | | Checkpoint option, a header rule that refuses another hash at a checkpoint height (AIP-22 stage 4, `aere.pq.checkpoint`) | yes (added 2026-09-23) | **no**; not configured anywhere | | Headers without ECDSA committed seals, sealed by the proposer's post-quantum seal as extraData element 6 (AIP-22 stage 5, `aere.pq.headerBlock`, guards AERE-PQC-HDR-01/02) | yes (added 2026-09-23) | **no**; proven on testnet 28001 only (H_hdr 3,131,000) |