aere-network/aere-node
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Dated: below block 24,148,752 the anchor certificate seals proved signing, not decision; from that block (AIP-22 stage R) a certificate carrying the quorum of one round proves it. SPEC rows 5 and 3.4 and the anchor table carry stage R as set on chain 2800

Browse Source
This commit is contained in:
Aere Network 2026-10-25 22:52:21 +02:00
parent c4771b6b32
commit 3e49753b31
6 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
AUDITS.md
View File

@ -41,7 +41,7 @@ The post-quantum anchor is designed so you do not have to take our word for it:
13,014,000 every 32nd block (every 128th from block 17,225,968 to block 20,746,736) carries a 13,014,000 every 32nd block (every 128th from block 17,225,968 to block 20,746,736) carries a
post-quantum certificate (Falcon-512, and from block 17,047,600 also SLH-DSA-SHA2-128s, at every post-quantum certificate (Falcon-512, and from block 17,047,600 also SLH-DSA-SHA2-128s, at every
128th block since block 20,746,736), and the block hash covers it. Since block 20,715,632 that 128th block since block 20,746,736), and the block hash covers it. Since block 20,715,632 that
certificate requires at least seven valid seals of each scheme, as many as the quorum of the ten validators (six from block 14,961,456, six of nine validators then); the seals prove those validators signed the block, not that it was decided (AIP-22 erratum, 2026-10-01). The verifier is certificate requires at least seven valid seals of each scheme, as many as the quorum of the ten validators (six from block 14,961,456, six of nine validators then); below block 24,148,752 the seals proved those validators signed the block, not that it was decided (AIP-22 erratum, 2026-10-01), and from that block a certificate that carries the quorum of one round proves the decision. The verifier is
public, the signatures are in the headers, and the check runs against any node — ours or your own. public, the signatures are in the headers, and the check runs against any node — ours or your own.
## Reporting a vulnerability ## Reporting a vulnerability

2
README.md
View File

@ -19,7 +19,7 @@ mechanism: the QBFT header anchor in `anchor/` and `patches/0003`. Since 2026-08
32nd block (an anchor block; every 128th from block 17,225,968 to block 20,746,736, see below) must carry, under its block hash, a certificate of valid post-quantum 32nd block (an anchor block; every 128th from block 17,225,968 to block 20,746,736, see below) must carry, under its block hash, a certificate of valid post-quantum
validator seals, and a node does not finalize an anchor block without it: at least three Falcon-512 validator seals, and a node does not finalize an anchor block without it: at least three Falcon-512
seals at first (f+1 of nine), six of nine, as many as the 2f+1 quorum, from block 14,961,456 (August 21, seals at first (f+1 of nine), six of nine, as many as the 2f+1 quorum, from block 14,961,456 (August 21,
2026), and **seven of ten per scheme, as many as the 2f+1 quorum of the ten validators, since block 20,715,632** (2026-09-29, AIP-22 stage 1; the seals prove those validators signed the block, not that it was decided, per the AIP-22 erratum of 2026-10-01); since block 17,047,600 (2026-09-04) the certificate is 2026), and **seven of ten per scheme, as many as the 2f+1 quorum of the ten validators, since block 20,715,632** (2026-09-29, AIP-22 stage 1; below block 24,148,752 the seals proved those validators signed the block, not that it was decided, per the AIP-22 erratum of 2026-10-01, and from that block a certificate that carries the quorum of one round proves the decision); since block 17,047,600 (2026-09-04) the certificate is
**hybrid**, Falcon-512 AND SLH-DSA-SHA2-128s seals. From block 17,225,968 (schedule set on all nine **hybrid**, Falcon-512 AND SLH-DSA-SHA2-128s seals. From block 17,225,968 (schedule set on all nine
validators on 2026-09-05) the anchor fell on every 128th block instead of every 32nd, with both validators on 2026-09-05) the anchor fell on every 128th block instead of every 32nd, with both
schemes at every anchor; since block 20,746,736 (AIP-22 stage 2) Falcon-512 is required at every schemes at every anchor; since block 20,746,736 (AIP-22 stage 2) Falcon-512 is required at every

2
RUN-A-NODE.md
View File

@ -142,7 +142,7 @@ running a configuration the chain does not.
Since block 13,014,000 every 32nd header of chain 2800 (every 128th from block 17,225,968 to block Since block 13,014,000 every 32nd header of chain 2800 (every 128th from block 17,225,968 to block
20,746,736) carries a sixth element in its QBFT `extraData`: a certificate of validator post-quantum 20,746,736) carries a sixth element in its QBFT `extraData`: a certificate of validator post-quantum
seals, universal since block 13,889,296, enforced at a minimum of three seals per anchor block (f+1 seals, universal since block 13,889,296, enforced at a minimum of three seals per anchor block (f+1
of nine) from 2026-08-14, of six from block 14,961,456 and of seven, as many as the quorum of the ten validators (the seals prove those validators signed the block, not that it was decided, per the AIP-22 erratum of 2026-10-01), from block 20,715,632, for each scheme once the certificate became hybrid (Falcon-512 of nine) from 2026-08-14, of six from block 14,961,456 and of seven, as many as the quorum of the ten validators (below block 24,148,752 the seals proved those validators signed the block, not that it was decided, per the AIP-22 erratum of 2026-10-01, and from that block a certificate that carries the quorum of one round proves the decision), from block 20,715,632, for each scheme once the certificate became hybrid (Falcon-512
and SLH-DSA-SHA2-128s) at block 17,047,600; since block 20,746,736 SLH-DSA seals are required at and SLH-DSA-SHA2-128s) at block 17,047,600; since block 20,746,736 SLH-DSA seals are required at
every 128th block only. A node rejects an anchor block whose every 128th block only. A node rejects an anchor block whose
certificate holds fewer valid seals than the schedule requires at its height. (Correction 2026-08-19: certificate holds fewer valid seals than the schedule requires at its height. (Correction 2026-08-19:

2
SECURITY.md
View File

@ -38,7 +38,7 @@ pointer is <https://aere.network/.well-known/security.txt>.
every 32nd block (every 128th from block 17,225,968 to block 20,746,736) carries a post-quantum every 32nd block (every 128th from block 17,225,968 to block 20,746,736) carries a post-quantum
certificate under the block hash (Falcon-512, and from block 17,047,600 also SLH-DSA-SHA2-128s, at certificate under the block hash (Falcon-512, and from block 17,047,600 also SLH-DSA-SHA2-128s, at
every 128th block since block 20,746,736), requiring at least seven valid seals of each scheme every 128th block since block 20,746,736), requiring at least seven valid seals of each scheme
since block 20,715,632, as many as the quorum of the ten validators (six from block 14,961,456, six of nine validators then); the seals prove those validators signed the block, not that it was decided (AIP-22 erratum, 2026-10-01). Blocks between anchors rest on ECDSA. We correct since block 20,715,632, as many as the quorum of the ten validators (six from block 14,961,456, six of nine validators then); below block 24,148,752 the seals proved those validators signed the block, not that it was decided (AIP-22 erratum, 2026-10-01), and from that block a certificate that carries the quorum of one round proves the decision. Blocks between anchors rest on ECDSA. We correct
over-claims publicly when we find them, and we have done so before. over-claims publicly when we find them, and we have done so before.
## Fixes ## Fixes

7
SPEC.md
View File

@ -232,7 +232,7 @@ negative control shows a majority quorum forks) (source:
| 2 | `vote` | empty RLP list when no vote; else `RLP[recipient(20 bytes), voteValue]` with the add/drop byte values defined in upstream Besu's `Vote` class | | 2 | `vote` | empty RLP list when no vote; else `RLP[recipient(20 bytes), voteValue]` with the add/drop byte values defined in upstream Besu's `Vote` class |
| 3 | `round` | int scalar | | 3 | `round` | int scalar |
| 4 | `committedSeals` | RLP list of ECDSA (secp256k1) commit signatures | | 4 | `committedSeals` | RLP list of ECDSA (secp256k1) commit signatures |
| 5 | the anchor certificate (Aere, optional; carried only at anchor heights) | present ONLY in the stored-header encoding and ONLY when non-empty. Its form is chosen by height alone and is defined HERE, once (rewritten 2026-10-14; until then this row named only the first form): **v1**, from block 13,014,000: RLP list of `[validatorIndex intScalar, falconSignature bytes]` pairs, indices strictly increasing; **v2**, from block 17,047,600 (`aere.pq.anchorV2Block`): `RLP[2, [[scheme intScalar, validatorIndex intScalar, signature bytes], ...]]`, scheme 1 = Falcon-512, 2 = SLH-DSA-SHA2-128s, rows in canonical order; **v3**, from `H_r` (`aere.pq.commitRoundBlock`, AIP-22 stage R, patch 0010; NOT set on chain 2800 as of 2026-10-14; 6,157,024 on testnet 28001 since 2026-10-14): `RLP[3, round intScalar, [[scheme, validatorIndex, signature], ...]]`, every seal over the commit message of that one round (section 2.6), the round written once, before the list, so that a v2 reader refuses a v3 certificate instead of counting its seals. The digest of the carried certificate, under the block hash, is element 0 (section 3.3) | | 5 | the anchor certificate (Aere, optional; carried only at anchor heights) | present ONLY in the stored-header encoding and ONLY when non-empty. Its form is chosen by height alone and is defined HERE, once (rewritten 2026-10-14; until then this row named only the first form): **v1**, from block 13,014,000: RLP list of `[validatorIndex intScalar, falconSignature bytes]` pairs, indices strictly increasing; **v2**, from block 17,047,600 (`aere.pq.anchorV2Block`): `RLP[2, [[scheme intScalar, validatorIndex intScalar, signature bytes], ...]]`, scheme 1 = Falcon-512, 2 = SLH-DSA-SHA2-128s, rows in canonical order; **v3**, from `H_r` (`aere.pq.commitRoundBlock`, AIP-22 stage R, patch 0010; block 24,148,752 on chain 2800, where it was not yet set as of 2026-10-14; 6,157,024 on testnet 28001 since 2026-10-14): `RLP[3, round intScalar, [[scheme, validatorIndex, signature], ...]]`, every seal over the commit message of that one round (section 2.6), the round written once, before the list, so that a v2 reader refuses a v3 certificate instead of counting its seals. The digest of the carried certificate, under the block hash, is element 0 (section 3.3) |
Three encodings exist, and which elements they carry is consensus-critical (source: same file, Three encodings exist, and which elements they carry is consensus-critical (source: same file,
`encode(...)`): `encode(...)`):
@ -508,7 +508,7 @@ that also carries a valid Falcon seal [MEASURED 2026-09-05, 400 consecutive anch
`anchor/consensus/common/.../PqAnchorV2.java`, `PqSchemeSchedule.java`; the public verifier `anchor/consensus/common/.../PqAnchorV2.java`, `PqSchemeSchedule.java`; the public verifier
`tools/verify-anchor.mjs`). The enforced minimum number of valid seals is a height `tools/verify-anchor.mjs`). The enforced minimum number of valid seals is a height
schedule: 0 from 13,014,000 (warm-up), 3 from 13,034,000 (f+1 of the nine validators of that time; enforced on the fleet since schedule: 0 from 13,014,000 (warm-up), 3 from 13,034,000 (f+1 of the nine validators of that time; enforced on the fleet since
2026-08-14), 6 from block 14,961,456 (of nine then, as many as the 2f+1 quorum at that size, and below the ten-validator quorum of seven from 2026-09-11), and **7 from block 20,715,632** (AIP-22 stage 1, as many as the 2f+1 quorum of the ten validators, the same count QBFT itself requires; the seals prove those validators signed the block, not that it was decided, per the AIP-22 erratum of 2026-10-01) (source: `anchor/README.md`, "Scope boundary"; `RUN-A-NODE.md`, the anchor section). 2026-08-14), 6 from block 14,961,456 (of nine then, as many as the 2f+1 quorum at that size, and below the ten-validator quorum of seven from 2026-09-11), and **7 from block 20,715,632** (AIP-22 stage 1, as many as the 2f+1 quorum of the ten validators, the same count QBFT itself requires; below block 24,148,752 the seals proved those validators signed the block, not that it was decided, per the AIP-22 erratum of 2026-10-01, and from that block a certificate that carries the quorum of one round proves the decision) (source: `anchor/README.md`, "Scope boundary"; `RUN-A-NODE.md`, the anchor section).
The defensible sentence, and the only form this document endorses: *every anchor block (every The defensible sentence, and the only form this document endorses: *every anchor block (every
32nd block; every 128th from 17,225,968 to 20,746,736) does not 32nd block; every 128th from 17,225,968 to 20,746,736) does not
@ -824,8 +824,7 @@ order (source: `anchor/consensus/qbft/.../PqAnchorSealsRule.java`, `validate`):
`IMPORT-PROOF-STARE-2026-08-15.md`]. `IMPORT-PROOF-STARE-2026-08-15.md`].
9. Any exception during checking rejects (fail-closed). 9. Any exception during checking rejects (fail-closed).
**From `H_r`, the v3 rules (patch 0010, AIP-22 stage R; added 2026-10-14; inert while `H_r` is not **From `H_r`, the v3 rules (patch 0010, AIP-22 stage R; added 2026-10-14; inert while `H_r` is not set, which was the state of chain 2800 at that date; there `H_r` is block 24,148,752).** At an anchor height `a >= H_r` the carried
set, which is the state of chain 2800 at this date).** At an anchor height `a >= H_r` the carried
certificate must be v3 (section 2.3) and R1 and R2 judge it with one pure function, certificate must be v3 (section 2.3) and R1 and R2 judge it with one pure function,
`PqAnchorV3.judge` (source: `anchor/consensus/common/.../PqAnchorV3.java`; the same codes are `PqAnchorV3.judge` (source: `anchor/consensus/common/.../PqAnchorV3.java`; the same codes are
returned by the second client, the public verifier and the shared conformance vectors), whose returned by the second client, the public verifier and the shared conformance vectors), whose

3
anchor/README.md
View File

@ -23,7 +23,7 @@ should not be confused:
14,961,456 (August 21, 2026): the enforced minimum became **six**, which at that time was as many as the 2f+1 quorum of the nine-validator set, the same count QBFT itself required to agree on the block. 14,961,456 (August 21, 2026): the enforced minimum became **six**, which at that time was as many as the 2f+1 quorum of the nine-validator set, the same count QBFT itself required to agree on the block.
From 2026-09-11 the set was ten and QBFT's quorum seven, so the same six was above f+1 and From 2026-09-11 the set was ten and QBFT's quorum seven, so the same six was above f+1 and
below the quorum: the threshold had not moved, the set had. **From block 20,715,632 (AIP-22 stage 1, below the quorum: the threshold had not moved, the set had. **From block 20,715,632 (AIP-22 stage 1,
armed 2026-09-29) the enforced minimum is seven, again as many as the 2f+1 quorum of the ten-validator set.** The seals prove those validators signed the block, not that it was decided (AIP-22 erratum, 2026-10-01). armed 2026-09-29) the enforced minimum is seven, again as many as the 2f+1 quorum of the ten-validator set.** Below block 24,148,752 the seals proved those validators signed the block, not that it was decided (AIP-22 erratum, 2026-10-01), and from that block a certificate that carries the quorum of one round proves the decision.
The schedule is `aere.pq.anchorMinSeals=13014000:0,13034000:3,14961456:6,17102384:0,17102416:6,20715632:7`, The schedule is `aere.pq.anchorMinSeals=13014000:0,13034000:3,14961456:6,17102384:0,17102416:6,20715632:7`,
uniform on all ten validators; the uniform on all ten validators; the
startup guard refuses any threshold above N - f = 7, the highest count reachable with the fault startup guard refuses any threshold above N - f = 7, the highest count reachable with the fault
@ -196,6 +196,7 @@ This matters more than the file list, so it is stated before it.
| Post-quantum validator identity and the v3 key registry (AIP-22 stage 3, `aere.pq.identityBlock`, `aere.pq.registryV3`) | yes (added 2026-09-23) | **yes**, since block 20,836,228 (2026-09-30) | | Post-quantum validator identity and the v3 key registry (AIP-22 stage 3, `aere.pq.identityBlock`, `aere.pq.registryV3`) | yes (added 2026-09-23) | **yes**, since block 20,836,228 (2026-09-30) |
| Sealing keys read from the v3 epochs, key rotation under an id (AIP-22 stage 3b, `aere.pq.registryV3.keysFrom`, `aere.falcon.keys.next`) | yes (added 2026-09-23) | **keys read from the v3 epoch since block 20,836,228**; no key rotated on chain 2800 | | Sealing keys read from the v3 epochs, key rotation under an id (AIP-22 stage 3b, `aere.pq.registryV3.keysFrom`, `aere.falcon.keys.next`) | yes (added 2026-09-23) | **keys read from the v3 epoch since block 20,836,228**; no key rotated on chain 2800 |
| The post-quantum commit seal bound to the consensus round (COMMIT-2) and the v3 anchor certificate (AIP-22 stage R, `aere.pq.commitRoundBlock`, patch 0010) | yes (added 2026-10-14) | **yes**, since block 24,148,752 (2026-10-24); on testnet 28001 since block 6,157,024 | | The post-quantum commit seal bound to the consensus round (COMMIT-2) and the v3 anchor certificate (AIP-22 stage R, `aere.pq.commitRoundBlock`, patch 0010) | yes (added 2026-10-14) | **yes**, since block 24,148,752 (2026-10-24); on testnet 28001 since block 6,157,024 |
| The post-quantum commit seal bound to the consensus round (COMMIT-2) and the v3 anchor certificate (AIP-22 stage R, `aere.pq.commitRoundBlock`, patch 0010) | yes (added 2026-10-14) | **yes**, since block 24,148,752 (2026-10-24); on testnet 28001 since block 6,157,024 |
| Message authorship from VERIFIED post-quantum seals, with the startup guards AERE-PQC-FIN-01/02/03 (AIP-22 stage 4, `aere.pq.finalityBlock`) | yes (added 2026-09-23) | **yes**, since block 24,300,000 (2026-10-25); on testnet 28001 since block 3,117,000 | | Message authorship from VERIFIED post-quantum seals, with the startup guards AERE-PQC-FIN-01/02/03 (AIP-22 stage 4, `aere.pq.finalityBlock`) | yes (added 2026-09-23) | **yes**, since block 24,300,000 (2026-10-25); on testnet 28001 since block 3,117,000 |
| Checkpoint option, a header rule that refuses another hash at a checkpoint height (AIP-22 stage 4, `aere.pq.checkpoint`) | yes (added 2026-09-23) | **no**; not configured anywhere | | Checkpoint option, a header rule that refuses another hash at a checkpoint height (AIP-22 stage 4, `aere.pq.checkpoint`) | yes (added 2026-09-23) | **no**; not configured anywhere |
| Headers without ECDSA committed seals, sealed by the proposer's post-quantum seal as extraData element 6 (AIP-22 stage 5, `aere.pq.headerBlock`, guards AERE-PQC-HDR-01/02) | yes (added 2026-09-23) | **no**; proven on testnet 28001 only (H_hdr 3,131,000) | | Headers without ECDSA committed seals, sealed by the proposer's post-quantum seal as extraData element 6 (AIP-22 stage 5, `aere.pq.headerBlock`, guards AERE-PQC-HDR-01/02) | yes (added 2026-09-23) | **no**; proven on testnet 28001 only (H_hdr 3,131,000) |