From 50bf1a07ca7f5420ecae1185986655dbe3a4d614 Mon Sep 17 00:00:00 2001 From: Aere Network Date: Fri, 11 Sep 2026 21:33:52 +0300 Subject: [PATCH] precompiles: withdraw the uncitable 'audited' adjective from the patch and the published sources (O-006, D-376) --- .../0001-aere-pqc-precompiles-mainnet.patch | 20 +++++++++++++++---- precompiles/AereFalconSupport.java | 2 +- precompiles/SHAKE256PrecompiledContract.java | 5 ++++- 3 files changed, 21 insertions(+), 6 deletions(-) diff --git a/patches/0001-aere-pqc-precompiles-mainnet.patch b/patches/0001-aere-pqc-precompiles-mainnet.patch index bf7d3db..f2a31fe 100644 --- a/patches/0001-aere-pqc-precompiles-mainnet.patch +++ b/patches/0001-aere-pqc-precompiles-mainnet.patch @@ -47,6 +47,15 @@ Regenerated 2026-09-10 from the production tree over the same file set, so that the public recipe carries the same Apache-2.0 section 4(b) modification notices that the production sources carry; measured the same day: a build from this recipe reproduces the fleet's consensus jars class for class. + +Corrected 2026-09-11, comments only. This patch still called Bouncy Castle +"audited" in three places after that adjective had already been removed from the +production sources and from the copies published beside it, because nothing +compared the patch with the sources it is generated from. We cannot cite an audit +of bcprov-jdk18on: it is not a FIPS validated module and we know of no published +third-party review of it. What is citable is byte-for-byte agreement with the NIST +KAT and ACVP vectors in both directions, and that is what the comments now say. +No code changed; the wording did. --- diff --git a/datatypes/src/main/java/org/hyperledger/besu/datatypes/Address.java b/datatypes/src/main/java/org/hyperledger/besu/datatypes/Address.java index 950cd59e3..3a63362d7 100644 @@ -182,7 +191,7 @@ index 000000000..1dbb2b85c + * Shared logic for the AERE Falcon-512 / Falcon-1024 verification precompiles. + * + *

Transcodes the NIST round-3 reference "signed message" (sm) blob into the encoding Bouncy -+ * Castle's {@link FalconSigner#verifySignature(byte[], byte[])} expects and drives the audited ++ * Castle's {@link FalconSigner#verifySignature(byte[], byte[])} expects and drives that + * verifier. No cryptography is reimplemented here. + * + *

NIST sm layout: {@code sigLen(2, big-endian) || nonce(40) || message || esig} where @@ -544,7 +553,7 @@ index 28d84abf1..554a1e111 100644 + // Activated on a running chain via genesis config "futureEipsTime"; no re-genesis needed. + populateForOsaka(registry, gasCalculator); + -+ // Native post-quantum precompiles (audited Bouncy Castle BCPQC verifiers). ++ // Native post-quantum precompiles (Bouncy Castle BCPQC verifiers). + registry.put(Address.AERE_FALCON512, new Falcon512PrecompiledContract(gasCalculator)); + registry.put(Address.AERE_FALCON1024, new Falcon1024PrecompiledContract(gasCalculator)); + registry.put(Address.AERE_MLDSA44, new MLDSA44PrecompiledContract(gasCalculator)); @@ -557,7 +566,7 @@ new file mode 100644 index 000000000..0c20e6a66 --- /dev/null +++ b/evm/src/main/java/org/hyperledger/besu/evm/precompile/SHAKE256PrecompiledContract.java -@@ -0,0 +1,93 @@ +@@ -0,0 +1,96 @@ +/* + * Copyright contributors to the AERE Network. + * @@ -588,7 +597,10 @@ index 000000000..0c20e6a66 + * Output: exactly {@code outLen} bytes of SHAKE256(data). + * + *

SHAKE256 is the hashing bottleneck inside Falcon, ML-DSA and SLH-DSA; exposing it natively lets -+ * on-chain PQC flows offload the hot path to audited Bouncy Castle rather than hand-rolled Solidity. ++ * on-chain PQC flows offload the hot path to Bouncy Castle rather than hand-rolled Solidity. The ++ * provider we ship, bcprov-jdk18on, is not a FIPS validated module and we know of no published ++ * third-party audit of it; what is citable is byte-for-byte agreement with the NIST KAT and ACVP ++ * vectors, in both directions. See AERE-NIST-VALIDATION-STATUS.md section 3.4. + */ +public class SHAKE256PrecompiledContract extends AbstractPrecompiledContract { + diff --git a/precompiles/AereFalconSupport.java b/precompiles/AereFalconSupport.java index 011fc21..8f58dc8 100644 --- a/precompiles/AereFalconSupport.java +++ b/precompiles/AereFalconSupport.java @@ -26,7 +26,7 @@ import org.bouncycastle.pqc.crypto.falcon.FalconSigner; * Shared logic for the AERE Falcon-512 / Falcon-1024 verification precompiles. * *

Transcodes the NIST round-3 reference "signed message" (sm) blob into the encoding Bouncy - * Castle's {@link FalconSigner#verifySignature(byte[], byte[])} expects and drives the audited + * Castle's {@link FalconSigner#verifySignature(byte[], byte[])} expects and drives that * verifier. No cryptography is reimplemented here. * *

NIST sm layout: {@code sigLen(2, big-endian) || nonce(40) || message || esig} where diff --git a/precompiles/SHAKE256PrecompiledContract.java b/precompiles/SHAKE256PrecompiledContract.java index 67604aa..0fcbcc9 100644 --- a/precompiles/SHAKE256PrecompiledContract.java +++ b/precompiles/SHAKE256PrecompiledContract.java @@ -28,7 +28,10 @@ import org.bouncycastle.crypto.digests.SHAKEDigest; * Output: exactly {@code outLen} bytes of SHAKE256(data). * *

SHAKE256 is the hashing bottleneck inside Falcon, ML-DSA and SLH-DSA; exposing it natively lets - * on-chain PQC flows offload the hot path to Bouncy Castle (well-exercised, but not FIPS-validated and with no published third-party audit known) rather than hand-rolled Solidity. + * on-chain PQC flows offload the hot path to Bouncy Castle rather than hand-rolled Solidity. The + * provider we ship, bcprov-jdk18on, is not a FIPS validated module and we know of no published + * third-party audit of it; what is citable is byte-for-byte agreement with the NIST KAT and ACVP + * vectors, in both directions. See AERE-NIST-VALIDATION-STATUS.md section 3.4. */ public class SHAKE256PrecompiledContract extends AbstractPrecompiledContract {