From e63135ed39eb3082d045568424c85bd26ea892bf Mon Sep 17 00:00:00 2001 From: Aere Network Date: Thu, 1 Oct 2026 19:11:34 +0300 Subject: [PATCH] Seals stated as many as the quorum, proving that those validators signed, not that the block was decided (AIP-22 erratum of 2026-10-01) --- AUDITS.md | 3 +-- README.md | 5 ++--- RUN-A-NODE.md | 3 +-- SECURITY.md | 3 +-- SPEC.md | 8 +++----- anchor/README.md | 5 ++--- 6 files changed, 10 insertions(+), 17 deletions(-) diff --git a/AUDITS.md b/AUDITS.md index 8a06f83..22e67ef 100644 --- a/AUDITS.md +++ b/AUDITS.md @@ -41,8 +41,7 @@ The post-quantum anchor is designed so you do not have to take our word for it: 13,014,000 every 32nd block (every 128th from block 17,225,968 to block 20,746,736) carries a post-quantum certificate (Falcon-512, and from block 17,047,600 also SLH-DSA-SHA2-128s, at every 128th block since block 20,746,736), and the block hash covers it. Since block 20,715,632 that -certificate requires at least seven valid seals of each scheme, the full quorum of the ten -validators (six from block 14,961,456, six of nine validators then). The verifier is +certificate requires at least seven valid seals of each scheme, as many as the quorum of the ten validators (six from block 14,961,456, six of nine validators then); the seals prove those validators signed the block, not that it was decided (AIP-22 erratum, 2026-10-01). The verifier is public, the signatures are in the headers, and the check runs against any node — ours or your own. ## Reporting a vulnerability diff --git a/README.md b/README.md index 36526c2..9bc7d58 100644 --- a/README.md +++ b/README.md @@ -18,9 +18,8 @@ Consensus on chain 2800 is **hybrid post-quantum in a precise and limited sense* mechanism: the QBFT header anchor in `anchor/` and `patches/0003`. Since 2026-08-14 every 32nd block (an anchor block; every 128th from block 17,225,968 to block 20,746,736, see below) must carry, under its block hash, a certificate of valid post-quantum validator seals, and a node does not finalize an anchor block without it: at least three Falcon-512 -seals at first (f+1 of nine), six of nine, a full 2f+1 quorum, from block 14,961,456 (August 21, -2026), and **seven of ten per scheme, the full 2f+1 quorum of the ten validators, since block -20,715,632** (2026-09-29, AIP-22 stage 1); since block 17,047,600 (2026-09-04) the certificate is +seals at first (f+1 of nine), six of nine, as many as the 2f+1 quorum, from block 14,961,456 (August 21, +2026), and **seven of ten per scheme, as many as the 2f+1 quorum of the ten validators, since block 20,715,632** (2026-09-29, AIP-22 stage 1; the seals prove those validators signed the block, not that it was decided, per the AIP-22 erratum of 2026-10-01); since block 17,047,600 (2026-09-04) the certificate is **hybrid**, Falcon-512 AND SLH-DSA-SHA2-128s seals. From block 17,225,968 (schedule set on all nine validators on 2026-09-05) the anchor fell on every 128th block instead of every 32nd, with both schemes at every anchor; since block 20,746,736 (AIP-22 stage 2) Falcon-512 is required at every diff --git a/RUN-A-NODE.md b/RUN-A-NODE.md index 398e773..5db9d12 100644 --- a/RUN-A-NODE.md +++ b/RUN-A-NODE.md @@ -141,8 +141,7 @@ running a configuration the chain does not. Since block 13,014,000 every 32nd header of chain 2800 (every 128th from block 17,225,968 to block 20,746,736) carries a sixth element in its QBFT `extraData`: a certificate of validator post-quantum seals, universal since block 13,889,296, enforced at a minimum of three seals per anchor block (f+1 -of nine) from 2026-08-14, of six from block 14,961,456 and of seven, the full quorum of the ten -validators, from block 20,715,632, for each scheme once the certificate became hybrid (Falcon-512 +of nine) from 2026-08-14, of six from block 14,961,456 and of seven, as many as the quorum of the ten validators (the seals prove those validators signed the block, not that it was decided, per the AIP-22 erratum of 2026-10-01), from block 20,715,632, for each scheme once the certificate became hybrid (Falcon-512 and SLH-DSA-SHA2-128s) at block 17,047,600; since block 20,746,736 SLH-DSA seals are required at every 128th block only. A node rejects an anchor block whose certificate holds fewer valid seals than the schedule requires at its height. (Correction 2026-08-19: diff --git a/SECURITY.md b/SECURITY.md index 8a33cf7..e0a3145 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -38,8 +38,7 @@ pointer is . every 32nd block (every 128th from block 17,225,968 to block 20,746,736) carries a post-quantum certificate under the block hash (Falcon-512, and from block 17,047,600 also SLH-DSA-SHA2-128s, at every 128th block since block 20,746,736), requiring at least seven valid seals of each scheme - since block 20,715,632, the full quorum of the ten validators (six from block 14,961,456, six of - nine validators then). Blocks between anchors rest on ECDSA. We correct + since block 20,715,632, as many as the quorum of the ten validators (six from block 14,961,456, six of nine validators then); the seals prove those validators signed the block, not that it was decided (AIP-22 erratum, 2026-10-01). Blocks between anchors rest on ECDSA. We correct over-claims publicly when we find them, and we have done so before. ## Fixes diff --git a/SPEC.md b/SPEC.md index cd7bb55..72407f8 100644 --- a/SPEC.md +++ b/SPEC.md @@ -435,13 +435,11 @@ that also carries a valid Falcon seal [MEASURED 2026-09-05, 400 consecutive anch `anchor/consensus/common/.../PqAnchorV2.java`, `PqSchemeSchedule.java`; the public verifier `tools/verify-anchor.mjs`). The enforced minimum number of valid seals is a height schedule: 0 from 13,014,000 (warm-up), 3 from 13,034,000 (f+1 of the nine validators of that time; enforced on the fleet since -2026-08-14), 6 from block 14,961,456 (of nine then, a full 2f+1 quorum at that size, and below the ten-validator quorum of seven from 2026-09-11), and **7 from block 20,715,632** (AIP-22 stage 1, the full 2f+1 quorum of the ten validators, the same count QBFT itself -requires) (source: `anchor/README.md`, "Scope boundary"; `RUN-A-NODE.md`, the anchor section). +2026-08-14), 6 from block 14,961,456 (of nine then, as many as the 2f+1 quorum at that size, and below the ten-validator quorum of seven from 2026-09-11), and **7 from block 20,715,632** (AIP-22 stage 1, as many as the 2f+1 quorum of the ten validators, the same count QBFT itself requires; the seals prove those validators signed the block, not that it was decided, per the AIP-22 erratum of 2026-10-01) (source: `anchor/README.md`, "Scope boundary"; `RUN-A-NODE.md`, the anchor section). The defensible sentence, and the only form this document endorses: *every anchor block (every 32nd block; every 128th from 17,225,968 to 20,746,736) does not -finalize without a certificate of at least seven valid Falcon-512 validator seals, the full quorum of the ten validators, under its -hash (seven since block 20,715,632; six from block 14,961,456 and three before it; see the schedule and the historical windows)*. Blocks between +finalize without a certificate of at least seven valid Falcon-512 validator seals, as many as the quorum of the ten validators, under its hash (seven since block 20,715,632; six from block 14,961,456 and three before it; see the schedule and the historical windows)*. Blocks between anchors carry no Falcon seals in the header and their header is finalized by the ECDSA committed seals alone. *Amended 2026-09-17:* the consensus MESSAGES that produce every block (proposal, prepare, commit, round-change) carry and require post-quantum seals since 2026-09-08 (section @@ -469,7 +467,7 @@ can be certified over the undecided sibling of the decided block, with honest va at the height of the last anchor's parent the validators sealed that sibling in rounds that did not decide it (an adversary that controls the order of messages across three round changes at that height can bring that about); the rewrite can then reach the anchor's parent, one block deeper than -the bound above. Before stage 5 of AIP-22 (not activated on chain 2800) forging the headers takes a +the bound above. Before stage 5 of AIP-22 (on chain 2800 stages 1 to 3 are active, stage 5 is not) forging the headers takes a quorum of classical keys, which this adversary holds and a single validator does not; from stage 5 the anchor's header needs its proposer's Falcon-512 seal, which this adversary lacks and a single validator has. Measured in a test fixture with the production rules; not exercised on any network. diff --git a/anchor/README.md b/anchor/README.md index c74c413..0e3c21b 100644 --- a/anchor/README.md +++ b/anchor/README.md @@ -20,11 +20,10 @@ should not be confused: 2. **The enforced minimum.** Since 2026-08-14 a node does not finalize an anchor block unless its certificate holds at least three valid Falcon-512 seals (f+1 of nine, the guarantee that at least one honest validator signed; eight or nine are carried in practice). Raised at block - 14,961,456 (August 21, 2026): the enforced minimum became **six**, which at that time was a full - 2f+1 quorum of the nine-validator set, the same count QBFT itself required to agree on the block. + 14,961,456 (August 21, 2026): the enforced minimum became **six**, which at that time was as many as the 2f+1 quorum of the nine-validator set, the same count QBFT itself required to agree on the block. From 2026-09-11 the set was ten and QBFT's quorum seven, so the same six was above f+1 and below the quorum: the threshold had not moved, the set had. **From block 20,715,632 (AIP-22 stage 1, - armed 2026-09-29) the enforced minimum is seven, again a full 2f+1 quorum of the ten-validator set.** + armed 2026-09-29) the enforced minimum is seven, again as many as the 2f+1 quorum of the ten-validator set.** The seals prove those validators signed the block, not that it was decided (AIP-22 erratum, 2026-10-01). The schedule is `aere.pq.anchorMinSeals=13014000:0,13034000:3,14961456:6,17102384:0,17102416:6,20715632:7`, uniform on all ten validators; the startup guard refuses any threshold above N - f = 7, the highest count reachable with the fault