4a0b48588c
Aere Network public source. Everything here can be checked against the live chain (chain id 2800, https://rpc.aere.network). Scope note, stated up front rather than buried: consensus on chain 2800 is classical secp256k1 ECDSA QBFT. The post-quantum work in this repository is at the signature, precompile, account and transport layers. Nothing here makes the consensus post-quantum, and no document in it should be read as claiming so.
94 lines
4.2 KiB
JSON
94 lines
4.2 KiB
JSON
{
|
|
"component": "Poseidon2 permutation over BabyBear, width 16 (port spec component (b))",
|
|
"precompile": "0x0000000000000000000000000000000000000ae8",
|
|
"scope": "port spec section 3; the hash Plonky3/SP1 uses for Merkle/MMCS compression and the Fiat-Shamir duplex challenger",
|
|
"validates": "SELF-CONSISTENCY + CONFORMANCE: x^7 is a bijection (7 = smallest coprime degree, proven); the permutation is deterministic and a genuine bijection (inverse round-trip, no collisions); M4 is MDS and the external/internal linear layers are invertible; Python/Node/Java produce byte-identical outputs; AND the permutation reproduces real known-answer vectors from the pinned p3-baby-bear / p3-poseidon2 0.4.3-succinct crates (the 'two wrong copies agree' trap is closed).",
|
|
"does_not_validate": "the FULL STARK verifier. Only component (b) (the Poseidon2 permutation) is confirmed. The duplex-sponge challenger, FRI folding/consistency, MMCS/Merkle openings, and the SP1 recursion-AIR are un-ported.",
|
|
"top_level_verifier": "unchanged, still fail-closed (returns EMPTY for every input). Poseidon2Bb.available is now true (the permutation is confirmed), but the challenger/FRI/AIR are still un-ported (Challenger.spongePorted=false, StarkConstraints=UNAVAILABLE), so the top level still returns EMPTY.",
|
|
"constants": {
|
|
"P": 2013265921,
|
|
"r_inv": 943718400,
|
|
"width": 16,
|
|
"sbox_degree": 7,
|
|
"rounds_f": 8,
|
|
"rounds_p": 13,
|
|
"internal_diag_m1_16": [
|
|
2013265919,
|
|
1,
|
|
2,
|
|
4,
|
|
8,
|
|
16,
|
|
32,
|
|
64,
|
|
128,
|
|
256,
|
|
512,
|
|
1024,
|
|
2048,
|
|
4096,
|
|
8192,
|
|
32768
|
|
],
|
|
"internal_layer_form": "M_I = R_INV * (J + diag(D)), R_INV = 943718400 (Montgomery artifact)",
|
|
"m4": [
|
|
2,
|
|
3,
|
|
1,
|
|
1,
|
|
1,
|
|
2,
|
|
3,
|
|
1,
|
|
1,
|
|
1,
|
|
2,
|
|
3,
|
|
3,
|
|
1,
|
|
1,
|
|
2
|
|
],
|
|
"round_constants": "141 CONFIRMED constants (128 external + 13 internal) from Xoroshiro128Plus::seed_from_u64(1) via new_from_rng_128"
|
|
},
|
|
"cross_language": [
|
|
"java",
|
|
"node",
|
|
"python"
|
|
],
|
|
"conformance": {
|
|
"status": "CONFIRMED (real known-answer test PASSED)",
|
|
"method": "the exact pinned crates were executed via cargo (lockfile checksums matched) to emit constants + 3 permutation vectors; this reference reproduces all 3 exactly",
|
|
"vectors": [
|
|
"zeros",
|
|
"iota",
|
|
"testvec"
|
|
]
|
|
},
|
|
"pinned_conformance_target": {
|
|
"revision": "Succinct Plonky3 fork, crates.io version 0.4.3-succinct",
|
|
"p3_poseidon2_checksum": "522986377b2164c5f94f2dae88e0e0a3d169cc6239202ef4aeb4322d60feffd0",
|
|
"p3_baby_bear_checksum": "d69e6e9af4eaaaa60f7bb9f0e0f73ebcbaefe7e00974d97ad0fa542d6a4f0890",
|
|
"found_in": "aerenew/zk-circuits/*/Cargo.lock and aerenew/rollup-evm-validity/*/Cargo.lock"
|
|
},
|
|
"confirmed": [
|
|
"CONFIRMED round constants: 128 external + 13 internal from seed_from_u64(1) / new_from_rng_128",
|
|
"CONFIRMED ROUNDS_F=8, ROUNDS_P=13 (poseidon2_round_numbers_128(16, 7))",
|
|
"CONFIRMED M4 = [[2,3,1,1],[1,2,3,1],[1,1,2,3],[3,1,1,2]] (recovered from Poseidon2ExternalMatrixGeneral)",
|
|
"CONFIRMED INTERNAL_DIAG_M1_16 (canonical) and the R^{-1}*(J+diag(D)) internal-layer form (Montgomery artifact, recovered exactly from DiffusionMatrixBabyBear's 16x16 canonical matrix)",
|
|
"CONFORMANCE KAT PASSED against p3-baby-bear / p3-poseidon2 0.4.3-succinct (checksums matched)"
|
|
],
|
|
"flags": [
|
|
"[VERIFY] the SP1 v6.1.0 Merkle/MMCS compression convention (padding/rate, which 8 lanes) for compress2to1 (component (c)) is not yet pinned"
|
|
],
|
|
"notes": [
|
|
"S-box x^7 CONFIRMED: 7 is the smallest d>1 with gcd(d, p-1)=1 (p-1 = 2^27*3*5), so x^7 is a bijection on F_p",
|
|
"permutation is a bijection: inverse round-trips on 3000 random states + fixed set; 3000 distinct outputs, 0 collisions",
|
|
"M4 is MDS (all 69 square submatrices nonsingular); external layer M_E and internal layer M_I = R^{-1}*(J + diag(D)) are invertible over F_p (both CONFIRMED vs p3)",
|
|
"CONFORMANCE: 3/3 known-answer vectors from p3-baby-bear/p3-poseidon2 0.4.3-succinct reproduced exactly (zeros, iota [0..15], testvec)",
|
|
"cross-language implementations compared: java, node, python"
|
|
],
|
|
"passed": 47017,
|
|
"failed": 0,
|
|
"total": 47017
|
|
} |