6cb0140fae
The public history carried kat/__pycache__/mlkem768_reference.cpython-314.pyc, a compiled Python artifact embedding the operator's absolute local path. Text secret scanners do not read compiled binaries, which is exactly how it slipped through, and removing it from the tip would have left it reachable through the old root commits. So this repository is republished from a single clean root. This root also carries, from the previously unpublished line of work: - corrected LICENSE year, LICENSING.md, VERIFY-POLICY.md, and CITATIONS-UNRESOLVED.md remeasured 2026-08-11 (101 paths, README aligned) - O-018: run_consensus_verification.py ran 19 of 29 models and reported PASS; it now runs all 29, and computemarket_smt.py gains resolveByTimeout / reclaimUnsettled cases plus a negative control - O-006: the word 'audited' removed from next to Bouncy Castle, twice, after a concurrent edit resurrected it - O-014: prior art named and dated - Algorand's native falcon_verify shipped about ten months before AERE's precompiles; the primacy claim is withdrawn where it was implied - bench/ scripts parametrized so they actually run for an outsider (the earlier textual sanitization left $STAGING unexpanded inside Python strings) - AIP-2/AIP-3 errata with measured figures, spec remeasurements at 2026-08-01, and the spec-zk-stack retractions (owner is an operational key, not the Foundation; 'maximally sound' withdrawn; aggregator V1 deprecated) The redacted bench-host environment files from the sanitized line are kept exactly as published; the unredacted local variants are not carried.
60 lines
5.1 KiB
JSON
60 lines
5.1 KiB
JSON
{
|
|
"component": "FRI low-degree test / query verification over BabyBear (port spec component (d))",
|
|
"precompile": "0x0000000000000000000000000000000000000ae8",
|
|
"scope": "port spec section 5; the FRI verifier's FOLD + OPENING relations (verify_query / verify_challenges): arity-2 folding in F_{p^4}, per-layer MMCS openings against the commit-phase roots, down to a single constant equal to the committed final polynomial.",
|
|
"validates": "CONFORMANCE: real FRI proofs emitted by the pinned Plonky3 p3-fri 0.4.3-succinct PROVER (and accepted by its own verifier) are re-verified byte-for-byte by this reference (accept), and four tamper variants are rejected (corrupted opened value, corrupted MMCS sibling digest, wrong fold challenge beta, non-matching final poly); Python/Node/Java produce byte-identical per-query folded values.",
|
|
"does_not_validate": "the SP1 recursion-AIR constraint evaluation (component (e)), which supplies the reduced openings and is UN-PORTED. Within THIS FRI KAT the betas / query indices are supplied as inputs; deriving them in-circuit is component (f) (the duplex-sponge challenger), now CONFIRMED separately (test_challenger.py), whose derived betas/indices close the loop into this verify_query.",
|
|
"top_level_verifier": "unchanged, still FAIL-CLOSED (returns EMPTY for every input). Even with the FRI fold+opening (d) and the challenger (f) confirmed, StarkConstraints.evaluateAtZeta=UNAVAILABLE (component (e)), so verify() never reaches ACCEPT and computePrecompile returns EMPTY. ACCEPT is unreachable. DO NOT ACTIVATE.",
|
|
"confirmed_config": {
|
|
"folding_arity": 2,
|
|
"sibling_rule": "index_sibling = index ^ 1, index_pair = index >> 1 (p3-fri verifier.rs)",
|
|
"num_fold_rounds": "log_max_height - log_blowup (final poly is a single F_{p^4} CONSTANT)",
|
|
"log_max_height": "commit_phase_commits.len() + log_blowup",
|
|
"commit_phase_mmcs": "ExtensionMmcs<Val,Challenge,ValMmcs> over the CONFIRMED FieldMerkleTreeMmcs (component (c)); a commit-phase leaf is a pair of F_{p^4} evals flattened to 8 BabyBear coords, hashed by the PaddingFreeSponge",
|
|
"coset_point": "x = two_adic_generator(log_max_height)^reverse_bits_len(index, log_max_height), in F_{p^4}; the sibling point is -x (two_adic_generator(1))",
|
|
"fold_relation": "folded = e0 + (beta - x0) * (e1 - e0) / (x1 - x0) (linear interpolation through beta), plus reduced_openings[log_folded_height+1] injected before each fold",
|
|
"final_poly_check": "every query's folded constant must equal proof.final_poly"
|
|
},
|
|
"confirmed_by_kat": [
|
|
"CONFIRMED arity-2 fold (sibling=index^1, index_pair=index>>1) vs p3-fri verifier.rs",
|
|
"CONFIRMED num_fold_rounds = log_max_height - log_blowup; final poly is a single F_{p^4} constant",
|
|
"CONFIRMED reverse_bits_len index-to-coset-point mapping (x = g^rev(index))",
|
|
"CONFIRMED two_adic_generator(bits) matches Plonky3 (the fold coset points are correct)",
|
|
"CONFIRMED the F_{p^4} non-residue W = 11 is Plonky3's (the EF fold arithmetic reproduces the fold)",
|
|
"CONFIRMED the ExtensionMmcs flatten (each F_{p^4} eval -> 4 base coords, pair -> 8) + base MMCS open"
|
|
],
|
|
"cross_language": [
|
|
"java",
|
|
"node",
|
|
"python"
|
|
],
|
|
"conformance": {
|
|
"status": "CONFIRMED (real known-answer test PASSED: accept genuine + reject tampered)",
|
|
"method": "pq-stark/fri-extractor (a Rust binary depending on the pinned crates; lockfile checksums matched) ran p3_fri::prover::prove over known low-degree codewords with the seed_from_u64(1) Poseidon2, then p3_fri::verifier::{verify_shape_and_sample_challenges,verify_challenges} to confirm the library accepts; its output is fri_ground_truth.json",
|
|
"cases": [
|
|
"blowup1_h6_q4",
|
|
"blowup2_h7_q5",
|
|
"blowup1_h8_q6"
|
|
]
|
|
},
|
|
"pinned_conformance_target": {
|
|
"revision": "Succinct Plonky3 fork, crates.io version 0.4.3-succinct",
|
|
"p3_fri_checksum": "5cbc4965ee488f3247867b7ec4bb005b8afa72cb0d461a4dcb1387ecab6426d5",
|
|
"p3_challenger_checksum": "b6a908924d43e4cfb93fb41c8346cac211b70314385a9037e9241f5b7f3eaf77",
|
|
"p3_dft_checksum": "be6408b10a2c27eb13a7d5580c546c2179a8dc7dbc10a990657311891f9b41c0",
|
|
"p3_commit_checksum": "50acacc7219fce6c01db938f82c1b21b5e7133990b7fff861f91534aeb569419",
|
|
"found_in": "aerenew/zk-circuits/*/Cargo.lock and aerenew/rollup-evm-validity/*/Cargo.lock"
|
|
},
|
|
"flags": [
|
|
"[VERIFY]->CONFIRMED here: arity-2 fold, num_fold_rounds, reverse-bits mapping, two_adic_generator, W=11 (all exercised by the accept-KAT over the pinned p3-fri proof)",
|
|
"[MEASURE] conformance against a REAL exported SP1 v6.1.0 inner proof's FRI section (needs the exported proof + the AIR reduced-openings, component (e))",
|
|
"component (f) transcript binding is now CONFIRMED (Challenger.spongePorted=true; the derived betas/indices close the loop into this verify_query, see test_challenger.py). The top level stays fail-closed on the AIR (component (e), StarkConstraints=UNAVAILABLE)"
|
|
],
|
|
"notes": [
|
|
"CONFORMANCE: 3 FRI proofs from the pinned p3-fri 0.4.3-succinct prover accepted; 4 tamper variants each rejected (opening, MMCS proof, beta, final poly)",
|
|
"cross-language implementations compared: java, node, python"
|
|
],
|
|
"passed": 55,
|
|
"failed": 0,
|
|
"total": 55
|
|
} |