6cb0140fae
The public history carried kat/__pycache__/mlkem768_reference.cpython-314.pyc, a compiled Python artifact embedding the operator's absolute local path. Text secret scanners do not read compiled binaries, which is exactly how it slipped through, and removing it from the tip would have left it reachable through the old root commits. So this repository is republished from a single clean root. This root also carries, from the previously unpublished line of work: - corrected LICENSE year, LICENSING.md, VERIFY-POLICY.md, and CITATIONS-UNRESOLVED.md remeasured 2026-08-11 (101 paths, README aligned) - O-018: run_consensus_verification.py ran 19 of 29 models and reported PASS; it now runs all 29, and computemarket_smt.py gains resolveByTimeout / reclaimUnsettled cases plus a negative control - O-006: the word 'audited' removed from next to Bouncy Castle, twice, after a concurrent edit resurrected it - O-014: prior art named and dated - Algorand's native falcon_verify shipped about ten months before AERE's precompiles; the primacy claim is withdrawn where it was implied - bench/ scripts parametrized so they actually run for an outsider (the earlier textual sanitization left $STAGING unexpanded inside Python strings) - AIP-2/AIP-3 errata with measured figures, spec remeasurements at 2026-08-01, and the spec-zk-stack retractions (owner is an operational key, not the Foundation; 'maximally sound' withdrawn; aggregator V1 deprecated) The redacted bench-host environment files from the sanitized line are kept exactly as published; the unredacted local variants are not carried.
94 lines
4.2 KiB
JSON
94 lines
4.2 KiB
JSON
{
|
|
"component": "Poseidon2 permutation over BabyBear, width 16 (port spec component (b))",
|
|
"precompile": "0x0000000000000000000000000000000000000ae8",
|
|
"scope": "port spec section 3; the hash Plonky3/SP1 uses for Merkle/MMCS compression and the Fiat-Shamir duplex challenger",
|
|
"validates": "SELF-CONSISTENCY + CONFORMANCE: x^7 is a bijection (7 = smallest coprime degree, proven); the permutation is deterministic and a genuine bijection (inverse round-trip, no collisions); M4 is MDS and the external/internal linear layers are invertible; Python/Node/Java produce byte-identical outputs; AND the permutation reproduces real known-answer vectors from the pinned p3-baby-bear / p3-poseidon2 0.4.3-succinct crates (the 'two wrong copies agree' trap is closed).",
|
|
"does_not_validate": "the FULL STARK verifier. Only component (b) (the Poseidon2 permutation) is confirmed. The duplex-sponge challenger, FRI folding/consistency, MMCS/Merkle openings, and the SP1 recursion-AIR are un-ported.",
|
|
"top_level_verifier": "unchanged, still fail-closed (returns EMPTY for every input). Poseidon2Bb.available is now true (the permutation is confirmed), but the challenger/FRI/AIR are still un-ported (Challenger.spongePorted=false, StarkConstraints=UNAVAILABLE), so the top level still returns EMPTY.",
|
|
"constants": {
|
|
"P": 2013265921,
|
|
"r_inv": 943718400,
|
|
"width": 16,
|
|
"sbox_degree": 7,
|
|
"rounds_f": 8,
|
|
"rounds_p": 13,
|
|
"internal_diag_m1_16": [
|
|
2013265919,
|
|
1,
|
|
2,
|
|
4,
|
|
8,
|
|
16,
|
|
32,
|
|
64,
|
|
128,
|
|
256,
|
|
512,
|
|
1024,
|
|
2048,
|
|
4096,
|
|
8192,
|
|
32768
|
|
],
|
|
"internal_layer_form": "M_I = R_INV * (J + diag(D)), R_INV = 943718400 (Montgomery artifact)",
|
|
"m4": [
|
|
2,
|
|
3,
|
|
1,
|
|
1,
|
|
1,
|
|
2,
|
|
3,
|
|
1,
|
|
1,
|
|
1,
|
|
2,
|
|
3,
|
|
3,
|
|
1,
|
|
1,
|
|
2
|
|
],
|
|
"round_constants": "141 CONFIRMED constants (128 external + 13 internal) from Xoroshiro128Plus::seed_from_u64(1) via new_from_rng_128"
|
|
},
|
|
"cross_language": [
|
|
"java",
|
|
"node",
|
|
"python"
|
|
],
|
|
"conformance": {
|
|
"status": "CONFIRMED (real known-answer test PASSED)",
|
|
"method": "the exact pinned crates were executed via cargo (lockfile checksums matched) to emit constants + 3 permutation vectors; this reference reproduces all 3 exactly",
|
|
"vectors": [
|
|
"zeros",
|
|
"iota",
|
|
"testvec"
|
|
]
|
|
},
|
|
"pinned_conformance_target": {
|
|
"revision": "Succinct Plonky3 fork, crates.io version 0.4.3-succinct",
|
|
"p3_poseidon2_checksum": "522986377b2164c5f94f2dae88e0e0a3d169cc6239202ef4aeb4322d60feffd0",
|
|
"p3_baby_bear_checksum": "d69e6e9af4eaaaa60f7bb9f0e0f73ebcbaefe7e00974d97ad0fa542d6a4f0890",
|
|
"found_in": "aerenew/zk-circuits/*/Cargo.lock and aerenew/rollup-evm-validity/*/Cargo.lock"
|
|
},
|
|
"confirmed": [
|
|
"CONFIRMED round constants: 128 external + 13 internal from seed_from_u64(1) / new_from_rng_128",
|
|
"CONFIRMED ROUNDS_F=8, ROUNDS_P=13 (poseidon2_round_numbers_128(16, 7))",
|
|
"CONFIRMED M4 = [[2,3,1,1],[1,2,3,1],[1,1,2,3],[3,1,1,2]] (recovered from Poseidon2ExternalMatrixGeneral)",
|
|
"CONFIRMED INTERNAL_DIAG_M1_16 (canonical) and the R^{-1}*(J+diag(D)) internal-layer form (Montgomery artifact, recovered exactly from DiffusionMatrixBabyBear's 16x16 canonical matrix)",
|
|
"CONFORMANCE KAT PASSED against p3-baby-bear / p3-poseidon2 0.4.3-succinct (checksums matched)"
|
|
],
|
|
"flags": [
|
|
"[VERIFY] the SP1 v6.1.0 Merkle/MMCS compression convention (padding/rate, which 8 lanes) for compress2to1 (component (c)) is not yet pinned"
|
|
],
|
|
"notes": [
|
|
"S-box x^7 CONFIRMED: 7 is the smallest d>1 with gcd(d, p-1)=1 (p-1 = 2^27*3*5), so x^7 is a bijection on F_p",
|
|
"permutation is a bijection: inverse round-trips on 3000 random states + fixed set; 3000 distinct outputs, 0 collisions",
|
|
"M4 is MDS (all 69 square submatrices nonsingular); external layer M_E and internal layer M_I = R^{-1}*(J + diag(D)) are invertible over F_p (both CONFIRMED vs p3)",
|
|
"CONFORMANCE: 3/3 known-answer vectors from p3-baby-bear/p3-poseidon2 0.4.3-succinct reproduced exactly (zeros, iota [0..15], testvec)",
|
|
"cross-language implementations compared: java, node, python"
|
|
],
|
|
"passed": 47017,
|
|
"failed": 0,
|
|
"total": 47017
|
|
} |