6cb0140fae
The public history carried kat/__pycache__/mlkem768_reference.cpython-314.pyc, a compiled Python artifact embedding the operator's absolute local path. Text secret scanners do not read compiled binaries, which is exactly how it slipped through, and removing it from the tip would have left it reachable through the old root commits. So this repository is republished from a single clean root. This root also carries, from the previously unpublished line of work: - corrected LICENSE year, LICENSING.md, VERIFY-POLICY.md, and CITATIONS-UNRESOLVED.md remeasured 2026-08-11 (101 paths, README aligned) - O-018: run_consensus_verification.py ran 19 of 29 models and reported PASS; it now runs all 29, and computemarket_smt.py gains resolveByTimeout / reclaimUnsettled cases plus a negative control - O-006: the word 'audited' removed from next to Bouncy Castle, twice, after a concurrent edit resurrected it - O-014: prior art named and dated - Algorand's native falcon_verify shipped about ten months before AERE's precompiles; the primacy claim is withdrawn where it was implied - bench/ scripts parametrized so they actually run for an outsider (the earlier textual sanitization left $STAGING unexpanded inside Python strings) - AIP-2/AIP-3 errata with measured figures, spec remeasurements at 2026-08-01, and the spec-zk-stack retractions (owner is an operational key, not the Foundation; 'maximally sound' withdrawn; aggregator V1 deprecated) The redacted bench-host environment files from the sanitized line are kept exactly as published; the unredacted local variants are not carried.
49 lines
2.2 KiB
Rust
49 lines
2.2 KiB
Rust
//! `xmss-verify-core`: the offline-testable REFERENCE model of the per-validator
|
|
//! inner logic of Aere Network's Post-Quantum Finality Certificate aggregation
|
|
//! zkVM circuit (research item #4).
|
|
//!
|
|
//! # What this crate IS
|
|
//!
|
|
//! An RFC 8391 XMSS-SHA2_10_256 signature-VERIFICATION core: WOTS+ one-time
|
|
//! signature verification plus the XMSS Merkle authentication-path check that
|
|
//! recovers a validator's long-term root public key. This is precisely the
|
|
//! computation the aggregation guest runs FOR EACH validator when it proves that a
|
|
//! quorum of validators hash-based-signed a finalized block. It is `no_std`,
|
|
//! allocation-free, float-free, hash-only, and deterministic: the exact shape a
|
|
//! zkVM circuit needs. See `xmss.rs`.
|
|
//!
|
|
//! It is validated against the OFFICIAL github.com/XMSS/xmss-reference known-answer
|
|
//! vector committed at `aerenew/contracts/test/fixtures/xmss-sha2_10_256-kat.json`,
|
|
//! the same vector the already-deployed on-chain `AereXmssVerifier.sol` and its
|
|
//! independent JS oracle use. See `tests/kat.rs`.
|
|
//!
|
|
//! # What this crate IS NOT (the honest boundary)
|
|
//!
|
|
//! This is the VERIFICATION CORE only. It is NOT the zkVM guest, NOT the SP1
|
|
//! aggregation program, NOT a proof of anything. The full off-chain aggregation
|
|
//! circuit (recover N roots, check committee membership, count a >= ceil(2N/3)
|
|
//! quorum, emit the on-chain verifier's 192-byte public values) and its SP1
|
|
//! proving pipeline are NOT implemented and are `[MEASURE]` multi-week specialist
|
|
//! work. See `../../docs/AERE-XMSS-AGGREGATION-CIRCUIT.md`.
|
|
//!
|
|
//! Nothing here changes Aere consensus, which stays classical ECDSA QBFT. This is
|
|
//! the ADDITIVE post-quantum finality-attestation read path only. PQ finality is
|
|
//! NOT live end to end.
|
|
//!
|
|
//! # Hash backend
|
|
//!
|
|
//! `sha256.rs` is a dependency-free `no_std` SHA-256 so `cargo test` runs fully
|
|
//! offline and deterministically. A production SP1 guest swaps in the SP1-patched
|
|
//! `sha2` crate (the accelerated precompile); the output bytes are identical, only
|
|
//! the in-circuit cost changes.
|
|
|
|
#![no_std]
|
|
|
|
pub mod sha256;
|
|
pub mod xmss;
|
|
pub mod vectors;
|
|
|
|
pub use xmss::{
|
|
chain_lengths, xmss_recover_root, xmss_verify, Hash, XmssPubKey, XmssSig, H, LEN, N, W,
|
|
};
|