6cb0140fae
The public history carried kat/__pycache__/mlkem768_reference.cpython-314.pyc, a compiled Python artifact embedding the operator's absolute local path. Text secret scanners do not read compiled binaries, which is exactly how it slipped through, and removing it from the tip would have left it reachable through the old root commits. So this repository is republished from a single clean root. This root also carries, from the previously unpublished line of work: - corrected LICENSE year, LICENSING.md, VERIFY-POLICY.md, and CITATIONS-UNRESOLVED.md remeasured 2026-08-11 (101 paths, README aligned) - O-018: run_consensus_verification.py ran 19 of 29 models and reported PASS; it now runs all 29, and computemarket_smt.py gains resolveByTimeout / reclaimUnsettled cases plus a negative control - O-006: the word 'audited' removed from next to Bouncy Castle, twice, after a concurrent edit resurrected it - O-014: prior art named and dated - Algorand's native falcon_verify shipped about ten months before AERE's precompiles; the primacy claim is withdrawn where it was implied - bench/ scripts parametrized so they actually run for an outsider (the earlier textual sanitization left $STAGING unexpanded inside Python strings) - AIP-2/AIP-3 errata with measured figures, spec remeasurements at 2026-08-01, and the spec-zk-stack retractions (owner is an operational key, not the Foundation; 'maximally sound' withdrawn; aggregator V1 deprecated) The redacted bench-host environment files from the sanitized line are kept exactly as published; the unredacted local variants are not carried.
37 lines
2.2 KiB
JSON
37 lines
2.2 KiB
JSON
{
|
|
"component": "BabyBear field F_p + degree-4 extension F_{p^4} (port spec component (a), FOUNDATION)",
|
|
"precompile": "0x0000000000000000000000000000000000000ae8",
|
|
"scope": "port spec section 2; the field-arithmetic foundation the whole STARK verifier is built on",
|
|
"validates": "F_p and F_{p^4} field axioms; Fermat inverse vs independent extended-Euclid bignum; generator has order p-1; two-adic generator order 2^k; W is a QNR so x^4-W is irreducible (real field); across Python/Node/Java",
|
|
"does_not_validate": "any real STARK proof (this is only component (a) of six); and that GENERATOR=31 / W=11 / two_adic_generator(27) are Plonky3's EXACT constants ([VERIFY]/[MEASURE] vs p3-baby-bear at pinned SP1 v6.1.0)",
|
|
"top_level_verifier": "unchanged, still fail-closed (returns EMPTY for every input)",
|
|
"constants": {
|
|
"P": 2013265921,
|
|
"P_expr": "2^31 - 2^27 + 1 = 15*2^27 + 1 = 0x78000001",
|
|
"generator": 31,
|
|
"two_adicity": 27,
|
|
"two_adic_generator_27": 440564289,
|
|
"W": 11
|
|
},
|
|
"cross_language": [
|
|
"java",
|
|
"node",
|
|
"python"
|
|
],
|
|
"flags": [
|
|
"[VERIFY] GENERATOR = 31 is Plonky3 p3-baby-bear's chosen multiplicative generator (order = p-1 is PROVEN here; the identity as Plonky3's is [VERIFY])",
|
|
"[VERIFY] W = 11 is Plonky3's BabyBear BinomialExtensionField<_,4> non-residue (x^4-11 irreducibility is PROVEN here; the identity as Plonky3's W is [VERIFY]/[MEASURE])",
|
|
"[VERIFY] two_adic_generator(27) exact value vs Plonky3 (order 2^27 is PROVEN here)",
|
|
"[MEASURE] byte-for-byte conformance of Fp/Fp4 outputs vs p3-baby-bear / p3-field unit vectors at the pinned revision (needs the pinned Plonky3 source)"
|
|
],
|
|
"notes": [
|
|
"multiplicative generator 31 proven order = p-1 = 2013265920 [VERIFY it is Plonky3's]",
|
|
"two_adic_generator(27) = 440564289, order proven 2^27 [VERIFY exact Plonky3 value]",
|
|
"W = 11: 11^((p-1)/2) == p-1 (QNR) and p == 1 mod 4 => x^4 - 11 irreducible (Lidl-Niederreiter Thm 3.75) => F_(p^4) is a genuine field [VERIFY it is Plonky3's W]",
|
|
"ord(W=11) = 671088640 = 2^27 * 5; ord(x) = 4*ord(W) = 2684354560 divides 4(p-1)",
|
|
"cross-language implementations compared: java, node, python"
|
|
],
|
|
"passed": 396242,
|
|
"failed": 0,
|
|
"total": 396242
|
|
} |