Validation dossier — not broken, really scales, full pentest battery (extreme scrutiny)¶
The new (stateless / message-bound / F-OFFSET σ=3β) version, validated three ways: regression (every earlier test re-run against the current revision), scale (measured to 2^17 signers + 512 stateless decisions), and a pentest battery (every attack we could mount).
1. Not broken — full regression (current revision)¶
- Go (go-mladsa): entire historical test suite re-run, 0 failures (incl. KAT byte-stability after the
AggregateOffsetF→core refactor that added the stateless
AggregateOffsetFMB). - Formal:
check-all.shALL GREEN — 33 classical EasyCrypt + 5 quantum (EasyPQC) + 5 Coq; genuineness 53/53. - Integration devnet package (qrysm/mladsa): full suite green; new version ported, existing devnet tests unaffected.
2. Really scales (measured, byte-exact, σ=3β)¶
| dimension | result |
|---|---|
| single aggregate cohort | byte-exact to n = 2^17 = 131072 signers (‖Σz‖∞ = 54.2% of wall, hint 70≤ω, 1 attempt); 8192 at 12.7% |
| stateless decisions per fixed key | 512 distinct decisions, ONE committee, NO rotation, NO one-time guard, all byte-exact + unique |
| recovery vs #uses (saturation) | flat 387 ≥ native to Qd=256 (Sage dual+hybrid) — accumulation does not erode |
| aggregate key hardness | nc=3000 → 515 classical / 467 quantum (≫ native) |
| total signers | unbounded via committee sharding (#117) |
3. Pentest battery — extreme scrutiny (every attack defended or contained)¶
Forgery / impersonation: fresh-content unforgeable; malicious insider cannot forge a fresh message; SelfTargetMSIS = native; rogue-key (bad PoP) rejected; aggregate malleability rejected; Merkle-proof forgery rejected; duplicate-participant collapsed; malformed input → no forge, no panic.
MitM / replay: all 7 bound fields (payload, epoch, ctx-domain, regRoot, partRoot, sig, pk) tamper-evident; cross-context/cross-chain replay blocked; metadata tamper rejected; verbatim replay = same valid sig ⇒ app consumes (epoch,decision) once.
Key-leak / nonce: full-w leaks the nonce by linear algebra (demonstrated) but F-OFFSET eliminates it (1792/1792 corrupted ⇒ ≥native LWE); nonce reuse recovers the key (demonstrated) but is contained — one-time discipline OR (new) message-bound nonce forbids the collision; recovered spent key only re-signs the already-agreed decision (binding containment, A13/finding-#3).
Byzantine: Byzantine nonce/response → safe abstention, never forgery; equivocation detected (audit); decoys carry weight 0; sub-threshold aggregates are valid sigs (tally-layer policy).
Stateless-specific battery (new version): message-bound reuse safe (distinct nonces 64/64); same-decision re-sign idempotent; hiding broadcast (full w never published); one-time guard NOT required.
Live-round (pre-finalization): commit phase is nonce-only (s1 untouched); response ≥native-hides s1; no exploitable window to steal the live key.
4. What can break it (honest) — and the mitigation, no requirement dropped¶
| Attack that works | Why it's not a deployment break | Requirement kept |
|---|---|---|
| Nonce REUSE (same nonce, two messages) → recover s1 | Message-bound nonce (or one-time guard) makes the nonce differ per decision ⇒ reuse impossible by construction | stateless, no rotation |
| Recover a SPENT one-time key | Bound message: a spent key re-signs only the already-agreed decision (a no-op); refresh confines | byte-exact, no leak of live/future/root |
| Unbounded LWE-sample accumulation (info-theoretic) | Saturates at ≥native for any realistic Q; refresh available as defense-in-depth | many-time |
| Forge >Cat-5 | Not possible (lattice hardness) — and not required (byte-exact FIPS caps at Cat-5) | PQ Cat-5 |
No mitigation drops a requirement: every defense is either intrinsic (binding, secret-blind verifier) or the message-bound/refresh discipline, all consistent with byte-exact FIPS-204, non-interactivity, no-setup, order-independence, hide-≤native, and many-time/no-rotation.