docs(shielded-pq): restate "128-bit" as classical soundness, scope QROM (PQV2-05) - #23
Merged
Merged
Conversation
…, scope QROM (PQV2-05) The pool-v2 STARK's 128-bit figure is a CLASSICAL FRI soundness bound (proven Johnson/list-decoding radius), not an established post-quantum (QROM) security level. Claiming it as post-quantum overstates it. This is a claims-accuracy fix only: no crypto, FRI parameters, gas, or consensus digest changed; proof_options() is byte-identical. Restated every occurrence found: - prover.rs proof_options() docstring: table relabeled conjectured/proven (classical); explicit "what 128 is and is NOT" block naming the QROM gap and Grover erosion, keeping the genuine no-Shor-target advantage. - lib.rs, pq-shielded-design.md, pq-shielded-soundness.md (§10 header + §8 item 7), quantum-posture.md, and two test comments. Kept genuinely-true PQ claims intact (ML-DSA-65, ML-KEM-768, hash-only / no Shor target). Did not fabricate a QROM proof. - notes/audit-scope-pq-pool.md §9: precise scope of the QROM / post-quantum soundness analysis required before any public "post-quantum secure" claim or before arming bit 2. - notes/pq-pool-v2-audit-response.md: PQV2-05 resolution — restated + QROM-scoped, accepted in writing as a pending arming prerequisite. cargo build --workspace green; cargo fmt -p sov-shielded-pq --check clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PQV2-05 — claims accuracy: "128-bit post-quantum" is a classical bound
Closes the audit Medium PQV2-05. The pool-v2 STARK's 128-bit figure is a
classical FRI soundness bound (proven Johnson / list-decoding radius for the
shipped 64q / blowup 16 / 16-bit grinding / cubic-extension parameters). It is
not an established post-quantum (QROM) security level, so quoting it as
"128-bit post-quantum" overstates it.
This is a claims-accuracy PR only: no crypto, no FRI parameters, no gas, no
consensus digest changed.
proof_options()is byte-identical; every proof/consensusKAT reproduces unchanged. Bit 2 is UNARMED on every canonical chain.
What was restated (every occurrence found)
chain/crates/shielded-pq/src/prover.rs—proof_options()docstring: table columns relabeled conjectured (classical) / proven (classical); new "what 128 is and is NOT" block naming the QROM gap and the Grover erosion of grinding/hash margins; the terse "no number-theoretic assumption a quantum adversary could break" line is expanded (kept as a genuine no-Shor-target advantage, but no longer implying a quantified PQ level).chain/crates/shielded-pq/src/lib.rs,chain/docs/pq-shielded-design.md,chain/docs/pq-shielded-soundness.md(§10 header + §8 item 7),chain/docs/quantum-posture.md, and two test comments (security_level.rs,decode_hardening.rs).What was NOT downgraded
Genuinely-established PQ claims kept intact: hybrid ML-DSA-65 (FIPS 204) spend auth, hybrid ML-KEM-768 (FIPS 203) note encryption, and hash-only soundness with no Shor-breakable assumption. No QROM proof was fabricated.
QROM analysis — scoped and pending
notes/audit-scope-pq-pool.md§9 now specifies exactly what a post-quantum soundness analysis must cover (QROM Fiat-Shamir round-by-round soundness at the shipped params, Grover erosion of grinding, Grover/BHT erosion of hash commitments, QROM query model, one reconciled bit figure + PQ-target parameter set).notes/pq-pool-v2-audit-response.md— PQV2-05 resolution: restated + QROM-scoped, accepted in writing as a pending arming prerequisite (one of the two allowed ways to clear a Medium). Added to the arming bar: no public "post-quantum secure" statement and no arming of bit 2 until §9 is completed.No user-facing overstatement found
No Station GUI / CLI / explorer / README / release-note surface claimed "128-bit post-quantum" for pool v2 (release notes correctly call it "dormant and incomplete"). The claim lived only in crate docs/comments and the two design docs — all corrected.
Verification
cargo build --workspace— green (doc/comment-only changes).cargo fmt -p sov-shielded-pq --check— clean.🤖 Generated with Claude Code