Activate the C1 production profile for end-to-end post-quantum soundness #4

Merged

ignotusnemo merged 10 commits from v2 into main

2026-08-07 07:58:39 +00:00

ignotusnemo commented

2026-08-07 07:57:12 +00:00

(Migrated from github.com)

Summary

This PR activates C1 as the canonical production proof profile for Parano1d.

The profile extends algebraic Fiat–Shamir challenges, terminal claims and recursive region authentication into GF(2^256), while committed traces and Poseidon2b remain over GF(2^128).

The mandatory joint HistoryStep path covers wallet authorization, the block relation, parent linkage, the exact State transition and recursive verification in one end-to-end security game.

Under the fixed Poseidon2b delta and coherent response-cost premises stated in the theorem, the production profile meets NIST PQC Category 1 for State validation from genesis.

Production profile

Parameter	Production value
Committed trace field	`GF(2^128)`
Poseidon2b arithmetic	`GF(2^128)`
Wide challenge field	`GF(2^256)`
Challenge support	Trace-one affine set of cardinality `2^255`
Transcript digest	256 bits
Wallet Fiat–Shamir queries	65
History/BaseFold queries	133
Joint recursive batch	3 Link regions and 6 Block regions
B25 History class	`m = 22`, `N = 2^19`, up to 25 positions
B255 History class	`m = 24`, `N = 2^21`, up to 255 positions
FRI rate	`1/4`
Target FRI security	128 bits

Security results

Security statement	Production result
Target FRI security	128 bits
Provable Block–Tiwari FS-FRI security	127 bits
Conjectured Block–Tiwari FS-FRI security	127 bits
Sequential ideal-QROM half-success boundary	64.707407428576 bits
NIST Post-Quantum Cryptography Category	Category 1
Dominant Category 1 gate-depth floor	173.273866314232 bits
Margin over the NIST `2^170` reference	3.273866314232 bits
Complete ideal bound at the Category 1 envelope	0.053364140323608411

Category 1 calculation

Resource term	Evaluated value
NIST AES-128 gate-depth reference	`2^170`
Evaluated NIST `MAXDEPTH` points	`2^40`, `2^64`, `2^96`
Largest finite envelope	`MAXDEPTH = 2^40`
Limiting typed event	`wallet.query`
Coherent Poseidon2b response gates	`17,648,280`
Coherent Poseidon2b response depth	`11,352`
Coherent response gate-depth	`200,343,274,560`
Ideal main term	`≤ 0.051693750450980417`
Typed finite term	`≤ 0.000199022715317804`
Global collision bound	`≤ 0.001471367157310191`
Complete ideal envelope	`≤ 0.053364140323608411`
Fixed Poseidon2b condition	`Delta_P2b^C1 < 0.446635859676391589`

The dominant half-success gate-depth floor is above the NIST Category 1 reference, while the complete ideal success bound remains below one half throughout the evaluated resource envelope.

Production activation

This PR:

implements the GF(2^256) challenge field and production C1 transcript;
adds the C1 zerocheck, lincheck, matrix-folding, PCS, BaseFold and recursive verification paths;
binds all nine recursive Link and Block regions through one joint GF(2^256) transcript;
makes the joint C1 HistoryStep terminal the mandatory production authority;
adopts B25 and B255 as the canonical production History classes;
adds the source-linked noid_soundness executable certificate and exact rational calculator;
updates production tests, benchmarks, release workflows and multilingual documentation;
includes the matrix-folding and sidecar-validation optimizations required by the production profile.

Reproduction

cargo run --release --locked -p noid_soundness
cargo test --release --locked -p noid_soundness

The certificate imports the parameters used by the production prover and verifier, checks their correspondence and evaluates the security inequalities with arbitrary-precision integer and rational arithmetic.

Current validation completes with all 20 certificate tests passing.

Research and certificate

## Summary This PR activates `C1` as the canonical production proof profile for Parano1d. The profile extends algebraic Fiat–Shamir challenges, terminal claims and recursive region authentication into `GF(2^256)`, while committed traces and Poseidon2b remain over `GF(2^128)`. The mandatory joint `HistoryStep` path covers wallet authorization, the block relation, parent linkage, the exact State transition and recursive verification in one end-to-end security game. Under the fixed Poseidon2b delta and coherent response-cost premises stated in the theorem, the production profile meets NIST PQC Category 1 for State validation from genesis. ## Production profile | Parameter | Production value | |---|---:| | Committed trace field | `GF(2^128)` | | Poseidon2b arithmetic | `GF(2^128)` | | Wide challenge field | `GF(2^256)` | | Challenge support | Trace-one affine set of cardinality `2^255` | | Transcript digest | 256 bits | | Wallet Fiat–Shamir queries | 65 | | History/BaseFold queries | 133 | | Joint recursive batch | 3 Link regions and 6 Block regions | | B25 History class | `m = 22`, `N = 2^19`, up to 25 positions | | B255 History class | `m = 24`, `N = 2^21`, up to 255 positions | | FRI rate | `1/4` | | Target FRI security | 128 bits | ## Security results | Security statement | Production result | |---|---:| | Target FRI security | **128 bits** | | Provable Block–Tiwari FS-FRI security | **127 bits** | | Conjectured Block–Tiwari FS-FRI security | **127 bits** | | Sequential ideal-QROM half-success boundary | **64.707407428576 bits** | | NIST Post-Quantum Cryptography Category | **Category 1** | | Dominant Category 1 gate-depth floor | **173.273866314232 bits** | | Margin over the NIST `2^170` reference | **3.273866314232 bits** | | Complete ideal bound at the Category 1 envelope | **0.053364140323608411** | ## Category 1 calculation | Resource term | Evaluated value | |---|---:| | NIST AES-128 gate-depth reference | `2^170` | | Evaluated NIST `MAXDEPTH` points | `2^40`, `2^64`, `2^96` | | Largest finite envelope | `MAXDEPTH = 2^40` | | Limiting typed event | `wallet.query` | | Coherent Poseidon2b response gates | `17,648,280` | | Coherent Poseidon2b response depth | `11,352` | | Coherent response gate-depth | `200,343,274,560` | | Ideal main term | `≤ 0.051693750450980417` | | Typed finite term | `≤ 0.000199022715317804` | | Global collision bound | `≤ 0.001471367157310191` | | Complete ideal envelope | `≤ 0.053364140323608411` | | Fixed Poseidon2b condition | `Delta_P2b^C1 < 0.446635859676391589` | The dominant half-success gate-depth floor is above the NIST Category 1 reference, while the complete ideal success bound remains below one half throughout the evaluated resource envelope. ## Production activation This PR: - implements the `GF(2^256)` challenge field and production C1 transcript; - adds the C1 zerocheck, lincheck, matrix-folding, PCS, BaseFold and recursive verification paths; - binds all nine recursive Link and Block regions through one joint `GF(2^256)` transcript; - makes the joint C1 `HistoryStep` terminal the mandatory production authority; - adopts B25 and B255 as the canonical production History classes; - adds the source-linked `noid_soundness` executable certificate and exact rational calculator; - updates production tests, benchmarks, release workflows and multilingual documentation; - includes the matrix-folding and sidecar-validation optimizations required by the production profile. ## Reproduction ```sh cargo run --release --locked -p noid_soundness cargo test --release --locked -p noid_soundness ``` The certificate imports the parameters used by the production prover and verifier, checks their correspondence and evaluates the security inequalities with arbitrary-precision integer and rational arithmetic. Current validation completes with all 20 certificate tests passing. ## Research and certificate - [Parano1d meets NIST PQC Category 1](https://lab.parano1d.org/research/parano1d-nist-pqc-category-one/) - [Parano1d soundness certificate](https://github.com/ignotusnemo/parano1d/tree/main/noid_soundness)