igneum-network/igneum
1
0
Fork 0
Code Issues Pull requests Releases Activity

adv-mixer-3 report: Q2 k=2 at 2^27 clean, SAT day 20733 k=2 timeout

Browse source 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
igneum-labs 2026-10-08 01:05:26 +00:00
parent ef080f0e6a
commit 18b1109cd9
1 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
docs/analysis/cryptanalysis/report-mixer-3.md
View file

@ -25,13 +25,13 @@ Plant rule: a tool is trusted once it has fired on a known-failed shape. Which s
| Q | Method | Known-failed shape | Gate | Result (numbers) | Status |
|---|---|---|---|---|---|
| Q1 | exhaustive round-0 line-index census, all 2^32 t, k = 0..8 | k = 0 (the init: one bin holds 2^32, fired on both days) | chi-square z within 6, no empty bin | day 20729: uniform at k = 1 (z -1.13), 2 (-0.68), 3 (-0.39), 4 (-0.47), 5 (-1.47), 6 (-0.30), 7 (-1.04), 8 (1.13, the real first read); day 20733 uniform at k = 1..8 (z -0.71, -1.09, -1.31, -0.20, 1.27, 1.12, 1.25, -0.28); day 20730 (queue 07) uniform at k = 2, 3, 4, 8 | PASS to k = 8 on both days (BOUND: the index histogram is uniform from k = 1) (BOUND: the index histogram is uniform from k = 1), RUNNING |
| Q2 | single-bit avalanche, random states, 2^24 (and 2^27) states | `one` at k = 8 (fired: 1959 holes); `weak` fires at k = 1 only, not at k = 8 (see Q2) | no cell beyond 6 sigma | day 20729 k = 1: 354 holes, 129,726 cells beyond 6 sigma, worst p = 1.000; day 20733 k = 1: 266 holes, 136,797 cells; day 20729 k = 2 at 2^24: 0 holes, 0 cells beyond 6 sigma, worst z -4.74 (band 0.0015); k = 3: 0 and 0, worst z -5.28; k = 4..8: 0 and 0, worst z 5.28, -4.60, -4.66, 5.01, 4.58 (day 20729 closed k = 1..8); day 20733 k = 2..8: 0 and 0, worst z -4.59, 4.61, 4.67, 4.78, 4.55, -4.58, -4.65 (closed k = 1..8); the 2^27 rows at k = 2, 3 running | FINDING at k = 1, PASS from k = 2 on both days, both days complete to k = 8 (margin: 1 of 8 on random states) |
| Q2 | single-bit avalanche, random states, 2^24 (and 2^27) states | `one` at k = 8 (fired: 1959 holes); `weak` fires at k = 1 only, not at k = 8 (see Q2) | no cell beyond 6 sigma | day 20729 k = 1: 354 holes, 129,726 cells beyond 6 sigma, worst p = 1.000; day 20733 k = 1: 266 holes, 136,797 cells; day 20729 k = 2 at 2^24: 0 holes, 0 cells beyond 6 sigma, worst z -4.74 (band 0.0015); k = 3: 0 and 0, worst z -5.28; k = 4..8: 0 and 0, worst z 5.28, -4.60, -4.66, 5.01, 4.58 (day 20729 closed k = 1..8); day 20733 k = 2..8: 0 and 0, worst z -4.59, 4.61, 4.67, 4.78, 4.55, -4.58, -4.65 (closed k = 1..8); day 20729 k = 2 at 2^27: 0 and 0, worst z 4.49 (band 0.00026); k = 3 at 2^27 running | FINDING at k = 1, PASS from k = 2 on both days, both days complete to k = 8, confirmed at 2^27 for k = 2 (margin: 1 of 8 on random states) |
| Q2b | t-bit avalanche on the round-0 input (32 bits in), 2^24 (and 2^28) states | k = 0 (the init alone, fired: 12,439 holes) | no cell beyond 6 sigma | k = 1: 0 holes, 218 cells beyond 6 sigma, worst p = 0.7427 (t bit 31 to state bit 53), 18 line-index cells beyond 6 sigma. k = 2..8 at 2^24: 0 cells beyond 6 sigma, worst z 3.7 to 4.7 (the maximum of 16,384 normals is about 4.1); k = 2, 3, 4 at 2^28 states: 0 cells beyond 6 sigma, worst z -4.30, 4.76, -4.64, band 0.00018. Day 20733: k = 1 has 502 cells beyond 6 sigma, worst p = 0.7595 (t bit 31 to state bit 127); k = 2..8 at 2^24: 0 cells, worst z 3.9 to 4.6; k = 2, 3 at 2^28: 0 cells, worst z -4.14, 4.85 (band 0.00018) | FINDING at k = 1 on both days, PASS from k = 2 on both days at 2^24 and 2^28 (margin: 1 of 8) |
| Q3 | differential multiplicity, 576 low-weight input differences, 2^20 pairs each | `nomul` at k = 1 (fired: 17,289 deterministic output bits at 4,096 pairs) | no multiplicity 4 or more, no deterministic bit | k = 1: 695 deterministic output bits over the 576 differences (max 35 in one difference) on day 20729, 537 (max 40) on 20733; k = 2..7: 0 deterministic bits, max multiplicity 1, no pair with 2 zero words, both days; k = 8 running | FINDING at k = 1 (deterministic bits), PASS from k = 2 |
| Q4 | single-bit linear correlations, random states, 2^26 samples | k = 0 (the identity, fired: c = 1.0 on the diagonal) | no cell beyond 6 sigma (band 0.00073) | day 20729 k = 1..7 and day 20733 k = 1..8: worst c between 0.00055 and 0.00062 (z 4.5 to 5.1; the expected maximum of 262,144 normals is 4.8), 0 cells beyond 6 sigma on every row; day 20729 k = 8 running | PASS from k = 1 (BOUND) |
| Q4b | t-bit linear correlations on the round-0 input, 2^26 samples | k = 0 (fired: c = 1.0, t bit 0 to s[8] bit 0) | no cell beyond 6 sigma | both days, k = 1..8: worst c 0.00046 to 0.00059 (z 3.7 to 4.9 over 16,384 cells), 0 cells beyond 6 sigma | PASS from k = 1 (BOUND) |
| Q5 | rotational-XOR, rotations 1, 8, 16, 2^22 samples | `weak0` at k = 1 (fired: 740 zero-difference words of 2^20 at r = 1, 245 at r = 16) | no zero-difference word above 2 of N, no repeated difference above 3 | both days, k = 1, 2, 3, 4 at 2^22 samples: 0 zero-difference words at every rotation (random expects about 0.001), most frequent per-word difference multiplicity 3 (the birthday expectation at 2^22 draws of 32 bits) | PASS from k = 1 (BOUND: the XOR constants and the odd multiply kill the rotational property inside one application) |
| Q6 | SAT (CaDiCaL) on the round-0 input: find t with a given 22-bit index after k applications | k = 1 solved and verified | solve inside one hour per k, time against the honest 2^10 x k x 130 ops | k = 1: SATISFIABLE in 137 s wall on build-1 (load about 160) and 1,593 s on build-2 (load about 500), the same model t = 0x49880000 both times, verified to the target 0x20eb79 through the real code; k = 2: TIMEOUT at the one-hour cap (68,624 vars, 227,767 clauses); k = 3: TIMEOUT (103,375 vars, 343,206 clauses); k = 4: TIMEOUT (138,126 vars, 458,645 clauses). Honest: 2^10 trials is under a millisecond at every k | PASS at k = 1..4 on day 20729 (BOUND: no SAT shortcut, the solver loses to brute force at k = 1 and does not return at k = 2, 3 or 4 inside an hour); day 20733 k = 2..4 RUNNING under the cap |
| Q6 | SAT (CaDiCaL) on the round-0 input: find t with a given 22-bit index after k applications | k = 1 solved and verified | solve inside one hour per k, time against the honest 2^10 x k x 130 ops | k = 1: SATISFIABLE in 137 s wall on build-1 (load about 160) and 1,593 s on build-2 (load about 500), the same model t = 0x49880000 both times, verified to the target 0x20eb79 through the real code; k = 2: TIMEOUT at the one-hour cap (68,624 vars, 227,767 clauses); k = 3: TIMEOUT (103,375 vars, 343,206 clauses); k = 4: TIMEOUT (138,126 vars, 458,645 clauses). Honest: 2^10 trials is under a millisecond at every k | PASS at k = 1..4 on day 20729 (BOUND: no SAT shortcut, the solver loses to brute force at k = 1 and does not return at k = 2, 3 or 4 inside an hour); day 20733 k = 2 TIMEOUT too; k = 3, 4 RUNNING under the cap |
| Q7 | days: 20733 on every row, 8 fixed day indices on Q1 and Q2 (queue 07, run by the sibling adv-mixer from the shared queue) | as above | as above | day 20733: every row above; day 20730: index uniform at k = 2, 3, 4, 8, sac clean at k = 2, 3; the other seven days pending in queue 07 | RUNNING |
| GPU | any GPU row | n/a | n/a | no GPU on either box | BLOCKED |
@ -97,6 +97,7 @@ run at k = 1 fired it too: 14,364 holes). The `one` plant is the firing check of
| 20729 | 6 | 2^24 | 0 | 0 | in 354 (word 11) to out 291 (word 9) | 0.49943 (z -4.66) | 0 | inside |
| 20729 | 7 | 2^24 | 0 | 0 | in 226 (word 7) to out 440 (word 13) | 0.50061 (z 5.01) | 0 | inside |
| 20729 | 8 | 2^24 | 0 | 0 | in 354 (word 11) to out 114 (word 3) | 0.50056 (z 4.58) | 0 | inside (the full 8 between reads) |
| 20729 | 2 | 2^27 | 0 | 0 | in 456 (word 14) to out 339 (word 10) | 0.50019 (z 4.49) | 0 | inside (band 0.00026) |
| 20733 | 2 | 2^24 | 0 | 0 | in 260 (word 8) to out 450 (word 14) | 0.49944 (z -4.59) | 0 | inside |
| 20733 | 3 | 2^24 | 0 | 0 | in 61 (word 1) to out 495 (word 15) | 0.50056 (z 4.61) | 0 | inside |
| 20733 | 4 | 2^24 | 0 | 0 | in 350 (word 10) to out 23 (word 0) | 0.50057 (z 4.67) | 0 | inside |
@ -273,7 +274,8 @@ under a millisecond on one core. The solver at k = 1 is five orders slower than
| 20729 | 2 | 68,624 | 227,767 | TIMEOUT at the one-hour cap (rc 124), 91.8 MB | 3,600 s | none |
| 20729 | 3 | 103,375 | 343,206 | TIMEOUT at the one-hour cap (status 124), 149 MB | 3,600 s | none |
| 20729 | 4 | 138,126 | 458,645 | TIMEOUT at the one-hour cap (status 124), 175 MB | 3,600 s | none |
| 20733 | 2, 3, 4 | as above (the same shape, the day's constants) | | queued from 23:41 UTC, one-hour cap each | | |
| 20733 | 2 | 67,944 | 225,543 | TIMEOUT at the one-hour cap (status 124), 139 MB | 3,600 s | none |
| 20733 | 3, 4 | the same shape, the day's constants | | queued from 01:05 UTC, one-hour cap each | | |
Reading: the one-application model is a 32-variable problem with 112 k clauses of ripple-carry adders (16
constant multiplies of up to 32 adders each dominate). CaDiCaL needs minutes on it where the honest search needs