diff --git a/docs/analysis/cryptanalysis/report-acceptance-rule.md b/docs/analysis/cryptanalysis/report-acceptance-rule.md index d372de8cd..f85c944ed 100644 --- a/docs/analysis/cryptanalysis/report-acceptance-rule.md +++ b/docs/analysis/cryptanalysis/report-acceptance-rule.md @@ -260,6 +260,36 @@ site 6's reads on heavily repeated WORD indices and a ratio of 0.9919: the two r (16 words each, 2^24 of them) are told from words (2^28), and the rule's sample does see it; its floor at 0.98 is set below it. +### Two mechanisms, not one (sibling input from adv-cache-2, 23:1x BST, and this lane's check) + +adv-cache-2 reports (their measurement, not re-run here) a mechanism for the mild biased-site class: with +`load_index` = rotl(x * M, R) then the 28-bit mask and an odd M, the low bits of the product are a +function of the low bits of x alone, so a source whose low bits carry a product's law (P(bit 0) = 1/4, bit 1 +3/8, bit 2 7/16, measured on Devnet 3 site 0 and their era-drawn-10 site 7) carries that bias into address +bits R, R+1, R+2; with R = 29 (the devnet era) those bits sit above the mask and vanish, with R in 1..27 they +land in the item index. Their controlled pair (one base program under two eras) reads 1.00x to 1.01x under +R = 29 and 1.06x to 1.51x under R of 3 to 22; 5 of their 50 programs read over 1.2x at one site. + +This lane's check, from the era line each live run prints (logs in logs/adv-accept/): + +| Live verdict | seeds and their era rotation R | +|---|---| +| hot set by X_f >= f (8) | 100767 R 28, 4346 R 19, 5245 R 29, 1738 R 29, 170 R 29, 106924 R 11, 107022 R 30, 122960 R 10 | +| beyond the gate, no hot set (10) | R = 31, 9, 7, 2, 10, 5, 28, 27, 25, 5 | +| clean low-ratio seeds (6) | R = 3, 24, 1, 4, 9, 28 | +| random clean (17) | R = 27, 14, 1, 13, 30, 5, 21, 29, 1, 18, 20, 27, 9, 25, 4, 11, 17 | + +Reading: five of the eight hot sets carry R of 28 to 30, where the product-law bits sit above the mask, so +the hot-set class is not adv-cache-2's mechanism. It is the near-saturated-source class: a source that +reaches zero or all-ones maps to ONE item whatever M and R (zero gives index 0: item 0x000000 is the hottest +in 100767, 4346, 5245 and 170; all-ones gives the fixed image of -M), and that is why these programs +concentrate hundreds of thousands of reads on a few items where the product-law class spreads a 1.1x to 1.5x +excess over a window. The two live-clean shapes (106924 at R 11, 107022 at R 30) are a third, smaller +set with neither signature traced. For the rule: the per-site distinct-index ratio catches the first class +(0.9821 to 0.9919 at 2^20, all refused by 0.995) and misses the second (0.9992 to 0.9997); the second class +is the stride's and is what a change to `load_index` (R restricted, or the low product bits folded) would +address, not a floor. + ### The class v5 floor at 0.995 against the measured concentrations (main's five-program job, box 2, 21:35 BST) `adv-accept gap --day 20733 --hex ::devnet3-epoch0-v4` and `adv-accept gap --day 20730