igneum-network/igneum
1
0
Fork 0
Code Issues Pull requests Releases Activity

adv-mixer-3 report: Q2 k=2 clean (margin 1 of 8 on random states), Q4b lin0 k=1..8, Q5 plant, Q4 k=7, the one-sweep-per-box rule

Browse source 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
igneum-labs 2026-10-07 18:58:14 +00:00
parent 05b5ac0ebf
commit 227f39dec0
1 changed files with 41 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

46
docs/analysis/cryptanalysis/report-mixer-3.md
View file

@ -25,12 +25,12 @@ Plant rule: a tool is trusted once it has fired on a known-failed shape. Which s
| Q | Method | Known-failed shape | Gate | Result (numbers) | Status |
|---|---|---|---|---|---|
| Q1 | exhaustive round-0 line-index census, all 2^32 t, k = 0..8 | k = 0 (the init: one bin holds 2^32, fired on both days) | chi-square z within 6, no empty bin | day 20729: uniform at k = 1 (z -1.13), 2 (-0.68), 3 (-0.39), 4 (-0.47); day 20733 uniform at k = 1 (z -0.71); k = 5..8 running | PASS to k = 4 (BOUND: the index histogram is uniform from k = 1), RUNNING |
| Q2 | single-bit avalanche, random states, 2^24 (and 2^27) states | `one` at k = 8 (fired: 1959 holes); `weak` fires at k = 1 only, not at k = 8 (see Q2) | no cell beyond 6 sigma | k = 1: 354 holes, 129,726 cells beyond 6 sigma, worst p = 1.000 | RUNNING |
| Q2 | single-bit avalanche, random states, 2^24 (and 2^27) states | `one` at k = 8 (fired: 1959 holes); `weak` fires at k = 1 only, not at k = 8 (see Q2) | no cell beyond 6 sigma | k = 1: 354 holes, 129,726 cells beyond 6 sigma, worst p = 1.000; k = 2 at 2^24: 0 holes, 0 cells beyond 6 sigma, worst z -4.74 (band 0.0015); k = 3..8 and the 2^27 rows running | FINDING at k = 1, PASS at k = 2 (margin: 1 of 8 on random states) |
| Q2b | t-bit avalanche on the round-0 input (32 bits in), 2^24 (and 2^28) states | k = 0 (the init alone, fired: 12,439 holes) | no cell beyond 6 sigma | k = 1: 0 holes, 218 cells beyond 6 sigma, worst p = 0.7427 (t bit 31 to state bit 53), 18 line-index cells beyond 6 sigma. k = 2..8 at 2^24: 0 cells beyond 6 sigma, worst z 3.7 to 4.7 (the maximum of 16,384 normals is about 4.1). 2^28 rows at k = 2, 3, 4 running | FINDING at k = 1, PASS from k = 2 (margin: 1 of 8) |
| Q3 | differential multiplicity, 576 low-weight input differences, 2^20 pairs each | `nomul` at k = 1 (fired: 17,289 deterministic output bits at 4,096 pairs) | no multiplicity 4 or more, no deterministic bit | k = 1: 695 deterministic output bits over the 576 differences (max 35 in one difference) on day 20729, 537 (max 40) on 20733; k = 2..7: 0 deterministic bits, max multiplicity 1, no pair with 2 zero words, both days; k = 8 running | FINDING at k = 1 (deterministic bits), PASS from k = 2 |
| Q4 | single-bit linear correlations, random states, 2^26 samples | k = 0 (the identity, fired: c = 1.0 on the diagonal) | no cell beyond 6 sigma (band 0.00073) | k = 1..6: worst c between 0.00055 and 0.00058 (z 4.5 to 4.7, the expected maximum of 262,144 normals is 4.8), 0 cells beyond 6 sigma; k = 7, 8 running | PASS from k = 1 (BOUND) |
| Q4b | t-bit linear correlations on the round-0 input, 2^26 samples | k = 0 | no cell beyond 6 sigma | pending | RUNNING |
| Q5 | rotational-XOR, rotations 1, 8, 16, 2^22 samples | `weak0` at k = 1 | no zero-difference word above 2 of N, no repeated difference above 3 | pending | RUNNING |
| Q4 | single-bit linear correlations, random states, 2^26 samples | k = 0 (the identity, fired: c = 1.0 on the diagonal) | no cell beyond 6 sigma (band 0.00073) | k = 1..7: worst c between 0.00055 and 0.00058 (z 4.5 to 4.7, the expected maximum of 262,144 normals is 4.8), 0 cells beyond 6 sigma; k = 8 running | PASS from k = 1 (BOUND) |
| Q4b | t-bit linear correlations on the round-0 input, 2^26 samples | k = 0 (fired: c = 1.0, t bit 0 to s[8] bit 0) | no cell beyond 6 sigma | k = 1..8: worst c 0.00048 to 0.00059 (z 3.9 to 4.9 over 16,384 cells), 0 cells beyond 6 sigma | PASS from k = 1 (BOUND) |
| Q5 | rotational-XOR, rotations 1, 8, 16, 2^22 samples | `weak0` at k = 1 (fired: 740 zero-difference words of 2^20 at r = 1, 245 at r = 16) | no zero-difference word above 2 of N, no repeated difference above 3 | k = 1..4 running | RUNNING |
| Q6 | SAT (CaDiCaL) on the round-0 input: find t with a given 22-bit index after k applications | k = 1 solved and verified | solve inside one hour per k, time against the honest 2^10 x k x 130 ops | k = 1: SATISFIABLE in 137 s wall (loaded box); model t = 0x49880000 verifies to the target 0x20eb79. Honest: 2^10 trials of one application is under a millisecond. The solver is already slower than brute force at k = 1 | PASS at k = 1 (BOUND); k = 2..4 RUNNING |
| Q7 | days: 20733 on every row, 8 fixed day indices on Q1 and Q2 | as above | as above | day 20733 rows land below | RUNNING |
| GPU | any GPU row | n/a | n/a | no GPU on either box | BLOCKED |
@ -74,6 +74,13 @@ run at k = 1 fired it too: 14,364 holes). The `one` plant is the firing check of
| Day | k | states | holes | cells beyond 6 sigma | worst cell | worst p | line-index cells beyond 6 sigma (of 11,264) | verdict |
|---|---|---|---|---|---|---|---|---|
| 20729 | 1 | 2^24 | 354 | 129,726 | in 279 (word 8) to out 64 (word 2) | 1.0000 | 7,930 | DISTINGUISHED |
| 20729 | 2 | 2^24 | 0 | 0 | in 322 (word 10) to out 373 (word 11) | 0.49942 (z -4.74) | 0 | inside the band |
Reading: one application on a random 512-bit state leaves 354 deterministic cells (an input bit that always
or never flips a given output bit) and 129,726 of 262,144 cells beyond 6 sigma; 7,930 of the 11,264 cells that
feed the line index are among them. Two applications leave no cell beyond 6 sigma at 2^24 states (band 0.0015).
The worst z of -4.74 is the expected extreme of 262,144 standard normals. The margin on this statistic is 1 of
the 8 applications between reads, the same as on the round-0 input (Q2b).
## Q2b: t-bit avalanche on the round-0 input
@ -131,11 +138,40 @@ Band: 6 sigma = 0.00073. Plant k = 0 fired (c = 1.0 on the 512 diagonal cells).
| 20729 | 4 | 2^26 | -0.00056 | -4.61 | 0 | 4.18 | 3.08 | inside |
| 20729 | 5 | 2^26 | 0.00057 | 4.64 | 0 | 4.14 | 3.27 | inside |
| 20729 | 6 | 2^26 | -0.00055 | -4.54 | 0 | pending | pending | inside |
| 20729 | 7 | 2^26 | -0.00055 | -4.51 | 0 | pending | pending | inside |
Reading: a single input bit and a single output bit have no measurable linear correlation after one application
on random states. The worst z of 4.6 to 4.7 over 262,144 cells is what 262,144 draws of a standard normal give
(expected maximum about 4.8). This is the single-bit mask family only; multi-bit masks are owed work.
## Q4b: t-bit linear correlations on the round-0 input
Command (build-1), per k: `adv-mixer-3 lin0 --day 20729 --apps k --samples 2^26 --threads 64` (x = the 32 bits
of t, y = the state after the init and k applications). Plant k = 0 fired: c = 1.0 between t bit 0 and s[8] bit 0
(the init's `t * MUL[0] + RC[0]` has bit 0 = t bit 0 XOR RC bit 0), 65 cells beyond 6 sigma.
| Day | k | worst c | worst z | cells beyond 6 sigma (of 16,384) |
|---|---|---|---|---|
| 20729 | 1 | 0.00048 | 3.93 | 0 |
| 20729 | 2 | 0.00059 | 4.85 | 0 |
| 20729 | 3 | 0.00051 | 4.14 | 0 |
| 20729 | 4 | 0.00049 | 4.04 | 0 |
| 20729 | 5 | -0.00057 | -4.67 | 0 |
| 20729 | 6 | -0.00048 | -3.97 | 0 |
| 20729 | 7 | 0.00058 | 4.76 | 0 |
| 20729 | 8 | -0.00051 | -4.15 | 0 |
Reading: no t bit has a linear correlation with any state bit after one application, at a band of 0.00073. The
24 percent avalanche bias of Q2b at k = 1 is a differential effect (a flipped t bit flips a state bit with
probability 0.74), not a linear one.
## Q5: rotational-XOR
Command (build-1): `adv-mixer-3 rx --day 20729 --apps k --start 8 --samples 2^22`. Plant `weak0` (MUL 1, RC 0,
ROT 16, round key 0: a constant-free ARX round) at k = 1 fired: at r = 1, 740 of 2^20 samples had a zero
rotational-XOR difference in one word and the difference 0x00000001 repeated 784 times; at r = 16, 245 zero
differences. Rows for the real day land here.
## Q6: SAT on the round-0 input
Command (build-1, smoke run): `adv-mixer-3 cnf --day 20729 --apps 1 --t0 0x12345678 --out k1.cnf` then
@ -152,7 +188,7 @@ rows (k = 1..4, both days, one-hour cap) land below.
Rule changes during the pass (so the hours stay honest): 18:4x UTC the build-server lane dropped the SIGSTOP
yield-to-builds rule and set every sweep to nice 10 on cores 8 to 95; the same lane moved every log, pid file and
CNF out of the worktree mirror into /srv/builds/_adv-mixer-3/. Both applied before the first sweep started.
CNF out of the worktree mirror into /srv/builds/_adv-mixer-3/. Both applied before the first sweep started. 18:56 UTC the same lane set one bounded sweep per box across all lanes (`flock /srv/builds/_adv/locks/sweep.lock`, 88 threads): queue 01 (index 20729, k = 5..8 left) and 02 (index 20733, k = 2..8 left) were killed by pid file at 18:57 and 18:58 UTC as the lowest-value runs and re-queued as queue 10 under the lock; the six other sweeps that had started were left to finish; nothing new starts outside the lock.
| Step | Box | Start (UTC) | Wall | Note |
|---|---|---|---|---|