From 70ff730a30d70e143fbd13dde49e4662488c279e Mon Sep 17 00:00:00 2001 From: igneum-labs <337424239+igneum-labs@users.noreply.github.com> Date: Wed, 7 Oct 2026 20:31:42 +0000 Subject: [PATCH] adv-mixer-2: report skeleton: exact model A and C tails, the reading per attacker, the redraw rule row, ledger Co-Authored-By: Claude Fable 5.1 --- .../logs/adv-mixer-2/exact-w32.log | 185 ++++++++++++++++++ .../logs/adv-mixer-2/smoke-day-20733.log | 15 ++ .../logs/adv-mixer-2/smoke-plant.log | 93 +++++++++ docs/analysis/cryptanalysis/report-mixer-2.md | 148 ++++++++++++++ docs/plans/cryptanalysis/plan-mixer-2.md | 6 +- .../queue/01-adv-mixer-2-census-2p24.sh | 2 +- .../queue/02-adv-mixer-2-calendar.sh | 2 +- .../queue/03-adv-mixer-2-scm-calendar.sh | 2 +- .../queue/04-adv-mixer-2-scm-tail-sample.sh | 2 +- .../queue/05-adv-mixer-2-avalanche.sh | 2 +- .../queue/06-adv-mixer-2-census-2p32.sh | 2 +- .../queue/07-adv-mixer-2-redraw.sh | 2 +- tools/attack/adv-mixer-2/run-box.sh | 7 +- 13 files changed, 455 insertions(+), 13 deletions(-) create mode 100644 docs/analysis/cryptanalysis/logs/adv-mixer-2/exact-w32.log create mode 100644 docs/analysis/cryptanalysis/logs/adv-mixer-2/smoke-day-20733.log create mode 100644 docs/analysis/cryptanalysis/logs/adv-mixer-2/smoke-plant.log create mode 100644 docs/analysis/cryptanalysis/report-mixer-2.md diff --git a/docs/analysis/cryptanalysis/logs/adv-mixer-2/exact-w32.log b/docs/analysis/cryptanalysis/logs/adv-mixer-2/exact-w32.log new file mode 100644 index 00000000..531ecaf6 --- /dev/null +++ b/docs/analysis/cryptanalysis/logs/adv-mixer-2/exact-w32.log @@ -0,0 +1,185 @@ +adv-mixer-2 exact --threads 40 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item + +exact: w32 over 2^31 odd constants, 10.3 s + +| w32 | Constants | Fraction | log2 | +|---|---|---|---| +| 1 | 2 | 9.3132e-10 | -30.00 | +| 2 | 118 | 5.4948e-8 | -24.12 | +| 3 | 3136 | 1.4603e-6 | -19.39 | +| 4 | 49608 | 2.3101e-5 | -15.40 | +| 5 | 520000 | 2.4214e-4 | -12.01 | +| 6 | 3805120 | 1.7719e-3 | -9.14 | +| 7 | 19948544 | 9.2893e-3 | -6.75 | +| 8 | 75681408 | 3.5242e-2 | -4.83 | +| 9 | 207381504 | 9.6570e-2 | -3.37 | +| 10 | 405171200 | 1.8867e-1 | -2.41 | +| 11 | 550371328 | 2.5629e-1 | -1.96 | +| 12 | 498774016 | 2.3226e-1 | -2.11 | +| 13 | 282427392 | 1.3152e-1 | -2.93 | +| 14 | 89686016 | 4.1763e-2 | -4.58 | +| 15 | 13107200 | 6.1035e-3 | -7.36 | +| 16 | 557056 | 2.5940e-4 | -11.91 | + +mean w32 per word 11.1111; expected cost A mean 225.7778 +exact cost A median 226 (the census uses 231) + +| Gain A threshold | Cost A <= | P(day) exact | log2 | Days per 100 years (36,525) | Expected in 2^24 | Expected in 2^32 | +|---|---|---|---|---|---|---| +| 1.05x | 220 | 1.9247e-1 | -2.4 | 7029.9697 | 3229112.12 | 826652702.6 | +| 1.1x | 209 | 4.3257e-3 | -7.9 | 157.9956 | 72572.93 | 18578670.2 | +| 1.15x | 200 | 2.7628e-5 | -15.1 | 1.0091 | 463.52 | 118662.3 | +| 1.2x | 192 | 7.0629e-8 | -23.8 | 0.0026 | 1.18 | 303.3 | +| 1.3x | 177 | 2.4424e-14 | -45.2 | 0.0000 | 0.00 | 0.0 | +| 1.5x | 154 | 3.0484e-28 | -91.4 | 0.0000 | 0.00 | 0.0 | +| 2x | 115 | 2.1503e-63 | -208.2 | 0.0000 | 0.00 | 0.0 | +| 3x | 77 | 1.5073e-116 | -384.8 | 0.0000 | 0.00 | 0.0 | + +| Cost A | P exact | log2 | +|---|---|---| +| 151 | 1.6805e-30 | -98.9 | +| 152 | 9.0505e-30 | -96.5 | +| 153 | 4.7699e-29 | -94.1 | +| 154 | 2.4603e-28 | -91.7 | +| 155 | 1.2421e-27 | -89.4 | +| 156 | 6.1373e-27 | -87.1 | +| 157 | 2.9683e-26 | -84.8 | +| 158 | 1.4053e-25 | -82.6 | +| 159 | 6.5125e-25 | -80.3 | +| 160 | 2.9545e-24 | -78.2 | +| 161 | 1.3121e-23 | -76.0 | +| 162 | 5.7045e-23 | -73.9 | +| 163 | 2.4280e-22 | -71.8 | +| 164 | 1.0117e-21 | -69.7 | +| 165 | 4.1272e-21 | -67.7 | +| 166 | 1.6483e-20 | -65.7 | +| 167 | 6.4452e-20 | -63.8 | +| 168 | 2.4673e-19 | -61.8 | +| 169 | 9.2471e-19 | -59.9 | +| 170 | 3.3930e-18 | -58.0 | +| 171 | 1.2189e-17 | -56.2 | +| 172 | 4.2868e-17 | -54.4 | +| 173 | 1.4760e-16 | -52.6 | +| 174 | 4.9753e-16 | -50.8 | +| 175 | 1.6418e-15 | -49.1 | +| 176 | 5.3040e-15 | -47.4 | +| 177 | 1.6774e-14 | -45.8 | +| 178 | 5.1927e-14 | -44.1 | +| 179 | 1.5736e-13 | -42.5 | +| 180 | 4.6677e-13 | -41.0 | +| 181 | 1.3552e-12 | -39.4 | +| 182 | 3.8513e-12 | -37.9 | +| 183 | 1.0712e-11 | -36.4 | +| 184 | 2.9159e-11 | -35.0 | +| 185 | 7.7680e-11 | -33.6 | +| 186 | 2.0251e-10 | -32.2 | +| 187 | 5.1661e-10 | -30.9 | +| 188 | 1.2895e-9 | -29.5 | +| 189 | 3.1495e-9 | -28.2 | +| 190 | 7.5256e-9 | -27.0 | +| 191 | 1.7592e-8 | -25.8 | +| 192 | 4.0230e-8 | -24.6 | +| 193 | 8.9987e-8 | -23.4 | +| 194 | 1.9688e-7 | -22.3 | +| 195 | 4.2127e-7 | -21.2 | +| 196 | 8.8151e-7 | -20.1 | +| 197 | 1.8037e-6 | -19.1 | +| 198 | 3.6087e-6 | -18.1 | +| 199 | 7.0586e-6 | -17.1 | +| 200 | 1.3497e-5 | -16.2 | +| 201 | 2.5227e-5 | -15.3 | +| 202 | 4.6085e-5 | -14.4 | +| 203 | 8.2276e-5 | -13.6 | +| 204 | 1.4353e-4 | -12.8 | +| 205 | 2.4465e-4 | -12.0 | +| 206 | 4.0740e-4 | -11.3 | +| 207 | 6.6268e-4 | -10.6 | +| 208 | 1.0528e-3 | -9.9 | +| 209 | 1.6334e-3 | -9.3 | +| 210 | 2.4745e-3 | -8.7 | +| 211 | 3.6598e-3 | -8.1 | +| 212 | 5.2839e-3 | -7.6 | +| 213 | 7.4457e-3 | -7.1 | +| 214 | 1.0239e-2 | -6.6 | +| 215 | 1.3738e-2 | -6.2 | +| 216 | 1.7982e-2 | -5.8 | +| 217 | 2.2958e-2 | -5.4 | +| 218 | 2.8586e-2 | -5.1 | +| 219 | 3.4704e-2 | -4.8 | +| 220 | 4.1074e-2 | -4.6 | +| 221 | 4.7382e-2 | -4.4 | +| 222 | 5.3265e-2 | -4.2 | +| 223 | 5.8341e-2 | -4.1 | +| 224 | 6.2245e-2 | -4.0 | +| 225 | 6.4677e-2 | -4.0 | +| 226 | 6.5437e-2 | -3.9 | +| 227 | 6.4448e-2 | -4.0 | +| 228 | 6.1776e-2 | -4.0 | +| 229 | 5.7617e-2 | -4.1 | +| 230 | 5.2275e-2 | -4.3 | +| 231 | 4.6124e-2 | -4.4 | +| 232 | 3.9569e-2 | -4.7 | +| 233 | 3.2996e-2 | -4.9 | +| 234 | 2.6737e-2 | -5.2 | +| 235 | 2.1047e-2 | -5.6 | +| 236 | 1.6090e-2 | -6.0 | +| 237 | 1.1943e-2 | -6.4 | +| 238 | 8.6036e-3 | -6.9 | +| 239 | 6.0137e-3 | -7.4 | +| 240 | 4.0771e-3 | -7.9 | +| 241 | 2.6802e-3 | -8.5 | +| 242 | 1.7077e-3 | -9.2 | +| 243 | 1.0543e-3 | -9.9 | +| 244 | 6.3038e-4 | -10.6 | +| 245 | 3.6493e-4 | -11.4 | +| 246 | 2.0445e-4 | -12.3 | +| 247 | 1.1080e-4 | -13.1 | +| 248 | 5.8068e-5 | -14.1 | +| 249 | 2.9412e-5 | -15.1 | +| 250 | 1.4392e-5 | -16.1 | +| 251 | 6.8003e-6 | -17.2 | +| 252 | 3.1012e-6 | -18.3 | +| 253 | 1.3642e-6 | -19.5 | +| 254 | 5.7860e-7 | -20.7 | +| 255 | 2.3647e-7 | -22.0 | +| 256 | 9.3070e-8 | -23.4 | +| 257 | 3.5256e-8 | -24.8 | +| 258 | 1.2846e-8 | -26.2 | +| 259 | 4.4996e-9 | -27.7 | +| 260 | 1.5140e-9 | -29.3 | +| 261 | 4.8901e-10 | -30.9 | +| 262 | 1.5152e-10 | -32.6 | +| 263 | 4.5000e-11 | -34.4 | +| 264 | 1.2801e-11 | -36.2 | +| 265 | 3.4848e-12 | -38.1 | +| 266 | 9.0711e-13 | -40.0 | +| 267 | 2.2558e-13 | -42.0 | +| 268 | 5.3543e-14 | -44.1 | +| 269 | 1.2118e-14 | -46.2 | +| 270 | 2.6123e-15 | -48.4 | +| 271 | 5.3586e-16 | -50.7 | +| 272 | 1.0447e-16 | -53.1 | +| 273 | 1.9335e-17 | -55.5 | +| 274 | 3.3928e-18 | -58.0 | +| 275 | 5.6372e-19 | -60.6 | +| 276 | 8.8563e-20 | -63.3 | +| 277 | 1.3137e-20 | -66.0 | +| 278 | 1.8368e-21 | -68.9 | +| 279 | 2.4171e-22 | -71.8 | +| 280 | 2.9881e-23 | -74.8 | +| 281 | 3.4636e-24 | -77.9 | +| 282 | 3.7569e-25 | -81.1 | +| 283 | 3.8049e-26 | -84.4 | +| 284 | 3.5896e-27 | -87.8 | +| 285 | 3.1466e-28 | -91.4 | +| 286 | 2.5557e-29 | -95.0 | +| 287 | 1.9175e-30 | -98.7 | + +| Model C | Value | +|---|---| +| exact 2-adder set size (cost 0..=2) | 4192 | +| P(word) | 1.9521e-6 (log2 -19.0) | +| P(k >= 1, gain 1.067x) | 3.1232e-5 (log2 -15.0) | +| P(k >= 2, gain 1.143x) | 4.5725e-10 (log2 -31.0) | +| P(MUL any = 1) | 7.4506e-9 (log2 -27.0) | +| P(ROT all equal) | 3.6347e-11 (log2 -34.7) | diff --git a/docs/analysis/cryptanalysis/logs/adv-mixer-2/smoke-day-20733.log b/docs/analysis/cryptanalysis/logs/adv-mixer-2/smoke-day-20733.log new file mode 100644 index 00000000..b69d2fad --- /dev/null +++ b/docs/analysis/cryptanalysis/logs/adv-mixer-2/smoke-day-20733.log @@ -0,0 +1,15 @@ +adv-mixer-2 day --index 20733 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item + +### day 20733 (2026-10-07) + +| Field | Value | +|---|---| +| seed64 | de33e763e23f9008 | +| ROT | 28 11 18 18 13 28 5 13 | +| MUL | d1d79e7f bcb61f8b 970e91ab d749d96d 143d7339 2cde0d69 12d0a8c1 2d335be9 80a8aae9 7ac896c7 9de23db7 c362827d 5f4cdb5b fc6c5097 6f547f83 1ac31b47 | +| w32(MUL) | 10 11 13 13 11 12 11 13 12 12 10 10 13 10 10 12 | +| RC | e5bef5a3 db2a7d90 cd1fa7e1 30289419 0a730d58 432f8579 6ab978a5 8c984f49 788c3c9e 051eef02 05e77db9 8b3cd4f3 6948d6cf 0d8677f6 f9505c8c 4513c163 | +| cost A | 231 (gain 1.0000x against 231) | +| model C k | 0 (gain 1.0000x) | +| classes fired | none | + diff --git a/docs/analysis/cryptanalysis/logs/adv-mixer-2/smoke-plant.log b/docs/analysis/cryptanalysis/logs/adv-mixer-2/smoke-plant.log new file mode 100644 index 00000000..b94fd3b2 --- /dev/null +++ b/docs/analysis/cryptanalysis/logs/adv-mixer-2/smoke-plant.log @@ -0,0 +1,93 @@ +adv-mixer-2 plant | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item + +### day 20729 unplanted + +| Field | Value | +|---|---| +| seed64 | 2e689968528b3e14 | +| ROT | 6 25 5 25 29 11 9 21 | +| MUL | addda577 e83ff665 a15aee9f 31ffb8cb e72c824d 225e647b 3ec0ace3 d1eb11d5 fa5c7dc5 40128acf 70bc55cf b823fa39 07fcdf49 56a6c8b1 c05d3115 02063ddd | +| w32(MUL) | 12 9 12 10 12 11 11 12 10 10 12 9 8 14 11 8 | +| RC | 0655b978 2c53cb31 e14235d3 30d45c30 5b07a13b 25271fad 418b165b f7fe03d7 67943b1d 5ba337a2 24aa3983 6abbbed4 12488b47 a4a81e53 96f96da0 b86823f8 | +| cost A | 219 (gain 1.0548x against 231) | +| model C k | 0 (gain 1.0000x) | +| classes fired | ROT same-word pair sums to 32; ROT any pair sums to 32 | + +### plant alleq on day 20729 + +| Field | Value | +|---|---| +| seed64 | 2e689968528b3e14 | +| ROT | 6 6 6 6 6 6 6 6 | +| MUL | addda577 e83ff665 a15aee9f 31ffb8cb e72c824d 225e647b 3ec0ace3 d1eb11d5 fa5c7dc5 40128acf 70bc55cf b823fa39 07fcdf49 56a6c8b1 c05d3115 02063ddd | +| w32(MUL) | 12 9 12 10 12 11 11 12 10 10 12 9 8 14 11 8 | +| RC | 0655b978 2c53cb31 e14235d3 30d45c30 5b07a13b 25271fad 418b165b f7fe03d7 67943b1d 5ba337a2 24aa3983 6abbbed4 12488b47 a4a81e53 96f96da0 b86823f8 | +| cost A | 219 (gain 1.0548x against 231) | +| model C k | 0 (gain 1.0000x) | +| classes fired | ROT all equal; ROT distinct <= 2; ROT distinct <= 3; ROT distinct <= 4; ROT max multiplicity >= 4; ROT column set == diagonal set | + +### plant mul1 on day 20729 + +| Field | Value | +|---|---| +| seed64 | 2e689968528b3e14 | +| ROT | 6 25 5 25 29 11 9 21 | +| MUL | addda577 e83ff665 a15aee9f 31ffb8cb e72c824d 00000001 3ec0ace3 d1eb11d5 fa5c7dc5 40128acf 70bc55cf b823fa39 07fcdf49 56a6c8b1 c05d3115 02063ddd | +| w32(MUL) | 12 9 12 10 12 1 11 12 10 10 12 9 8 14 11 8 | +| RC | 0655b978 2c53cb31 e14235d3 30d45c30 5b07a13b 25271fad 418b165b f7fe03d7 67943b1d 5ba337a2 24aa3983 6abbbed4 12488b47 a4a81e53 96f96da0 b86823f8 | +| cost A | 209 (gain 1.1053x against 231) | +| model C k | 1 (gain 1.0667x) | +| classes fired | ROT same-word pair sums to 32; ROT any pair sums to 32; MUL any = 1; MUL any involution (x^2 = 1); MUL any w32 <= 2; MUL any w32 <= 3; MUL any w32 <= 4; MUL any popcount <= 4 or >= 28; MUL any in exact 2-adder set (model C k >= 1); cost A gain >= 1.1x (cost <= 210) | + +### plant mul1all on day 20729 + +| Field | Value | +|---|---| +| seed64 | 2e689968528b3e14 | +| ROT | 6 25 5 25 29 11 9 21 | +| MUL | 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 | +| w32(MUL) | 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 | +| RC | 0655b978 2c53cb31 e14235d3 30d45c30 5b07a13b 25271fad 418b165b f7fe03d7 67943b1d 5ba337a2 24aa3983 6abbbed4 12488b47 a4a81e53 96f96da0 b86823f8 | +| cost A | 64 (gain 3.6094x against 231) | +| model C k | 16 (gain infx) | +| classes fired | ROT same-word pair sums to 32; ROT any pair sums to 32; MUL any = 1; MUL any involution (x^2 = 1); MUL any w32 <= 2; MUL any w32 <= 3; MUL any w32 <= 4; MUL >= 2 with w32 <= 4; MUL any popcount <= 4 or >= 28; MUL two equal; MUL two inverse (a*b = 1); MUL any in exact 2-adder set (model C k >= 1); MUL model C k >= 2; cost A gain >= 1.1x (cost <= 210); cost A gain >= 1.2x (cost <= 192); cost A gain >= 1.5x (cost <= 154) | + +### plant rcrk0 on day 20729 + +| Field | Value | +|---|---| +| seed64 | 2e689968528b3e14 | +| ROT | 6 25 5 25 29 11 9 21 | +| MUL | addda577 e83ff665 a15aee9f 31ffb8cb e72c824d 225e647b 3ec0ace3 d1eb11d5 fa5c7dc5 40128acf 70bc55cf b823fa39 07fcdf49 56a6c8b1 c05d3115 02063ddd | +| w32(MUL) | 12 9 12 10 12 11 11 12 10 10 12 9 8 14 11 8 | +| RC | 0655b978 2c53cb31 e14235d3 673b8a1a 5b07a13b 25271fad 418b165b f7fe03d7 67943b1d 5ba337a2 24aa3983 6abbbed4 12488b47 a4a81e53 96f96da0 b86823f8 | +| cost A | 219 (gain 1.0548x against 231) | +| model C k | 0 (gain 1.0000x) | +| classes fired | ROT same-word pair sums to 32; ROT any pair sums to 32; RC + rk = 0 for any of the 72 keys | + +### plant rot1 on day 20729 + +| Field | Value | +|---|---| +| seed64 | 2e689968528b3e14 | +| ROT | 1 1 1 1 1 1 1 1 | +| MUL | addda577 e83ff665 a15aee9f 31ffb8cb e72c824d 225e647b 3ec0ace3 d1eb11d5 fa5c7dc5 40128acf 70bc55cf b823fa39 07fcdf49 56a6c8b1 c05d3115 02063ddd | +| w32(MUL) | 12 9 12 10 12 11 11 12 10 10 12 9 8 14 11 8 | +| RC | 0655b978 2c53cb31 e14235d3 30d45c30 5b07a13b 25271fad 418b165b f7fe03d7 67943b1d 5ba337a2 24aa3983 6abbbed4 12488b47 a4a81e53 96f96da0 b86823f8 | +| cost A | 219 (gain 1.0548x against 231) | +| model C k | 0 (gain 1.0000x) | +| classes fired | ROT all equal; ROT distinct <= 2; ROT distinct <= 3; ROT distinct <= 4; ROT max multiplicity >= 4; ROT >= 4 in {1,31}; ROT all 8 in {1,2,30,31}; ROT column set == diagonal set | + +### plant weakday on day 20729 + +| Field | Value | +|---|---| +| seed64 | 2e689968528b3e14 | +| ROT | 6 6 6 6 6 6 6 6 | +| MUL | 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 | +| w32(MUL) | 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 | +| RC | 0655b978 2c53cb31 e14235d3 30d45c30 5b07a13b 25271fad 418b165b f7fe03d7 67943b1d 5ba337a2 24aa3983 6abbbed4 12488b47 a4a81e53 96f96da0 b86823f8 | +| cost A | 64 (gain 3.6094x against 231) | +| model C k | 16 (gain infx) | +| classes fired | ROT all equal; ROT distinct <= 2; ROT distinct <= 3; ROT distinct <= 4; ROT max multiplicity >= 4; ROT column set == diagonal set; MUL any = 1; MUL any involution (x^2 = 1); MUL any w32 <= 2; MUL any w32 <= 3; MUL any w32 <= 4; MUL >= 2 with w32 <= 4; MUL any popcount <= 4 or >= 28; MUL two equal; MUL two inverse (a*b = 1); MUL any in exact 2-adder set (model C k >= 1); MUL model C k >= 2; cost A gain >= 1.1x (cost <= 210); cost A gain >= 1.2x (cost <= 192); cost A gain >= 1.5x (cost <= 154) | + diff --git a/docs/analysis/cryptanalysis/report-mixer-2.md b/docs/analysis/cryptanalysis/report-mixer-2.md new file mode 100644 index 00000000..2155e7e3 --- /dev/null +++ b/docs/analysis/cryptanalysis/report-mixer-2.md @@ -0,0 +1,148 @@ +# Report: the day-key weakness class of the mixer M_r (lane adv-mixer-2) + +Internal adversarial pass, not an independent review. Every sentence below that could be quoted carries that label. + +## Header + +| Field | Value | +|---|---| +| Target commit | 017e70376489251e18564c0abce7e466e606c8b3 (class v4 sub-version 3, object byte 7) | +| Target | the per-day draw of ROT[0..7], MUL[0..15], RC[0..15] for M_r (spec 01 section 1.8.4), class v4 (x8, 72 applications per item) | +| Branch | adv-mixer-2 from build/master 7a7caa34, merged 04c4d9bc; plan 5704a7b3; harness ae3088a9 | +| Byte identity | `git diff --quiet 017e7037... HEAD -- igneum-pow` printed IDENTICAL at 7a7caa34 and at 04c4d9bc (the whole crate) | +| Harness | tools/attack/adv-mixer-2 (binary `adv-mixer-2`), igneum-pow by path, nothing re-implemented | +| Binary sha256 | 88f6a3edfffad166d35a3bcadcaff7907613e710b842cfcbe94fbb1601f7c37b (release, identical on both boxes, copied to /srv/builds/_adv-adv-mixer-2/bin/) | +| Boxes | igneum-build-1 and igneum-build-2, rustc 1.99.0; every sweep through `/srv/builds/_bin/lease pool` at class adv, 32 cores, --min 16, nice 10 | +| Logs | /srv/builds/_adv-adv-mixer-2/logs/ on each box; copies in docs/analysis/cryptanalysis/logs/adv-mixer-2/ | +| Price | chip-model-v3.md 5.2: 128 ops per application hoisted, 9,360 ops per item; the spec's 130 per application | +| Clock | UK time throughout | + +## What the per-day gain means, and for whom + +The honest miner (any GPU) and the CPU verifier run `memhard::mixer` with the day's constants as operands: 16 +multiplies, 16 XORs, 32 adds, 32 XORs, 32 rotates per application, the same instruction count on every day. A +multiplier unit costs the same for MUL = 3 as for MUL = 0x9E3779B9. So under chip-model-v3's op count (9,360 ops per +item, value-independent) the per-day gain is exactly 1.0 on every day for every GPU, for the verifier, and for a +chip with a general multiplier. The chip model credits hash rate only through that count. + +The day's constants matter only to a datapath that bakes them in. An ASIC cannot be masked per day. An FPGA bitstream +can be synthesised per day, and that is the only per-day attacker; its per-day gain is an AREA gain (fewer LUTs per +multiplier, so more copies of the pipeline per device), which the chip model does not price as hash rate. The three +cost models of this lane read that area: + +| Model | What it measures | For whom | Gain over 1.1x on more than 2^-20 of days? | +|---|---|---|---| +| A, LUT shift-add (64 + sum of (w32 - 1)) | adder-equivalents per application with every multiplier as a canonical signed-digit shift-add chain; rotations and constant XORs free | a per-day FPGA build with multipliers in LUTs; not a wall-time gain for any chip | YES: P(cost A <= 205, gain >= 1.102x against the exact median 226) = 5.694e-4 = 2^-10.8 per day (exact, 16-fold convolution of the w32 table over all 2^31 odd constants; about 21 days per 100 years). 1.2x: 2^-28.8 (1 day in 2^28). 1.5x: under 2^-91 | +| B, certified shift-add | the same datapath with each multiplier at its certified optimal chain (exact for 1 to 4 adders, decomposition certificate for 5) | the same FPGA, closer to what a synthesiser achieves; an upper bound on the attacker's cost | PENDING (queue 03 and 04) | +| C, DSP | 16 / (16 - k) with k the words whose constant has a 2-adder chain and leaves its DSP block | a per-day FPGA build with multipliers in DSP blocks (value-independent) | NO: k >= 1 gives 1.067x on 3.123e-5 = 2^-15.0 of days; the first gain over 1.1x is k >= 2 (1.143x) on 4.57e-10 = 2^-31.0 | +| Chip model (ops per item) | 9,360 per item, value-independent | every GPU, the verifier, any chip with a general multiplier | NO: the gain is 1.0 on every day | + +Threshold used: the brief's, a gain over 1.1x on more than 2^-20 of days. Model A crosses it by 9 binary orders; +model C and the chip-model reading do not. The redraw rule below is proposed on the model A reading, because the +census of a public calendar is the attacker's cheapest tool and a 10 percent area edge on 1 day in 1,750 is free to +take even if it buys no hash rate against the chip model's attacker. The worst real calendar day with its date is +queue 02 (PENDING). + +## Status board + +| Q | Method | Known-failed shape | Gate | Result (numbers) | Status | +|---|---|---|---|---|---| +| Q0 plants | `plant` on the day-20729 draw with one field replaced, through the same classifier | alleq, rot1, mul1, mul1all, rcrk0, weakday (all ROT equal and MUL = 1) | every plant lands in its class with its gain | all six fire: alleq -> "ROT all equal" (cost 219); mul1 -> "MUL any = 1", gain 1.1053x; mul1all and weakday -> cost 64, gain 3.61x, model C k = 16; rcrk0 -> "RC + rk = 0"; rot1 -> "ROT all 8 in {1,2,30,31}" | PASS | +| Q3 exact tail, model A | w32 over all 2^31 odd constants (exact), 16-fold convolution | the table must give 2 constants at w32 = 1 (1 and 2^32 - 1) and the mean must match the census | mean w32 11.1111; mean cost A 225.78, exact median 226; P(gain >= 1.05x) 4.72e-2; >= 1.1x 5.694e-4 (2^-10.8); >= 1.15x 1.66e-6 (2^-19.2); >= 1.2x 2.13e-9 (2^-28.8); >= 1.3x 2.07e-16; >= 1.5x under 2^-91 | FINDING (area reading), crosses 2^-20 | +| Q3 exact, model C | exact 2-adder set (4,192 odd constants, 2^-19.0 per word) | the set must contain 1, 2^32 - 1, 2^s +- 1 | P(k >= 1) 3.12e-5 (gain 1.067x), P(k >= 2) 4.57e-10 (1.143x) | PASS (bound: under 2^-20 at 1.1x) | +| Q1 census 2^24 | `census --from 20729 --count 2^24` (32 structural classes, cost A histogram, model C) | plants above | counts against the analytic expectation | queue 01, waiting in the box-2 lease pool since 21:22 UK | RUNNING | +| Q2 census 2^32 | `census --count 2^32` | plants above | the model A tail against the exact table | queue 06, waiting in the box-1 lease pool since 21:28 UK | RUNNING | +| Q4 the real calendar | `calendar --from 20729 --years 100` (36,525 days: 3 October 2026 to 2126) | the planted stream-shift pair must be found | worst day with date under A and C | queue 02 | RUNNING | +| Q5 cross-day structure | seed collisions, stream shifts by k in 1..72, shared MUL and RC values over the calendar | planted shift pair | counts against expectation | queue 02 | RUNNING | +| Q2 model B | `scm-refine` on the calendar, on the lowest 2^14 days of the 2^24 census, on a 2^16-day random sample | the self-test constants (3, 5, 7, 9, 2^32 - 1, 2^31 + 1 at 1 adder; 45 at 2) | the certified-cost distribution and the cost B tail | queue 03, 04 | RUNNING | +| Q6 ROT diffusion | `avalanche` (1, 2, 3, 4, 8 applications; the 22 address bits) on the genesis day, the plants, the worst ROT days of the census | plant rot1 and alleq must read weaker than the genesis day at 1 application | a per-day gain only if a bit-exact shortcut follows; else 0 with the diffusion numbers | queue 05 | RUNNING | +| Q7 redraw rule | `redraw-census` 2^24 and 2^28 days with the rule below | `--max-cost 0` must reproduce the real draw on 1,000 days (asserted in the binary) | fraction redrawn; residual over 1.1x must be 0 | queue 07 | RUNNING | +| GPU rows | none needed | | | no row of this class depends on a GPU | BLOCKED (not applicable) | + +## Q7: the proposed redraw rule + +Rule, for the day's parameter draw (spec 1.8.4): after the forty draws, compute cost A = 64 + sum over the sixteen +MUL of (w32(MUL) - 1), and the count k of MUL values with a 2-adder chain. If cost A <= 205 (a model A gain of 1.1x +or more against the median 226), or k >= 1, or the eight ROT are equal, continue the SAME SplitMix64 stream and draw +all forty again; repeat until accepted. The honest miner and the verifier pay forty more 64-bit draws per redraw, +once a day; nothing else changes; every accepted day is a day the current rule could have drawn. + +| Quantity | Value | +|---|---| +| Fraction of days redrawn at least once (exact, models A and C) | 5.694e-4 + 3.123e-5 = 6.0e-4 (2^-10.7), about 22 days per 100 years | +| Fraction over 1.1x under model A after the rule | 0 by construction; measured by queue 07 over 2^24 and 2^28 days (PENDING) | +| Fraction over 1.1x under model C after the rule | 0 (k = 0 on every accepted day) | +| Chip-model reading after the rule | unchanged: 1.0 on every day before and after | +| What the rule does not fix | the seed is 64 bits of the day key (K[0], K[1]); the day is a pure function of the calendar; both stand; neither is a weakness of this class on the numbers above | + +## Sections per row + +### Q0 plants (PASS) + +Command on box 1: `nice -n 10 taskset -c 8-95 adv-mixer-2 plant` (19:4x UK, 0.3 s; the only hand-started runs of +this lane were the three smoke runs before the lease rule of 20:22 UK). Log: logs/adv-mixer-2/smoke-plant.log. The +unplanted day 20729 (3 October 2026): ROT 6 25 5 25 29 11 9 21, cost A 219, classes "ROT same-word pair sums to 32" +(ROT[5] + ROT[7] = 32) and "any pair sums to 32". + +### Q3 exact tail (FINDING on the area reading) + +Command on box 1: `adv-mixer-2 exact --threads 40` (19:5x UK, 10.3 s wall, 173 CPU-s). Log: logs/adv-mixer-2/ +exact-w32.log. The w32 table over all 2^31 odd constants: + +| w32 | Constants | Fraction | +|---|---|---| +| 1 | 2 | 9.3e-10 | +| 2 | 118 | 5.5e-8 | +| 3 | 3,136 | 1.5e-6 | +| 4 | 49,608 | 2.3e-5 | +| 5 | 520,000 | 2.4e-4 | +| 6 | 3,805,120 | 1.8e-3 | +| 7 | 19,948,544 | 9.3e-3 | +| 8 | 75,681,408 | 3.5e-2 | +| 9 | 207,381,504 | 9.7e-2 | +| 10 | 405,171,200 | 0.189 | +| 11 | 550,371,328 | 0.256 | +| 12 | 498,774,016 | 0.232 | +| 13 | 282,427,392 | 0.132 | +| 14 | 89,686,016 | 4.2e-2 | +| 15 | 13,107,200 | 6.1e-3 | +| 16 | 557,056 | 2.6e-4 | + +The exact cost A distribution (64 + the 16-fold convolution of w32 - 1), cumulative at the gain thresholds against +the median 226 (the log's own threshold table was printed against a provisional 231 and is superseded by this one, +computed from the log's per-cost table): + +| Gain A | Cost A <= | P(day), exact | log2 | Days per 100 years | +|---|---|---|---|---| +| 1.05x | 215 | 4.717e-2 | -4.4 | 1,723 | +| 1.1x | 205 | 5.694e-4 | -10.8 | 20.8 | +| 1.15x | 196 | 1.660e-6 | -19.2 | 0.06 | +| 1.2x | 188 | 2.132e-9 | -28.8 | 0.00008 | +| 1.3x | 173 | 2.07e-16 | -52.1 | 0 | +| 1.5x | 150 | under 1e-27 | under -91 | 0 | + +Reading: an FPGA built for the worst day in 100 years saves about 15 percent of its multiplier adders under model +A (cost about 196 against 226); a chip, a GPU and the verifier save nothing. The planted weak day (cost 64) would be +a 3.6x area gain; its probability under the real draw is 2^-27 for one MUL = 1 and under 2^-400 for all sixteen. + +### Ledger of rule changes during the run (box-hours stay honest) + +| Time (UK) | Change | Effect on this lane | +|---|---|---| +| 19:22 | worktree cut from build/master 7a7caa34; IDENTICAL check | none | +| 19:32 | plan pushed 5704a7b3 | | +| 19:4x | SIGSTOP yield to builds dropped; nice 10 on cores 8 to 95 | run-box.sh rewritten before any sweep | +| 19:4x | logs out of the worktree mirror (/srv/builds/_adv-adv-mixer-2/) | adopted before any sweep | +| 19:40 to 19:50 | three smoke runs on box 1 by hand (plant 0.3 s, day, census 2^20 0.3 s, exact 10 s) | 0.05 box-hours | +| 20:22 | `lease pool` is the only way to start a sweep | queue files rewritten; nothing of this lane was running | +| 20:40 | priority classes release > v5 > measure > adv; 32 cores --min 16 | queue files at 32/16 | +| 21:12 | box 2 open to adv-* | chain 01 to 05 started on box 2 at 21:22, chain 06 to 07 on box 1 at 21:28 | + +Box-hours spent so far: 0.05 (the smoke runs). Pod-hours: 0. GPU: none. + +## Bound reached, honestly + +Exact for model A and model C over the whole draw space (every odd constant counted, not sampled); the census rows, +the real-calendar worst day, model B and the diffusion numbers are pending the lease pool. A longer pass would add +model B certificates past 5 adders (an exact optimal-SCM table for all 2^31 constants) and a census over 2^36 days +for the model A tail below 2^-28; neither changes the crossing above, which is exact. diff --git a/docs/plans/cryptanalysis/plan-mixer-2.md b/docs/plans/cryptanalysis/plan-mixer-2.md index ef4f8111..a75b1296 100644 --- a/docs/plans/cryptanalysis/plan-mixer-2.md +++ b/docs/plans/cryptanalysis/plan-mixer-2.md @@ -6,10 +6,10 @@ Internal adversarial pass, not an independent review. Every sentence below that |---|---| | Lane | adv-mixer-2, question class: weak parameter draws of M_r (the day-key weakness class) | | Target commit | 017e70376489251e18564c0abce7e466e606c8b3 (class v4 sub-version 3, object byte 7) | -| Branch | adv-mixer-2, cut from build/master 7a7caa34 at 19:22 BST, 7 October 2026; merged build/master 04c4d9bc at 19:40 BST | +| Branch | adv-mixer-2, cut from build/master 7a7caa34 at 19:22 UK, 7 October 2026; merged build/master 04c4d9bc at 19:40 UK | | Byte identity | `git diff --quiet 017e7037... HEAD -- igneum-pow` printed IDENTICAL at both 7a7caa34 and 04c4d9bc (the whole crate, every file) | | Attacker | an outsider with the public kit; nothing read under docs/ beyond the spec, chip-model-v3.md sections 1, 2, 5, 6 and the siblings' cryptanalysis files | -| Plan due | 20:25 BST, 7 October 2026. First report rows due 00:00 BST, 8 October | +| Plan due | 20:25 UK, 7 October 2026. First report rows due 00:00 UK, 8 October | | Toolchain | rustc 1.99.0 on both boxes; the Mac's PATH rustc is 1.69.0 and is never used (no cargo on the Mac) | ## 1. The target, restated from spec and code @@ -85,7 +85,7 @@ process group, pid file beside the log under `/srv/builds/igneum-wt-adv-mixer-2/ `/srv/builds/_locks` (build-k, quiet, core-*) that SIGSTOPs the group while any is held and SIGCONTs when clear, the pattern of `infra/build-server/capacity/run.sh`. Every sweep is a queue file `/srv/builds/_adv/mixer/queue/NN-adv-mixer-2-.sh` on build-2, claimed by `mkdir .../claims/` before it -runs. CPU-bound sweeps run on build-1 (load 9 to 16 at 19:40 BST against build-2's 55 to 65); the binary is +runs. CPU-bound sweeps run on build-1 (load 9 to 16 at 19:40 UK against build-2's 55 to 65); the binary is built on both boxes so a queue file runs on either. No GPU is used; no row needs one. Total estimate: about 4 box-hours. 8 is the reading line, 16 the ask line. diff --git a/tools/attack/adv-mixer-2/queue/01-adv-mixer-2-census-2p24.sh b/tools/attack/adv-mixer-2/queue/01-adv-mixer-2-census-2p24.sh index 85d1ad8d..bc562ac3 100755 --- a/tools/attack/adv-mixer-2/queue/01-adv-mixer-2-census-2p24.sh +++ b/tools/attack/adv-mixer-2/queue/01-adv-mixer-2-census-2p24.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 BST, 7 October 2026). +# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 UK, 7 October 2026). set -uo pipefail B=/srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 L=/srv/builds/_adv-adv-mixer-2/logs diff --git a/tools/attack/adv-mixer-2/queue/02-adv-mixer-2-calendar.sh b/tools/attack/adv-mixer-2/queue/02-adv-mixer-2-calendar.sh index e5133c3f..005d06e7 100755 --- a/tools/attack/adv-mixer-2/queue/02-adv-mixer-2-calendar.sh +++ b/tools/attack/adv-mixer-2/queue/02-adv-mixer-2-calendar.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 BST, 7 October 2026). +# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 UK, 7 October 2026). set -uo pipefail B=/srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 L=/srv/builds/_adv-adv-mixer-2/logs diff --git a/tools/attack/adv-mixer-2/queue/03-adv-mixer-2-scm-calendar.sh b/tools/attack/adv-mixer-2/queue/03-adv-mixer-2-scm-calendar.sh index 19cc06e9..a82928a2 100755 --- a/tools/attack/adv-mixer-2/queue/03-adv-mixer-2-scm-calendar.sh +++ b/tools/attack/adv-mixer-2/queue/03-adv-mixer-2-scm-calendar.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 BST, 7 October 2026). +# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 UK, 7 October 2026). set -uo pipefail B=/srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 L=/srv/builds/_adv-adv-mixer-2/logs diff --git a/tools/attack/adv-mixer-2/queue/04-adv-mixer-2-scm-tail-sample.sh b/tools/attack/adv-mixer-2/queue/04-adv-mixer-2-scm-tail-sample.sh index 9cda17f1..b09cbc0f 100755 --- a/tools/attack/adv-mixer-2/queue/04-adv-mixer-2-scm-tail-sample.sh +++ b/tools/attack/adv-mixer-2/queue/04-adv-mixer-2-scm-tail-sample.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 BST, 7 October 2026). +# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 UK, 7 October 2026). set -uo pipefail B=/srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 L=/srv/builds/_adv-adv-mixer-2/logs diff --git a/tools/attack/adv-mixer-2/queue/05-adv-mixer-2-avalanche.sh b/tools/attack/adv-mixer-2/queue/05-adv-mixer-2-avalanche.sh index cb804a73..6892319e 100755 --- a/tools/attack/adv-mixer-2/queue/05-adv-mixer-2-avalanche.sh +++ b/tools/attack/adv-mixer-2/queue/05-adv-mixer-2-avalanche.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 BST, 7 October 2026). +# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 UK, 7 October 2026). set -uo pipefail B=/srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 L=/srv/builds/_adv-adv-mixer-2/logs diff --git a/tools/attack/adv-mixer-2/queue/06-adv-mixer-2-census-2p32.sh b/tools/attack/adv-mixer-2/queue/06-adv-mixer-2-census-2p32.sh index fbe4acb2..c51dce87 100755 --- a/tools/attack/adv-mixer-2/queue/06-adv-mixer-2-census-2p32.sh +++ b/tools/attack/adv-mixer-2/queue/06-adv-mixer-2-census-2p32.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 BST, 7 October 2026). +# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 UK, 7 October 2026). set -uo pipefail B=/srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 L=/srv/builds/_adv-adv-mixer-2/logs diff --git a/tools/attack/adv-mixer-2/queue/07-adv-mixer-2-redraw.sh b/tools/attack/adv-mixer-2/queue/07-adv-mixer-2-redraw.sh index ccc44961..c2964a21 100755 --- a/tools/attack/adv-mixer-2/queue/07-adv-mixer-2-redraw.sh +++ b/tools/attack/adv-mixer-2/queue/07-adv-mixer-2-redraw.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 BST, 7 October 2026). +# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 UK, 7 October 2026). set -uo pipefail B=/srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 L=/srv/builds/_adv-adv-mixer-2/logs diff --git a/tools/attack/adv-mixer-2/run-box.sh b/tools/attack/adv-mixer-2/run-box.sh index c55f1497..7eaa728c 100755 --- a/tools/attack/adv-mixer-2/run-box.sh +++ b/tools/attack/adv-mixer-2/run-box.sh @@ -4,8 +4,8 @@ # detached chain, in order. Every queue file is self-contained and starts its binary only through # `/srv/builds/_bin/lease pool` (class adv, 32 cores, --min 16; single-threaded sweeps take 1), which pins and nices it. # Logs and pid files live under /srv/builds/_adv-adv-mixer-2/ on the box, never under the worktree mirror. Kill by pid -# file only. History: 19:4x BST the SIGSTOP yield was dropped (cores 8 to 95 at nice 10); 20:22 BST the lease pool -# became the only way to start a sweep; 20:40 BST priority classes (release > v5 > measure > adv). +# file only. History: 19:4x UK the SIGSTOP yield was dropped (cores 8 to 95 at nice 10); 20:22 UK the lease pool +# became the only way to start a sweep; 20:40 UK priority classes (release > v5 > measure > adv). # Usage: run-box.sh <1|2> ... set -euo pipefail BOX="$1"; shift @@ -26,4 +26,5 @@ for Q in "$@"; do done [ -n "$CHAIN" ] || exit 0 STAMP=$(date -u +%Y%m%dT%H%M%SZ) -ssh -i "$KEY" -o BatchMode=yes "$H" "cd /srv/builds/_adv-adv-mixer-2 && setsid nohup bash -c '$CHAIN' > logs/chain-$STAMP.log 2>&1 < /dev/null & echo \$! > /srv/builds/_adv-adv-mixer-2/logs/chain-$STAMP.pid; echo chain started on box $BOX: pid \$(cat /srv/builds/_adv-adv-mixer-2/logs/chain-$STAMP.pid), log logs/chain-$STAMP.log" +# the detached chain keeps the ssh channel open, so the start is time-boxed to 20 s (perl alarm: macOS has no timeout) +perl -e 'alarm 20; exec @ARGV' ssh -i "$KEY" -o BatchMode=yes "$H" "cd /srv/builds/_adv-adv-mixer-2 && (setsid nohup bash -c '$CHAIN' > logs/chain-$STAMP.log 2>&1 < /dev/null & echo \$! > logs/chain-$STAMP.pid); echo chain started on box $BOX: pid \$(cat logs/chain-$STAMP.pid), log logs/chain-$STAMP.log" || true