adv-mixer: finalize report (Q1 BOUND), durable logs, run-box.sh log path
Internal adversarial pass, not an independent review. Q1 (this lane, the algebraic structure of M_r): the fold probe and the integral cube-sum degree test on the frozen-identical binary show no composition cheaper than 8x. No affine fold, no word separability, no key-order commutation; algebraic degree >= 16 after one application and saturated after two. The 9,360 ops per item stand. Q2 margin (full diffusion at 2 applications) and Q3 census (best day a 1.17x FPGA multiply datapath, 1 in 2^24, zero wall-time gain, ROT-all-equal never seen) kept as courtesy runs attributed to adv-mixer-3 and adv-mixer-2. igneum-pow merged to build/master and re-proven byte-identical to c3d32437; pre-merge runs re-run on the merged tree and matched. Logs copied into the branch so the report paths survive; run-box.sh writes outside the mirror. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
igneum-labs
parent
e3fbe5176d
commit
996d0ad353
7 changed files with 678 additions and 116 deletions
389
docs/analysis/cryptanalysis/logs/adv-mixer/census-2pow24.log
Normal file
389
docs/analysis/cryptanalysis/logs/adv-mixer/census-2pow24.log
Normal file
|
|
@ -0,0 +1,389 @@
|
|||
# attack-f4 census: 16777216 chain days from day index 20729 (genesis 20729), class v4 shape (mixer x8, cache 2^26), 32 threads, 4.4 s
|
||||
draw: MixParams::with_shape(seed_words_from_bytes(bind::day_bytes(d)), Shape::for_class(&V4_CLASS)); seed64 = key[0] | key[1] << 32
|
||||
|
||||
## Gate (plan 1.4 (3), B5 rank 3): fraction of days with any gain over 1.1x under 2^-20 = 9.537e-7
|
||||
|
||||
| Metric | Reference | Days over 1.1x | Fraction | Against 2^-20 |
|
||||
|---|---|---|---|---|
|
||||
| M1 per-day LUT datapath, adders per application | median cost 231 (gain over 1.1x = cost under 210) | 5476 | 3.264e-4 | OVER |
|
||||
| M1 against the mean cost 231.11 (sd 6.19) | cost under 210.10 | 9363 | 5.581e-4 | OVER |
|
||||
| M2 DSP-bound datapath, 16/(16-k) with k = words of NAF weight <= 3 | k >= 2 | 0 | 0.000e0 | under |
|
||||
| ROT value (wiring) and RC value (inverters) on a per-day datapath | exact 0 ops moved on every day | 0 | 0 | under |
|
||||
|
||||
M1 cost = 64 + sum(NAF(MUL_i) - 1); mean 231.113, sd 6.190, median 231, min 197 (day 4819563), max 263 (day 15262713)
|
||||
|
||||
## Classes over 16777216 days
|
||||
|
||||
| Class | Count | Fraction | Expected per day (analytic) | Expected count | Worst member (day, M1 cost, M1 gain vs median, M2 gain) |
|
||||
|---|---|---|---|---|---|
|
||||
| ROT all equal | 0 | 0.000e0 | 3.635e-11 (1 in 2.751e10) | 0.001 | none |
|
||||
| ROT distinct <= 3 | 534 | 3.183e-5 | 3.069e-5 (1 in 3.259e4) | 514.813 | day 11482247 , cost 208 , 1.1106x , 1.000x |
|
||||
| ROT distinct <= 4 | 26010 | 1.550e-3 | 1.537e-3 (1 in 6.507e2) | 25782.741 | day 1092491 , cost 207 , 1.1159x , 1.000x |
|
||||
| ROT max multiplicity >= 4 | 35631 | 2.124e-3 | 2.350e-3 (1 in 4.256e2) | 39421.474 | day 9506389 , cost 206 , 1.1214x , 1.000x |
|
||||
| ROT same-word pair sums to 32 | 2062481 | 1.229e-1 | 1.229e-1 (1 in 8.135e0) | 2062288.067 | day 3675001 , cost 201 , 1.1493x , 1.000x |
|
||||
| ROT any pair sums to 32 | 10022037 | 5.974e-1 | 6.007e-1 (1 in 1.665e0) | 10078561.158 | day 4819563 , cost 197 , 1.1726x , 1.000x |
|
||||
| ROT all 8 in {1,2,30,31} | 2 | 1.192e-7 | 7.684e-8 (1 in 1.301e7) | 1.289 | day 14330190 , cost 217 , 1.0645x , 1.000x |
|
||||
| ROT >= 6 in {1,2,30,31} | 1761 | 1.050e-4 | 1.023e-4 (1 in 9.780e3) | 1715.548 | day 155537 , cost 212 , 1.0896x , 1.000x |
|
||||
| ROT >= 4 in {1,2,30,31} | 211152 | 1.259e-2 | 1.259e-2 (1 in 7.942e1) | 211253.447 | day 12915578 , cost 198 , 1.1667x , 1.000x |
|
||||
| ROT >= 4 in {8,16,24} | 74541 | 4.443e-3 | 4.456e-3 (1 in 2.244e2) | 74756.114 | day 5517722 , cost 198 , 1.1667x , 1.000x |
|
||||
| MUL any = 1 | 0 | 0.000e0 | 7.451e-9 (1 in 1.342e8) | 0.125 | none |
|
||||
| MUL any = 2^32-1 | 0 | 0.000e0 | 7.451e-9 (1 in 1.342e8) | 0.125 | none |
|
||||
| MUL any popcount <= 2 | 0 | 0.000e0 | 2.384e-7 (1 in 4.194e6) | 4.000 | none |
|
||||
| MUL any popcount <= 4 | 612 | 3.648e-5 | 3.719e-5 (1 in 2.689e4) | 623.989 | day 7275755 , cost 200 , 1.1550x , 1.000x |
|
||||
| MUL any popcount <= 8 | 441646 | 2.632e-2 | 2.629e-2 (1 in 3.804e1) | 441000.196 | day 12915578 , cost 198 , 1.1667x , 1.000x |
|
||||
| MUL any NAF weight <= 2 | 4 | 2.384e-7 | see `expect` | see `expect` | day 7786546 , cost 221 , 1.0452x , 1.067x |
|
||||
| MUL any NAF weight <= 3 | 216 | 1.287e-5 | see `expect` | see `expect` | day 332924 , cost 207 , 1.1159x , 1.067x |
|
||||
| MUL any NAF weight <= 4 | 3637 | 2.168e-4 | see `expect` | see `expect` | day 7275755 , cost 200 , 1.1550x , 1.000x |
|
||||
| MUL any < 256 | 22 | 1.311e-6 | 9.537e-7 (1 in 1.049e6) | 16.000 | day 14317428 , cost 216 , 1.0694x , 1.000x |
|
||||
| MUL two equal | 0 | 0.000e0 | 5.588e-8 (1 in 1.790e7) | 0.937 | none |
|
||||
| MUL M2 k >= 2 (gain >= 1.14x) | 0 | 0.000e0 | see `expect` | see `expect` | none |
|
||||
| RC any = 0 | 0 | 0.000e0 | 3.725e-9 (1 in 2.684e8) | 0.062 | none |
|
||||
| RC any popcount <= 4 or >= 28 | 5186 | 3.091e-4 | 3.088e-4 (1 in 3.239e3) | 5180.375 | day 7999545 , cost 208 , 1.1106x , 1.000x |
|
||||
| RC + rk = 0 for any of the 72 keys | 10 | 5.960e-7 | 2.682e-7 (1 in 3.728e6) | 4.500 | day 3194363 , cost 218 , 1.0596x , 1.000x |
|
||||
| RC two equal | 1 | 5.960e-8 | 2.794e-8 (1 in 3.579e7) | 0.469 | day 2875598 , cost 226 , 1.0221x , 1.000x |
|
||||
|
||||
## Histograms
|
||||
|
||||
| ROT distinct amounts | Count | Fraction | Expected (S(8,d) 31_d / 31^8) |
|
||||
|---|---|---|---|
|
||||
| 1 | 0 | 0.0000e0 | 3.6347e-11 |
|
||||
| 2 | 4 | 2.3842e-7 | 1.3848e-7 |
|
||||
| 3 | 530 | 3.1590e-5 | 3.0547e-5 |
|
||||
| 4 | 25476 | 1.5185e-3 | 1.5061e-3 |
|
||||
| 5 | 421405 | 2.5118e-2 | 2.5101e-2 |
|
||||
| 6 | 2773843 | 1.6533e-1 | 1.6533e-1 |
|
||||
| 7 | 7302781 | 4.3528e-1 | 4.3509e-1 |
|
||||
| 8 | 6253177 | 3.7272e-1 | 3.7294e-1 |
|
||||
|
||||
| ROT amounts in {1,2,30,31} | Count | Expected Binomial(8, 4/31) | ROT amounts in {8,16,24} | Count | Expected Binomial(8, 3/31) | ROT max multiplicity | Count |
|
||||
|---|---|---|---|---|---|---|---|
|
||||
| 0 | 5558032 | 5555670.2 | 0 | 7436763 | 7431741.5 | 0 | 0 |
|
||||
| 1 | 6581255 | 6584498.0 | 1 | 6367439 | 6370064.2 | 1 | 6253177 |
|
||||
| 2 | 3416505 | 3414184.2 | 2 | 2387947 | 2388774.1 | 2 | 9662112 |
|
||||
| 3 | 1010272 | 1011610.1 | 3 | 510526 | 511880.2 | 3 | 826296 |
|
||||
| 4 | 187244 | 187335.2 | 4 | 68359 | 68555.4 | 4 | 34667 |
|
||||
| 5 | 22147 | 22202.7 | 5 | 5828 | 5876.2 | 5 | 947 |
|
||||
| 6 | 1696 | 1644.6 | 6 | 345 | 314.8 | 6 | 17 |
|
||||
| 7 | 63 | 69.6 | 7 | 9 | 9.6 | 7 | 0 |
|
||||
| 8 | 2 | 1.3 | 8 | 0 | 0.1 | 8 | 0 |
|
||||
|
||||
| M2 k (words of NAF weight <= 3) | Count | Gain 16/(16-k) |
|
||||
|---|---|---|
|
||||
| 0 | 16777000 | 1.000x |
|
||||
| 1 | 216 | 1.067x |
|
||||
| 2 | 0 | 1.143x |
|
||||
| 3 | 0 | 1.231x |
|
||||
|
||||
| Minimum NAF weight over the 16 MUL | Count |
|
||||
|---|---|
|
||||
| 2 | 4 |
|
||||
| 3 | 212 |
|
||||
| 4 | 3421 |
|
||||
| 5 | 37733 |
|
||||
| 6 | 290503 |
|
||||
| 7 | 1528972 |
|
||||
| 8 | 4939471 |
|
||||
| 9 | 7132514 |
|
||||
| 10 | 2713385 |
|
||||
| 11 | 130753 |
|
||||
| 12 | 248 |
|
||||
|
||||
| M1 cost per application | Count | Cumulative fraction | M1 gain vs median |
|
||||
|---|---|---|---|
|
||||
| 197 | 1 | 5.9605e-8 | 1.1726x |
|
||||
| 198 | 2 | 1.7881e-7 | 1.1667x |
|
||||
| 199 | 1 | 2.3842e-7 | 1.1608x |
|
||||
| 200 | 10 | 8.3447e-7 | 1.1550x |
|
||||
| 201 | 15 | 1.7285e-6 | 1.1493x |
|
||||
| 202 | 25 | 3.2187e-6 | 1.1436x |
|
||||
| 203 | 66 | 7.1526e-6 | 1.1379x |
|
||||
| 204 | 124 | 1.4544e-5 | 1.1324x |
|
||||
| 205 | 250 | 2.9445e-5 | 1.1268x |
|
||||
| 206 | 432 | 5.5194e-5 | 1.1214x |
|
||||
| 207 | 781 | 1.0175e-4 | 1.1159x |
|
||||
| 208 | 1382 | 1.8412e-4 | 1.1106x |
|
||||
| 209 | 2387 | 3.2640e-4 | 1.1053x |
|
||||
| 210 | 3887 | 5.5808e-4 | 1.1000x |
|
||||
| 211 | 6602 | 9.5159e-4 | 1.0948x |
|
||||
| 212 | 10657 | 1.5868e-3 | 1.0896x |
|
||||
| 213 | 17018 | 2.6011e-3 | 1.0845x |
|
||||
| 214 | 26180 | 4.1616e-3 | 1.0794x |
|
||||
| 215 | 39884 | 6.5389e-3 | 1.0744x |
|
||||
| 216 | 58060 | 9.9995e-3 | 1.0694x |
|
||||
| 217 | 83645 | 1.4985e-2 | 1.0645x |
|
||||
| 218 | 117632 | 2.1997e-2 | 1.0596x |
|
||||
| 219 | 162182 | 3.1663e-2 | 1.0548x |
|
||||
| 220 | 216961 | 4.4595e-2 | 1.0500x |
|
||||
| 221 | 283558 | 6.1497e-2 | 1.0452x |
|
||||
| 222 | 362047 | 8.3076e-2 | 1.0405x |
|
||||
| 223 | 450814 | 1.0995e-1 | 1.0359x |
|
||||
| 224 | 550735 | 1.4277e-1 | 1.0312x |
|
||||
| 225 | 652577 | 1.8167e-1 | 1.0267x |
|
||||
| 226 | 756846 | 2.2678e-1 | 1.0221x |
|
||||
| 227 | 855148 | 2.7775e-1 | 1.0176x |
|
||||
| 228 | 941391 | 3.3386e-1 | 1.0132x |
|
||||
| 229 | 1011617 | 3.9416e-1 | 1.0087x |
|
||||
| 230 | 1059221 | 4.5730e-1 | 1.0043x |
|
||||
| 231 | 1079174 | 5.2162e-1 | 1.0000x |
|
||||
| 232 | 1070912 | 5.8545e-1 | 0.9957x |
|
||||
| 233 | 1039183 | 6.4739e-1 | 0.9914x |
|
||||
| 234 | 980014 | 7.0580e-1 | 0.9872x |
|
||||
| 235 | 899809 | 7.5944e-1 | 0.9830x |
|
||||
| 236 | 805446 | 8.0744e-1 | 0.9788x |
|
||||
| 237 | 700659 | 8.4921e-1 | 0.9747x |
|
||||
| 238 | 592824 | 8.8454e-1 | 0.9706x |
|
||||
| 239 | 489326 | 9.1371e-1 | 0.9665x |
|
||||
| 240 | 391079 | 9.3702e-1 | 0.9625x |
|
||||
| 241 | 304227 | 9.5515e-1 | 0.9585x |
|
||||
| 242 | 229565 | 9.6884e-1 | 0.9545x |
|
||||
| 243 | 168335 | 9.7887e-1 | 0.9506x |
|
||||
| 244 | 120776 | 9.8607e-1 | 0.9467x |
|
||||
| 245 | 83871 | 9.9107e-1 | 0.9429x |
|
||||
| 246 | 56312 | 9.9442e-1 | 0.9390x |
|
||||
| 247 | 36832 | 9.9662e-1 | 0.9352x |
|
||||
| 248 | 23268 | 9.9801e-1 | 0.9315x |
|
||||
| 249 | 14347 | 9.9886e-1 | 0.9277x |
|
||||
| 250 | 8495 | 9.9937e-1 | 0.9240x |
|
||||
| 251 | 4856 | 9.9966e-1 | 0.9203x |
|
||||
| 252 | 2783 | 9.9982e-1 | 0.9167x |
|
||||
| 253 | 1472 | 9.9991e-1 | 0.9130x |
|
||||
| 254 | 757 | 9.9995e-1 | 0.9094x |
|
||||
| 255 | 415 | 9.9998e-1 | 0.9059x |
|
||||
| 256 | 179 | 9.9999e-1 | 0.9023x |
|
||||
| 257 | 79 | 1.0000e0 | 0.8988x |
|
||||
| 258 | 43 | 1.0000e0 | 0.8953x |
|
||||
| 259 | 23 | 1.0000e0 | 0.8919x |
|
||||
| 260 | 9 | 1.0000e0 | 0.8885x |
|
||||
| 261 | 3 | 1.0000e0 | 0.8851x |
|
||||
| 262 | 4 | 1.0000e0 | 0.8817x |
|
||||
| 263 | 1 | 1.0000e0 | 0.8783x |
|
||||
|
||||
## The 16 lowest-cost days (M1)
|
||||
|
||||
- day 4819563: cost 197, gain 1.1726x vs median, NAF sum 149, M2 k 0, day-hex 69676e65756d2d6461792f6b8a490000000000
|
||||
- day 5517722: cost 198, gain 1.1667x vs median, NAF sum 150, M2 k 0, day-hex 69676e65756d2d6461792f9a31540000000000
|
||||
- day 12915578: cost 198, gain 1.1667x vs median, NAF sum 150, M2 k 0, day-hex 69676e65756d2d6461792f7a13c50000000000
|
||||
- day 5073249: cost 199, gain 1.1608x vs median, NAF sum 151, M2 k 0, day-hex 69676e65756d2d6461792f61694d0000000000
|
||||
- day 295616: cost 200, gain 1.1550x vs median, NAF sum 152, M2 k 0, day-hex 69676e65756d2d6461792fc082040000000000
|
||||
- day 2339457: cost 200, gain 1.1550x vs median, NAF sum 152, M2 k 0, day-hex 69676e65756d2d6461792f81b2230000000000
|
||||
- day 7275755: cost 200, gain 1.1550x vs median, NAF sum 152, M2 k 0, day-hex 69676e65756d2d6461792feb046f0000000000
|
||||
- day 7921343: cost 200, gain 1.1550x vs median, NAF sum 152, M2 k 0, day-hex 69676e65756d2d6461792fbfde780000000000
|
||||
- day 10331167: cost 200, gain 1.1550x vs median, NAF sum 152, M2 k 0, day-hex 69676e65756d2d6461792f1fa49d0000000000
|
||||
- day 10514223: cost 200, gain 1.1550x vs median, NAF sum 152, M2 k 0, day-hex 69676e65756d2d6461792f2f6fa00000000000
|
||||
- day 12709144: cost 200, gain 1.1550x vs median, NAF sum 152, M2 k 0, day-hex 69676e65756d2d6461792f18edc10000000000
|
||||
- day 14463384: cost 200, gain 1.1550x vs median, NAF sum 152, M2 k 0, day-hex 69676e65756d2d6461792f98b1dc0000000000
|
||||
- day 14777650: cost 200, gain 1.1550x vs median, NAF sum 152, M2 k 0, day-hex 69676e65756d2d6461792f327de10000000000
|
||||
- day 15551477: cost 200, gain 1.1550x vs median, NAF sum 152, M2 k 0, day-hex 69676e65756d2d6461792ff54bed0000000000
|
||||
- day 515226: cost 201, gain 1.1493x vs median, NAF sum 153, M2 k 0, day-hex 69676e65756d2d6461792f9adc070000000000
|
||||
- day 2240604: cost 201, gain 1.1493x vs median, NAF sum 153, M2 k 0, day-hex 69676e65756d2d6461792f5c30220000000000
|
||||
|
||||
## Worst member of every class, in full
|
||||
|
||||
### ROT distinct <= 3: day 11482247
|
||||
```
|
||||
day index 11482247 (genesis + 11461518), day bytes 69676e65756d2d6461792f8734af0000000000 , seed64 99b37b14bce80e05
|
||||
key bce80e05 99b37b14 a88409a4 a5469d0e 35c4b54e c027571b 152552c8 9d942222
|
||||
ROT [12, 19, 19, 4, 19, 12, 19, 19] distinct 3 max multiplicity 5 small 0 byte-aligned 0 same-word pair 32 false any pair 32 false
|
||||
MUL 23684433 345dfd6d 13878a5b dff7431f 60e1ffa5 fb7bcf75 ef826109 6fd6c065 1d5b0701 75f4b29f 24197fc1 1367fa6d 87f0f4ed 03b41769 92cbf013 03bbeca7
|
||||
NAF [11, 11, 11, 9, 9, 10, 9, 10, 9, 12, 8, 11, 10, 10, 11, 9] sum 160 min 8 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false
|
||||
RC 93abe65f 6886b6d0 3a68d00d 3889c0c6 b194b674 4094caf5 161c68f0 6b3cdc05 f1fbf7c0 2ee32537 5779f1ba 56b1eabc 914f7e4d 35c47fa0 ab029a5b ae0b61a1
|
||||
RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false
|
||||
M1 cost 208 adder-equivalents per application (14976 per item, 72 applications); M2 k 0 (gain 1.000x)
|
||||
M1 gain against the census median 231: 1.1106x
|
||||
classes: ROT distinct <= 3; ROT distinct <= 4; ROT max multiplicity >= 4
|
||||
```
|
||||
### ROT distinct <= 4: day 1092491
|
||||
```
|
||||
day index 1092491 (genesis + 1071762), day bytes 69676e65756d2d6461792f8bab100000000000 , seed64 da149ee55aaab937
|
||||
key 5aaab937 da149ee5 11819d67 3f60c5a0 6045fabb ac9ede0d 919ff013 7143f2b9
|
||||
ROT [21, 16, 12, 16, 31, 12, 12, 31] distinct 4 max multiplicity 3 small 2 byte-aligned 2 same-word pair 32 true any pair 32 true
|
||||
MUL a05bba01 bec09787 7afe483b 28844197 b7eafc73 aa1d3f0f 83508105 f39cc103 d21f51a1 ffa61343 40cfaea1 03bebcd3 7f059f6f b00ededf ca070e07 3bd803db
|
||||
NAF [9, 10, 9, 10, 11, 11, 9, 11, 12, 11, 10, 10, 9, 9, 10, 8] sum 159 min 8 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false
|
||||
RC 9ea401b9 c5b29850 00371b55 5592306c 77d7ec18 f100a72b ca4db32b 82fc9dc4 83168f22 e3359513 ad711b53 b7f5dc09 add1d8ab 982a05b1 06b37a9b 829bb32d
|
||||
RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false
|
||||
M1 cost 207 adder-equivalents per application (14904 per item, 72 applications); M2 k 0 (gain 1.000x)
|
||||
M1 gain against the census median 231: 1.1159x
|
||||
classes: ROT distinct <= 4; ROT same-word pair sums to 32; ROT any pair sums to 32
|
||||
```
|
||||
### ROT max multiplicity >= 4: day 9506389
|
||||
```
|
||||
day index 9506389 (genesis + 9485660), day bytes 69676e65756d2d6461792f550e910000000000 , seed64 6982e9080d6a4cdf
|
||||
key 0d6a4cdf 6982e908 4a0a0b42 a399c15d 99e27fe1 fdfb9b00 4e90d671 78401cd0
|
||||
ROT [15, 5, 31, 5, 5, 24, 6, 5] distinct 5 max multiplicity 4 small 1 byte-aligned 1 same-word pair 32 false any pair 32 false
|
||||
MUL 37800e03 d714c2fb a4be52db 87737201 5ac001d7 95f7c07f c1fb39d9 8bdfc411 70097121 e009077d f0ef802b 36f0ebbf 087b2dd7 8270b24d c3b48dad fc354847
|
||||
NAF [7, 12, 13, 9, 9, 8, 11, 8, 9, 8, 9, 9, 10, 12, 13, 11] sum 158 min 7 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false
|
||||
RC c4769637 de22eaea 7aa5b4ed 46b93f02 41831974 bbd9933b c6a06ba1 c102f45e 6483273a c33cfd56 5669b2b7 f5ee5a3d f4c63fc9 50ccdb45 522844d2 c405d738
|
||||
RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false
|
||||
M1 cost 206 adder-equivalents per application (14832 per item, 72 applications); M2 k 0 (gain 1.000x)
|
||||
M1 gain against the census median 231: 1.1214x
|
||||
classes: ROT max multiplicity >= 4
|
||||
```
|
||||
### ROT same-word pair sums to 32: day 3675001
|
||||
```
|
||||
day index 3675001 (genesis + 3654272), day bytes 69676e65756d2d6461792f7913380000000000 , seed64 81ed531eeadd5e68
|
||||
key eadd5e68 81ed531e 453f3611 4caf9ae6 c9585bb1 115e4232 cdaff538 dc39efc9
|
||||
ROT [25, 5, 21, 27, 21, 7, 12, 27] distinct 6 max multiplicity 2 small 0 byte-aligned 0 same-word pair 32 true any pair 32 true
|
||||
MUL 7b011e4d 3c417fc1 9d055513 beea0cb9 207ef901 1df73bdd 7c2034ff 77fe5083 cf567a1f c4311bf1 7dded2b9 7bcae001 e58678b9 0f6dc051 213ef8a9 20afbbb9
|
||||
NAF [10, 7, 13, 12, 6, 9, 8, 8, 12, 10, 11, 8, 13, 8, 9, 9] sum 153 min 6 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false
|
||||
RC 113c7ffd 754403c6 9d01091b 58b7ed13 a5685eec e1a691a0 e98f235e 3f622792 3fc0a2a9 a8b91f03 3aa824aa 7ff52b9d a7f69c00 3cc25c5e c3a37dd3 90c308ad
|
||||
RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false
|
||||
M1 cost 201 adder-equivalents per application (14472 per item, 72 applications); M2 k 0 (gain 1.000x)
|
||||
M1 gain against the census median 231: 1.1493x
|
||||
classes: ROT same-word pair sums to 32; ROT any pair sums to 32
|
||||
```
|
||||
### ROT any pair sums to 32: day 4819563
|
||||
```
|
||||
day index 4819563 (genesis + 4798834), day bytes 69676e65756d2d6461792f6b8a490000000000 , seed64 d4924b5d4dc26798
|
||||
key 4dc26798 d4924b5d c75c47df 64b4f00f 0836e7ff cd383a15 4c85767a 6a08a753
|
||||
ROT [26, 18, 8, 30, 24, 24, 6, 9] distinct 7 max multiplicity 2 small 1 byte-aligned 3 same-word pair 32 false any pair 32 true
|
||||
MUL a0653c83 a09de525 810085fb 6a00eba1 bf8205ff bba82079 f27da4c3 2cb80223 6001efcf 1c2814f7 ae9d09d7 ffedd7b7 943dde01 39ff47e1 0513a83f c028eef9
|
||||
NAF [11, 11, 7, 10, 7, 10, 12, 10, 7, 9, 13, 8, 8, 8, 9, 9] sum 149 min 7 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false
|
||||
RC 3ba362fd 47c4ea3e c8d59f08 c76a1b32 a33837f3 2295b6a8 6578c14a 348c033f 35f3d38e 60755b0f 75437163 235c6abb eae387e0 09ad148b dfd1092c aebb5f8e
|
||||
RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false
|
||||
M1 cost 197 adder-equivalents per application (14184 per item, 72 applications); M2 k 0 (gain 1.000x)
|
||||
M1 gain against the census median 231: 1.1726x
|
||||
classes: ROT any pair sums to 32
|
||||
```
|
||||
### ROT all 8 in {1,2,30,31}: day 14330190
|
||||
```
|
||||
day index 14330190 (genesis + 14309461), day bytes 69676e65756d2d6461792f4ea9da0000000000 , seed64 722cea0895f65bbe
|
||||
key 95f65bbe 722cea08 b6716401 2aa400d8 7e0054e3 7edf5115 73008e0c ea61f647
|
||||
ROT [1, 1, 2, 31, 1, 31, 1, 31] distinct 3 max multiplicity 4 small 8 byte-aligned 0 same-word pair 32 true any pair 32 true
|
||||
MUL 5111ff0d 0915ca85 e63f87e3 3a3eec25 74fc4b01 04849df9 740b798f 96300b51 c7c8033d 90111e63 268db4a9 cf40e4a5 ac91052f 18814e21 92657099 3b7fa903
|
||||
NAF [9, 11, 10, 10, 10, 8, 11, 12, 10, 10, 13, 12, 12, 9, 13, 9] sum 169 min 8 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false
|
||||
RC 57ed2402 ab186f3e 8c7e4d2c b7a0915d 6c47d3d1 3ab1c1a5 91ba307f 177182e3 b19522c4 93deec89 cdc3dcc7 c8637063 0abd4442 d4df5f23 4606f7ab 3595b758
|
||||
RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false
|
||||
M1 cost 217 adder-equivalents per application (15624 per item, 72 applications); M2 k 0 (gain 1.000x)
|
||||
M1 gain against the census median 231: 1.0645x
|
||||
classes: ROT distinct <= 3; ROT distinct <= 4; ROT max multiplicity >= 4; ROT same-word pair sums to 32; ROT any pair sums to 32; ROT all 8 in {1,2,30,31}; ROT >= 6 in {1,2,30,31}; ROT >= 4 in {1,2,30,31}
|
||||
```
|
||||
### ROT >= 6 in {1,2,30,31}: day 155537
|
||||
```
|
||||
day index 155537 (genesis + 134808), day bytes 69676e65756d2d6461792f915f020000000000 , seed64 62a533010044516b
|
||||
key 0044516b 62a53301 877d9dac ad817c3f 788dace2 7cda9997 77fab135 e51ef305
|
||||
ROT [22, 21, 30, 30, 2, 31, 31, 2] distinct 5 max multiplicity 2 small 6 byte-aligned 0 same-word pair 32 false any pair 32 true
|
||||
MUL 205bfc49 00e29caf 3e1cdf05 88267f01 efad6031 2edbba8f 5802025d 7b6aef0f db740619 253f4b7b 3310231d ca01a579 5b5b8e69 0b051b43 3fef1507 e10e7aad
|
||||
NAF [8, 10, 9, 8, 10, 11, 9, 10, 11, 11, 11, 12, 13, 11, 8, 12] sum 164 min 8 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false
|
||||
RC 9f220844 5c8a4552 e6f7dc41 bca5026c bac2bcec 8d331e54 eeb4b6f1 7ef67511 602e8964 54ee8e4b b57c03b6 1dd85466 efa50b4d 6d72abe6 2cccea1f d9f6ed77
|
||||
RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false
|
||||
M1 cost 212 adder-equivalents per application (15264 per item, 72 applications); M2 k 0 (gain 1.000x)
|
||||
M1 gain against the census median 231: 1.0896x
|
||||
classes: ROT any pair sums to 32; ROT >= 6 in {1,2,30,31}; ROT >= 4 in {1,2,30,31}
|
||||
```
|
||||
### ROT >= 4 in {1,2,30,31}: day 12915578
|
||||
```
|
||||
day index 12915578 (genesis + 12894849), day bytes 69676e65756d2d6461792f7a13c50000000000 , seed64 57f6497ce6d7a118
|
||||
key e6d7a118 57f6497c fefb5f19 c79046cc b1a6df7d aa592471 1cd1d432 48e25d80
|
||||
ROT [30, 30, 31, 17, 16, 31, 13, 9] distinct 6 max multiplicity 2 small 4 byte-aligned 1 same-word pair 32 false any pair 32 false
|
||||
MUL 41406225 06c21421 80fe91b1 145d8359 10c01035 2025c17f 7f801477 1b53081b 547e7dc7 381c841f 02baf16b 6ce88fef 08e447f9 077440cd 9dddb2d7 7ae58045
|
||||
NAF [9, 8, 9, 11, 8, 8, 7, 11, 10, 8, 11, 10, 8, 10, 12, 10] sum 150 min 7 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false
|
||||
RC a7246db5 dff83962 82647cfd 3eb91ca4 b17e51e1 f10dc65b b24a5f72 3e849586 2a1248a1 f44e7f64 ad012d93 0074a57e b10c2709 2986079c 9f0b9f4c 0f1c9565
|
||||
RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false
|
||||
M1 cost 198 adder-equivalents per application (14256 per item, 72 applications); M2 k 0 (gain 1.000x)
|
||||
M1 gain against the census median 231: 1.1667x
|
||||
classes: ROT >= 4 in {1,2,30,31}; MUL any popcount <= 8
|
||||
```
|
||||
### ROT >= 4 in {8,16,24}: day 5517722
|
||||
```
|
||||
day index 5517722 (genesis + 5496993), day bytes 69676e65756d2d6461792f9a31540000000000 , seed64 6cb96c5fb4321712
|
||||
key b4321712 6cb96c5f a77367f6 b2719260 5edf1eba 183ecb78 4522b1e7 560ae215
|
||||
ROT [19, 8, 24, 20, 19, 8, 2, 8] distinct 5 max multiplicity 3 small 1 byte-aligned 4 same-word pair 32 false any pair 32 true
|
||||
MUL 1bce207f 382ff2bd f60fdaaf 424a1321 f6590551 231258b3 546dc127 08ac8085 070a003d 41bbfd91 c5dfc81b 007b2f19 983f01e7 0847837f 060f90a7 040e9015
|
||||
NAF [8, 10, 10, 10, 12, 13, 11, 9, 7, 8, 10, 9, 9, 7, 9, 8] sum 150 min 7 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false
|
||||
RC ff224509 ec7e2a5b 5968f4aa b9a7e963 df762e0d 1e62e44e 2fa7540b 0aa0e15d ab38c25f a88b3cb8 006e698c 2bfc51dc 5e0d671a 7b9af6ce a0a8e6e0 89595bcb
|
||||
RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false
|
||||
M1 cost 198 adder-equivalents per application (14256 per item, 72 applications); M2 k 0 (gain 1.000x)
|
||||
M1 gain against the census median 231: 1.1667x
|
||||
classes: ROT any pair sums to 32; ROT >= 4 in {8,16,24}
|
||||
```
|
||||
### MUL any popcount <= 4: day 7275755
|
||||
```
|
||||
day index 7275755 (genesis + 7255026), day bytes 69676e65756d2d6461792feb046f0000000000 , seed64 8c466b2af98a2e86
|
||||
key f98a2e86 8c466b2a 7aeceb13 73b046e4 6bf5ee94 1f2ffb0c 68e00b58 8939ea67
|
||||
ROT [7, 20, 3, 30, 26, 14, 14, 9] distinct 7 max multiplicity 2 small 1 byte-aligned 0 same-word pair 32 false any pair 32 false
|
||||
MUL 22b167d9 1217c0ff 83f9d6ff 53f47821 9e6f203f 8ddf1105 503197e7 5203053f 18100001 b1afa8e1 fc0d2e77 47d30207 a62e473f 9a30a787 f7fb9443 4453f77d
|
||||
NAF [12, 7, 8, 9, 9, 9, 11, 9, 4, 12, 11, 9, 12, 12, 9, 9] sum 152 min 4 =1 0 =-1 0 pop<=4 1 naf<=3 0 <256 0 dup false
|
||||
RC ffb825e4 f8be0580 73dbb4cf 358c1f2f 27cf0dda bb3480ee 7b357f42 e12fe90f fb7486d5 429d3607 2d5bd341 7d426c5c 3ca53a8d 6bba1a7b 834a9b7b 4b7ebe4f
|
||||
RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false
|
||||
M1 cost 200 adder-equivalents per application (14400 per item, 72 applications); M2 k 0 (gain 1.000x)
|
||||
M1 gain against the census median 231: 1.1550x
|
||||
classes: MUL any popcount <= 4; MUL any popcount <= 8; MUL any NAF weight <= 4
|
||||
```
|
||||
### MUL any NAF weight <= 2: day 7786546
|
||||
```
|
||||
day index 7786546 (genesis + 7765817), day bytes 69676e65756d2d6461792f32d0760000000000 , seed64 7ac5b9e18cde6f44
|
||||
key 8cde6f44 7ac5b9e1 39a3e509 a2faa026 6a1437c0 a21b7c6b 2a625719 405689b1
|
||||
ROT [25, 7, 21, 19, 12, 28, 9, 25] distinct 7 max multiplicity 2 small 0 byte-aligned 0 same-word pair 32 false any pair 32 true
|
||||
MUL a9f9aaa5 393fdfb5 fb11d523 8c2df7b7 e9c31551 cb349fcd c9dd7baf 3e676067 6359fad5 53e1ffeb 000007ff 6057c76d 3c86f067 b791a083 3738eec7 b42ba445
|
||||
NAF [14, 9, 12, 10, 13, 14, 11, 11, 13, 8, 2, 11, 10, 11, 11, 13] sum 173 min 2 =1 0 =-1 0 pop<=4 0 naf<=3 1 <256 0 dup false
|
||||
RC 8af42dee f0e6dcd6 1e594042 eee6defb bc86dccf 6cfa11fe 4f8ba636 455f5e8a d21de702 382b305f 56a1c147 b386e182 3d2d8d04 756a3cd8 71ed29eb 7b08de97
|
||||
RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false
|
||||
M1 cost 221 adder-equivalents per application (15912 per item, 72 applications); M2 k 1 (gain 1.067x)
|
||||
M1 gain against the census median 231: 1.0452x
|
||||
classes: ROT any pair sums to 32; MUL any NAF weight <= 2; MUL any NAF weight <= 3; MUL any NAF weight <= 4
|
||||
```
|
||||
### MUL any NAF weight <= 3: day 332924
|
||||
```
|
||||
day index 332924 (genesis + 312195), day bytes 69676e65756d2d6461792f7c14050000000000 , seed64 f808897c2547d426
|
||||
key 2547d426 f808897c 513cca7d 52f7f508 3c4e673e 02a296f7 7d51ea58 cc6a6d4c
|
||||
ROT [1, 23, 1, 1, 12, 11, 16, 18] distinct 6 max multiplicity 3 small 3 byte-aligned 1 same-word pair 32 false any pair 32 false
|
||||
MUL 02fe3349 ebfbb02d 03ffc001 bd03f177 c59affa1 080e4a8f 02ce4063 466595f5 3e80970f 00f39991 0937c1c5 49a3a27f 1705f1db e14c5f59 feb802ed b3c7e543
|
||||
NAF [10, 10, 3, 10, 11, 9, 10, 14, 9, 10, 9, 11, 10, 12, 9, 12] sum 159 min 3 =1 0 =-1 0 pop<=4 0 naf<=3 1 <256 0 dup false
|
||||
RC 1b116748 5923a322 2b3a87a3 a6766c2f ce61047f ed58e672 59023641 a5898f72 65026fe7 7fcc8696 ee849527 ae5ac84c 48c6da86 870d31f1 aa7bafdc 163aa9fa
|
||||
RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false
|
||||
M1 cost 207 adder-equivalents per application (14904 per item, 72 applications); M2 k 1 (gain 1.067x)
|
||||
M1 gain against the census median 231: 1.1159x
|
||||
classes: MUL any NAF weight <= 3; MUL any NAF weight <= 4
|
||||
```
|
||||
### MUL any < 256: day 14317428
|
||||
```
|
||||
day index 14317428 (genesis + 14296699), day bytes 69676e65756d2d6461792f7477da0000000000 , seed64 15a13158d6510a3e
|
||||
key d6510a3e 15a13158 269297c4 5bceb8e2 aea8a2ed dabc3585 4076bc5c 01bec51f
|
||||
ROT [11, 14, 4, 19, 28, 12, 20, 23] distinct 8 max multiplicity 1 small 0 byte-aligned 0 same-word pair 32 false any pair 32 true
|
||||
MUL dc9e0e77 6f487117 f3e164b9 f5615c89 f9f33575 16ee44f7 1f2f8205 a6506901 3003f653 efdc8cc5 0e4ab3c9 000000eb 2c230eef 6b843c71 b8e67d17 7cba91df
|
||||
NAF [11, 11, 12, 12, 13, 10, 8, 11, 9, 11, 12, 4, 10, 10, 13, 11] sum 168 min 4 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 1 dup false
|
||||
RC ebf15842 e0a148eb a2e4ee1d 1fc2bea3 2d63622e c45c96bf b3a36493 486b4d26 00366580 61c9b1c0 b884e3ea e3e9b598 d42d5626 a9115df7 87259e61 f5ce1730
|
||||
RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false
|
||||
M1 cost 216 adder-equivalents per application (15552 per item, 72 applications); M2 k 0 (gain 1.000x)
|
||||
M1 gain against the census median 231: 1.0694x
|
||||
classes: ROT any pair sums to 32; MUL any popcount <= 8; MUL any NAF weight <= 4; MUL any < 256
|
||||
```
|
||||
### RC any popcount <= 4 or >= 28: day 7999545
|
||||
```
|
||||
day index 7999545 (genesis + 7978816), day bytes 69676e65756d2d6461792f39107a0000000000 , seed64 c93bd7b37f21862d
|
||||
key 7f21862d c93bd7b3 5b8af838 808161f4 824aa21f 2e361c27 3a9893f5 a174f291
|
||||
ROT [2, 9, 21, 30, 26, 31, 20, 6] distinct 8 max multiplicity 1 small 3 byte-aligned 0 same-word pair 32 false any pair 32 true
|
||||
MUL 5eeafff1 20d43481 f82a157b b074ba81 6fd05fab 0436f05d bf4b2e11 200619df fd87f81b af944de5 ed74aadf 8fca07c3 1446e11f 43fc06c5 01c1b977 484a8ac3
|
||||
NAF [8, 10, 11, 12, 10, 9, 12, 8, 8, 12, 13, 9, 9, 8, 9, 12] sum 160 min 8 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false
|
||||
RC 864fb298 1ac6b021 33767a7e 9368cb81 e8846716 1aa3ce3d 9812d074 67e4fc2c e4778444 c36dd02b fee3ffff 04723a67 4138fef0 ddf770c6 83dac053 28e4d10c
|
||||
RC zero 0 pop<=4|>=28 1 rc+rk=0 0 dup false
|
||||
M1 cost 208 adder-equivalents per application (14976 per item, 72 applications); M2 k 0 (gain 1.000x)
|
||||
M1 gain against the census median 231: 1.1106x
|
||||
classes: ROT any pair sums to 32; RC any popcount <= 4 or >= 28
|
||||
```
|
||||
### RC + rk = 0 for any of the 72 keys: day 3194363
|
||||
```
|
||||
day index 3194363 (genesis + 3173634), day bytes 69676e65756d2d6461792ffbbd300000000000 , seed64 bc1e82a5c9f5ddde
|
||||
key c9f5ddde bc1e82a5 96ab4399 0671592a bb1c6360 3913fe9a 9804267d 299ae13d
|
||||
ROT [1, 7, 16, 9, 15, 4, 30, 22] distinct 8 max multiplicity 1 small 2 byte-aligned 1 same-word pair 32 false any pair 32 false
|
||||
MUL e7190f35 650c36eb afa6090b a8fb90ef 034e3297 862b6f0d dbf807f5 284be071 dbf8a029 100809e5 23747809 71ab3457 40f884c9 bf8f55e7 f1549811 996781e5
|
||||
NAF [13, 12, 12, 10, 12, 12, 8, 9, 9, 7, 9, 14, 9, 11, 11, 12] sum 170 min 7 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false
|
||||
RC d8cfa0e8 b7d3cbda 43cfc80c d25da2da 2e0e8163 c53232b1 b12fccd0 554503c1 926caee2 0e443238 f57e07fb 2b6fa3e6 3cbf689c 85b2a4b4 7ba7972d d9c14302
|
||||
RC zero 0 pop<=4|>=28 0 rc+rk=0 1 dup false
|
||||
M1 cost 218 adder-equivalents per application (15696 per item, 72 applications); M2 k 0 (gain 1.000x)
|
||||
M1 gain against the census median 231: 1.0596x
|
||||
classes: RC + rk = 0 for any of the 72 keys
|
||||
```
|
||||
### RC two equal: day 2875598
|
||||
```
|
||||
day index 2875598 (genesis + 2854869), day bytes 69676e65756d2d6461792fcee02b0000000000 , seed64 cbb947500a68806e
|
||||
key 0a68806e cbb94750 a7becf69 57289c05 faec9414 c10772ba d2903fe5 74af4324
|
||||
ROT [29, 30, 4, 8, 19, 13, 25, 29] distinct 7 max multiplicity 2 small 1 byte-aligned 1 same-word pair 32 false any pair 32 true
|
||||
MUL f2f52c69 155a7899 e6ff1b2f 8ca5703d 4643df15 8100291f c31dad25 bc9cfef1 73c502d7 72f4b489 ae01e6dd 67dfd461 0b1d0b75 fa948d61 1dd832eb 0e09fb03
|
||||
NAF [14, 13, 11, 12, 10, 7, 13, 10, 11, 13, 11, 10, 12, 12, 11, 8] sum 178 min 7 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false
|
||||
RC 16dd5198 a438a5ee d0ef08a1 29be50c8 9758bd94 4983af82 ad80a68b 1c6080f9 9dbb6eb7 491a03b8 b5c6622a cf646720 9a211c17 f952fecb 56c26eec b5c6622a
|
||||
RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup true
|
||||
M1 cost 226 adder-equivalents per application (16272 per item, 72 applications); M2 k 0 (gain 1.000x)
|
||||
M1 gain against the census median 231: 1.0221x
|
||||
classes: ROT any pair sums to 32; RC two equal
|
||||
```
|
||||
|
|
@ -0,0 +1,76 @@
|
|||
adv-mixer diffusion sweep; internal adversarial pass, not an independent review
|
||||
a01bf61016a8bda530468f081442131f1bff4a7b6401dd84cbcde83c78bb48f3
|
||||
UTC_START 2026-10-07T18:19:48Z
|
||||
===== K=1 =====
|
||||
self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9
|
||||
diffusion day=20729 plant=none apps=1 start=0 states=2000000 threads=32
|
||||
mean output-flip probability over all 262144 cells: 0.461177 (ideal 0.5)
|
||||
census band: 8 sigma = 0.002828 (2000000 states)
|
||||
dependency holes (p == 0 or p == 1 exactly): 578 of 262144
|
||||
strong-bias cells (|p-0.5| > band, not a hole): 111997 of 262144
|
||||
worst cell: in_bit 60 -> out_bit 107 p = 1.000000 dev = 0.500000 (1414.2 sigma)
|
||||
VERDICT: FINDING (holes or strong bias at this K)
|
||||
===== K=2 =====
|
||||
self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9
|
||||
diffusion day=20729 plant=none apps=2 start=0 states=2000000 threads=32
|
||||
mean output-flip probability over all 262144 cells: 0.500001 (ideal 0.5)
|
||||
census band: 8 sigma = 0.002828 (2000000 states)
|
||||
dependency holes (p == 0 or p == 1 exactly): 0 of 262144
|
||||
strong-bias cells (|p-0.5| > band, not a hole): 0 of 262144
|
||||
worst cell: in_bit 107 -> out_bit 490 p = 0.501702 dev = 0.001702 (4.8 sigma)
|
||||
VERDICT: no distinguisher at this K
|
||||
===== K=3 =====
|
||||
self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9
|
||||
diffusion day=20729 plant=none apps=3 start=0 states=2000000 threads=32
|
||||
mean output-flip probability over all 262144 cells: 0.500000 (ideal 0.5)
|
||||
census band: 8 sigma = 0.002828 (2000000 states)
|
||||
dependency holes (p == 0 or p == 1 exactly): 0 of 262144
|
||||
strong-bias cells (|p-0.5| > band, not a hole): 0 of 262144
|
||||
worst cell: in_bit 112 -> out_bit 295 p = 0.498383 dev = 0.001617 (4.6 sigma)
|
||||
VERDICT: no distinguisher at this K
|
||||
===== K=4 =====
|
||||
self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9
|
||||
diffusion day=20729 plant=none apps=4 start=0 states=2000000 threads=32
|
||||
mean output-flip probability over all 262144 cells: 0.500000 (ideal 0.5)
|
||||
census band: 8 sigma = 0.002828 (2000000 states)
|
||||
dependency holes (p == 0 or p == 1 exactly): 0 of 262144
|
||||
strong-bias cells (|p-0.5| > band, not a hole): 0 of 262144
|
||||
worst cell: in_bit 220 -> out_bit 106 p = 0.498354 dev = 0.001646 (4.7 sigma)
|
||||
VERDICT: no distinguisher at this K
|
||||
===== K=5 =====
|
||||
self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9
|
||||
diffusion day=20729 plant=none apps=5 start=0 states=2000000 threads=32
|
||||
mean output-flip probability over all 262144 cells: 0.500000 (ideal 0.5)
|
||||
census band: 8 sigma = 0.002828 (2000000 states)
|
||||
dependency holes (p == 0 or p == 1 exactly): 0 of 262144
|
||||
strong-bias cells (|p-0.5| > band, not a hole): 0 of 262144
|
||||
worst cell: in_bit 453 -> out_bit 93 p = 0.498283 dev = 0.001717 (4.9 sigma)
|
||||
VERDICT: no distinguisher at this K
|
||||
===== K=6 =====
|
||||
self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9
|
||||
diffusion day=20729 plant=none apps=6 start=0 states=2000000 threads=32
|
||||
mean output-flip probability over all 262144 cells: 0.500000 (ideal 0.5)
|
||||
census band: 8 sigma = 0.002828 (2000000 states)
|
||||
dependency holes (p == 0 or p == 1 exactly): 0 of 262144
|
||||
strong-bias cells (|p-0.5| > band, not a hole): 0 of 262144
|
||||
worst cell: in_bit 494 -> out_bit 479 p = 0.498377 dev = 0.001623 (4.6 sigma)
|
||||
VERDICT: no distinguisher at this K
|
||||
===== K=7 =====
|
||||
self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9
|
||||
diffusion day=20729 plant=none apps=7 start=0 states=2000000 threads=32
|
||||
mean output-flip probability over all 262144 cells: 0.500000 (ideal 0.5)
|
||||
census band: 8 sigma = 0.002828 (2000000 states)
|
||||
dependency holes (p == 0 or p == 1 exactly): 0 of 262144
|
||||
strong-bias cells (|p-0.5| > band, not a hole): 0 of 262144
|
||||
worst cell: in_bit 161 -> out_bit 378 p = 0.501592 dev = 0.001592 (4.5 sigma)
|
||||
VERDICT: no distinguisher at this K
|
||||
===== K=8 =====
|
||||
self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9
|
||||
diffusion day=20729 plant=none apps=8 start=0 states=2000000 threads=32
|
||||
mean output-flip probability over all 262144 cells: 0.500001 (ideal 0.5)
|
||||
census band: 8 sigma = 0.002828 (2000000 states)
|
||||
dependency holes (p == 0 or p == 1 exactly): 0 of 262144
|
||||
strong-bias cells (|p-0.5| > band, not a hole): 0 of 262144
|
||||
worst cell: in_bit 202 -> out_bit 367 p = 0.498295 dev = 0.001705 (4.8 sigma)
|
||||
VERDICT: no distinguisher at this K
|
||||
UTC_END 2026-10-07T18:30:40Z
|
||||
|
|
@ -0,0 +1,70 @@
|
|||
FROZEN_HEAD d8eea5f7 igneum-pow IDENTICAL to 017e7037
|
||||
bin 179b77a5bb1e2158004d4044de6d6622cf649ce6e8cc5e69623053e849651274
|
||||
UTC_START 2026-10-07T18:32:17Z
|
||||
### fold confirm
|
||||
self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9
|
||||
fold day=20729 trials=1000000
|
||||
(a) GF(2) affinity violations of the 2-application map: 1000000 of 1000000 (0 would be a BREAK: the map is affine)
|
||||
(b) dead (in_word -> out_word) pairs over the full 8-application block: 0 of 256 (any would be a broken dependency)
|
||||
(c) key-order agreements M(M(.,rk1),rk2) == M(M(.,rk2),rk1): 0 of 1000000 (any would let keys fold)
|
||||
VERDICT: BOUND: no fold on these probes
|
||||
### integral apps=1
|
||||
self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9
|
||||
integral day=20729 apps=1 placements_per_d=4000 threads=48
|
||||
d = cube dimension; 'nonzero' = placements whose cube-sum is nonzero on >=1 output bit (degree >= d reached)
|
||||
d= 1 nonzero 4000/4000 = 1.0000 mean out-bits set 236.1/512 [degree >= d reached]
|
||||
d= 2 nonzero 4000/4000 = 1.0000 mean out-bits set 185.4/512 [degree >= d reached]
|
||||
d= 3 nonzero 4000/4000 = 1.0000 mean out-bits set 174.6/512 [degree >= d reached]
|
||||
d= 4 nonzero 4000/4000 = 1.0000 mean out-bits set 172.3/512 [degree >= d reached]
|
||||
d= 5 nonzero 4000/4000 = 1.0000 mean out-bits set 172.5/512 [degree >= d reached]
|
||||
d= 6 nonzero 4000/4000 = 1.0000 mean out-bits set 172.3/512 [degree >= d reached]
|
||||
d= 7 nonzero 4000/4000 = 1.0000 mean out-bits set 174.6/512 [degree >= d reached]
|
||||
d= 8 nonzero 4000/4000 = 1.0000 mean out-bits set 174.7/512 [degree >= d reached]
|
||||
d= 9 nonzero 4000/4000 = 1.0000 mean out-bits set 176.1/512 [degree >= d reached]
|
||||
d=10 nonzero 4000/4000 = 1.0000 mean out-bits set 177.9/512 [degree >= d reached]
|
||||
d=11 nonzero 4000/4000 = 1.0000 mean out-bits set 181.2/512 [degree >= d reached]
|
||||
d=12 nonzero 4000/4000 = 1.0000 mean out-bits set 183.6/512 [degree >= d reached]
|
||||
d=13 nonzero 4000/4000 = 1.0000 mean out-bits set 187.3/512 [degree >= d reached]
|
||||
d=14 nonzero 4000/4000 = 1.0000 mean out-bits set 191.5/512 [degree >= d reached]
|
||||
d=15 nonzero 4000/4000 = 1.0000 mean out-bits set 196.4/512 [degree >= d reached]
|
||||
d=16 nonzero 4000/4000 = 1.0000 mean out-bits set 203.1/512 [degree >= d reached]
|
||||
READING: the smallest d at which nonzero is ~1.0 is the degree floor; high degree at small d means no low-degree algebraic shortcut across the applications
|
||||
### integral apps=2
|
||||
self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9
|
||||
integral day=20729 apps=2 placements_per_d=4000 threads=48
|
||||
d = cube dimension; 'nonzero' = placements whose cube-sum is nonzero on >=1 output bit (degree >= d reached)
|
||||
d= 1 nonzero 4000/4000 = 1.0000 mean out-bits set 256.1/512 [degree >= d reached]
|
||||
d= 2 nonzero 4000/4000 = 1.0000 mean out-bits set 255.8/512 [degree >= d reached]
|
||||
d= 3 nonzero 4000/4000 = 1.0000 mean out-bits set 255.7/512 [degree >= d reached]
|
||||
d= 4 nonzero 4000/4000 = 1.0000 mean out-bits set 255.9/512 [degree >= d reached]
|
||||
d= 5 nonzero 4000/4000 = 1.0000 mean out-bits set 256.2/512 [degree >= d reached]
|
||||
d= 6 nonzero 4000/4000 = 1.0000 mean out-bits set 255.7/512 [degree >= d reached]
|
||||
d= 7 nonzero 4000/4000 = 1.0000 mean out-bits set 255.8/512 [degree >= d reached]
|
||||
d= 8 nonzero 4000/4000 = 1.0000 mean out-bits set 255.7/512 [degree >= d reached]
|
||||
d= 9 nonzero 4000/4000 = 1.0000 mean out-bits set 256.0/512 [degree >= d reached]
|
||||
d=10 nonzero 4000/4000 = 1.0000 mean out-bits set 256.4/512 [degree >= d reached]
|
||||
d=11 nonzero 4000/4000 = 1.0000 mean out-bits set 256.4/512 [degree >= d reached]
|
||||
d=12 nonzero 4000/4000 = 1.0000 mean out-bits set 256.1/512 [degree >= d reached]
|
||||
d=13 nonzero 4000/4000 = 1.0000 mean out-bits set 256.1/512 [degree >= d reached]
|
||||
d=14 nonzero 4000/4000 = 1.0000 mean out-bits set 255.8/512 [degree >= d reached]
|
||||
d=15 nonzero 4000/4000 = 1.0000 mean out-bits set 255.8/512 [degree >= d reached]
|
||||
d=16 nonzero 4000/4000 = 1.0000 mean out-bits set 255.9/512 [degree >= d reached]
|
||||
READING: the smallest d at which nonzero is ~1.0 is the degree floor; high degree at small d means no low-degree algebraic shortcut across the applications
|
||||
### diffusion spot K=1,2
|
||||
self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9
|
||||
diffusion day=20729 plant=none apps=1 start=0 states=2000000 threads=48
|
||||
mean output-flip probability over all 262144 cells: 0.461179 (ideal 0.5)
|
||||
census band: 8 sigma = 0.002828 (2000000 states)
|
||||
dependency holes (p == 0 or p == 1 exactly): 551 of 262144
|
||||
strong-bias cells (|p-0.5| > band, not a hole): 112032 of 262144
|
||||
worst cell: in_bit 29 -> out_bit 76 p = 1.000000 dev = 0.500000 (1414.2 sigma)
|
||||
VERDICT: FINDING (holes or strong bias at this K)
|
||||
self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9
|
||||
diffusion day=20729 plant=none apps=2 start=0 states=2000000 threads=48
|
||||
mean output-flip probability over all 262144 cells: 0.500001 (ideal 0.5)
|
||||
census band: 8 sigma = 0.002828 (2000000 states)
|
||||
dependency holes (p == 0 or p == 1 exactly): 0 of 262144
|
||||
strong-bias cells (|p-0.5| > band, not a hole): 0 of 262144
|
||||
worst cell: in_bit 203 -> out_bit 42 p = 0.501711 dev = 0.001711 (4.8 sigma)
|
||||
VERDICT: no distinguisher at this K
|
||||
UTC_END 2026-10-07T18:34:01Z
|
||||
|
|
@ -10,149 +10,158 @@ quoted in public. This is such a pass. It is not an outside review.
|
|||
| Field | Value |
|
||||
|---|---|
|
||||
| Target commit | 017e70376489251e18564c0abce7e466e606c8b3 (class v4 sub-version 3, object byte 7) |
|
||||
| Target | the mixer M_r (spec 01 section 1.8.4), 8 keyed applications between reads, 72 per item, class v4 (m = 8) |
|
||||
| Branch | adv-mixer, from build/master |
|
||||
| Byte-identity | memhard.rs, seed.rs, bind.rs, derive.rs, Cargo.toml, Cargo.lock are byte-identical to the frozen commit; accept.rs, emit.rs, generator.rs, packcheck.rs and the two mixer/recheck test files differ and are NOT M_r (plan section 0) |
|
||||
| Harness attack-adv-mixer | sha256 a01bf61016a8bda530468f081442131f1bff4a7b6401dd84cbcde83c78bb48f3 (box 2 release) |
|
||||
| Harness attack-f4 census | sha256 d51df6caab338b0165485c3ce6d6379c0af7180bf2b72fc0a1531beabeaf2d22 (box 2 release) |
|
||||
| Box | igneum-build-2 (box 2), nice 10; the f4 expect tail on igneum-build-1 (box 1), nice 10 |
|
||||
| Target | the mixer M_r (spec 01 section 1.8.4): 8 keyed applications between reads, 72 per item, class v4 (m = 8) |
|
||||
| Lane | adv-mixer, narrowed by main (19:2x BST) to the ALGEBRAIC STRUCTURE of M_r (Q1); Q2 is adv-mixer-3, Q3 is adv-mixer-2 |
|
||||
| Branch | adv-mixer; working HEAD d8eea5f7 (merge of build/master 04c4d9bc) |
|
||||
| Byte-identity | after the merge, `git diff --quiet 017e70376489251e18564c0abce7e466e606c8b3 HEAD -- igneum-pow` prints IDENTICAL: the whole crate is the frozen object. The branch was first cut from stale master 3f0afcd5 whose igneum-pow differed in 6 non-mixer files; those pre-merge runs were re-run on the merged tree and match (see below) |
|
||||
| Harness attack-adv-mixer (merged) | sha256 179b77a5bb1e2158004d4044de6d6622cf649ce6e8cc5e69623053e849651274 |
|
||||
| Harness attack-f4 census (stale, mixer-identical) | sha256 d51df6caab338b0165485c3ce6d6379c0af7180bf2b72fc0a1531beabeaf2d22 |
|
||||
| Boxes | igneum-build-2 (box 2) and igneum-build-1 (box 1), nice 10 |
|
||||
| Toolchain | rustc 1.99.0 both sides |
|
||||
| Day under test | chain day index 20729 (genesis, 3 October 2026), bind::day_bytes(20729) |
|
||||
| Clock | plan pushed 18:11 BST; first results in this report by 18:40 BST (ask line 00:00 BST) |
|
||||
|
||||
## Status board
|
||||
|
||||
| Q | Method | Known-failed shape | Gate | Result (numbers) | Status |
|
||||
|---|---|---|---|---|---|
|
||||
| Q3 weak draws | f4 census over 2^24 days, M1/M2 datapath cost | plant alleq/mul1/mul1all/rc0/rcrk0 (all fired) | any class >= 1.1x on a non-negligible fraction | largest per-day M1 gain 1.1726x on 1 day in 2^24; 5476 days (3.26e-4) over 1.1x on the generous M1 metric; 0 days with any M2 DSP gain; 0 ops from ROT or RC on any day; ROT-all-equal never occurred | FINDING (tail), BOUNDED |
|
||||
| Q2 round margin | adv-mixer diffusion census, K = 1..8, 2e6 states | diffusion --plant weak (fired: 7894 holes, 236269 strong cells at K=1) | full diffusion (no hole, no strong bias at 8 sigma) at K | running | RUNNING |
|
||||
| Q1 shortcut | adv-mixer fold probe, 1e6 trials | the probes are their own control | affinity violations > 0, dead pairs = 0, key agreements = 0 | 1e6/1e6 affinity violations, 0 of 256 dead word pairs, 0 of 1e6 key-order agreements | PASS (BOUND: no fold) |
|
||||
| Q4 other | watched while the above ran | n/a | n/a | fixed round keys and MUL/RC reuse in item init are covered by Q3 classes; nothing further yet | RUNNING |
|
||||
| Q | Lane | Method | Known-failed shape | Gate | Result (numbers) | Status |
|
||||
|---|---|---|---|---|---|---|
|
||||
| Q1 algebraic structure | adv-mixer (this) | fold probe + integral cube-sum degree test | the probes are their own control | affinity violations > 0, dead pairs = 0, key agreements = 0; degree saturates | 1e6/1e6 affinity violations; 0/256 dead word pairs; 0/1e6 key-order agreements; algebraic degree >= 16 after 1 application, saturated (256/512 bits per cube-sum) after 2 | PASS (BOUND: no shortcut, 8x stands) |
|
||||
| Q2 round margin | adv-mixer-3 (courtesy run here) | diffusion avalanche census K=1..8, 2e6 states | diffusion --plant weak (fired) | full diffusion at K | distinguisher reaches K=1 only; K=2..8 clean (0 holes, 0 strong, worst 4.5 to 4.9 sigma) | BOUND (handed to adv-mixer-3) |
|
||||
| Q3 weak draws | adv-mixer-2 (courtesy run here) | f4 census over 2^24 days | plant alleq/mul1/mul1all/rc0/rcrk0 (all fired) | any class >= 1.1x on a non-negligible fraction | M1 cost 197 to 263, mean 231.1; best day a 1.17x smaller FPGA multiply datapath, 1 day in 2^24; 0 days DSP or wall-time gain; ROT-all-equal never seen | BOUND+tail (handed to adv-mixer-2) |
|
||||
|
||||
## Q3: weak parameter draws (BOUND with a measured tail)
|
||||
## Q1: the algebraic structure of M_r (BOUND: no composition cheaper than 8x)
|
||||
|
||||
Command (box 2):
|
||||
The question. The 8 keyed applications between two cache reads differ only in the round key rk. Can they be
|
||||
evaluated in fewer than 8x one application, by folding or commuting the multiply layer, by a surviving
|
||||
differential, linear or rotational property of the drawn double round, or by a low-degree algebraic form of the
|
||||
composition? Any gain is priced in ops per item against the chip model's 9,360 (hoisted, m = 8).
|
||||
|
||||
Two measurements, both on the frozen-identical binary (sha 179b77a5), day 20729.
|
||||
|
||||
### Fold probe
|
||||
|
||||
Command (box 1):
|
||||
```
|
||||
nice -n 10 taskset -c 64-95 attack-f4 census --from 20729 --count 16777216 --threads 32
|
||||
nice -n 10 attack-adv-mixer fold --day 20729 --trials 1000000
|
||||
```
|
||||
Seed: MixParams::with_shape(seed_words_from_bytes(bind::day_bytes(d)), Shape::for_class(&V4_CLASS)) for
|
||||
consecutive chain day indices d from 20729. No external seed. 16,777,216 days (2^24), 4.4 s wall.
|
||||
Log: /srv/builds/igneum-wt-adv-mixer/adv/census-20261007T181830Z.log on box 2.
|
||||
|
||||
The gain metric M1 is the per-day LUT datapath: an FPGA bitstream synthesised for one day, the only per-day
|
||||
attacker that exists. A constant XOR folds into the next LUT, a constant rotation is routing, a 32-bit add or XOR
|
||||
is one adder-equivalent, a multiply by a constant is NAF(MUL) - 1 adders. M1 cost per application is
|
||||
64 + sum(NAF(MUL_i) - 1). The 64 is the 8 quarter rounds' adds and xors. Gain is the census median over the
|
||||
day's cost. This is the generous bound: real single-constant multipliers beat NAF and a DSP multiply is
|
||||
value-independent.
|
||||
| Probe | Result | Reading |
|
||||
|---|---|---|
|
||||
| (a) GF(2) affinity of the 2-application map g | 1,000,000 of 1,000,000 quadruples violate g(a)+g(b)+g(c)+g(a+b+c)=g(0) | g is maximally far from affine; the two multiply layers do not fold through the double round |
|
||||
| (b) dead (in_word, out_word) pairs over the full 8-application block | 0 of 256 | every output word depends on every input word; no separability to split on |
|
||||
| (c) key-order agreements M(M(.,rk1),rk2) == M(M(.,rk2),rk1) | 0 of 1,000,000 | key order matters; the 8 round keys cannot be folded or commuted |
|
||||
|
||||
Headline numbers:
|
||||
### Integral (algebraic-degree) cube-sum test
|
||||
|
||||
| Quantity | Value |
|
||||
|---|---|
|
||||
| M1 cost mean | 231.11 adders per application (sd 6.19) |
|
||||
| M1 cost median | 231 |
|
||||
| M1 cost min (best attacker day) | 197, day 4819563 |
|
||||
| M1 cost max | 263, day 15262713 |
|
||||
| Largest M1 gain | 1.1726x (231 / 197), 1 day in 2^24 |
|
||||
| Days with M1 gain over 1.1x (cost < 210) | 5476 of 16,777,216 = 3.26e-4 (about 1 in 3064 days) |
|
||||
| Days with any M2 DSP-bound gain, k >= 2 | 0 |
|
||||
| Days with a ROT or RC wall-time gain | 0 (a bit-exact verifier never skips an application; ROT is wiring, RC is inverters) |
|
||||
Command (box 1):
|
||||
```
|
||||
nice -n 10 attack-adv-mixer integral --day 20729 --apps 1 --dmax 16 --placements 4000 --threads 48
|
||||
nice -n 10 attack-adv-mixer integral --day 20729 --apps 2 --dmax 16 --placements 4000 --threads 48
|
||||
```
|
||||
For each cube dimension d the harness XOR-sums the output over all 2^d flips of d random input bits, over 4000
|
||||
random placements. A zero sum on every output bit would prove algebraic degree < d (a low-degree form a shortcut
|
||||
could exploit). The result:
|
||||
|
||||
What this means for the honest miner and the verifier. The M1 gain is the adder count of an FPGA datapath
|
||||
synthesised for one calendar day. It is not a wall-time shortcut against the honest GPU and not a skipped
|
||||
application at the bit-exact verifier. The chip model prices the mixer at 9,360 ops per item hoisted; a 1.17x cut
|
||||
in the multiply layer's adder count on the single best day in 2^24 does not move the chip rows, which are bound
|
||||
by the 8 cache reads and the fixed op count, not by the FPGA adder count of one day. Over 2^24 days (about 45,900
|
||||
years of calendar days) the worst day hands a per-day FPGA a 1.17x smaller multiply datapath, once.
|
||||
|
||||
The spec's open worry (1.8.4: a ROT draw of eight equal values is possible and untested). ROT all equal did NOT
|
||||
occur in 2^24 days. The analytic rate is 1 in 2.751e10 days (about 1 day in 75 million years). The worst realized
|
||||
ROT concentration is 2 days with all eight ROT in {1,2,30,31}, at M1 gain 1.0645x.
|
||||
|
||||
Class table, the members that matter (full table in the log):
|
||||
|
||||
| Class | Count / 2^24 | Fraction | Analytic expected | Worst day: M1 cost, gain |
|
||||
| Applications | d = 1..16 | Cube-sum nonzero fraction | Mean output bits set per cube-sum | Reading |
|
||||
|---|---|---|---|---|
|
||||
| ROT all equal | 0 | 0 | 3.64e-11 | none |
|
||||
| ROT distinct <= 3 | 534 | 3.18e-5 | 3.07e-5 | day 11482247: 208, 1.1106x |
|
||||
| ROT max multiplicity >= 4 | 35631 | 2.12e-3 | 2.35e-3 | day 9506389: 206, 1.1214x |
|
||||
| ROT any pair sums to 32 | 10022037 | 5.97e-1 | 6.01e-1 | day 4819563: 197, 1.1726x |
|
||||
| ROT all 8 in {1,2,30,31} | 2 | 1.19e-7 | 7.68e-8 | day 14330190: 217, 1.0645x |
|
||||
| MUL any = 1 | 0 | 0 | 7.45e-9 | none |
|
||||
| MUL any popcount <= 4 | 612 | 3.65e-5 | 3.72e-5 | day 7275755: 200, 1.1550x |
|
||||
| MUL any NAF weight <= 2 | 4 | 2.38e-7 | (expect run) | day 7786546: 221, M2 1.067x |
|
||||
| MUL any NAF weight <= 3 | 216 | 1.29e-5 | (expect run) | day 332924: 207, M2 1.067x |
|
||||
| MUL two equal | 0 | 0 | 5.59e-8 | none |
|
||||
| MUL M2 k >= 2 (gain >= 1.14x) | 0 | 0 | (expect run) | none |
|
||||
| RC any = 0 | 0 | 0 | 3.73e-9 | none |
|
||||
| RC + rk = 0 for any of 72 keys | 10 | 5.96e-7 | 2.68e-7 | day 3194363: 218, 1.0596x |
|
||||
| 1 | every d | 1.0000 at every d | 172 to 236 of 512 | degree >= 16 already after one application |
|
||||
| 2 | every d | 1.0000 at every d | about 256 of 512 (half) | saturated: two applications look like a random high-degree map up to degree 16 |
|
||||
|
||||
Every counted fraction tracks the analytic expectation (the draw is unbiased). The M2 DSP metric found zero days
|
||||
with two or more low-NAF multiplies, so no day frees a second DSP block. The analytic expect run (box 1) is
|
||||
cross-checking the NAF-weight tail; its numbers land in this section when it finishes.
|
||||
Verdict for Q1. No composition cheaper than 8x was found. The multiply layers of adjacent applications are
|
||||
separated by a nonlinear double round and do not merge (fold probe a). The drawn double round gives no
|
||||
commutation that would fold keys (fold probe c). The word-dependency is complete at 8 applications (fold probe
|
||||
b). The algebraic degree reaches at least 16 after a single application and saturates after two, so there is no
|
||||
low-degree algebraic or integral form of even one application, let alone the 8, that an attacker could batch. The
|
||||
8 keyed applications cost 8x on this evidence. Priced against the chip model: 0 ops saved per item; the 9,360 ops
|
||||
per item stand. This is a BOUND, not a proof: the integral test reaches degree 16 (2^16 cube), and the fold
|
||||
probe is GF(2)-degree-1; an exact algebraic-degree measurement above 16 and a SAT or MILP algebraic form are owed
|
||||
work. One line on what a longer pass would add: it would pin the exact degree above 16 and rule out a
|
||||
medium-degree (17 to 40) relation the cube test at d = 16 cannot see; it would not change the no-fold bound.
|
||||
|
||||
Verdict for Q3. A measured weak-day tail exists on the generous M1 FPGA-adder metric: 3.26e-4 of days beat 1.1x,
|
||||
the single best day reaches 1.1726x. It is bounded and small, zero on the DSP metric and zero on any wall-time
|
||||
metric, and the spec's untested ROT-all-equal case never occurs and is astronomically rare. A weak day is a
|
||||
public calendar, so an FPGA attacker could target day 4819563 of the chain for a 1.17x smaller multiply datapath,
|
||||
which the chip model does not credit as a hash-rate gain. This is a FINDING in that the tail is nonzero, a BOUND
|
||||
in that the worst case is 1.17x on a metric that does not move the honest or verifier cost.
|
||||
|
||||
## Q2: the round margin (RUNNING)
|
||||
## Q2: the round margin (courtesy run; lane adv-mixer-3)
|
||||
|
||||
Command (box 2), per K in 1..8:
|
||||
```
|
||||
nice -n 10 attack-adv-mixer diffusion --day 20729 --apps K --states 2000000 --threads 32
|
||||
```
|
||||
Seed: probe states from the harness SplitMix64 seeded per thread from the day index; mixer params the real day
|
||||
20729 draw. Log: /srv/builds/igneum-wt-adv-mixer/adv/diffusion-20261007T181948Z.log on box 2.
|
||||
Log: docs/analysis/cryptanalysis/logs/adv-mixer/diffusion-K1-8.log (copied off the box). Census band at 2e6 states is 8
|
||||
sigma = 0.00283, so a per-cell bias below 0.28 percent is invisible; quoted with the result.
|
||||
|
||||
The census band at 2e6 states is 8 sigma = 0.00566, so a per-cell bias below 0.57 percent is invisible; this
|
||||
limit is quoted with every row. The plant fired: the degenerate day (MUL all 1, RC all 0, ROT all 16) at K = 1
|
||||
gave 7894 dependency holes and 236269 strong-bias cells of 262144, mean flip 0.1739, worst cell 223.6 sigma. A
|
||||
real day must clear to zero holes and zero strong cells to call the distinguisher out at that K. Results land here
|
||||
per K as the sweep runs.
|
||||
| K applications | Dependency holes | Strong-bias cells (> 8 sigma) | Worst cell | Verdict |
|
||||
|---|---|---|---|---|
|
||||
| 1 | 578 of 262144 | 111997 of 262144 | 1414 sigma | distinguisher reaches K=1 |
|
||||
| 2 | 0 | 0 | 4.8 sigma | clean |
|
||||
| 3 | 0 | 0 | 4.6 sigma | clean |
|
||||
| 4 | 0 | 0 | 4.7 sigma | clean |
|
||||
| 5 | 0 | 0 | 4.9 sigma | clean |
|
||||
| 6 | 0 | 0 | 4.6 sigma | clean |
|
||||
| 7 | 0 | 0 | 4.5 sigma | clean |
|
||||
| 8 | 0 | 0 | 4.8 sigma | clean |
|
||||
|
||||
## Q1: the structural shortcut (BOUND, no fold)
|
||||
The plant fired: the degenerate day (MUL all 1, RC all 0, ROT all 16) at K=1 gave 7894 holes and 236269 strong
|
||||
cells, worst 223.6 sigma. Reading: the strict-avalanche distinguisher reaches only 1 application. Full diffusion
|
||||
at 2 applications. Margin against the 8 between reads: 6 applications (8 minus 2). Margin against the 72 per item:
|
||||
70. This is an avalanche census, not a trail search; a bias below 0.28 percent at K=2 is invisible. The
|
||||
differential, linear, rotational-XOR and SAT/MILP tightening is adv-mixer-3's lane; handed over.
|
||||
|
||||
## Q3: weak parameter draws (courtesy run; lane adv-mixer-2)
|
||||
|
||||
Command (box 2):
|
||||
```
|
||||
attack-adv-mixer fold --day 20729 --trials 1000000
|
||||
nice -n 10 taskset -c 64-95 attack-f4 census --from 20729 --count 16777216 --threads 32
|
||||
```
|
||||
Seed: harness SplitMix64 seeded from the day index; mixer params the real day 20729 draw.
|
||||
16,777,216 days (2^24), 4.4 s. Log: docs/analysis/cryptanalysis/logs/adv-mixer/census-2pow24.log (copied off the box).
|
||||
|
||||
| Probe | Result | Reading |
|
||||
The M1 metric is the per-day FPGA LUT datapath adder count, 64 + sum(NAF(MUL_i) - 1). Convention-free facts over
|
||||
2^24 days:
|
||||
|
||||
| Quantity | Value |
|
||||
|---|---|
|
||||
| M1 cost range | 197 (day 4819563) to 263 (day 15262713) |
|
||||
| M1 cost mean, sd | 231.1, 6.19 |
|
||||
| Best attacker day | multiply datapath 197/231.1 = 0.853 of mean, a 1.17x smaller datapath, on 1 day in 2^24 |
|
||||
| Days with any M2 (DSP-bound) gain, k >= 2 | 0 |
|
||||
| Days with a ROT or RC wall-time gain | 0 (bit-exact verifier; ROT is wiring, RC is inverters) |
|
||||
| ROT all equal (the spec's untested worry) | 0 of 2^24 (analytic 1 in 2.751e10 days) |
|
||||
| MUL any = 1, MUL two equal, RC any = 0 | 0, 0, 0 |
|
||||
|
||||
Open cross-check for the Q3 lane owner: the census computes the over-1.1x count against its own measured median
|
||||
231 (5476 days, 3.26e-4), while the analytic `expect` tool reports a reference median 221 and an over-1.1x
|
||||
fraction near 8.6e-7 (about 14.5 days in 2^24). The two references differ by 10 adders; the convention-free range
|
||||
above does not depend on the choice. Reconciling the median is handed to adv-mixer-2. Either way the best day is a
|
||||
1.17x FPGA-datapath gain the chip model does not credit as hash rate (the chip is bound by the 8 cache reads and
|
||||
the fixed op count, not by one day's multiply-adder count), and a weak day is a public calendar.
|
||||
|
||||
## Confirmation across the stale and frozen trees
|
||||
|
||||
The branch was first cut from stale master 3f0afcd5. Its igneum-pow differed from the frozen object in six
|
||||
non-mixer files (accept.rs, emit.rs, generator.rs, packcheck.rs, tests/mixer.rs, tests/recheck.rs); memhard.rs,
|
||||
seed.rs, bind.rs, derive.rs and the Cargo pin were byte-identical. After `git merge build/master` the whole crate
|
||||
is byte-identical to 017e7037 (IDENTICAL). The Q1 fold and the K=1 and K=2 diffusion spot-checks were re-run on
|
||||
the merged binary and match the stale runs within sampling noise (K=1 holes 551 merged vs 578 stale, K=2 clean on
|
||||
both). So the stale-tree Q2 and Q3 numbers coincide with the frozen object. The self-check asserts the spec 1.8.4
|
||||
genesis ROT, MUL and RC vectors on every run.
|
||||
|
||||
## Box-hours and pod-hours spent
|
||||
|
||||
No GPU pods used: pod-hours 0. All CPU, nice 10, both boxes.
|
||||
|
||||
| Step | Box | Wall |
|
||||
|---|---|---|
|
||||
| (a) GF(2) affinity of the 2-application map | 1,000,000 of 1,000,000 quadruples violate affinity | the two multiply layers do not fold through the double round; the map is far from affine |
|
||||
| (b) dead (in_word, out_word) pairs over the full 8-application block | 0 of 256 | every output word depends on every input word after 8 applications |
|
||||
| (c) key-order agreements M(M(.,rk1),rk2) == M(M(.,rk2),rk1) | 0 of 1,000,000 | key order matters; the 8 round keys cannot be folded |
|
||||
| Builds (adv-mixer x2, f4 x2) | box 1 and 2 | about 1.5 min total |
|
||||
| f4 five plant firings | box 2 | about 3 min |
|
||||
| f4 census 2^24 | box 2 | 4.4 s |
|
||||
| f4 expect analytic tail | box 1 | a few min (log later wiped by a box re-sync; numbers captured) |
|
||||
| Q2 diffusion sweep K=1..8, 2e6 states | box 2 | 11 min |
|
||||
| Q1 fold + integral + spot-checks | box 1 | 1 min 44 s |
|
||||
|
||||
Verdict for Q1. On these probes the 8 keyed applications show no cheap composition. The multiply layers of
|
||||
adjacent applications are separated by a nonlinear double round, so they do not merge (candidate 1 fails). The
|
||||
drawn double round gives no surviving commutation that would fold keys (candidate 3 fails). The word-dependency
|
||||
is complete at 8 applications (no separability). This bounds the cheapest folds. It does not rule out a high-order
|
||||
algebraic or integral distinguisher below the probe's reach; that is owed work (plan section 7). No gain is
|
||||
priced against the 9,360 ops per item: the 8 applications cost 8x on this evidence.
|
||||
Total about 0.4 box-hours of the 8-hour first-results budget (ask line 16). Pod-hours 0.
|
||||
|
||||
## Q4: anything else (RUNNING)
|
||||
## Rule-change timeline (so the box-hours stay honest)
|
||||
|
||||
Two structural notes, both covered by Q3 classes. The 72 round keys are fixed multiples of 0x9E3779B9, not drawn,
|
||||
so a bad round key is the same every day; the RC + rk = 0 class counts the one interaction (10 days in 2^24). The
|
||||
item init s[8+i] = t*MUL[i] + RC[i] reuses MUL and RC, so a MUL[i] = 1 would collapse an init word to t + RC[i];
|
||||
MUL any = 1 occurred on 0 days. Nothing further found yet.
|
||||
|
||||
## Box-hours spent (so far)
|
||||
|
||||
| Step | Box | Wall | Slot-hours |
|
||||
|---|---|---|---|
|
||||
| Build adv-mixer | box 2 | 21 s | 0.006 |
|
||||
| Build f4-weakday | box 2 | 4 s | 0.001 |
|
||||
| adv-mixer diffusion plant K=1 (50k) | box 2 | 5 s | 0.001 |
|
||||
| adv-mixer fold 1e6 | box 2 | ~6 s | 0.002 |
|
||||
| f4 five plant firings | box 2 | ~3 min | 0.05 |
|
||||
| f4 census 2^24 | box 2 | 4.4 s | 0.001 |
|
||||
| Build f4 on box 1 | box 1 | 39 s | 0.011 |
|
||||
| Q2 diffusion sweep K=1..8 | box 2 | running | tracked at end |
|
||||
| f4 expect tail | box 1 | running | tracked at end |
|
||||
|
||||
Spent before the two running sweeps: about 0.08 box-hours of the 8-hour first-results budget.
|
||||
| Time (BST) | Change | Effect on this lane |
|
||||
|---|---|---|
|
||||
| 19:0x | both boxes, nice 10, drop the single band | adopted; runs moved off a single 32-core band |
|
||||
| 19:2x | three-lane re-scope: this lane is Q1 only | Q2 and Q3 kept as courtesy runs, attributed |
|
||||
| 19:3x | merge build/master, re-prove igneum-pow identical | done, IDENTICAL; pre-merge runs re-run and matched |
|
||||
| 19:4x | drop SIGSTOP yield, run on cores 8-95 only | no yield was ever added; run-box.sh band set to 8-95; direct nohup runs at nice 10 |
|
||||
|
|
|
|||
14
tools/attack/adv-mixer/Cargo.lock
generated
Normal file
14
tools/attack/adv-mixer/Cargo.lock
generated
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
# This file is automatically @generated by Cargo.
|
||||
# It is not intended for manual editing.
|
||||
version = 4
|
||||
|
||||
[[package]]
|
||||
name = "attack-adv-mixer"
|
||||
version = "0.1.0"
|
||||
dependencies = [
|
||||
"igneum-pow",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "igneum-pow"
|
||||
version = "0.2.0"
|
||||
|
|
@ -12,9 +12,9 @@ set -euo pipefail
|
|||
ROOT=/srv/builds/igneum-wt-adv-mixer
|
||||
ADV="$ROOT/tools/attack/adv-mixer/target/release/attack-adv-mixer"
|
||||
F4="$ROOT/tools/attack/f4-weakday/target/release/attack-f4"
|
||||
OUT="$ROOT/adv"
|
||||
OUT="/srv/builds/_adv-adv-mixer"
|
||||
mkdir -p "$OUT"
|
||||
BAND=64-95
|
||||
BAND=8-95
|
||||
STATES=${STATES:-2000000}
|
||||
|
||||
case "${1:-}" in
|
||||
|
|
|
|||
|
|
@ -15,3 +15,7 @@ docs/analysis/ci-failures-2026-10-06.md
|
|||
# 7 October 2026: the last research round (the mission lanes and the closed list): internal research written for the
|
||||
# owner, quoting his words and the operations record; the public spec mirror carries none of it
|
||||
docs/analysis/mission
|
||||
# 7 October 2026: the mixer cryptanalysis lane (adv-mixer): an internal adversarial pass that names the lanes, the
|
||||
# coordinator and the operations timeline and quotes binary hashes and seeds; not for the public spec mirror
|
||||
docs/analysis/cryptanalysis
|
||||
docs/plans/cryptanalysis
|
||||
|
|
|
|||
Loading…
Reference in a new issue