diff --git a/docs/analysis/cryptanalysis/logs/adv-mixer/census-2pow24.log b/docs/analysis/cryptanalysis/logs/adv-mixer/census-2pow24.log new file mode 100644 index 000000000..ceb70058c --- /dev/null +++ b/docs/analysis/cryptanalysis/logs/adv-mixer/census-2pow24.log @@ -0,0 +1,389 @@ +# attack-f4 census: 16777216 chain days from day index 20729 (genesis 20729), class v4 shape (mixer x8, cache 2^26), 32 threads, 4.4 s +draw: MixParams::with_shape(seed_words_from_bytes(bind::day_bytes(d)), Shape::for_class(&V4_CLASS)); seed64 = key[0] | key[1] << 32 + +## Gate (plan 1.4 (3), B5 rank 3): fraction of days with any gain over 1.1x under 2^-20 = 9.537e-7 + +| Metric | Reference | Days over 1.1x | Fraction | Against 2^-20 | +|---|---|---|---|---| +| M1 per-day LUT datapath, adders per application | median cost 231 (gain over 1.1x = cost under 210) | 5476 | 3.264e-4 | OVER | +| M1 against the mean cost 231.11 (sd 6.19) | cost under 210.10 | 9363 | 5.581e-4 | OVER | +| M2 DSP-bound datapath, 16/(16-k) with k = words of NAF weight <= 3 | k >= 2 | 0 | 0.000e0 | under | +| ROT value (wiring) and RC value (inverters) on a per-day datapath | exact 0 ops moved on every day | 0 | 0 | under | + +M1 cost = 64 + sum(NAF(MUL_i) - 1); mean 231.113, sd 6.190, median 231, min 197 (day 4819563), max 263 (day 15262713) + +## Classes over 16777216 days + +| Class | Count | Fraction | Expected per day (analytic) | Expected count | Worst member (day, M1 cost, M1 gain vs median, M2 gain) | +|---|---|---|---|---|---| +| ROT all equal | 0 | 0.000e0 | 3.635e-11 (1 in 2.751e10) | 0.001 | none | +| ROT distinct <= 3 | 534 | 3.183e-5 | 3.069e-5 (1 in 3.259e4) | 514.813 | day 11482247 , cost 208 , 1.1106x , 1.000x | +| ROT distinct <= 4 | 26010 | 1.550e-3 | 1.537e-3 (1 in 6.507e2) | 25782.741 | day 1092491 , cost 207 , 1.1159x , 1.000x | +| ROT max multiplicity >= 4 | 35631 | 2.124e-3 | 2.350e-3 (1 in 4.256e2) | 39421.474 | day 9506389 , cost 206 , 1.1214x , 1.000x | +| ROT same-word pair sums to 32 | 2062481 | 1.229e-1 | 1.229e-1 (1 in 8.135e0) | 2062288.067 | day 3675001 , cost 201 , 1.1493x , 1.000x | +| ROT any pair sums to 32 | 10022037 | 5.974e-1 | 6.007e-1 (1 in 1.665e0) | 10078561.158 | day 4819563 , cost 197 , 1.1726x , 1.000x | +| ROT all 8 in {1,2,30,31} | 2 | 1.192e-7 | 7.684e-8 (1 in 1.301e7) | 1.289 | day 14330190 , cost 217 , 1.0645x , 1.000x | +| ROT >= 6 in {1,2,30,31} | 1761 | 1.050e-4 | 1.023e-4 (1 in 9.780e3) | 1715.548 | day 155537 , cost 212 , 1.0896x , 1.000x | +| ROT >= 4 in {1,2,30,31} | 211152 | 1.259e-2 | 1.259e-2 (1 in 7.942e1) | 211253.447 | day 12915578 , cost 198 , 1.1667x , 1.000x | +| ROT >= 4 in {8,16,24} | 74541 | 4.443e-3 | 4.456e-3 (1 in 2.244e2) | 74756.114 | day 5517722 , cost 198 , 1.1667x , 1.000x | +| MUL any = 1 | 0 | 0.000e0 | 7.451e-9 (1 in 1.342e8) | 0.125 | none | +| MUL any = 2^32-1 | 0 | 0.000e0 | 7.451e-9 (1 in 1.342e8) | 0.125 | none | +| MUL any popcount <= 2 | 0 | 0.000e0 | 2.384e-7 (1 in 4.194e6) | 4.000 | none | +| MUL any popcount <= 4 | 612 | 3.648e-5 | 3.719e-5 (1 in 2.689e4) | 623.989 | day 7275755 , cost 200 , 1.1550x , 1.000x | +| MUL any popcount <= 8 | 441646 | 2.632e-2 | 2.629e-2 (1 in 3.804e1) | 441000.196 | day 12915578 , cost 198 , 1.1667x , 1.000x | +| MUL any NAF weight <= 2 | 4 | 2.384e-7 | see `expect` | see `expect` | day 7786546 , cost 221 , 1.0452x , 1.067x | +| MUL any NAF weight <= 3 | 216 | 1.287e-5 | see `expect` | see `expect` | day 332924 , cost 207 , 1.1159x , 1.067x | +| MUL any NAF weight <= 4 | 3637 | 2.168e-4 | see `expect` | see `expect` | day 7275755 , cost 200 , 1.1550x , 1.000x | +| MUL any < 256 | 22 | 1.311e-6 | 9.537e-7 (1 in 1.049e6) | 16.000 | day 14317428 , cost 216 , 1.0694x , 1.000x | +| MUL two equal | 0 | 0.000e0 | 5.588e-8 (1 in 1.790e7) | 0.937 | none | +| MUL M2 k >= 2 (gain >= 1.14x) | 0 | 0.000e0 | see `expect` | see `expect` | none | +| RC any = 0 | 0 | 0.000e0 | 3.725e-9 (1 in 2.684e8) | 0.062 | none | +| RC any popcount <= 4 or >= 28 | 5186 | 3.091e-4 | 3.088e-4 (1 in 3.239e3) | 5180.375 | day 7999545 , cost 208 , 1.1106x , 1.000x | +| RC + rk = 0 for any of the 72 keys | 10 | 5.960e-7 | 2.682e-7 (1 in 3.728e6) | 4.500 | day 3194363 , cost 218 , 1.0596x , 1.000x | +| RC two equal | 1 | 5.960e-8 | 2.794e-8 (1 in 3.579e7) | 0.469 | day 2875598 , cost 226 , 1.0221x , 1.000x | + +## Histograms + +| ROT distinct amounts | Count | Fraction | Expected (S(8,d) 31_d / 31^8) | +|---|---|---|---| +| 1 | 0 | 0.0000e0 | 3.6347e-11 | +| 2 | 4 | 2.3842e-7 | 1.3848e-7 | +| 3 | 530 | 3.1590e-5 | 3.0547e-5 | +| 4 | 25476 | 1.5185e-3 | 1.5061e-3 | +| 5 | 421405 | 2.5118e-2 | 2.5101e-2 | +| 6 | 2773843 | 1.6533e-1 | 1.6533e-1 | +| 7 | 7302781 | 4.3528e-1 | 4.3509e-1 | +| 8 | 6253177 | 3.7272e-1 | 3.7294e-1 | + +| ROT amounts in {1,2,30,31} | Count | Expected Binomial(8, 4/31) | ROT amounts in {8,16,24} | Count | Expected Binomial(8, 3/31) | ROT max multiplicity | Count | +|---|---|---|---|---|---|---|---| +| 0 | 5558032 | 5555670.2 | 0 | 7436763 | 7431741.5 | 0 | 0 | +| 1 | 6581255 | 6584498.0 | 1 | 6367439 | 6370064.2 | 1 | 6253177 | +| 2 | 3416505 | 3414184.2 | 2 | 2387947 | 2388774.1 | 2 | 9662112 | +| 3 | 1010272 | 1011610.1 | 3 | 510526 | 511880.2 | 3 | 826296 | +| 4 | 187244 | 187335.2 | 4 | 68359 | 68555.4 | 4 | 34667 | +| 5 | 22147 | 22202.7 | 5 | 5828 | 5876.2 | 5 | 947 | +| 6 | 1696 | 1644.6 | 6 | 345 | 314.8 | 6 | 17 | +| 7 | 63 | 69.6 | 7 | 9 | 9.6 | 7 | 0 | +| 8 | 2 | 1.3 | 8 | 0 | 0.1 | 8 | 0 | + +| M2 k (words of NAF weight <= 3) | Count | Gain 16/(16-k) | +|---|---|---| +| 0 | 16777000 | 1.000x | +| 1 | 216 | 1.067x | +| 2 | 0 | 1.143x | +| 3 | 0 | 1.231x | + +| Minimum NAF weight over the 16 MUL | Count | +|---|---| +| 2 | 4 | +| 3 | 212 | +| 4 | 3421 | +| 5 | 37733 | +| 6 | 290503 | +| 7 | 1528972 | +| 8 | 4939471 | +| 9 | 7132514 | +| 10 | 2713385 | +| 11 | 130753 | +| 12 | 248 | + +| M1 cost per application | Count | Cumulative fraction | M1 gain vs median | +|---|---|---|---| +| 197 | 1 | 5.9605e-8 | 1.1726x | +| 198 | 2 | 1.7881e-7 | 1.1667x | +| 199 | 1 | 2.3842e-7 | 1.1608x | +| 200 | 10 | 8.3447e-7 | 1.1550x | +| 201 | 15 | 1.7285e-6 | 1.1493x | +| 202 | 25 | 3.2187e-6 | 1.1436x | +| 203 | 66 | 7.1526e-6 | 1.1379x | +| 204 | 124 | 1.4544e-5 | 1.1324x | +| 205 | 250 | 2.9445e-5 | 1.1268x | +| 206 | 432 | 5.5194e-5 | 1.1214x | +| 207 | 781 | 1.0175e-4 | 1.1159x | +| 208 | 1382 | 1.8412e-4 | 1.1106x | +| 209 | 2387 | 3.2640e-4 | 1.1053x | +| 210 | 3887 | 5.5808e-4 | 1.1000x | +| 211 | 6602 | 9.5159e-4 | 1.0948x | +| 212 | 10657 | 1.5868e-3 | 1.0896x | +| 213 | 17018 | 2.6011e-3 | 1.0845x | +| 214 | 26180 | 4.1616e-3 | 1.0794x | +| 215 | 39884 | 6.5389e-3 | 1.0744x | +| 216 | 58060 | 9.9995e-3 | 1.0694x | +| 217 | 83645 | 1.4985e-2 | 1.0645x | +| 218 | 117632 | 2.1997e-2 | 1.0596x | +| 219 | 162182 | 3.1663e-2 | 1.0548x | +| 220 | 216961 | 4.4595e-2 | 1.0500x | +| 221 | 283558 | 6.1497e-2 | 1.0452x | +| 222 | 362047 | 8.3076e-2 | 1.0405x | +| 223 | 450814 | 1.0995e-1 | 1.0359x | +| 224 | 550735 | 1.4277e-1 | 1.0312x | +| 225 | 652577 | 1.8167e-1 | 1.0267x | +| 226 | 756846 | 2.2678e-1 | 1.0221x | +| 227 | 855148 | 2.7775e-1 | 1.0176x | +| 228 | 941391 | 3.3386e-1 | 1.0132x | +| 229 | 1011617 | 3.9416e-1 | 1.0087x | +| 230 | 1059221 | 4.5730e-1 | 1.0043x | +| 231 | 1079174 | 5.2162e-1 | 1.0000x | +| 232 | 1070912 | 5.8545e-1 | 0.9957x | +| 233 | 1039183 | 6.4739e-1 | 0.9914x | +| 234 | 980014 | 7.0580e-1 | 0.9872x | +| 235 | 899809 | 7.5944e-1 | 0.9830x | +| 236 | 805446 | 8.0744e-1 | 0.9788x | +| 237 | 700659 | 8.4921e-1 | 0.9747x | +| 238 | 592824 | 8.8454e-1 | 0.9706x | +| 239 | 489326 | 9.1371e-1 | 0.9665x | +| 240 | 391079 | 9.3702e-1 | 0.9625x | +| 241 | 304227 | 9.5515e-1 | 0.9585x | +| 242 | 229565 | 9.6884e-1 | 0.9545x | +| 243 | 168335 | 9.7887e-1 | 0.9506x | +| 244 | 120776 | 9.8607e-1 | 0.9467x | +| 245 | 83871 | 9.9107e-1 | 0.9429x | +| 246 | 56312 | 9.9442e-1 | 0.9390x | +| 247 | 36832 | 9.9662e-1 | 0.9352x | +| 248 | 23268 | 9.9801e-1 | 0.9315x | +| 249 | 14347 | 9.9886e-1 | 0.9277x | +| 250 | 8495 | 9.9937e-1 | 0.9240x | +| 251 | 4856 | 9.9966e-1 | 0.9203x | +| 252 | 2783 | 9.9982e-1 | 0.9167x | +| 253 | 1472 | 9.9991e-1 | 0.9130x | +| 254 | 757 | 9.9995e-1 | 0.9094x | +| 255 | 415 | 9.9998e-1 | 0.9059x | +| 256 | 179 | 9.9999e-1 | 0.9023x | +| 257 | 79 | 1.0000e0 | 0.8988x | +| 258 | 43 | 1.0000e0 | 0.8953x | +| 259 | 23 | 1.0000e0 | 0.8919x | +| 260 | 9 | 1.0000e0 | 0.8885x | +| 261 | 3 | 1.0000e0 | 0.8851x | +| 262 | 4 | 1.0000e0 | 0.8817x | +| 263 | 1 | 1.0000e0 | 0.8783x | + +## The 16 lowest-cost days (M1) + +- day 4819563: cost 197, gain 1.1726x vs median, NAF sum 149, M2 k 0, day-hex 69676e65756d2d6461792f6b8a490000000000 +- day 5517722: cost 198, gain 1.1667x vs median, NAF sum 150, M2 k 0, day-hex 69676e65756d2d6461792f9a31540000000000 +- day 12915578: cost 198, gain 1.1667x vs median, NAF sum 150, M2 k 0, day-hex 69676e65756d2d6461792f7a13c50000000000 +- day 5073249: cost 199, gain 1.1608x vs median, NAF sum 151, M2 k 0, day-hex 69676e65756d2d6461792f61694d0000000000 +- day 295616: cost 200, gain 1.1550x vs median, NAF sum 152, M2 k 0, day-hex 69676e65756d2d6461792fc082040000000000 +- day 2339457: cost 200, gain 1.1550x vs median, NAF sum 152, M2 k 0, day-hex 69676e65756d2d6461792f81b2230000000000 +- day 7275755: cost 200, gain 1.1550x vs median, NAF sum 152, M2 k 0, day-hex 69676e65756d2d6461792feb046f0000000000 +- day 7921343: cost 200, gain 1.1550x vs median, NAF sum 152, M2 k 0, day-hex 69676e65756d2d6461792fbfde780000000000 +- day 10331167: cost 200, gain 1.1550x vs median, NAF sum 152, M2 k 0, day-hex 69676e65756d2d6461792f1fa49d0000000000 +- day 10514223: cost 200, gain 1.1550x vs median, NAF sum 152, M2 k 0, day-hex 69676e65756d2d6461792f2f6fa00000000000 +- day 12709144: cost 200, gain 1.1550x vs median, NAF sum 152, M2 k 0, day-hex 69676e65756d2d6461792f18edc10000000000 +- day 14463384: cost 200, gain 1.1550x vs median, NAF sum 152, M2 k 0, day-hex 69676e65756d2d6461792f98b1dc0000000000 +- day 14777650: cost 200, gain 1.1550x vs median, NAF sum 152, M2 k 0, day-hex 69676e65756d2d6461792f327de10000000000 +- day 15551477: cost 200, gain 1.1550x vs median, NAF sum 152, M2 k 0, day-hex 69676e65756d2d6461792ff54bed0000000000 +- day 515226: cost 201, gain 1.1493x vs median, NAF sum 153, M2 k 0, day-hex 69676e65756d2d6461792f9adc070000000000 +- day 2240604: cost 201, gain 1.1493x vs median, NAF sum 153, M2 k 0, day-hex 69676e65756d2d6461792f5c30220000000000 + +## Worst member of every class, in full + +### ROT distinct <= 3: day 11482247 +``` +day index 11482247 (genesis + 11461518), day bytes 69676e65756d2d6461792f8734af0000000000 , seed64 99b37b14bce80e05 +key bce80e05 99b37b14 a88409a4 a5469d0e 35c4b54e c027571b 152552c8 9d942222 +ROT [12, 19, 19, 4, 19, 12, 19, 19] distinct 3 max multiplicity 5 small 0 byte-aligned 0 same-word pair 32 false any pair 32 false +MUL 23684433 345dfd6d 13878a5b dff7431f 60e1ffa5 fb7bcf75 ef826109 6fd6c065 1d5b0701 75f4b29f 24197fc1 1367fa6d 87f0f4ed 03b41769 92cbf013 03bbeca7 +NAF [11, 11, 11, 9, 9, 10, 9, 10, 9, 12, 8, 11, 10, 10, 11, 9] sum 160 min 8 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false +RC 93abe65f 6886b6d0 3a68d00d 3889c0c6 b194b674 4094caf5 161c68f0 6b3cdc05 f1fbf7c0 2ee32537 5779f1ba 56b1eabc 914f7e4d 35c47fa0 ab029a5b ae0b61a1 +RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false +M1 cost 208 adder-equivalents per application (14976 per item, 72 applications); M2 k 0 (gain 1.000x) +M1 gain against the census median 231: 1.1106x +classes: ROT distinct <= 3; ROT distinct <= 4; ROT max multiplicity >= 4 +``` +### ROT distinct <= 4: day 1092491 +``` +day index 1092491 (genesis + 1071762), day bytes 69676e65756d2d6461792f8bab100000000000 , seed64 da149ee55aaab937 +key 5aaab937 da149ee5 11819d67 3f60c5a0 6045fabb ac9ede0d 919ff013 7143f2b9 +ROT [21, 16, 12, 16, 31, 12, 12, 31] distinct 4 max multiplicity 3 small 2 byte-aligned 2 same-word pair 32 true any pair 32 true +MUL a05bba01 bec09787 7afe483b 28844197 b7eafc73 aa1d3f0f 83508105 f39cc103 d21f51a1 ffa61343 40cfaea1 03bebcd3 7f059f6f b00ededf ca070e07 3bd803db +NAF [9, 10, 9, 10, 11, 11, 9, 11, 12, 11, 10, 10, 9, 9, 10, 8] sum 159 min 8 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false +RC 9ea401b9 c5b29850 00371b55 5592306c 77d7ec18 f100a72b ca4db32b 82fc9dc4 83168f22 e3359513 ad711b53 b7f5dc09 add1d8ab 982a05b1 06b37a9b 829bb32d +RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false +M1 cost 207 adder-equivalents per application (14904 per item, 72 applications); M2 k 0 (gain 1.000x) +M1 gain against the census median 231: 1.1159x +classes: ROT distinct <= 4; ROT same-word pair sums to 32; ROT any pair sums to 32 +``` +### ROT max multiplicity >= 4: day 9506389 +``` +day index 9506389 (genesis + 9485660), day bytes 69676e65756d2d6461792f550e910000000000 , seed64 6982e9080d6a4cdf +key 0d6a4cdf 6982e908 4a0a0b42 a399c15d 99e27fe1 fdfb9b00 4e90d671 78401cd0 +ROT [15, 5, 31, 5, 5, 24, 6, 5] distinct 5 max multiplicity 4 small 1 byte-aligned 1 same-word pair 32 false any pair 32 false +MUL 37800e03 d714c2fb a4be52db 87737201 5ac001d7 95f7c07f c1fb39d9 8bdfc411 70097121 e009077d f0ef802b 36f0ebbf 087b2dd7 8270b24d c3b48dad fc354847 +NAF [7, 12, 13, 9, 9, 8, 11, 8, 9, 8, 9, 9, 10, 12, 13, 11] sum 158 min 7 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false +RC c4769637 de22eaea 7aa5b4ed 46b93f02 41831974 bbd9933b c6a06ba1 c102f45e 6483273a c33cfd56 5669b2b7 f5ee5a3d f4c63fc9 50ccdb45 522844d2 c405d738 +RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false +M1 cost 206 adder-equivalents per application (14832 per item, 72 applications); M2 k 0 (gain 1.000x) +M1 gain against the census median 231: 1.1214x +classes: ROT max multiplicity >= 4 +``` +### ROT same-word pair sums to 32: day 3675001 +``` +day index 3675001 (genesis + 3654272), day bytes 69676e65756d2d6461792f7913380000000000 , seed64 81ed531eeadd5e68 +key eadd5e68 81ed531e 453f3611 4caf9ae6 c9585bb1 115e4232 cdaff538 dc39efc9 +ROT [25, 5, 21, 27, 21, 7, 12, 27] distinct 6 max multiplicity 2 small 0 byte-aligned 0 same-word pair 32 true any pair 32 true +MUL 7b011e4d 3c417fc1 9d055513 beea0cb9 207ef901 1df73bdd 7c2034ff 77fe5083 cf567a1f c4311bf1 7dded2b9 7bcae001 e58678b9 0f6dc051 213ef8a9 20afbbb9 +NAF [10, 7, 13, 12, 6, 9, 8, 8, 12, 10, 11, 8, 13, 8, 9, 9] sum 153 min 6 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false +RC 113c7ffd 754403c6 9d01091b 58b7ed13 a5685eec e1a691a0 e98f235e 3f622792 3fc0a2a9 a8b91f03 3aa824aa 7ff52b9d a7f69c00 3cc25c5e c3a37dd3 90c308ad +RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false +M1 cost 201 adder-equivalents per application (14472 per item, 72 applications); M2 k 0 (gain 1.000x) +M1 gain against the census median 231: 1.1493x +classes: ROT same-word pair sums to 32; ROT any pair sums to 32 +``` +### ROT any pair sums to 32: day 4819563 +``` +day index 4819563 (genesis + 4798834), day bytes 69676e65756d2d6461792f6b8a490000000000 , seed64 d4924b5d4dc26798 +key 4dc26798 d4924b5d c75c47df 64b4f00f 0836e7ff cd383a15 4c85767a 6a08a753 +ROT [26, 18, 8, 30, 24, 24, 6, 9] distinct 7 max multiplicity 2 small 1 byte-aligned 3 same-word pair 32 false any pair 32 true +MUL a0653c83 a09de525 810085fb 6a00eba1 bf8205ff bba82079 f27da4c3 2cb80223 6001efcf 1c2814f7 ae9d09d7 ffedd7b7 943dde01 39ff47e1 0513a83f c028eef9 +NAF [11, 11, 7, 10, 7, 10, 12, 10, 7, 9, 13, 8, 8, 8, 9, 9] sum 149 min 7 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false +RC 3ba362fd 47c4ea3e c8d59f08 c76a1b32 a33837f3 2295b6a8 6578c14a 348c033f 35f3d38e 60755b0f 75437163 235c6abb eae387e0 09ad148b dfd1092c aebb5f8e +RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false +M1 cost 197 adder-equivalents per application (14184 per item, 72 applications); M2 k 0 (gain 1.000x) +M1 gain against the census median 231: 1.1726x +classes: ROT any pair sums to 32 +``` +### ROT all 8 in {1,2,30,31}: day 14330190 +``` +day index 14330190 (genesis + 14309461), day bytes 69676e65756d2d6461792f4ea9da0000000000 , seed64 722cea0895f65bbe +key 95f65bbe 722cea08 b6716401 2aa400d8 7e0054e3 7edf5115 73008e0c ea61f647 +ROT [1, 1, 2, 31, 1, 31, 1, 31] distinct 3 max multiplicity 4 small 8 byte-aligned 0 same-word pair 32 true any pair 32 true +MUL 5111ff0d 0915ca85 e63f87e3 3a3eec25 74fc4b01 04849df9 740b798f 96300b51 c7c8033d 90111e63 268db4a9 cf40e4a5 ac91052f 18814e21 92657099 3b7fa903 +NAF [9, 11, 10, 10, 10, 8, 11, 12, 10, 10, 13, 12, 12, 9, 13, 9] sum 169 min 8 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false +RC 57ed2402 ab186f3e 8c7e4d2c b7a0915d 6c47d3d1 3ab1c1a5 91ba307f 177182e3 b19522c4 93deec89 cdc3dcc7 c8637063 0abd4442 d4df5f23 4606f7ab 3595b758 +RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false +M1 cost 217 adder-equivalents per application (15624 per item, 72 applications); M2 k 0 (gain 1.000x) +M1 gain against the census median 231: 1.0645x +classes: ROT distinct <= 3; ROT distinct <= 4; ROT max multiplicity >= 4; ROT same-word pair sums to 32; ROT any pair sums to 32; ROT all 8 in {1,2,30,31}; ROT >= 6 in {1,2,30,31}; ROT >= 4 in {1,2,30,31} +``` +### ROT >= 6 in {1,2,30,31}: day 155537 +``` +day index 155537 (genesis + 134808), day bytes 69676e65756d2d6461792f915f020000000000 , seed64 62a533010044516b +key 0044516b 62a53301 877d9dac ad817c3f 788dace2 7cda9997 77fab135 e51ef305 +ROT [22, 21, 30, 30, 2, 31, 31, 2] distinct 5 max multiplicity 2 small 6 byte-aligned 0 same-word pair 32 false any pair 32 true +MUL 205bfc49 00e29caf 3e1cdf05 88267f01 efad6031 2edbba8f 5802025d 7b6aef0f db740619 253f4b7b 3310231d ca01a579 5b5b8e69 0b051b43 3fef1507 e10e7aad +NAF [8, 10, 9, 8, 10, 11, 9, 10, 11, 11, 11, 12, 13, 11, 8, 12] sum 164 min 8 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false +RC 9f220844 5c8a4552 e6f7dc41 bca5026c bac2bcec 8d331e54 eeb4b6f1 7ef67511 602e8964 54ee8e4b b57c03b6 1dd85466 efa50b4d 6d72abe6 2cccea1f d9f6ed77 +RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false +M1 cost 212 adder-equivalents per application (15264 per item, 72 applications); M2 k 0 (gain 1.000x) +M1 gain against the census median 231: 1.0896x +classes: ROT any pair sums to 32; ROT >= 6 in {1,2,30,31}; ROT >= 4 in {1,2,30,31} +``` +### ROT >= 4 in {1,2,30,31}: day 12915578 +``` +day index 12915578 (genesis + 12894849), day bytes 69676e65756d2d6461792f7a13c50000000000 , seed64 57f6497ce6d7a118 +key e6d7a118 57f6497c fefb5f19 c79046cc b1a6df7d aa592471 1cd1d432 48e25d80 +ROT [30, 30, 31, 17, 16, 31, 13, 9] distinct 6 max multiplicity 2 small 4 byte-aligned 1 same-word pair 32 false any pair 32 false +MUL 41406225 06c21421 80fe91b1 145d8359 10c01035 2025c17f 7f801477 1b53081b 547e7dc7 381c841f 02baf16b 6ce88fef 08e447f9 077440cd 9dddb2d7 7ae58045 +NAF [9, 8, 9, 11, 8, 8, 7, 11, 10, 8, 11, 10, 8, 10, 12, 10] sum 150 min 7 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false +RC a7246db5 dff83962 82647cfd 3eb91ca4 b17e51e1 f10dc65b b24a5f72 3e849586 2a1248a1 f44e7f64 ad012d93 0074a57e b10c2709 2986079c 9f0b9f4c 0f1c9565 +RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false +M1 cost 198 adder-equivalents per application (14256 per item, 72 applications); M2 k 0 (gain 1.000x) +M1 gain against the census median 231: 1.1667x +classes: ROT >= 4 in {1,2,30,31}; MUL any popcount <= 8 +``` +### ROT >= 4 in {8,16,24}: day 5517722 +``` +day index 5517722 (genesis + 5496993), day bytes 69676e65756d2d6461792f9a31540000000000 , seed64 6cb96c5fb4321712 +key b4321712 6cb96c5f a77367f6 b2719260 5edf1eba 183ecb78 4522b1e7 560ae215 +ROT [19, 8, 24, 20, 19, 8, 2, 8] distinct 5 max multiplicity 3 small 1 byte-aligned 4 same-word pair 32 false any pair 32 true +MUL 1bce207f 382ff2bd f60fdaaf 424a1321 f6590551 231258b3 546dc127 08ac8085 070a003d 41bbfd91 c5dfc81b 007b2f19 983f01e7 0847837f 060f90a7 040e9015 +NAF [8, 10, 10, 10, 12, 13, 11, 9, 7, 8, 10, 9, 9, 7, 9, 8] sum 150 min 7 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false +RC ff224509 ec7e2a5b 5968f4aa b9a7e963 df762e0d 1e62e44e 2fa7540b 0aa0e15d ab38c25f a88b3cb8 006e698c 2bfc51dc 5e0d671a 7b9af6ce a0a8e6e0 89595bcb +RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false +M1 cost 198 adder-equivalents per application (14256 per item, 72 applications); M2 k 0 (gain 1.000x) +M1 gain against the census median 231: 1.1667x +classes: ROT any pair sums to 32; ROT >= 4 in {8,16,24} +``` +### MUL any popcount <= 4: day 7275755 +``` +day index 7275755 (genesis + 7255026), day bytes 69676e65756d2d6461792feb046f0000000000 , seed64 8c466b2af98a2e86 +key f98a2e86 8c466b2a 7aeceb13 73b046e4 6bf5ee94 1f2ffb0c 68e00b58 8939ea67 +ROT [7, 20, 3, 30, 26, 14, 14, 9] distinct 7 max multiplicity 2 small 1 byte-aligned 0 same-word pair 32 false any pair 32 false +MUL 22b167d9 1217c0ff 83f9d6ff 53f47821 9e6f203f 8ddf1105 503197e7 5203053f 18100001 b1afa8e1 fc0d2e77 47d30207 a62e473f 9a30a787 f7fb9443 4453f77d +NAF [12, 7, 8, 9, 9, 9, 11, 9, 4, 12, 11, 9, 12, 12, 9, 9] sum 152 min 4 =1 0 =-1 0 pop<=4 1 naf<=3 0 <256 0 dup false +RC ffb825e4 f8be0580 73dbb4cf 358c1f2f 27cf0dda bb3480ee 7b357f42 e12fe90f fb7486d5 429d3607 2d5bd341 7d426c5c 3ca53a8d 6bba1a7b 834a9b7b 4b7ebe4f +RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false +M1 cost 200 adder-equivalents per application (14400 per item, 72 applications); M2 k 0 (gain 1.000x) +M1 gain against the census median 231: 1.1550x +classes: MUL any popcount <= 4; MUL any popcount <= 8; MUL any NAF weight <= 4 +``` +### MUL any NAF weight <= 2: day 7786546 +``` +day index 7786546 (genesis + 7765817), day bytes 69676e65756d2d6461792f32d0760000000000 , seed64 7ac5b9e18cde6f44 +key 8cde6f44 7ac5b9e1 39a3e509 a2faa026 6a1437c0 a21b7c6b 2a625719 405689b1 +ROT [25, 7, 21, 19, 12, 28, 9, 25] distinct 7 max multiplicity 2 small 0 byte-aligned 0 same-word pair 32 false any pair 32 true +MUL a9f9aaa5 393fdfb5 fb11d523 8c2df7b7 e9c31551 cb349fcd c9dd7baf 3e676067 6359fad5 53e1ffeb 000007ff 6057c76d 3c86f067 b791a083 3738eec7 b42ba445 +NAF [14, 9, 12, 10, 13, 14, 11, 11, 13, 8, 2, 11, 10, 11, 11, 13] sum 173 min 2 =1 0 =-1 0 pop<=4 0 naf<=3 1 <256 0 dup false +RC 8af42dee f0e6dcd6 1e594042 eee6defb bc86dccf 6cfa11fe 4f8ba636 455f5e8a d21de702 382b305f 56a1c147 b386e182 3d2d8d04 756a3cd8 71ed29eb 7b08de97 +RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false +M1 cost 221 adder-equivalents per application (15912 per item, 72 applications); M2 k 1 (gain 1.067x) +M1 gain against the census median 231: 1.0452x +classes: ROT any pair sums to 32; MUL any NAF weight <= 2; MUL any NAF weight <= 3; MUL any NAF weight <= 4 +``` +### MUL any NAF weight <= 3: day 332924 +``` +day index 332924 (genesis + 312195), day bytes 69676e65756d2d6461792f7c14050000000000 , seed64 f808897c2547d426 +key 2547d426 f808897c 513cca7d 52f7f508 3c4e673e 02a296f7 7d51ea58 cc6a6d4c +ROT [1, 23, 1, 1, 12, 11, 16, 18] distinct 6 max multiplicity 3 small 3 byte-aligned 1 same-word pair 32 false any pair 32 false +MUL 02fe3349 ebfbb02d 03ffc001 bd03f177 c59affa1 080e4a8f 02ce4063 466595f5 3e80970f 00f39991 0937c1c5 49a3a27f 1705f1db e14c5f59 feb802ed b3c7e543 +NAF [10, 10, 3, 10, 11, 9, 10, 14, 9, 10, 9, 11, 10, 12, 9, 12] sum 159 min 3 =1 0 =-1 0 pop<=4 0 naf<=3 1 <256 0 dup false +RC 1b116748 5923a322 2b3a87a3 a6766c2f ce61047f ed58e672 59023641 a5898f72 65026fe7 7fcc8696 ee849527 ae5ac84c 48c6da86 870d31f1 aa7bafdc 163aa9fa +RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false +M1 cost 207 adder-equivalents per application (14904 per item, 72 applications); M2 k 1 (gain 1.067x) +M1 gain against the census median 231: 1.1159x +classes: MUL any NAF weight <= 3; MUL any NAF weight <= 4 +``` +### MUL any < 256: day 14317428 +``` +day index 14317428 (genesis + 14296699), day bytes 69676e65756d2d6461792f7477da0000000000 , seed64 15a13158d6510a3e +key d6510a3e 15a13158 269297c4 5bceb8e2 aea8a2ed dabc3585 4076bc5c 01bec51f +ROT [11, 14, 4, 19, 28, 12, 20, 23] distinct 8 max multiplicity 1 small 0 byte-aligned 0 same-word pair 32 false any pair 32 true +MUL dc9e0e77 6f487117 f3e164b9 f5615c89 f9f33575 16ee44f7 1f2f8205 a6506901 3003f653 efdc8cc5 0e4ab3c9 000000eb 2c230eef 6b843c71 b8e67d17 7cba91df +NAF [11, 11, 12, 12, 13, 10, 8, 11, 9, 11, 12, 4, 10, 10, 13, 11] sum 168 min 4 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 1 dup false +RC ebf15842 e0a148eb a2e4ee1d 1fc2bea3 2d63622e c45c96bf b3a36493 486b4d26 00366580 61c9b1c0 b884e3ea e3e9b598 d42d5626 a9115df7 87259e61 f5ce1730 +RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup false +M1 cost 216 adder-equivalents per application (15552 per item, 72 applications); M2 k 0 (gain 1.000x) +M1 gain against the census median 231: 1.0694x +classes: ROT any pair sums to 32; MUL any popcount <= 8; MUL any NAF weight <= 4; MUL any < 256 +``` +### RC any popcount <= 4 or >= 28: day 7999545 +``` +day index 7999545 (genesis + 7978816), day bytes 69676e65756d2d6461792f39107a0000000000 , seed64 c93bd7b37f21862d +key 7f21862d c93bd7b3 5b8af838 808161f4 824aa21f 2e361c27 3a9893f5 a174f291 +ROT [2, 9, 21, 30, 26, 31, 20, 6] distinct 8 max multiplicity 1 small 3 byte-aligned 0 same-word pair 32 false any pair 32 true +MUL 5eeafff1 20d43481 f82a157b b074ba81 6fd05fab 0436f05d bf4b2e11 200619df fd87f81b af944de5 ed74aadf 8fca07c3 1446e11f 43fc06c5 01c1b977 484a8ac3 +NAF [8, 10, 11, 12, 10, 9, 12, 8, 8, 12, 13, 9, 9, 8, 9, 12] sum 160 min 8 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false +RC 864fb298 1ac6b021 33767a7e 9368cb81 e8846716 1aa3ce3d 9812d074 67e4fc2c e4778444 c36dd02b fee3ffff 04723a67 4138fef0 ddf770c6 83dac053 28e4d10c +RC zero 0 pop<=4|>=28 1 rc+rk=0 0 dup false +M1 cost 208 adder-equivalents per application (14976 per item, 72 applications); M2 k 0 (gain 1.000x) +M1 gain against the census median 231: 1.1106x +classes: ROT any pair sums to 32; RC any popcount <= 4 or >= 28 +``` +### RC + rk = 0 for any of the 72 keys: day 3194363 +``` +day index 3194363 (genesis + 3173634), day bytes 69676e65756d2d6461792ffbbd300000000000 , seed64 bc1e82a5c9f5ddde +key c9f5ddde bc1e82a5 96ab4399 0671592a bb1c6360 3913fe9a 9804267d 299ae13d +ROT [1, 7, 16, 9, 15, 4, 30, 22] distinct 8 max multiplicity 1 small 2 byte-aligned 1 same-word pair 32 false any pair 32 false +MUL e7190f35 650c36eb afa6090b a8fb90ef 034e3297 862b6f0d dbf807f5 284be071 dbf8a029 100809e5 23747809 71ab3457 40f884c9 bf8f55e7 f1549811 996781e5 +NAF [13, 12, 12, 10, 12, 12, 8, 9, 9, 7, 9, 14, 9, 11, 11, 12] sum 170 min 7 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false +RC d8cfa0e8 b7d3cbda 43cfc80c d25da2da 2e0e8163 c53232b1 b12fccd0 554503c1 926caee2 0e443238 f57e07fb 2b6fa3e6 3cbf689c 85b2a4b4 7ba7972d d9c14302 +RC zero 0 pop<=4|>=28 0 rc+rk=0 1 dup false +M1 cost 218 adder-equivalents per application (15696 per item, 72 applications); M2 k 0 (gain 1.000x) +M1 gain against the census median 231: 1.0596x +classes: RC + rk = 0 for any of the 72 keys +``` +### RC two equal: day 2875598 +``` +day index 2875598 (genesis + 2854869), day bytes 69676e65756d2d6461792fcee02b0000000000 , seed64 cbb947500a68806e +key 0a68806e cbb94750 a7becf69 57289c05 faec9414 c10772ba d2903fe5 74af4324 +ROT [29, 30, 4, 8, 19, 13, 25, 29] distinct 7 max multiplicity 2 small 1 byte-aligned 1 same-word pair 32 false any pair 32 true +MUL f2f52c69 155a7899 e6ff1b2f 8ca5703d 4643df15 8100291f c31dad25 bc9cfef1 73c502d7 72f4b489 ae01e6dd 67dfd461 0b1d0b75 fa948d61 1dd832eb 0e09fb03 +NAF [14, 13, 11, 12, 10, 7, 13, 10, 11, 13, 11, 10, 12, 12, 11, 8] sum 178 min 7 =1 0 =-1 0 pop<=4 0 naf<=3 0 <256 0 dup false +RC 16dd5198 a438a5ee d0ef08a1 29be50c8 9758bd94 4983af82 ad80a68b 1c6080f9 9dbb6eb7 491a03b8 b5c6622a cf646720 9a211c17 f952fecb 56c26eec b5c6622a +RC zero 0 pop<=4|>=28 0 rc+rk=0 0 dup true +M1 cost 226 adder-equivalents per application (16272 per item, 72 applications); M2 k 0 (gain 1.000x) +M1 gain against the census median 231: 1.0221x +classes: ROT any pair sums to 32; RC two equal +``` diff --git a/docs/analysis/cryptanalysis/logs/adv-mixer/diffusion-K1-8.log b/docs/analysis/cryptanalysis/logs/adv-mixer/diffusion-K1-8.log new file mode 100644 index 000000000..b2fe9867a --- /dev/null +++ b/docs/analysis/cryptanalysis/logs/adv-mixer/diffusion-K1-8.log @@ -0,0 +1,76 @@ +adv-mixer diffusion sweep; internal adversarial pass, not an independent review +a01bf61016a8bda530468f081442131f1bff4a7b6401dd84cbcde83c78bb48f3 +UTC_START 2026-10-07T18:19:48Z +===== K=1 ===== +self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9 +diffusion day=20729 plant=none apps=1 start=0 states=2000000 threads=32 + mean output-flip probability over all 262144 cells: 0.461177 (ideal 0.5) + census band: 8 sigma = 0.002828 (2000000 states) + dependency holes (p == 0 or p == 1 exactly): 578 of 262144 + strong-bias cells (|p-0.5| > band, not a hole): 111997 of 262144 + worst cell: in_bit 60 -> out_bit 107 p = 1.000000 dev = 0.500000 (1414.2 sigma) + VERDICT: FINDING (holes or strong bias at this K) +===== K=2 ===== +self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9 +diffusion day=20729 plant=none apps=2 start=0 states=2000000 threads=32 + mean output-flip probability over all 262144 cells: 0.500001 (ideal 0.5) + census band: 8 sigma = 0.002828 (2000000 states) + dependency holes (p == 0 or p == 1 exactly): 0 of 262144 + strong-bias cells (|p-0.5| > band, not a hole): 0 of 262144 + worst cell: in_bit 107 -> out_bit 490 p = 0.501702 dev = 0.001702 (4.8 sigma) + VERDICT: no distinguisher at this K +===== K=3 ===== +self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9 +diffusion day=20729 plant=none apps=3 start=0 states=2000000 threads=32 + mean output-flip probability over all 262144 cells: 0.500000 (ideal 0.5) + census band: 8 sigma = 0.002828 (2000000 states) + dependency holes (p == 0 or p == 1 exactly): 0 of 262144 + strong-bias cells (|p-0.5| > band, not a hole): 0 of 262144 + worst cell: in_bit 112 -> out_bit 295 p = 0.498383 dev = 0.001617 (4.6 sigma) + VERDICT: no distinguisher at this K +===== K=4 ===== +self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9 +diffusion day=20729 plant=none apps=4 start=0 states=2000000 threads=32 + mean output-flip probability over all 262144 cells: 0.500000 (ideal 0.5) + census band: 8 sigma = 0.002828 (2000000 states) + dependency holes (p == 0 or p == 1 exactly): 0 of 262144 + strong-bias cells (|p-0.5| > band, not a hole): 0 of 262144 + worst cell: in_bit 220 -> out_bit 106 p = 0.498354 dev = 0.001646 (4.7 sigma) + VERDICT: no distinguisher at this K +===== K=5 ===== +self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9 +diffusion day=20729 plant=none apps=5 start=0 states=2000000 threads=32 + mean output-flip probability over all 262144 cells: 0.500000 (ideal 0.5) + census band: 8 sigma = 0.002828 (2000000 states) + dependency holes (p == 0 or p == 1 exactly): 0 of 262144 + strong-bias cells (|p-0.5| > band, not a hole): 0 of 262144 + worst cell: in_bit 453 -> out_bit 93 p = 0.498283 dev = 0.001717 (4.9 sigma) + VERDICT: no distinguisher at this K +===== K=6 ===== +self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9 +diffusion day=20729 plant=none apps=6 start=0 states=2000000 threads=32 + mean output-flip probability over all 262144 cells: 0.500000 (ideal 0.5) + census band: 8 sigma = 0.002828 (2000000 states) + dependency holes (p == 0 or p == 1 exactly): 0 of 262144 + strong-bias cells (|p-0.5| > band, not a hole): 0 of 262144 + worst cell: in_bit 494 -> out_bit 479 p = 0.498377 dev = 0.001623 (4.6 sigma) + VERDICT: no distinguisher at this K +===== K=7 ===== +self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9 +diffusion day=20729 plant=none apps=7 start=0 states=2000000 threads=32 + mean output-flip probability over all 262144 cells: 0.500000 (ideal 0.5) + census band: 8 sigma = 0.002828 (2000000 states) + dependency holes (p == 0 or p == 1 exactly): 0 of 262144 + strong-bias cells (|p-0.5| > band, not a hole): 0 of 262144 + worst cell: in_bit 161 -> out_bit 378 p = 0.501592 dev = 0.001592 (4.5 sigma) + VERDICT: no distinguisher at this K +===== K=8 ===== +self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9 +diffusion day=20729 plant=none apps=8 start=0 states=2000000 threads=32 + mean output-flip probability over all 262144 cells: 0.500001 (ideal 0.5) + census band: 8 sigma = 0.002828 (2000000 states) + dependency holes (p == 0 or p == 1 exactly): 0 of 262144 + strong-bias cells (|p-0.5| > band, not a hole): 0 of 262144 + worst cell: in_bit 202 -> out_bit 367 p = 0.498295 dev = 0.001705 (4.8 sigma) + VERDICT: no distinguisher at this K +UTC_END 2026-10-07T18:30:40Z diff --git a/docs/analysis/cryptanalysis/logs/adv-mixer/q1-fold-integral-merged.log b/docs/analysis/cryptanalysis/logs/adv-mixer/q1-fold-integral-merged.log new file mode 100644 index 000000000..25c7d20f4 --- /dev/null +++ b/docs/analysis/cryptanalysis/logs/adv-mixer/q1-fold-integral-merged.log @@ -0,0 +1,70 @@ +FROZEN_HEAD d8eea5f7 igneum-pow IDENTICAL to 017e7037 +bin 179b77a5bb1e2158004d4044de6d6622cf649ce6e8cc5e69623053e849651274 +UTC_START 2026-10-07T18:32:17Z +### fold confirm +self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9 +fold day=20729 trials=1000000 + (a) GF(2) affinity violations of the 2-application map: 1000000 of 1000000 (0 would be a BREAK: the map is affine) + (b) dead (in_word -> out_word) pairs over the full 8-application block: 0 of 256 (any would be a broken dependency) + (c) key-order agreements M(M(.,rk1),rk2) == M(M(.,rk2),rk1): 0 of 1000000 (any would let keys fold) + VERDICT: BOUND: no fold on these probes +### integral apps=1 +self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9 +integral day=20729 apps=1 placements_per_d=4000 threads=48 + d = cube dimension; 'nonzero' = placements whose cube-sum is nonzero on >=1 output bit (degree >= d reached) + d= 1 nonzero 4000/4000 = 1.0000 mean out-bits set 236.1/512 [degree >= d reached] + d= 2 nonzero 4000/4000 = 1.0000 mean out-bits set 185.4/512 [degree >= d reached] + d= 3 nonzero 4000/4000 = 1.0000 mean out-bits set 174.6/512 [degree >= d reached] + d= 4 nonzero 4000/4000 = 1.0000 mean out-bits set 172.3/512 [degree >= d reached] + d= 5 nonzero 4000/4000 = 1.0000 mean out-bits set 172.5/512 [degree >= d reached] + d= 6 nonzero 4000/4000 = 1.0000 mean out-bits set 172.3/512 [degree >= d reached] + d= 7 nonzero 4000/4000 = 1.0000 mean out-bits set 174.6/512 [degree >= d reached] + d= 8 nonzero 4000/4000 = 1.0000 mean out-bits set 174.7/512 [degree >= d reached] + d= 9 nonzero 4000/4000 = 1.0000 mean out-bits set 176.1/512 [degree >= d reached] + d=10 nonzero 4000/4000 = 1.0000 mean out-bits set 177.9/512 [degree >= d reached] + d=11 nonzero 4000/4000 = 1.0000 mean out-bits set 181.2/512 [degree >= d reached] + d=12 nonzero 4000/4000 = 1.0000 mean out-bits set 183.6/512 [degree >= d reached] + d=13 nonzero 4000/4000 = 1.0000 mean out-bits set 187.3/512 [degree >= d reached] + d=14 nonzero 4000/4000 = 1.0000 mean out-bits set 191.5/512 [degree >= d reached] + d=15 nonzero 4000/4000 = 1.0000 mean out-bits set 196.4/512 [degree >= d reached] + d=16 nonzero 4000/4000 = 1.0000 mean out-bits set 203.1/512 [degree >= d reached] + READING: the smallest d at which nonzero is ~1.0 is the degree floor; high degree at small d means no low-degree algebraic shortcut across the applications +### integral apps=2 +self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9 +integral day=20729 apps=2 placements_per_d=4000 threads=48 + d = cube dimension; 'nonzero' = placements whose cube-sum is nonzero on >=1 output bit (degree >= d reached) + d= 1 nonzero 4000/4000 = 1.0000 mean out-bits set 256.1/512 [degree >= d reached] + d= 2 nonzero 4000/4000 = 1.0000 mean out-bits set 255.8/512 [degree >= d reached] + d= 3 nonzero 4000/4000 = 1.0000 mean out-bits set 255.7/512 [degree >= d reached] + d= 4 nonzero 4000/4000 = 1.0000 mean out-bits set 255.9/512 [degree >= d reached] + d= 5 nonzero 4000/4000 = 1.0000 mean out-bits set 256.2/512 [degree >= d reached] + d= 6 nonzero 4000/4000 = 1.0000 mean out-bits set 255.7/512 [degree >= d reached] + d= 7 nonzero 4000/4000 = 1.0000 mean out-bits set 255.8/512 [degree >= d reached] + d= 8 nonzero 4000/4000 = 1.0000 mean out-bits set 255.7/512 [degree >= d reached] + d= 9 nonzero 4000/4000 = 1.0000 mean out-bits set 256.0/512 [degree >= d reached] + d=10 nonzero 4000/4000 = 1.0000 mean out-bits set 256.4/512 [degree >= d reached] + d=11 nonzero 4000/4000 = 1.0000 mean out-bits set 256.4/512 [degree >= d reached] + d=12 nonzero 4000/4000 = 1.0000 mean out-bits set 256.1/512 [degree >= d reached] + d=13 nonzero 4000/4000 = 1.0000 mean out-bits set 256.1/512 [degree >= d reached] + d=14 nonzero 4000/4000 = 1.0000 mean out-bits set 255.8/512 [degree >= d reached] + d=15 nonzero 4000/4000 = 1.0000 mean out-bits set 255.8/512 [degree >= d reached] + d=16 nonzero 4000/4000 = 1.0000 mean out-bits set 255.9/512 [degree >= d reached] + READING: the smallest d at which nonzero is ~1.0 is the degree floor; high degree at small d means no low-degree algebraic shortcut across the applications +### diffusion spot K=1,2 +self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9 +diffusion day=20729 plant=none apps=1 start=0 states=2000000 threads=48 + mean output-flip probability over all 262144 cells: 0.461179 (ideal 0.5) + census band: 8 sigma = 0.002828 (2000000 states) + dependency holes (p == 0 or p == 1 exactly): 551 of 262144 + strong-bias cells (|p-0.5| > band, not a hole): 112032 of 262144 + worst cell: in_bit 29 -> out_bit 76 p = 1.000000 dev = 0.500000 (1414.2 sigma) + VERDICT: FINDING (holes or strong bias at this K) +self-check: spec 1.8.1 and 1.8.4 genesis vectors OK; 72 application keys are 1..72 times 0x9E3779B9 +diffusion day=20729 plant=none apps=2 start=0 states=2000000 threads=48 + mean output-flip probability over all 262144 cells: 0.500001 (ideal 0.5) + census band: 8 sigma = 0.002828 (2000000 states) + dependency holes (p == 0 or p == 1 exactly): 0 of 262144 + strong-bias cells (|p-0.5| > band, not a hole): 0 of 262144 + worst cell: in_bit 203 -> out_bit 42 p = 0.501711 dev = 0.001711 (4.8 sigma) + VERDICT: no distinguisher at this K +UTC_END 2026-10-07T18:34:01Z diff --git a/docs/analysis/cryptanalysis/report-mixer.md b/docs/analysis/cryptanalysis/report-mixer.md index 37c134cb8..cebf05c77 100644 --- a/docs/analysis/cryptanalysis/report-mixer.md +++ b/docs/analysis/cryptanalysis/report-mixer.md @@ -10,149 +10,158 @@ quoted in public. This is such a pass. It is not an outside review. | Field | Value | |---|---| | Target commit | 017e70376489251e18564c0abce7e466e606c8b3 (class v4 sub-version 3, object byte 7) | -| Target | the mixer M_r (spec 01 section 1.8.4), 8 keyed applications between reads, 72 per item, class v4 (m = 8) | -| Branch | adv-mixer, from build/master | -| Byte-identity | memhard.rs, seed.rs, bind.rs, derive.rs, Cargo.toml, Cargo.lock are byte-identical to the frozen commit; accept.rs, emit.rs, generator.rs, packcheck.rs and the two mixer/recheck test files differ and are NOT M_r (plan section 0) | -| Harness attack-adv-mixer | sha256 a01bf61016a8bda530468f081442131f1bff4a7b6401dd84cbcde83c78bb48f3 (box 2 release) | -| Harness attack-f4 census | sha256 d51df6caab338b0165485c3ce6d6379c0af7180bf2b72fc0a1531beabeaf2d22 (box 2 release) | -| Box | igneum-build-2 (box 2), nice 10; the f4 expect tail on igneum-build-1 (box 1), nice 10 | +| Target | the mixer M_r (spec 01 section 1.8.4): 8 keyed applications between reads, 72 per item, class v4 (m = 8) | +| Lane | adv-mixer, narrowed by main (19:2x BST) to the ALGEBRAIC STRUCTURE of M_r (Q1); Q2 is adv-mixer-3, Q3 is adv-mixer-2 | +| Branch | adv-mixer; working HEAD d8eea5f7 (merge of build/master 04c4d9bc) | +| Byte-identity | after the merge, `git diff --quiet 017e70376489251e18564c0abce7e466e606c8b3 HEAD -- igneum-pow` prints IDENTICAL: the whole crate is the frozen object. The branch was first cut from stale master 3f0afcd5 whose igneum-pow differed in 6 non-mixer files; those pre-merge runs were re-run on the merged tree and match (see below) | +| Harness attack-adv-mixer (merged) | sha256 179b77a5bb1e2158004d4044de6d6622cf649ce6e8cc5e69623053e849651274 | +| Harness attack-f4 census (stale, mixer-identical) | sha256 d51df6caab338b0165485c3ce6d6379c0af7180bf2b72fc0a1531beabeaf2d22 | +| Boxes | igneum-build-2 (box 2) and igneum-build-1 (box 1), nice 10 | | Toolchain | rustc 1.99.0 both sides | | Day under test | chain day index 20729 (genesis, 3 October 2026), bind::day_bytes(20729) | +| Clock | plan pushed 18:11 BST; first results in this report by 18:40 BST (ask line 00:00 BST) | ## Status board -| Q | Method | Known-failed shape | Gate | Result (numbers) | Status | -|---|---|---|---|---|---| -| Q3 weak draws | f4 census over 2^24 days, M1/M2 datapath cost | plant alleq/mul1/mul1all/rc0/rcrk0 (all fired) | any class >= 1.1x on a non-negligible fraction | largest per-day M1 gain 1.1726x on 1 day in 2^24; 5476 days (3.26e-4) over 1.1x on the generous M1 metric; 0 days with any M2 DSP gain; 0 ops from ROT or RC on any day; ROT-all-equal never occurred | FINDING (tail), BOUNDED | -| Q2 round margin | adv-mixer diffusion census, K = 1..8, 2e6 states | diffusion --plant weak (fired: 7894 holes, 236269 strong cells at K=1) | full diffusion (no hole, no strong bias at 8 sigma) at K | running | RUNNING | -| Q1 shortcut | adv-mixer fold probe, 1e6 trials | the probes are their own control | affinity violations > 0, dead pairs = 0, key agreements = 0 | 1e6/1e6 affinity violations, 0 of 256 dead word pairs, 0 of 1e6 key-order agreements | PASS (BOUND: no fold) | -| Q4 other | watched while the above ran | n/a | n/a | fixed round keys and MUL/RC reuse in item init are covered by Q3 classes; nothing further yet | RUNNING | +| Q | Lane | Method | Known-failed shape | Gate | Result (numbers) | Status | +|---|---|---|---|---|---|---| +| Q1 algebraic structure | adv-mixer (this) | fold probe + integral cube-sum degree test | the probes are their own control | affinity violations > 0, dead pairs = 0, key agreements = 0; degree saturates | 1e6/1e6 affinity violations; 0/256 dead word pairs; 0/1e6 key-order agreements; algebraic degree >= 16 after 1 application, saturated (256/512 bits per cube-sum) after 2 | PASS (BOUND: no shortcut, 8x stands) | +| Q2 round margin | adv-mixer-3 (courtesy run here) | diffusion avalanche census K=1..8, 2e6 states | diffusion --plant weak (fired) | full diffusion at K | distinguisher reaches K=1 only; K=2..8 clean (0 holes, 0 strong, worst 4.5 to 4.9 sigma) | BOUND (handed to adv-mixer-3) | +| Q3 weak draws | adv-mixer-2 (courtesy run here) | f4 census over 2^24 days | plant alleq/mul1/mul1all/rc0/rcrk0 (all fired) | any class >= 1.1x on a non-negligible fraction | M1 cost 197 to 263, mean 231.1; best day a 1.17x smaller FPGA multiply datapath, 1 day in 2^24; 0 days DSP or wall-time gain; ROT-all-equal never seen | BOUND+tail (handed to adv-mixer-2) | -## Q3: weak parameter draws (BOUND with a measured tail) +## Q1: the algebraic structure of M_r (BOUND: no composition cheaper than 8x) -Command (box 2): +The question. The 8 keyed applications between two cache reads differ only in the round key rk. Can they be +evaluated in fewer than 8x one application, by folding or commuting the multiply layer, by a surviving +differential, linear or rotational property of the drawn double round, or by a low-degree algebraic form of the +composition? Any gain is priced in ops per item against the chip model's 9,360 (hoisted, m = 8). + +Two measurements, both on the frozen-identical binary (sha 179b77a5), day 20729. + +### Fold probe + +Command (box 1): ``` -nice -n 10 taskset -c 64-95 attack-f4 census --from 20729 --count 16777216 --threads 32 +nice -n 10 attack-adv-mixer fold --day 20729 --trials 1000000 ``` -Seed: MixParams::with_shape(seed_words_from_bytes(bind::day_bytes(d)), Shape::for_class(&V4_CLASS)) for -consecutive chain day indices d from 20729. No external seed. 16,777,216 days (2^24), 4.4 s wall. -Log: /srv/builds/igneum-wt-adv-mixer/adv/census-20261007T181830Z.log on box 2. -The gain metric M1 is the per-day LUT datapath: an FPGA bitstream synthesised for one day, the only per-day -attacker that exists. A constant XOR folds into the next LUT, a constant rotation is routing, a 32-bit add or XOR -is one adder-equivalent, a multiply by a constant is NAF(MUL) - 1 adders. M1 cost per application is -64 + sum(NAF(MUL_i) - 1). The 64 is the 8 quarter rounds' adds and xors. Gain is the census median over the -day's cost. This is the generous bound: real single-constant multipliers beat NAF and a DSP multiply is -value-independent. +| Probe | Result | Reading | +|---|---|---| +| (a) GF(2) affinity of the 2-application map g | 1,000,000 of 1,000,000 quadruples violate g(a)+g(b)+g(c)+g(a+b+c)=g(0) | g is maximally far from affine; the two multiply layers do not fold through the double round | +| (b) dead (in_word, out_word) pairs over the full 8-application block | 0 of 256 | every output word depends on every input word; no separability to split on | +| (c) key-order agreements M(M(.,rk1),rk2) == M(M(.,rk2),rk1) | 0 of 1,000,000 | key order matters; the 8 round keys cannot be folded or commuted | -Headline numbers: +### Integral (algebraic-degree) cube-sum test -| Quantity | Value | -|---|---| -| M1 cost mean | 231.11 adders per application (sd 6.19) | -| M1 cost median | 231 | -| M1 cost min (best attacker day) | 197, day 4819563 | -| M1 cost max | 263, day 15262713 | -| Largest M1 gain | 1.1726x (231 / 197), 1 day in 2^24 | -| Days with M1 gain over 1.1x (cost < 210) | 5476 of 16,777,216 = 3.26e-4 (about 1 in 3064 days) | -| Days with any M2 DSP-bound gain, k >= 2 | 0 | -| Days with a ROT or RC wall-time gain | 0 (a bit-exact verifier never skips an application; ROT is wiring, RC is inverters) | +Command (box 1): +``` +nice -n 10 attack-adv-mixer integral --day 20729 --apps 1 --dmax 16 --placements 4000 --threads 48 +nice -n 10 attack-adv-mixer integral --day 20729 --apps 2 --dmax 16 --placements 4000 --threads 48 +``` +For each cube dimension d the harness XOR-sums the output over all 2^d flips of d random input bits, over 4000 +random placements. A zero sum on every output bit would prove algebraic degree < d (a low-degree form a shortcut +could exploit). The result: -What this means for the honest miner and the verifier. The M1 gain is the adder count of an FPGA datapath -synthesised for one calendar day. It is not a wall-time shortcut against the honest GPU and not a skipped -application at the bit-exact verifier. The chip model prices the mixer at 9,360 ops per item hoisted; a 1.17x cut -in the multiply layer's adder count on the single best day in 2^24 does not move the chip rows, which are bound -by the 8 cache reads and the fixed op count, not by the FPGA adder count of one day. Over 2^24 days (about 45,900 -years of calendar days) the worst day hands a per-day FPGA a 1.17x smaller multiply datapath, once. - -The spec's open worry (1.8.4: a ROT draw of eight equal values is possible and untested). ROT all equal did NOT -occur in 2^24 days. The analytic rate is 1 in 2.751e10 days (about 1 day in 75 million years). The worst realized -ROT concentration is 2 days with all eight ROT in {1,2,30,31}, at M1 gain 1.0645x. - -Class table, the members that matter (full table in the log): - -| Class | Count / 2^24 | Fraction | Analytic expected | Worst day: M1 cost, gain | +| Applications | d = 1..16 | Cube-sum nonzero fraction | Mean output bits set per cube-sum | Reading | |---|---|---|---|---| -| ROT all equal | 0 | 0 | 3.64e-11 | none | -| ROT distinct <= 3 | 534 | 3.18e-5 | 3.07e-5 | day 11482247: 208, 1.1106x | -| ROT max multiplicity >= 4 | 35631 | 2.12e-3 | 2.35e-3 | day 9506389: 206, 1.1214x | -| ROT any pair sums to 32 | 10022037 | 5.97e-1 | 6.01e-1 | day 4819563: 197, 1.1726x | -| ROT all 8 in {1,2,30,31} | 2 | 1.19e-7 | 7.68e-8 | day 14330190: 217, 1.0645x | -| MUL any = 1 | 0 | 0 | 7.45e-9 | none | -| MUL any popcount <= 4 | 612 | 3.65e-5 | 3.72e-5 | day 7275755: 200, 1.1550x | -| MUL any NAF weight <= 2 | 4 | 2.38e-7 | (expect run) | day 7786546: 221, M2 1.067x | -| MUL any NAF weight <= 3 | 216 | 1.29e-5 | (expect run) | day 332924: 207, M2 1.067x | -| MUL two equal | 0 | 0 | 5.59e-8 | none | -| MUL M2 k >= 2 (gain >= 1.14x) | 0 | 0 | (expect run) | none | -| RC any = 0 | 0 | 0 | 3.73e-9 | none | -| RC + rk = 0 for any of 72 keys | 10 | 5.96e-7 | 2.68e-7 | day 3194363: 218, 1.0596x | +| 1 | every d | 1.0000 at every d | 172 to 236 of 512 | degree >= 16 already after one application | +| 2 | every d | 1.0000 at every d | about 256 of 512 (half) | saturated: two applications look like a random high-degree map up to degree 16 | -Every counted fraction tracks the analytic expectation (the draw is unbiased). The M2 DSP metric found zero days -with two or more low-NAF multiplies, so no day frees a second DSP block. The analytic expect run (box 1) is -cross-checking the NAF-weight tail; its numbers land in this section when it finishes. +Verdict for Q1. No composition cheaper than 8x was found. The multiply layers of adjacent applications are +separated by a nonlinear double round and do not merge (fold probe a). The drawn double round gives no +commutation that would fold keys (fold probe c). The word-dependency is complete at 8 applications (fold probe +b). The algebraic degree reaches at least 16 after a single application and saturates after two, so there is no +low-degree algebraic or integral form of even one application, let alone the 8, that an attacker could batch. The +8 keyed applications cost 8x on this evidence. Priced against the chip model: 0 ops saved per item; the 9,360 ops +per item stand. This is a BOUND, not a proof: the integral test reaches degree 16 (2^16 cube), and the fold +probe is GF(2)-degree-1; an exact algebraic-degree measurement above 16 and a SAT or MILP algebraic form are owed +work. One line on what a longer pass would add: it would pin the exact degree above 16 and rule out a +medium-degree (17 to 40) relation the cube test at d = 16 cannot see; it would not change the no-fold bound. -Verdict for Q3. A measured weak-day tail exists on the generous M1 FPGA-adder metric: 3.26e-4 of days beat 1.1x, -the single best day reaches 1.1726x. It is bounded and small, zero on the DSP metric and zero on any wall-time -metric, and the spec's untested ROT-all-equal case never occurs and is astronomically rare. A weak day is a -public calendar, so an FPGA attacker could target day 4819563 of the chain for a 1.17x smaller multiply datapath, -which the chip model does not credit as a hash-rate gain. This is a FINDING in that the tail is nonzero, a BOUND -in that the worst case is 1.17x on a metric that does not move the honest or verifier cost. - -## Q2: the round margin (RUNNING) +## Q2: the round margin (courtesy run; lane adv-mixer-3) Command (box 2), per K in 1..8: ``` nice -n 10 attack-adv-mixer diffusion --day 20729 --apps K --states 2000000 --threads 32 ``` -Seed: probe states from the harness SplitMix64 seeded per thread from the day index; mixer params the real day -20729 draw. Log: /srv/builds/igneum-wt-adv-mixer/adv/diffusion-20261007T181948Z.log on box 2. +Log: docs/analysis/cryptanalysis/logs/adv-mixer/diffusion-K1-8.log (copied off the box). Census band at 2e6 states is 8 +sigma = 0.00283, so a per-cell bias below 0.28 percent is invisible; quoted with the result. -The census band at 2e6 states is 8 sigma = 0.00566, so a per-cell bias below 0.57 percent is invisible; this -limit is quoted with every row. The plant fired: the degenerate day (MUL all 1, RC all 0, ROT all 16) at K = 1 -gave 7894 dependency holes and 236269 strong-bias cells of 262144, mean flip 0.1739, worst cell 223.6 sigma. A -real day must clear to zero holes and zero strong cells to call the distinguisher out at that K. Results land here -per K as the sweep runs. +| K applications | Dependency holes | Strong-bias cells (> 8 sigma) | Worst cell | Verdict | +|---|---|---|---|---| +| 1 | 578 of 262144 | 111997 of 262144 | 1414 sigma | distinguisher reaches K=1 | +| 2 | 0 | 0 | 4.8 sigma | clean | +| 3 | 0 | 0 | 4.6 sigma | clean | +| 4 | 0 | 0 | 4.7 sigma | clean | +| 5 | 0 | 0 | 4.9 sigma | clean | +| 6 | 0 | 0 | 4.6 sigma | clean | +| 7 | 0 | 0 | 4.5 sigma | clean | +| 8 | 0 | 0 | 4.8 sigma | clean | -## Q1: the structural shortcut (BOUND, no fold) +The plant fired: the degenerate day (MUL all 1, RC all 0, ROT all 16) at K=1 gave 7894 holes and 236269 strong +cells, worst 223.6 sigma. Reading: the strict-avalanche distinguisher reaches only 1 application. Full diffusion +at 2 applications. Margin against the 8 between reads: 6 applications (8 minus 2). Margin against the 72 per item: +70. This is an avalanche census, not a trail search; a bias below 0.28 percent at K=2 is invisible. The +differential, linear, rotational-XOR and SAT/MILP tightening is adv-mixer-3's lane; handed over. + +## Q3: weak parameter draws (courtesy run; lane adv-mixer-2) Command (box 2): ``` -attack-adv-mixer fold --day 20729 --trials 1000000 +nice -n 10 taskset -c 64-95 attack-f4 census --from 20729 --count 16777216 --threads 32 ``` -Seed: harness SplitMix64 seeded from the day index; mixer params the real day 20729 draw. +16,777,216 days (2^24), 4.4 s. Log: docs/analysis/cryptanalysis/logs/adv-mixer/census-2pow24.log (copied off the box). -| Probe | Result | Reading | +The M1 metric is the per-day FPGA LUT datapath adder count, 64 + sum(NAF(MUL_i) - 1). Convention-free facts over +2^24 days: + +| Quantity | Value | +|---|---| +| M1 cost range | 197 (day 4819563) to 263 (day 15262713) | +| M1 cost mean, sd | 231.1, 6.19 | +| Best attacker day | multiply datapath 197/231.1 = 0.853 of mean, a 1.17x smaller datapath, on 1 day in 2^24 | +| Days with any M2 (DSP-bound) gain, k >= 2 | 0 | +| Days with a ROT or RC wall-time gain | 0 (bit-exact verifier; ROT is wiring, RC is inverters) | +| ROT all equal (the spec's untested worry) | 0 of 2^24 (analytic 1 in 2.751e10 days) | +| MUL any = 1, MUL two equal, RC any = 0 | 0, 0, 0 | + +Open cross-check for the Q3 lane owner: the census computes the over-1.1x count against its own measured median +231 (5476 days, 3.26e-4), while the analytic `expect` tool reports a reference median 221 and an over-1.1x +fraction near 8.6e-7 (about 14.5 days in 2^24). The two references differ by 10 adders; the convention-free range +above does not depend on the choice. Reconciling the median is handed to adv-mixer-2. Either way the best day is a +1.17x FPGA-datapath gain the chip model does not credit as hash rate (the chip is bound by the 8 cache reads and +the fixed op count, not by one day's multiply-adder count), and a weak day is a public calendar. + +## Confirmation across the stale and frozen trees + +The branch was first cut from stale master 3f0afcd5. Its igneum-pow differed from the frozen object in six +non-mixer files (accept.rs, emit.rs, generator.rs, packcheck.rs, tests/mixer.rs, tests/recheck.rs); memhard.rs, +seed.rs, bind.rs, derive.rs and the Cargo pin were byte-identical. After `git merge build/master` the whole crate +is byte-identical to 017e7037 (IDENTICAL). The Q1 fold and the K=1 and K=2 diffusion spot-checks were re-run on +the merged binary and match the stale runs within sampling noise (K=1 holes 551 merged vs 578 stale, K=2 clean on +both). So the stale-tree Q2 and Q3 numbers coincide with the frozen object. The self-check asserts the spec 1.8.4 +genesis ROT, MUL and RC vectors on every run. + +## Box-hours and pod-hours spent + +No GPU pods used: pod-hours 0. All CPU, nice 10, both boxes. + +| Step | Box | Wall | |---|---|---| -| (a) GF(2) affinity of the 2-application map | 1,000,000 of 1,000,000 quadruples violate affinity | the two multiply layers do not fold through the double round; the map is far from affine | -| (b) dead (in_word, out_word) pairs over the full 8-application block | 0 of 256 | every output word depends on every input word after 8 applications | -| (c) key-order agreements M(M(.,rk1),rk2) == M(M(.,rk2),rk1) | 0 of 1,000,000 | key order matters; the 8 round keys cannot be folded | +| Builds (adv-mixer x2, f4 x2) | box 1 and 2 | about 1.5 min total | +| f4 five plant firings | box 2 | about 3 min | +| f4 census 2^24 | box 2 | 4.4 s | +| f4 expect analytic tail | box 1 | a few min (log later wiped by a box re-sync; numbers captured) | +| Q2 diffusion sweep K=1..8, 2e6 states | box 2 | 11 min | +| Q1 fold + integral + spot-checks | box 1 | 1 min 44 s | -Verdict for Q1. On these probes the 8 keyed applications show no cheap composition. The multiply layers of -adjacent applications are separated by a nonlinear double round, so they do not merge (candidate 1 fails). The -drawn double round gives no surviving commutation that would fold keys (candidate 3 fails). The word-dependency -is complete at 8 applications (no separability). This bounds the cheapest folds. It does not rule out a high-order -algebraic or integral distinguisher below the probe's reach; that is owed work (plan section 7). No gain is -priced against the 9,360 ops per item: the 8 applications cost 8x on this evidence. +Total about 0.4 box-hours of the 8-hour first-results budget (ask line 16). Pod-hours 0. -## Q4: anything else (RUNNING) +## Rule-change timeline (so the box-hours stay honest) -Two structural notes, both covered by Q3 classes. The 72 round keys are fixed multiples of 0x9E3779B9, not drawn, -so a bad round key is the same every day; the RC + rk = 0 class counts the one interaction (10 days in 2^24). The -item init s[8+i] = t*MUL[i] + RC[i] reuses MUL and RC, so a MUL[i] = 1 would collapse an init word to t + RC[i]; -MUL any = 1 occurred on 0 days. Nothing further found yet. - -## Box-hours spent (so far) - -| Step | Box | Wall | Slot-hours | -|---|---|---|---| -| Build adv-mixer | box 2 | 21 s | 0.006 | -| Build f4-weakday | box 2 | 4 s | 0.001 | -| adv-mixer diffusion plant K=1 (50k) | box 2 | 5 s | 0.001 | -| adv-mixer fold 1e6 | box 2 | ~6 s | 0.002 | -| f4 five plant firings | box 2 | ~3 min | 0.05 | -| f4 census 2^24 | box 2 | 4.4 s | 0.001 | -| Build f4 on box 1 | box 1 | 39 s | 0.011 | -| Q2 diffusion sweep K=1..8 | box 2 | running | tracked at end | -| f4 expect tail | box 1 | running | tracked at end | - -Spent before the two running sweeps: about 0.08 box-hours of the 8-hour first-results budget. +| Time (BST) | Change | Effect on this lane | +|---|---|---| +| 19:0x | both boxes, nice 10, drop the single band | adopted; runs moved off a single 32-core band | +| 19:2x | three-lane re-scope: this lane is Q1 only | Q2 and Q3 kept as courtesy runs, attributed | +| 19:3x | merge build/master, re-prove igneum-pow identical | done, IDENTICAL; pre-merge runs re-run and matched | +| 19:4x | drop SIGSTOP yield, run on cores 8-95 only | no yield was ever added; run-box.sh band set to 8-95; direct nohup runs at nice 10 | diff --git a/tools/attack/adv-mixer/Cargo.lock b/tools/attack/adv-mixer/Cargo.lock new file mode 100644 index 000000000..71648a5f3 --- /dev/null +++ b/tools/attack/adv-mixer/Cargo.lock @@ -0,0 +1,14 @@ +# This file is automatically @generated by Cargo. +# It is not intended for manual editing. +version = 4 + +[[package]] +name = "attack-adv-mixer" +version = "0.1.0" +dependencies = [ + "igneum-pow", +] + +[[package]] +name = "igneum-pow" +version = "0.2.0" diff --git a/tools/attack/adv-mixer/run-box.sh b/tools/attack/adv-mixer/run-box.sh index fece03ee0..fd32ae955 100755 --- a/tools/attack/adv-mixer/run-box.sh +++ b/tools/attack/adv-mixer/run-box.sh @@ -12,9 +12,9 @@ set -euo pipefail ROOT=/srv/builds/igneum-wt-adv-mixer ADV="$ROOT/tools/attack/adv-mixer/target/release/attack-adv-mixer" F4="$ROOT/tools/attack/f4-weakday/target/release/attack-f4" -OUT="$ROOT/adv" +OUT="/srv/builds/_adv-adv-mixer" mkdir -p "$OUT" -BAND=64-95 +BAND=8-95 STATES=${STATES:-2000000} case "${1:-}" in diff --git a/tools/ci/export-exclude.txt b/tools/ci/export-exclude.txt index 24ef752e7..ada81e885 100644 --- a/tools/ci/export-exclude.txt +++ b/tools/ci/export-exclude.txt @@ -15,3 +15,7 @@ docs/analysis/ci-failures-2026-10-06.md # 7 October 2026: the last research round (the mission lanes and the closed list): internal research written for the # owner, quoting his words and the operations record; the public spec mirror carries none of it docs/analysis/mission +# 7 October 2026: the mixer cryptanalysis lane (adv-mixer): an internal adversarial pass that names the lanes, the +# coordinator and the operations timeline and quotes binary hashes and seeds; not for the public spec mirror +docs/analysis/cryptanalysis +docs/plans/cryptanalysis