October attacks and the v2 certificate
The review checks published attack conditions against the Owner/Main authorization capsule, HistoryStep, sparse retirement and authenticated State installation in Parano1d v2.0.3. The October 1 to 13 publisher catalogue window contains 262 papers or revisions.
The Category 1 assessment is preserved
The exact mainnet v2 report is byte-for-byte identical to the October 8 result. It retains all twenty typed events, the limiting event retirement.b25.query, the descriptive dominant half-success gate-depth floor 173.3897612554174 and the ideal Category 1 success bound approximately 0.04937388373372754.
The calculation uses the certificate's all-root composition, ideal compiler, fixed-Poseidon2b deviation, honest public preprocessing and coherent response-price conditions. Authorization hiding uses independent OS-CSPRNG entropy for each honest attempt.
Inspect the exact rational report and the four-input execution receipt.
Both output lanes are authenticated
Poseidon2b uses GF(2^128), width 4, x^7, 8 full rounds and 58 partial rounds. All 69 square minors of the external matrix and all 69 of its inverse are nonsingular. The S-box is bijective because gcd(7, 2^128 - 1) = 1. Fifteen audited source files match production revision 50d6dac5a37b.
For the published collapse, N_v = floor((t-k)/(k+1)) and the dimension-preserving branch requires N_v ≥ k. At t=4, k=2, no tuple variable survives. Our compression adds the left input to both output lanes after the tagged permutation. The native verifier compares the full 32-byte cap hash; both lanes also enter the authorization transcripts.
Eleven authorization tests, twelve PCS tests and all 41 integrated soundness tests passed. The public research verifier passed all 69 tests and verified the existing evidence ledger. Inspect the exact parameter and interface checks.
Why the published mechanisms do not transfer
| Construction | Necessary condition | Production argument |
|---|---|---|
| Poseidon subspace restriction | The dimension-preserving CICO-2 collapse must leave two tuple variables. | Width four leaves zero, while the branch requires width at least eight. CICO-1 constrains one permutation output; the verifier authenticates both digest lanes. Two initial full rounds and all 58 partial rounds remain after its front collapse. |
| Proofs of work for Fiat-Shamir | One puzzle must satisfy both strong PoW and non-amortization with cheap verification. | The local theorem removes grinding. The final nonce has zero fixed QROM security credit, so the calculation uses neither the strong-PoW claim nor the incompatible conjunction. |
| Resettable prover randomness | An adversary restores or selectively controls an honest prover's private randomness. | Every honest attempt uses OsRng and a fresh PCS commitment. Private PCS states are consumed. Under independent OS entropy, proof-byte inputs cannot supply the reset operation. |
| SDitH and MQOM seed recovery | VOLE leaf seeds or correlated GGM/BLC seed shares expose the papers' recovery equations. | Authorization carries algebraic evaluations and commitment hashes. Its Merkle siblings are hashes, with no seed shares opening either attacked construction. |
| Goppa-code and lattice key recovery 2026/1778, 2026/1747, 2026/1984, 2026/2420, 2026/2426, 2026/2386 | A hidden Goppa/alternant-code key or lattice secret defines the recovery instance. | Proof field bases, code domains and preprocessing matrices are public and independent of the owner secret. The authorization and recursive validity stack contains neither targeted private-key instance. |
| Raptor availability attacks | Threshold attestations accept R10/RaptorQ fragments before reconstruction. | Native snapshot admission authenticates the exact selected terminal and State segment bytes before the atomic commit. The attacked Raptor attestation interface is absent. |
| Jacobian and algebraic-solving diagnostics | A tangent-space claim must meet the finite-field lifting conditions; a solving projection must use the attacked equations. | The large-characteristic separability condition fails in characteristic two. Direct source arguments enforce the selector, carried lanes and retirement closure. Macaulay projections are separate from the certificate's twenty-event calculation. |
| New Reed-Solomon list bounds | The new linear-list theorem requires sufficiently large characteristic. | The proof stack uses characteristic two and preserves its existing finite-domain proximity bounds and query counts. |