@xmbl/state-machine 0.1.15 → 0.1.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +34 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,39 @@
|
|
|
1
1
|
# @xmbl/state-machine
|
|
2
2
|
|
|
3
|
+
## 0.1.16
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- **SECURITY — 0.1.15 still leaked the AIR trace, by a second route.** The mask added in 0.1.13
|
|
8
|
+
closed the linear attack; it did not close this one, and the published 0.1.15 bytes return the
|
|
9
|
+
exact secret.
|
|
10
|
+
|
|
11
|
+
Base-field Merkle leaves were `H('l:' + value)` and the field is 31 bits. Every opening hands the
|
|
12
|
+
verifier its authentication path, whose FIRST element is the level-0 SIBLING's leaf hash —
|
|
13
|
+
inverting it is a sweep of 2^31 SHA-256, measured at **450 seconds** for the whole field, once,
|
|
14
|
+
reusable against every proof ever made. So each of the `2*nc` trace openings donated one more
|
|
15
|
+
evaluation of `col'` for nothing: **80 opened + 80 swept = 160** points against a polynomial of
|
|
16
|
+
degree `T + blindDeg = 104` that needs **105**. Interpolate, evaluate at `g^0`, read row 0.
|
|
17
|
+
Measured against published 0.1.15: `RECOVERED 570682118` / `ACTUAL 570682118`. The blind cannot
|
|
18
|
+
see this — `blindDeg = 2*nc + 8` is sized against what is opened DIRECTLY.
|
|
19
|
+
|
|
20
|
+
**Fix**: `@xmbl/zero-knowledge` exports `merkleSalted`, `mverifySalted` and `randomSalts`; a
|
|
21
|
+
base-field leaf is now `H('ls:' + value + ':' + salt)` with a fresh 128-bit salt per leaf, carried
|
|
22
|
+
in the opening as `sCur`/`sNxt`. A missing or short salt is refused, so a salt-stripped proof does
|
|
23
|
+
not verify. Extension-field leaves are ~124 bits and stay unsalted.
|
|
24
|
+
|
|
25
|
+
**BREAKING for AIR proofs**: the statement tag is versioned `zk3` and the opening shape gained the
|
|
26
|
+
salts, so **no proof made by 0.1.13–0.1.15 verifies on 0.1.16**. Re-prove. `airSetup`/`airProve`/
|
|
27
|
+
`airVerify`/`AIR_STATEMENTS` signatures are unchanged.
|
|
28
|
+
|
|
29
|
+
`xzk` (the cube-curve statement) is unaffected and deliberately not salted: its FRI layer 0 IS the
|
|
30
|
+
curve codeword in the clear, `Pt` is public by construction, and its hiding is the witness family
|
|
31
|
+
(`Pt = P + Z_R*B`, a 2-parameter family per proof) rather than leaf secrecy.
|
|
32
|
+
|
|
33
|
+
The standing regression check is no longer a guess at the next attack. It is a COUNT: the points
|
|
34
|
+
an adversary can hold must stay strictly below `T + blindDeg + 1`. At the shipped parameters that
|
|
35
|
+
is `80 + 0 < 105`; un-salting the leaves makes it `160 < 105` and fails.
|
|
36
|
+
|
|
3
37
|
## 0.1.15
|
|
4
38
|
|
|
5
39
|
### Patch Changes
|