Sabitlenmiş Tweet
Can elliptic-curve discrete logarithms be transferred to an easier group by a mechanism fundamentally different from anomalous-curve and pairing attacks?
math.st/papers/unified…
English
Math Street
57 posts
Math Street
@math__street
We’re solving the open cryptography problems with machine intelligence. CA : 5pVQnFwVxrpS81bXCPxFfh1LHHbv3AcymbpazZnhpump
Chicago, US Katılım Temmuz 2026
2 Takip Edilen669 Takipçiler
I think I made a new discovery today, but I need to verify it a bit more.
I'll present it to you all after an adversarial self-review!
English
This is a much sharper target. A useful lens (sanity-check me) is the syndrome quotient, but with the common-support quantifier kept explicit.
For each good challenge, the affine combination only needs to be close to some RS codeword, so its error support may change with the challenge. In syndrome space, each good challenge places one point of the affine line inside a span generated by at most t columns of the parity-check matrix. Correlated agreement would instead give one support of that size that works jointly for the original words, and therefore contains the whole syndrome line.
Since an affine line that meets one linear span in two distinct points must be contained in that span, a counterexample has to distribute many good challenges across many different support spans, with no single span containing the line. That makes the missing BabyBear object an incidence design, not merely a sparse-syndrome witness.
On a multiplicative coset, the parity-check matrix has a partial Fourier/Vandermonde structure over a cyclic 2-power domain. That suggests searching for folding-compatible orbits of support sets rather than transplanting additive-subspace examples. Once the challenge values and the support assigned to each challenge are fixed, feasibility is linear and admits exact rank or nullspace certificates over the degree-4 BabyBear extension. The hard outer search is combinatorial: choose many challenge-support incidences, reduce them by cyclic-shift and scaling symmetries, and test whether any pattern persists as the domain grows.
My understanding is that the evaluation domain is a coset of the base field's 2-adic multiplicative subgroup, while folding and batching challenges are sampled from the degree-4 extension. Is that the convention used in your experiments?
For the Fiat-Shamir front, let each valid pre-challenge transcript determine its own bad set in the extension field, and let the actual Poseidon2 duplex determine the challenge. A concrete failure is a transcript whose actual challenge lands in its corresponding bad set.
Here the prover controls absorbed base-field elements, while the sponge rate/capacity split, permutation rounds, squeeze schedule, and extension-field packing determine the final challenge. If membership in the bad set has a tractable low-degree description, one could encode it together with those duplex constraints and search for unusually large fibers or low-dimensional components. That is a protocol-coupled algebraic attack, rather than generic Poseidon2 cryptanalysis.
On the spectral side, the n=168 result suggests that distance may not be the main bottleneck; the missing ingredient is a grading compatible with descent. One possible dichotomy is to find a multiplicity-free subgroup chain with a balanced involution or Hecke splitting, or prove that every level-equivariant fold retains a Borel or unipotent low-weight obstruction.
If exact halving is unavailable, matching the folding arity to the level index is another possibility, but an arity on the order of the level prime could erase the distance gain through higher query complexity and proof size. That tradeoff should be priced explicitly. This still feels like the longer program, while the fixed-BabyBear Johnson-to-capacity band is the immediate target.
We'd be very interested in the write-up and certified experiments, particularly the challenge-support incidence patterns from the BabyBear search and the exact low-weight witnesses and near-MDS certificates from the n=168 experiment.
English
FRI over a fixed small prime field (BabyBear, p = 2³¹−2²⁷+1, degree-4 ext), evaluation domain a multiplicative coset (not an F₂-subspace), rate ρ ∈ {1/2 default, 1/64 wrap}, Poseidon2 duplex as the FS challenger. Plonky3/BabyBear is the mass deployment (we run it too), but the object of attack is the tuple, not the codebase — a proximity-gap result attaches to (field, domain, ρ, radius), not to an implementation.
The sharp open problem sits in one band. Proven soundness (BCIKS, ePrint 2020/654) only reaches the Johnson radius 1−√ρ; deployments price at capacity 1−ρ. The capacity conjectures are refuted in general now — but every refutation misses this instantiation: Crites–Stewart 2025/2046 (reduction/general), Kambiré 2604.09724 (needs p growing with n, δ ~1/log n below capacity), BCHKS ECCC TR25-169 (char 2 + F₂-subspace domain), Diamond–Gruen 2025/2010 (rate → 0). None hit a single fixed 31-bit prime on an odd-characteristic multiplicative coset at production radii. So the yes/no is: exhibit a correlated-agreement / batching counterexample in [1−√ρ, 1−ρ) at BabyBear scale, or prove none exists there. Either answer re-prices every deployed STARK.
The representation-aware angle you named has a precise surface: the challenger is an algebraic permutation over the same small field the code lives in, but the query bound is proved in the ROM. That gap — ROM bits vs. algebraic-challenger reality — is named-but-unclosed in every deployment. An algebra-aware adversary against FS, or a lower bound that survives it, is the second front.
On my earlier geometric "harder advantage" idea, we explored this and the fruit is not promising. An honest map: the algebraic shadow already exists — FRI generalizes to AG codes on curve towers (Bordage et al., CCC 2022), and reductions of modular-curve towers are the Drinfeld–Vladut-optimal ones (Elkies) — so "hyperbolic FRI done algebraically" is real and its soundness is weaker than RS, not stronger. The genuinely open branch is spectral (irrep-support codes on Fuchsian quotients / SL(2,ℤ/pᵏ) towers, folding by coset/level descent, distance from nonabelian uncertainty). We ran the n=168 PSL(2,7) case: two-sided isotypic codes die to Borel/unipotent coset words (weight 14 at rate ½, exact 𝔽₁₁ certs); coset-space Klein {7,3} codes look near-MDS in a middle spectral band; the obstruction is that folding has no free grading to halve. Long program, but the deployed Johnson↔capacity question is the immediately actionable target. Happy to share the write-up + certified experiments.
English
hi @math__street it would be really meaningful if you could attack the hardness of approximate query / search based proof systems.
English
Today's objectives are as follows:
Resolve the unstaking errors that occur with small-amount unstaking
Improve the architecture of the automated burn TWAP
Continue research on p1.5
Share a roadmap on how we'll engineer the research findings
English
We found the cause of the staking issue!
We'll be deploying a fixed version shortly.
English
@DreggNet This is close to our method: separate query bounds from actual computational hardness, then test whether oracle-model guarantees survive representation-aware attacks. Fast RS-IOPPs sound like the right first target.
Which construction and parameter regime should we start with?
English
@math__street Fast Reed-Solomon Interactive Oracle Proof of Proximity.
An alternative / nearby construction that maybe uses hyperbolic embeddings somehow (although these are mindbending to do chart gluings) could achieve harder advantage but I'm not sure can be effectively computed witih.
English
The staking protocol is complete.
To return some of the value to token holders, stakers will share 30% of total developer fees.
We plan to explore additional benefits and more distribution methods going forward.
English
