[Cryptography] SIGIL/Flux v1.0 -- require-both SQIsign+Ed25519 hybrid provenance (~356 B), transparent Ajtai/SIS whole-chain folding (2, 568 B constant, 342 ms), a 3-microsecond live tip check, and a measured gossip delivery law
Viktor S. Kristensen
overdrevetfedmetodologi at pm.me
Tue Jul 21 02:00:04 EDT 2026
Hey Metzdowd, I've prepared the following for everyone:
== What SIGIL is (the short version, before the crypto) ==
SIGIL is a live experimental DagKnight chain (network sigil-g0, height ~29M
under accelerated laboratory economics) built on a simple conviction: money's
ledger should be checkable rather than taken on faith, and every binary that
runs the network should prove its own origin. Bitcoin proved a network can agree
on a supply no one can quietly inflate -- but deliberately left out
expressiveness, and, like every widely deployed chain, runs on elliptic-curve
signatures a large quantum computer would break. Ethereum added the
expressiveness and already commits state, transaction and receipt roots in every
execution header -- but it fixes no 21M-style monetary policy, puts no post-
quantum floor under its signatures, and offers no protocol-level provenance for
the client binaries that run it; it is pre-quantum underneath too. SIGIL's brief is to keep what they got right
(capped honest money, programmability) and add what post-quantum cryptography
and a self-signing compiler now make possible: four sparse-Merkle state roots in
every header (a node that drifts on any of them halts itself before serving a
byte), a compiler-emitted post-quantum provenance proof binding each release
binary to its build, a programmable economy (a contract VM, a constant-product
AMM DEX, on-chain credit, and an experimental Bitcoin SPV deposit verifier --
it checks an SPV proof + PoW finality, NOT yet a complete trustless bridge; BTC
custody and peg-out are not trustless yet) riding inside that same structural
guarantee, and tip verification cheap enough that a browser frame -- or honestly,
a potato -- can hold the chain to account.
This email leads with what is MEASURED, keeps simulation results labeled as
simulation, and closes with what is still open. Three numbers set the tone, each
reproducible from section 4:
- One constant-size proof for the whole chain: 2,568 bytes regardless of
length, full verification 342 ms at the 100k-block benchmark, and a
3-microsecond incremental tip check on the live 29M-block network. (Two
separate measurements, two lanes -- NOT one pipeline; the honest nuance is
in section 0.)
- One closed-form law for the gossip layer: delivery D(p,r) = 1 - p^r,
validated against 22 seeded deterministic simulations, RMS residual 0.4
percentage points -- and inverted into the provisioning rule the network
actually ships with (r = 3 clears a 99.9% SLA up to p = 0.1).
- Zero divergence across a six-scenario adversarial ordering gate (multi-
producer braid: 30% drop/reorder/equivocation, withheld blocks, 16/16
orderings agree, tamper suite 5/5 rejected) before the live producer
flipped to the braid binary -- stress-test evidence, not a theorem, and we
say which out loud.
One methodological result worth this list's time even if the chain is not: the
project's Rule 0, learned at cost. Our local sync pipeline stages benchmarked at
251k-2.5M blocks/s while the LIVE sync number sat at ~800 blocks/s for five
days. The wall was never the pipeline -- it was a producer-side serve throttle
and a serial fetch loop, found only when we measured the deployed path directly;
removing them moved the live number 2,322 -> 10,853 blocks/s on the running
node. A fast microbenchmark next to a slow live number is a bug report about
your understanding, not a victory. Every figure in this email names which side
of that line it sits on.
Honesty up front (the whitepaper carries this as a boxed disclosure, so the
email should too). First, decentralization: sigil-g0 is a SINGLE-PRODUCER,
permissioned testnet today -- one block producer (the operator's node), one
operator, minimal peers. The operator can reset or rewrite the chain; external
miners submit dual-lane shares to that one producer and do NOT independently
produce or order blocks yet. There is no genesis allocation and no sale, but
single-operator production means the operator has necessarily controlled most of
the emitted supply (the treasury and the 1.2% commons quorum are operator-held),
and every testnet balance is discarded before mainnet. A permissionless multi-
producer mesh is the next milestone -- do not read the multi-producer braid
simulations below as a decentralized network. Second, authentication: sigil-g0's
RPC money routes ARE authenticated (per-wallet ed25519 signature + monotonic
nonce; the 2026-06 audit's theft findings are fixed and enforcing). The residual risk is deeper: block-apply does not yet
enforce the producer's signature (H1 -- a height-gated verifier is written,
tested, dormant), the live VDF still runs over a forgeable fixed modulus while
its trustless replacement sits unwired (C10), and peer-sync ingress is
under-authenticated (H2/H3/H4; the first H2 gate -- a real ed25519
verify-before-sync handshake with channel binding on the block-serve path --
landed on the hardening branch in log-only mode). Tracked with file:line in the
public hardening backlog. Do not route significant value through SIGIL until
they close. [V: re-state H2 status at posting -- branch-only today.]
== 0. The crypto, up front (everything below is reproducible; URLs in section 4) ==
- Hybrid provenance signatures, require-both: a composite of SQIsign
(post-quantum isogeny; sqisign-rs 0.3; targeting NIST Level 5 -- SQIsign is
a candidate in NIST's additional-signatures on-ramp, NOT a standardized
scheme; 292-byte sig / 129-byte pk) AND Ed25519 (64-byte sig / 32-byte pk):
a ~356-byte signature, smaller than a single ML-DSA-87 (Dilithium-5)
signature at 4595 B. The verifier requires EVERY leg in a fixed scheme-set
to validate -- no single-leg downgrade -- so a break in either family does
not forge a binary. This is defense-in-depth against the youngest PQ family
(sqisign-rs is 0.x; a sibling, SIDH/SIKE, fell in 2022), with Ed25519 as a
classical belt; its security rests on strict domain separation and
require-both verification, NOT a published proof -- combiner analysis is
ongoing and review is invited. The fair PQ-only size comparison is the
292-byte SQIsign leg alone vs 4595 B; Ed25519 adds classical, not
post-quantum, security. This is OUT-OF-BAND release provenance verified once
at update time -- NOT in the per-tx auth or sync path, so it cannot regress
throughput. (A third lattice leg, ML-DSA-87, slots into the same container
for root keys wanting isogeny-AND-lattice diversity.) [V: artifacts carry
non-empty SQIsign AND Ed25519 fields; a single-leg bundle is REJECTED, not
downgraded; the proof hash is committed in-header.]
- flux-sigil: a streaming BLAKE3 hasher that signs its own digest with the
SQIsign L5 key on finalize -- sign-on-finalize, NOT BLAKE3 keyed-hashing
(the output is digest || signature, a signature over the hash, not a MAC).
Hash and authenticate in one pass.
- Four sparse-Merkle state roots per block (wallet, dex, event log, contract
storage). A node that drifts on any root diverges on the header and HALTS
itself (exit 78) before it serves a byte. State divergence cannot hide.
- flux-fold: a transparent, post-quantum folding construction over Ajtai/SIS
lattice commitments (NO trusted setup) that folds N block commitments into
one compact proof. Ajtai/SIS is the hardness assumption, not the protocol
-- the folding construction is our own and unpublished; independent review
of it and its Fiat-Shamir transcript is invited. Measured, reproducible
(flux-fold's fold-verify-bench): N=100k blocks -> 2,568-byte proof,
280-342 ms full verification across runs on a loaded 48-core host. The
honest nuance the benchmark surfaced: the PROOF is constant-size
(independent of chain length) but full verification is O(M) -- the verifier
reads all M commitments (~51 MB at 100k blocks) to recompute the random
linear combination. Constant-size proof, NOT constant-cost verification;
the steady state is cheap because of the incremental lane: a 3-microsecond
live tip check against an already-verified fold state, 0 blocks downloaded,
running today on the 29M-block network. (Two lanes, two experiments; full
verification of the live 29M fold has not been separately benchmarked, and
we deliberately do not quote chain-length-per-verify-second as throughput.)
Late join = verify one fold of the history prefix, adopt the checkpoint,
apply live -- divergence 0. The founding claim was tip verification under
10 ms in a browser; the live incremental check beats it by three orders of
magnitude.
- The gossip delivery law: D(p,r) = 1 - p^r under independent per-
transmission loss p with redundancy r, inverted to the provisioning rule
r* = ceil(ln(1-SLA)/ln p). Derived and validated against 22 seeded
flux-chronos star-flood simulations, RMS residual 0.4 pp; the shipped
default r=3 satisfies a 99.9% SLA up to p=0.1. Statistical mechanics of the
gossip layer done properly: model, measurement, closed form, residual, and
a rule operators actually use. (Standalone paper: URL in section 4.)
- A browser tip-check in two layers: the light path recomputes the exact
BLAKE3 tip fingerprint a native node commits, 0 blocks downloaded; the PQ
path is the flux-ivc-verifier-wasm verifier (STARK + lattice) with a 10 ms
gate [V: which path ships enabled by default]. In-tab hybrid PQ key
material: Ed25519 and ML-DSA-87 for signing identity, ML-KEM-1024 for key
encapsulation (a KEM, not a signature: confidentiality, not authentication;
FIPS 204/203; the ML-DSA-87 and ML-KEM-1024 members target NIST Level 5),
full keygen ~267 ms in-browser, no wasm; ML-KEM channel establishment
measured at 115 ms browser-to-bridge.
- chronos: a deterministic, seeded, virtual-time harness that runs the REAL
chain code and measures the CPU-time cost of its real crypto paths. It times
actual ed25519 batch-auth (keygen + sign + verify, one signature per N-op
batch, parallel across cores) head-to-head against a zk-flux verify-once
path. The zk-flux numbers are real prove/verify times and real byte sizes,
but a COST STRUCTURE only: the lattice wrap binds the FRI-STARK commitment,
it does not yet PROVE STARK validity. A 72-hour soak resolves in seconds of
wall clock and is bit-reproducible. The delivery law's 22 validation runs
and the braid's six-scenario adversarial gate (divergence = 0 under 30%
drop/reorder/equivocation and withheld blocks; 16/16 orderings agree;
tamper suite 5/5 rejected) both ran under this harness.
- Time-based emission: block_reward = integral of rate over
[prev_block_ts, block_ts]; rate halves every HALVING_PERIOD = 126,144,000 s
(4 years). The first period emits exactly MAX_SUPPLY/2; the geometric sum
2 x (MAX_SUPPLY/2) -> 21,000,000 is approached asymptotically and never
reached, and a compile-time const_assert checks the schedule sums to exactly
the cap. Invariant under block rate -- a height-based schedule breaks when
block cadence changes (we found this at 220 blk/s).
== What Flux is (three paragraphs) ==
Flux is an AI-native, self-hosting Rust build orchestrator: the tool that
compiled, tested, signed, and shipped every binary described in this email,
including itself. Mechanically it is a content-hash compile cache (~6x
intra-workspace speedup), a Kahn's-algorithm parallel batch scheduler, and a
MIR -> CLIF native-object backend for a growing subset of Rust. The
list-relevant part is not the speed. It is that Flux treats a compiled artifact
as something to be cryptographically attested at the moment it exists: every
release binary leaves the compiler carrying a `.proof` bundle that binds the
artifact's BLAKE3, the source's BLAKE3, the compiler's own version and git
commit, and the identity that built it, signed post-quantum. The compiler signs
what it builds.
Flux is driven by autonomous agents, not only by humans. The build / test /
optimize / release loop is exposed as a typed tool surface that AI agents call
directly; each unit of work is claimed, performed, and settled on-chain, and the
agent's settlement wallet is one of the fields inside the signed `.proof` record.
The practical consequence is that "who produced this binary, from which source,
with which compiler" stops being a trust assumption recorded in a CI log and
becomes a fact you can recompute from the artifact alone -- offline, with no
trusted server. Builds distribute across a peer-to-peer fleet; releases are
content-addressed by BLAKE3, and the updater is fail-closed (manifest verified
end-to-end, the new binary's version probed before handoff, auto-rollback after
three failed boots). Reproducibility and attribution are properties of the
primitive, not of the process wrapped around it.
For this list specifically, Flux is a working substrate for post-quantum
supply-chain provenance, and SIGIL is its proving ground. The signing leg is the
require-both hybrid above: SQIsign Level 5 AND Ed25519, ~356 bytes together,
smaller than a single ML-DSA-87 signature, with a downgraded single-leg bundle
rejected rather than silently accepted (section 1 gives the canonical signing
record and the honest limits). SIGIL exercises that substrate end to end: a
single static binary that is node, miner, light client, and wallet, on a chain
whose every shipped artifact, every block header, and every committed state root
is built to be self-attesting and independently checkable. The composition is
ours and unpublished; the primitives it rests on (SQIsign, Ajtai/SIS, BLAKE3,
Ed25519, the FIPS 203/204 members) are not. Cryptanalysis and review of the
composition are explicitly invited.
== 1. The substrate: a compiler that signs what it builds ==
Flux is a self-hosting Rust build orchestrator (content-hash compile cache,
~6x intra-workspace cache speedup; Kahn's-algorithm parallel batching; a
MIR -> CLIF native-object backend for a growing subset of Rust). The
list-relevant primitive: a release binary carries a `.proof` bundle whose
signing input is a canonical 177-byte record --
version || artifact_blake3 || source_blake3 || fluxc_version ||
fluxc_git || agent_wallet || swarm_task_id || settle_tx || timestamp_us
-- signed with SQIsign Level 5; verification recomputes the artifact BLAKE3,
then checks the signature. Downgraded-length signatures are rejected before
parsing (a 148-byte Level-1 sig is a hard error). Releases are content-addressed
by BLAKE3; the updater is fail-closed (manifest verified end-to-end, the new
binary's version probed before handoff, auto-rollback after three failed boots).
A require-both SQIsign-L5 + Ed25519 `.proof` is LIVE for the shipping v7.0.4
release, and its two builder-key fingerprints are published for pinning
(section 4). Honest limit: it binds the artifact and signing agent, NOT
the source -- post-build signing, because the matching tree was not cleanly
available; the compiler-emitted artifact+source binding is wired and
demonstrated, pending a cut from a current tree. [V: ship built+signed in one
pass so artifact AND source bind, proof hash committed in-header.]
== 2. The chain: divergence cannot hide, and money cannot drift ==
Every header commits four state roots; a node that drifts halts itself before
serving traffic -- the structural fix for the replay-bug class that silently
corrupted a production balance on our sister chain in May 2026. Three
independent emission guards: a compile-time const_assert that the schedule sums
exactly to the cap; a runtime commit chokepoint that refuses any post-state
above 21M base units; and a fail-loud band enforcer that compares realized
supply (read from the committed wallet root) to the deterministic target and
HALTS at +/-2% drift. A controller that mints is drift-prone; a verifier that
halts turns "three days of wrong rewards" into "halt at block 1."
Ordering is a DagKnight braid (sigil-dagknight + flux-topology). Before the
live producer flipped to the braid binary it passed a six-scenario adversarial
simulation gate -- multi-producer divergence 0 at 10k and 100k blocks, 30%
drop/reorder/equivocation, a withheld-block attacker with the finalized prefix
byte-identical, 16/16 ordering permutations agreeing, tamper suite 5/5 rejected
-- and a two-producer live mesh ran 3385 emissions byte-identical first.
But the LIVE network today runs a SINGLE producer (see the honesty note up top):
the braid's multi-producer results are simulation plus one bounded two-producer
mesh, not the deployed topology. Simulation convergence is encouraging evidence,
not a safety or liveness proof; the Byzantine threshold for the braid is named
open theory.
== 3. One binary: node + miner + wallet, on a potato ==
sigil-top is a single static binary (Linux + Windows): a monitoring node, a
light client, a dual-lane miner, and a wallet. Highlights, each encoding a
hard-won invariant:
- Light monitor by default: verifies the live tip fingerprint
fp = BLAKE3(version || len(net_id) || net_id || height
|| wallet_root || dex_root || event_root || contract_root)
in ~3 microseconds with 0 blocks downloaded; a browser implementation
(vendored @noble/hashes BLAKE3) computes the identical value. Opt-in
genesis->tip sync runs at a measured LIVE 10,853 blocks/s on the running
node (up from 2,322 after removing a producer-side serve throttle + a
serial fetch loop -- the live path, not a microbenchmark; wire compression
14.0x on the backfill codec, 70.7 B/header live). A full restart
stream-recovered ~102,000 blocks in bounded memory. [V: name the exact
run + build for the 10.8k figure at posting.]
- Anti-phantom sync: a peer-claimed tip may only RAISE the sync target within
a bounded lead over a signed oracle tip; store watermarks are keyed to the
genesis hash, so a testnet reset self-heals in seconds instead of leaving
clients chasing a ghost height. [V: stale-client + fresh-genesis self-heal
< 10 s acceptance test is in CI.]
- Bounded-RAM durability: the block store opens in O(window), never O(chain);
a write-ahead log past a sanity bound is quarantined at open, not replayed
into RAM (the fix for a Windows append-mode quirk where a 1.6 GB poisoned
WAL ate 3-4 GB of RAM at every start).
- Verified-identity earning: a wallet binds an identity by signing a
domain-separated nonce'd message; the wallet IS the public key. Verified
wallets earn to themselves; unverified mining routes to the treasury. A
fixed 1.2% of every reward routes to a commons pool under an M-of-N quorum
-- the cryptographic quorum is load-bearing; an LLM-debate layer above it is
policy, not consensus.
== 4. Testing, and how to reproduce ==
Two practices earned their keep. (1) Deterministic virtual time (chronos): the
harness runs the REAL chain code -- apply_tx + commit_state_transition + the
four roots -- under a simulated clock, measuring real signature-verification CPU
cost, not just network timing, benchmarking the ed25519 batch-auth path against
a zk-flux verify-once path. (2) A Stargate state-transition wind tunnel:
`parallel_exec.rs` measured 1,901,939 tx/s at 4 threads, 5,173,981 peak at 16
(4M tx, 1M accounts), the parallel commutative-merge root asserted equal to the
serial fold root at every thread count -- a wind-tunnel number, NOT testnet TPS;
DagKnight/Narwhal ordering remains a named integration lane.
Reproduce:
curl https://sigilgraph.fluxapp.xyz/sigil-status.json (live feed)
curl https://sigilgraph.fluxapp.xyz/sigil-tip-live.json (live tip)
https://sigilgraph.fluxapp.xyz/downloads/sigil-top-latest.json (BLAKE3
content-addressed manifest; Linux x86_64 + Windows x64)
https://sigilgraph.fluxapp.xyz/downloads/sigil-top-v7.0.4-linux-x64 (the
binary the proof below attests; verified 200, 13,819,984 B)
https://sigilgraph.fluxapp.xyz/downloads/sigil-top-v7.0.4-linux-x64.proof (LIVE
require-both SQIsign-L5 + Ed25519 hybrid proof, 6002 B; sqisign_pubkey 129 B
+ sqisign_sig 292 B + ed25519_pubkey 32 B + ed25519_sig 64 B. Recompute
BLAKE3 of the binary above -- it equals the proof's artifact_hash
413807bd55ccbf4b7fe0acc19879b52d57e2c32cb49bd9e8ff6879163135314a
(re-verified with b3sum this pass) -- then run
`fluxc verify-proof <bin> <bin>.proof`, which checks the artifact BLAKE3
AND both signatures over the canonical record; a stripped single-leg
bundle is rejected.)
https://sigilgraph.fluxapp.xyz/downloads/sigil-builder-keys.json (the PINNED
builder keys -- the step this list will care about most. A self-consistent
proof signed by the WRONG keys is still a forgery, so after verify-proof
passes, compare the proof's builder keys to these pinned fingerprints:
SQIsign-L5 pubkey BLAKE3
02b8b38c5f168758757a5f81a33c257f16e482c313aec08c0b5bbc3afac57e09, Ed25519
pubkey BLAKE3
6e0128278d97d793546d76da2bb6d69d053e4308d2d4680962953280fd72c563.)
https://quillon.xyz/downloads/sigil-top-delivery-law.pdf (the delivery-
law paper: derivation, 22 seeded runs, residuals)
https://quillon.xyz/downloads/sigil-whitepaper-v1.pdf (the v1
whitepaper: the master equation, measured laws, honest-status ladder;
mirror at sigilgraph.fluxapp.xyz/downloads/sigil-whitepaper-v1.pdf)
The browser node verifies the tip fingerprint in front of you.
Source: https://github.com/deme-plata/sigilgraph
Flux it self: https://fluxapp.xyz
Reporting: non-sensitive findings -> public issues on that repo; security-
sensitive findings -> GitHub private vulnerability reporting, or email
bitknight.dipper688 at passmail.net (ask for a PGP key to encrypt).
Reference machine + method: throughput and soak figures are single-box on the
public testnet node; the SQIsign / ed25519 / zk-flux cost numbers come from the
named crate benches and the sigil-chronos bins; the fold verification range is
280-342 ms across runs on a loaded 48-core host (fold-verify-bench in
flux-fold); the ~267 ms hybrid keygen is an in-browser consumer-hardware
figure; the ~3 us fingerprint is the native light-path figure. [V: pin the
exact CPU / RAM / OS / browser strings at posting -- "consumer hardware" and
"the testnet node" are not measurements.]
- chronos benchmarks the ed25519 auth path and a zk-flux cost structure; it
is not a cryptanalysis harness. SQIsign-L5 secures provenance and one
tip-proof flavor, NOT the per-tx batch-auth.
- The require-both hybrid is LIVE: each leg signs a domain-separated digest
binding the (scheme, public-key) set; a single-leg bundle is rejected, never
downgraded. It is additive -- it touches neither the SQIsign surface nor the
ed25519 batch-auth path, so throughput stands. Two limits: it binds
artifact + agent, NOT source (post-build signing; current-tree cut pending),
and in-header commitment of the proof hash is the v1.0 target.
- flux-fold: constant-size proof (2,568 B), NOT constant-cost verification --
full verify is O(M) in commitments read (~51 MB at 100k blocks); 280-342 ms
is a measured range at the 100k benchmark, not an asymptotic bound, and the
live 29M fold has not been full-verified as a separate benchmark. Soundness
rests on Ajtai/SIS -- review of the construction and its Fiat-Shamir
transcript is welcome. zk-flux's lattice wrap binds but does not yet prove
STARK validity (cost-structure, not soundness).
- The braid's divergence-0 record is simulation-gated + one live two-producer
mesh; it is not a Byzantine safety/liveness proof.
- The ~2M / ~5.17M Stargate numbers are state-transition harness numbers,
excluding mempool, storage, p2p, and DagKnight ordering -- not production
throughput.
- Consensus-layer hardening in flight, tracked publicly with file:line:
block-apply producer-sig (H1: verifier written + height-gated, dormant),
trustless VDF modulus (C10: built, unwired), peer-sync ingress auth
(H2: real ed25519 verify-before-sync handshake with per-peer channel
binding landed on the hardening branch, log-only pending fleet telemetry;
H3 follower difficulty + H4 wire tip-proofs open).
- The @noble PQ hybrid composition (Ed25519 + ML-DSA-87 + ML-KEM-1024) is ours
and worth independent eyes; "NIST L5" describes the PQ members, not the
composition. The testnet runs two chains by design (verify-once throughput +
dual-lane mined rewards); each number above names its chain.
Cryptanalysis on the tip-proof construction, the fold scheme, the time-based
emission integral (especially boundary behavior at halving edges and the
remainder-carry), the SQIsign provenance binding, and the PQ hybrid composition
is explicitly invited.
-- Viktor Sandstrøm Kristensen
Really important if something matters
Afsendt med Proton Mail sikker e-mail.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.metzdowd.com/pipermail/cryptography/attachments/20260721/50e23dbd/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: publickey - overdrevetfedmetodologi at pm.me - 0x5F4716BA.asc
Type: application/pgp-keys
Size: 1722 bytes
Desc: not available
URL: <https://www.metzdowd.com/pipermail/cryptography/attachments/20260721/50e23dbd/attachment.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 603 bytes
Desc: OpenPGP digital signature
URL: <https://www.metzdowd.com/pipermail/cryptography/attachments/20260721/50e23dbd/attachment.sig>
More information about the cryptography
mailing list