From a1a9c5ba274e5248c0da2073ad31d6a4f850a4af Mon Sep 17 00:00:00 2001 From: Davide Galassi Date: Wed, 29 Jul 2026 15:22:18 +0200 Subject: [PATCH 1/3] Fix null validator key for ed25519 --- preamble.tex | 3 ++- text/safrole.tex | 12 ++++++++++-- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/preamble.tex b/preamble.tex index 3c865ce..84c7369 100644 --- a/preamble.tex +++ b/preamble.tex @@ -595,7 +595,8 @@ \newcommand*{\dx¬gas}{g} % Derived fields of validator keys. -\newcommand*{\valkey}{\mathbb{K}} +\newcommand*{\valkey}[1][]{\mathbb{K}_{#1}} +\newcommand*{\nullvalkey}{\valkey[0]} \newcommand*{\vkX}{k} \newcommand*{\vk¬bs}{b} \newcommand*{\vk¬ed}{e} diff --git a/text/safrole.tex b/text/safrole.tex index f34e114..0052b31 100644 --- a/text/safrole.tex +++ b/text/safrole.tex @@ -112,6 +112,14 @@ \subsection{Key Rotation} \forall \vkX \in \valkey : \vkX_\vk¬metadata \in \metadatakey &\equiv \vkX\subrange{208}{128} \end{align} +We also define $\nullvalkey$, the \emph{null} validator key, used in place of the key of a validator which must be prevented from taking part in the protocol. Formally: +\begin{equation} + \label{eq:nullvalkey} + \nullvalkey \equiv \sq{0}_{32} \concat \sq{2} \concat \sq{0}_{303} +\end{equation} + +No valid signature exists under $\nullvalkey$ since none of its cryptographic components is a valid public key. Note that this is the reason its Ed25519 component is $\sq{2, 0, 0, \dots}$ rather than zero: unlike the Bandersnatch and \textsc{bls} cases, the all-zero Ed25519 sequence does encode a curve point, of order four, under which a signature may be forged for any message without knowledge of any secret. The value $2$ instead encodes a $y$-coordinate admitting no corresponding curve point. + With a new epoch under regular conditions, validator keys get rotated and the epoch's Bandersnatch ring root is updated into $\epochroot'$: \begin{align} \tup{\pendingset', \activeset', \previousset', \epochroot'} &\equiv \begin{cases} @@ -121,7 +129,7 @@ \subsection{Key Rotation} \label{eq:blacklistfilter} \Phi(\mathbf{k}) &\equiv \sq{ \build{ \begin{rcases} - \sq{0, 0, \dots} &\when \vkX_\vk¬ed \in \offenders' \\ + \nullvalkey &\when \vkX_\vk¬ed \in \offenders' \\ \vkX &\otherwise \end{rcases} }{ @@ -130,7 +138,7 @@ \subsection{Key Rotation} } \end{align} -Note that on epoch changes the posterior queued validator key sequence $\pendingset'$ is defined such that incoming keys belonging to the offenders $\offenders'$ are replaced with a null key containing only zeroes. The origin of the offenders is explained in section \ref{sec:disputes}. +Note that on epoch changes the posterior queued validator key sequence $\pendingset'$ is defined such that incoming keys belonging to the offenders $\offenders'$ are replaced with the null key $\nullvalkey$. The origin of the offenders is explained in section \ref{sec:disputes}. From 7d8e363edae20dc659e61481c92e1486ab679543 Mon Sep 17 00:00:00 2001 From: Davide Galassi Date: Wed, 29 Jul 2026 16:39:37 +0200 Subject: [PATCH 2/3] Cite aggregatable BLS variant accounting for 144-octet keys --- text/notation.tex | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/text/notation.tex b/text/notation.tex index 5a5f19e..8f892f8 100644 --- a/text/notation.tex +++ b/text/notation.tex @@ -170,6 +170,6 @@ \subsubsection{Signing Schemes}\label{sec:signing} Both the Bandersnatch signature and Ring\textsc{vrf} proof strictly imply that a member utilized their secret key in combination with both the context $x$ and the message $m$; the difference is that the member is identified in the former and is anonymous in the latter. Furthermore, both define a \textsc{vrf} \emph{output}, a high entropy hash influenced by $x$ but not by $m$, formally denoted $\banderout{\bsringproof{r}{x}{m}} \in \hash$ and $\banderout{\bssignature{k}{x}{m}} \in \hash$. -We use $\blskey \subset \blob[144]$ to denote the set of public keys for the \textsc{bls} signature scheme, described by \cite{jofc-2004-14130}, on curve \textsc{bls}\oldstylenums{12}-\oldstylenums{381} defined by \cite{bls12-381}. We correspondingly use the notation $\blssignature{k}{m}$ to denote the set of valid \textsc{bls} signatures for public key $k \in \blskey$ and message $m \in \blob$. +We use $\blskey \subset \blob[144]$ to denote the set of public keys for the \textsc{bls} signature scheme, described by \cite{jofc-2004-14130}, on curve \textsc{bls}\oldstylenums{12}-\oldstylenums{381} defined by \cite{bls12-381}, in the aggregatable form given by \cite{cryptoeprint:2022/1611}. We correspondingly use the notation $\blssignature{k}{m}$ to denote the set of valid \textsc{bls} signatures for public key $k \in \blskey$ and message $m \in \blob$. We define the signature functions for creating valid signatures; $\edsigndata{k}{m} \in \edsignature{k}{m}$, $\blssigndata{k}{m} \in \blssignature{k}{m}$. We assert that the ability to compute a result for this function relies on knowledge of a secret key. From c0f7d2538f3ef5c86cfaffc8ffd6123b26cb3b6d Mon Sep 17 00:00:00 2001 From: Davide Galassi Date: Mon, 3 Aug 2026 15:32:55 +0200 Subject: [PATCH 3/3] Apply review suggestion --- text/safrole.tex | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/text/safrole.tex b/text/safrole.tex index 0052b31..ac69ca2 100644 --- a/text/safrole.tex +++ b/text/safrole.tex @@ -115,7 +115,13 @@ \subsection{Key Rotation} We also define $\nullvalkey$, the \emph{null} validator key, used in place of the key of a validator which must be prevented from taking part in the protocol. Formally: \begin{equation} \label{eq:nullvalkey} - \nullvalkey \equiv \sq{0}_{32} \concat \sq{2} \concat \sq{0}_{303} + \begin{aligned} + \nullvalkey &\in \valkey \\ + (\nullvalkey)_\vk¬bs &= \sq{0, 0, \dots} \\ + (\nullvalkey)_\vk¬ed &= \sq{2, 0, 0, \dots} \\ + (\nullvalkey)_\vk¬bls &= \sq{0, 0, \dots} \\ + (\nullvalkey)_\vk¬metadata &= \sq{0, 0, \dots} + \end{aligned} \end{equation} No valid signature exists under $\nullvalkey$ since none of its cryptographic components is a valid public key. Note that this is the reason its Ed25519 component is $\sq{2, 0, 0, \dots}$ rather than zero: unlike the Bandersnatch and \textsc{bls} cases, the all-zero Ed25519 sequence does encode a curve point, of order four, under which a signature may be forged for any message without knowledge of any secret. The value $2$ instead encodes a $y$-coordinate admitting no corresponding curve point.