Fix null validator key for ed25519

preamble.tex

@@ -595,7 +595,8 @@
 \newcommand*{\dx¬gas}{g}
 
 % Derived fields of validator keys.
-\newcommand*{\valkey}{\mathbb{K}}
+\newcommand*{\valkey}[1][]{\mathbb{K}_{#1}}
+\newcommand*{\nullvalkey}{\valkey[0]}
 \newcommand*{\vkX}{k}
 \newcommand*{\vk¬bs}{b}
 \newcommand*{\vk¬ed}{e}

text/notation.tex

@@ -170,6 +170,6 @@ \subsubsection{Signing Schemes}\label{sec:signing}
 
 Both the Bandersnatch signature and Ring\textsc{vrf} proof strictly imply that a member utilized their secret key in combination with both the context $x$ and the message $m$; the difference is that the member is identified in the former and is anonymous in the latter. Furthermore, both define a \textsc{vrf} \emph{output}, a high entropy hash influenced by $x$ but not by $m$, formally denoted $\banderout{\bsringproof{r}{x}{m}} \in \hash$ and $\banderout{\bssignature{k}{x}{m}} \in \hash$.
 
-We use $\blskey \subset \blob[144]$ to denote the set of public keys for the \textsc{bls} signature scheme, described by \cite{jofc-2004-14130}, on curve \textsc{bls}\oldstylenums{12}-\oldstylenums{381} defined by \cite{bls12-381}. We correspondingly use the notation $\blssignature{k}{m}$ to denote the set of valid \textsc{bls} signatures for public key $k \in \blskey$ and message $m \in \blob$.
+We use $\blskey \subset \blob[144]$ to denote the set of public keys for the \textsc{bls} signature scheme, described by \cite{jofc-2004-14130}, on curve \textsc{bls}\oldstylenums{12}-\oldstylenums{381} defined by \cite{bls12-381}, in the aggregatable form given by \cite{cryptoeprint:2022/1611}. We correspondingly use the notation $\blssignature{k}{m}$ to denote the set of valid \textsc{bls} signatures for public key $k \in \blskey$ and message $m \in \blob$.
 
 We define the signature functions for creating valid signatures; $\edsigndata{k}{m} \in \edsignature{k}{m}$, $\blssigndata{k}{m} \in \blssignature{k}{m}$. We assert that the ability to compute a result for this function relies on knowledge of a secret key.

text/safrole.tex

@@ -112,6 +112,20 @@ \subsection{Key Rotation}
   \forall \vkX \in \valkey : \vkX_\vk¬metadata \in \metadatakey &\equiv \vkX\subrange{208}{128}
 \end{align}
 
+We also define $\nullvalkey$, the \emph{null} validator key, used in place of the key of a validator which must be prevented from taking part in the protocol. Formally:
+\begin{equation}
+  \label{eq:nullvalkey}
+  \begin{aligned}
+    \nullvalkey &\in \valkey \\
+    (\nullvalkey)_\vk¬bs &= \sq{0, 0, \dots} \\
+    (\nullvalkey)_\vk¬ed &= \sq{2, 0, 0, \dots} \\
+    (\nullvalkey)_\vk¬bls &= \sq{0, 0, \dots} \\
+    (\nullvalkey)_\vk¬metadata &= \sq{0, 0, \dots}
+  \end{aligned}
+\end{equation}
+
+No valid signature exists under $\nullvalkey$ since none of its cryptographic components is a valid public key. Note that this is the reason its Ed25519 component is $\sq{2, 0, 0, \dots}$ rather than zero: unlike the Bandersnatch and \textsc{bls} cases, the all-zero Ed25519 sequence does encode a curve point, of order four, under which a signature may be forged for any message without knowledge of any secret. The value $2$ instead encodes a $y$-coordinate admitting no corresponding curve point.
+
 With a new epoch under regular conditions, validator keys get rotated and the epoch's Bandersnatch ring root is updated into $\epochroot'$:
 \begin{align}
   \tup{\pendingset', \activeset', \previousset', \epochroot'} &\equiv \begin{cases}
@@ -121,7 +135,7 @@ \subsection{Key Rotation}
   \label{eq:blacklistfilter} \Phi(\mathbf{k}) &\equiv \sq{
     \build{
       \begin{rcases}
-        \sq{0, 0, \dots} &\when \vkX_\vk¬ed \in \offenders' \\
+        \nullvalkey &\when \vkX_\vk¬ed \in \offenders' \\
         \vkX &\otherwise
       \end{rcases}
     }{
@@ -130,7 +144,7 @@ \subsection{Key Rotation}
   }
 \end{align}
 
-Note that on epoch changes the posterior queued validator key sequence $\pendingset'$ is defined such that incoming keys belonging to the offenders $\offenders'$ are replaced with a null key containing only zeroes. The origin of the offenders is explained in section \ref{sec:disputes}.
+Note that on epoch changes the posterior queued validator key sequence $\pendingset'$ is defined such that incoming keys belonging to the offenders $\offenders'$ are replaced with the null key $\nullvalkey$. The origin of the offenders is explained in section \ref{sec:disputes}.