PaperlayerView exact revision on arXiv

Source-linked AI summary

SILMARILS-MV: Information-Theoretically Secure Multi-Verifier Signatures with Dealer-Free Key Issuance and Linear Aggregation for Permissioned Blockchains

Khadijeh Bagheri, Hassan Khodaiemehr, Chen Feng

arXiv:2610.31814v1cs.CRcs.DCcs.ITmath.ITquant-ph

TL;DR

Permissioned ledgers need durable authentication, but computational signatures impose post-quantum traffic overhead and existing information-theoretic approaches have practical constraints. SILMARILS-MV uses secret verifier functionals and committee-issued keys, with linear aggregation and threshold notarization. In the reported 1000-validator model, threshold notarization uses 71 KiB per validator per block, 22× less than ML-DSA-44 in the stated setting.

  • Problem

    Existing information-theoretic signatures have required trusted authorities, per-message key material or interaction, or limited transferability, while post-quantum signature replacements inflate consensus traffic.

    Source: §I · p. 1

  • Method

    SILMARILS-MV uses secret verifier-specific linear functionals and virtual anchors, with validators issuing keys through MPC and linearity enabling aggregation and threshold notarization.

    Source: §XI · p. 22

  • Results

    71 KiB per validator per block for threshold notarization at 1000 validators, 22× less than ML-DSA-44 in the reported normal-case model.

    Source: D. Scalability to 1000 Validators · p. 18

  • Takeaways & Limitations

    Threshold notarization provides constant-size certificates and per-validator issuance cost independent of committee size in the stated deployment.

    Source: §XI · p. 22

    Asynchronous issuance and variants for t < n/2 with statistical security are outside the paper’s scope.

    Source: §X · p. 22

Abstract

from arXiv · show

Permissioned blockchains authenticate transactions, votes and quorum certificates with computationally secure signatures, and post-quantum replacements inflate consensus traffic by orders of magnitude. Information-theoretic alternatives have required a trusted authority, quantum channels, per-signature interaction, or single-use keys with bounded transfer. We present SILMARILS-MV, a multi-verifier unconditionally secure signature in which a signature is the vector $\alpha = A\,e(m)$ and each verifier holds a secret functional $c_i = \Gamma^T \lambda(x_i)$ derived from virtual anchors $\Gamma$ that nobody learns. Against unbounded adversaries corrupting up to $\omega$ verifiers and any signers, and observing every decision, an honest verifier accepts a forged or invalid signature with probability at most $Q/q + 1/(q-1)$, a bound that is tight in its leading term. The scheme is strongly unforgeable, non-repudiable, transferable across unboundedly many hops, and linearly aggregatable. Keys are issued by the validators through perfectly secure MPC for $t < n/3$, without broadcast. To scale, we let the committee itself sign: in threshold notarization, finality certificates have constant size $32(\omega+1)$ bytes and per-validator issuance cost no longer depends on $n$. Arbiter-verified keys give clients 32-byte signatures, robust redistribution supports membership changes and share refresh, and verifiers can be enrolled retroactively. A certificate verifies in 2.4 microseconds. In an analytic normal-case model at 1000 validators, threshold notarization needs 71 KiB of authentication traffic per validator per block, 22x less than ML-DSA-44 for admitted verifiers. In a Rust HotStuff prototype with 100 validators, SILMARILS-MV commits 2.8x more transactions per second than ML-DSA-44 with 67x less cryptographic CPU, and Monte-Carlo attacks match the bounds.

I. INTRODUCTION

Permissioned blockchains need signatures that remain convincing for later accountability, but computational and existing information-theoretic schemes have drawbacks for ledger use. SILMARILS-MV uses secret verifier-specific linear functionals and committee-issued keys; linearity supports aggregation and threshold notarization.

I. INTRODUCTION

  • Computational signatures face a post-quantum migration cost: standardized alternatives increase signature sizes from 64 B to 0.7–17 KB, while ledger evidence must remain unforgeable for later audits.Existing information-theoretic alternatives have required trusted authorities, per-message key material or interaction, or limited transferability.Source: §I · p. 1

A. Our Approach

  • SILMARILS-MV makes verification depend on secret, verifier-specific linear functionals, preventing public reconstruction and limiting what a coalition of ω verifiers learns about an honest verifier’s response.A dishonest signer also cannot tailor signatures to public verifier identifiers because it does not know the verifiers’ functionals.Source: A. Our Approach · p. 2
  • Linearity in the verifier key, signature, and signing key yields dealer-free issuance, aggregation into a single (ω + 1)-vector, and threshold notarization by the committee.The virtual anchors Γ remain shared and unreconstructed; the committee signs as one signer, so issuance cost and collusion bound ω do not grow with committee size.Source: A. Our Approach · p. 2

B. Contributions

  • Threshold notarization gives verifiers a constant-size, transferable information-theoretic certificate, but uses secret verifier keys; at 1000 validators it is estimated to use 71 KiB per validator per block versus 1.5 MiB for ML-DSA-44.The comparison is for the admitted-verifier setting; certificates attest to the committee decision rather than individual votes unless an accountable variant is added.Source: B. Contributions · p. 2, §II · p. 2

A. Notation and Algebraic Tools

  • The paper’s notation uses Vandermonde vectors λ(x) and e(m), which are linearly independent for distinct inputs up to their stated dimensions.These algebraic facts underpin the construction’s verifier and message encodings.Source: A. Notation and Algebraic Tools · p. 3

B. Participants, Channels and Adversary

The scheme assumes a BFT committee with t < n/3 and private authenticated point-to-point channels for issuance. Its signature operations are non-interactive, and its security model counts adaptive verification and resolution decisions against an unbounded adversary.

B. Participants, Channels and Adversary

  • The committee tolerates t < n/3 Byzantine members; verifier and committee share identifiers are distinct and non-zero, while the arbiter is a virtual verifier at x0 = 0.Issuance assumes synchronous, private, authenticated point-to-point channels; signatures travel over public channels and verification is non-interactive.Source: B. Participants, Channels and Adversary · p. 3
  • Signing, aggregation, verification, issuance, and resolution require no broadcast channel; broadcast in MPC subprotocols is emulated over point-to-point channels for t < n/3.Signatures can be forwarded over public channels any number of times.Source: B. Participants, Channels and Adversary · p. 3

D. Security Model

  • Security is measured against an adaptive, malicious, computationally unbounded adversary that may corrupt up to t committee members, ω verifiers, and any subset of signers while observing honest decisions.The adversary makes at most Q verification, aggregate-verification, and resolution queries; security bounds the probability that any accepts an unacceptable signature.Source: B. Participants, Channels and Adversary · p. 3, D. Security Model · pp. 3–4

C. Syntax

  • The scheme provides stateful signing keys, individual verification, aggregation of distinct signers’ signatures on a common message, and committee-arbiter resolution.Each signing index can be used for ψ distinct messages; arbitrary messages are mapped to Fq using a collision-resistant hash.Source: C. Syntax · p. 3

A. Design Rationale

  • The security event covers strong unforgeability, non-repudiation, transferability, and sound dispute resolution; the design meets the associated risks with secret per-verifier functionals, random signing matrices, and committee-generated keys.Public linear reconstruction can permit forgery, shared verification secrets let verifiers forge, and signer-dealt keys can be inconsistent.Source: D. Security Model · p. 4, A. Design Rationale · p. 5

B. Ideal Key Issuance

Ideal key issuance gives each verifier an evaluation of a secret bivariate polynomial at its public identifier, while the signer does not learn that polynomial. Signatures and aggregates are checked linearly, and resolution uses a fresh mask to avoid exposing the arbiter key.

B. Ideal Key Issuance

  • Verifier keys are evaluations of F_U,k at public identifiers; the signer knows A_U,k but not F_U,k, preventing it from tailoring signatures to selected verifiers.The polynomial has degree ω in x and ψ in z; its relation to the signer’s key is hidden by the secret anchors.Source: B. Ideal Key Issuance · p. 5

C. Signing, Verification, Aggregation and Resolution

  • Valid signatures and aggregates are accepted by every verifier and Resolve, with aggregate verification following from linearity.Resolve tests a masked residual using a fresh non-zero mask; reusing a mask across non-zero residuals would reveal their ratio.Source: C. Signing, Verification, Aggregation… · pp. 5–6

D. Parameters and Costs

  • With q = 2^255 − 19, ω = 10, ψ = 16, and a one-hour epoch of 3600 blocks, each validator stores 3.7 MiB of verifier keys and 1.3 MiB of signing keys.The passage also gives a core authentication bound below 2^-189 under its stated Q and epoch choices; MAC, decoder, and redistribution terms are separate.Source: D. Parameters and Costs · p. 6
  • For hashed long messages, security additionally assumes collision resistance of the hash-to-field map; the guarantee is information-theoretic only for the injective encoding described.An unbounded adversary choosing hashed messages can find collisions; the injective encoding permits only one distinct message per index, with costs scaling in its encoding dimension.Source: D. Parameters and Costs · p. 6
  • A signing index is limited to ψ distinct messages; exceeding that limit reveals that index’s key, with damage confined to that index and the misbehaving signer.The ledger uses a counter to select indices, and signing different messages for the same consensus slot is equivocation.Source: D. Parameters and Costs · p. 6

V. SECURITY ANALYSIS

SILMARILS-MV is perfectly correct and bounds forgery or invalid acceptance by unbounded adversaries making at most Q verification-related queries, even when they corrupt up to ω verifiers and any signers. Its proof reduces each query to a 1/q bad-event bound, with an additional term for singular anchors.

A. Main Theorem

  • Q/q + 1/(q −1) bounds the probability of Bad while preserving perfect correctness against unbounded adversaries corrupting up to ω verifiers and arbitrary signers.The bound covers at most Q verification, aggregate-verification, and resolution queries.Source: A. Main Theorem · p. 6
  • The 1/(q −1) term bounds singular anchors and is paid once per anchor matrix, not once per query.Across E independently anchored epochs, the bound uses total queries and an epoch-level singularity term; only epochs with decisions count.Source: A. Main Theorem · pp. 6–8
  • The proof replaces verification answers with ideal acceptability bits, obtains a uniform affine-subspace posterior over secrets, then bounds each query using an explicit shift.The shifts act in the anchor matrix or a signing matrix.Source: A. Main Theorem · pp. 6–7
  • The proof needs no computational assumption, random oracle, or rewinding, and remains valid for unbounded query strategies.The verifier-key span condition used in the proof holds deterministically.Source: §V · p. 6, A. Main Theorem · p. 7
  • The distributed protocol retains uniform anchors because implementing invertible-anchor sampling would require an additional secure test, retries, and leakage analysis.The authors therefore keep the 1/(q −1) term in their bound.Source: A. Main Theorem · pp. 6, 8

B. Consequences

The security bound yields strong unforgeability, non-repudiation, unbounded-hop transferability, and information-theoretic aggregation. A three-party simulation-based guarantee is stated under classical hypotheses, while its quantum extension remains conditional.

B. Consequences

  • Except with probability Q/q + 1/(q −1), honest verifiers reject forged honest-signer signatures, modified genuine signatures, and invalid signatures from dishonest signers.Resolve upholds any signature accepted by an honest verifier, preventing the signer from repudiating it.Source: B. Consequences · p. 8
  • A valid signature remains acceptable at every honest verifier across unbounded hops; later checks of the same object add nothing to the bound.Transferability does not cover unboundedly many fresh verification attempts, which Theorem 1 charges at 1/q each.Source: B. Consequences · p. 8
  • Except with probability Q/q + 1/(q −1), an accepted aggregate contains valid signatures from every honest signer listed, and its signature is their sum.Rogue-key attacks do not apply because participants do not choose their own keys.Source: B. Consequences · p. 8
  • Under the stated three-party classical hypotheses, the non-interactive protocol implements the signature functionality with error at most 2ε, where ε ≤ 1/q + 1/(q −1).The quantum simulation-based claim is conditional on the quantum characterization's hypotheses; no claim is made for entangled auxiliary inputs or a particular composable quantum framework.Source: B. Consequences · p. 8
  • The game-based security properties hold against quantum adversaries interacting classically, but simulation-based quantum security needs a separate conditional argument.For long messages hashed into Fq, collision resistance is an additional assumption.Source: B. Consequences · pp. 8–9

C. Tightness

Proposition 2 makes the security boundaries explicit: its leading Q/q forgery term is tight, and the verifier-collusion and per-index capacity thresholds are exact. The paper also realizes dealer-free key issuance through perfectly secure committee MPC for t < n/3.

C. Tightness

  • For Q ≤ q queries on a fixed unsigned message, success is at least (Q/q)(1−1/q)(1−1/(q−1)), so the leading Q/q term is tight; ω+1 colluding verifiers recover Γ, ψ+1 distinct-message signatures under one index enable probability-1 forgery, and for a first query with invalid α each honest verifier accepts with probability exactly 1/q.The tightness result concerns the leading term, not necessarily the whole Q/q + 1/(q−1) bound for every parameter set.Source: C. Tightness · p. 9

VI. DEALER-FREE DISTRIBUTED KEY ISSUANCE

  • Dealer-free ΠDKI computes FKI outputs with multiplicative work independent of verifier count, while Γ, MU,k, and the arbiter’s key remain unopened.The construction uses the virtual anchors held in shares by the committee.Source: §VI · p. 9, B. The Protocol · p. 9

A. Building Blocks

  • Degree-t Shamir sharings and perfectly secure subprotocols support random sharing, inner products, and private openings for t < n/3.Linear combinations with public coefficients are local; an inner product costs one degree reduction, equivalent to one multiplication’s communication.Source: A. Building Blocks · p. 9

B. The Protocol

  • ΠDKI securely computes FKI with perfect security and guaranteed output delivery against static malicious corruption of at most t < n/3 committee members.The theorem allows any set of signers and verifiers and assumes synchronous private channels; the core scheme’s security bounds carry over unchanged.Source: B. The Protocol · p. 9

C. Communication Cost

The communication analysis distinguishes exact circuit counts and validated semi-honest costs from an estimate of malicious communication. The deployment uses epochs and per-message index streams to support BFT votes and aggregated quorum certificates.

C. Communication Cost

  • (ω + 1)(ψ + 1) multiplications per index and none per verifier are exact; malicious communication is only estimated because Eq. (3) omits security and operational overheads.Semi-honest simulation matched Eq. (3) within 0.4%, including 908 elements per index at n = 7, ω = 2, ψ = 4.Source: C. Communication Cost · p. 10
  • Virtual anchors use (ω + 1)(ψ + 1) rather than ν(ψ + 1) multiplications per index; with ν = n = 3t + 1 and ω = t, the naive alternative costs a factor (3t + 1)/(t + 1) more.Measured total per-index costs for the anchored scheme were 1.5×, 1.65×, and 1.72× higher for n = 4, 7, and 10, respectively, at ψ = 4.Source: C. Communication Cost · p. 10

B. Message Format, Slots and Index Streams

  • Each validator’s separate message-type stream assigns index k = ⌊j/ψ⌋ to its j-th signature, limiting each index to ψ distinct messages; exhaustion can delay but not compromise safety.Epoch headroom and top-up issuance address streams nearing exhaustion; extra view-change rounds consume capacity.Source: B. Message Format, Slots and Index… · pp. 10–11

A. Epochs and Key Refresh

  • Key issuance for the next epoch runs offline; fresh Γ and A isolate later epochs, while compromised verifier credentials across an epoch all count toward ω.Epochs are provisioned for expected activity plus headroom, and arbiter shares are retained for a dispute window and redistributed to new committees.Source: A. Epochs and Key Refresh · p. 10, Figure 3 · p. 11

C. Votes and Aggregated Quorum Certificates

  • Each QC aggregates votes from |S| = 2t + 1; replicas run AggVerify in ω + 1 + |S|(ψ + 1) multiplications, with explicit indices for independently advancing validator streams.Accepted QCs certify that every honest signer in S voted for M, except with probability Q/q + 1/(q − 1), plus collision resistance of H.Source: C. Votes and Aggregated Quorum… · p. 11

D. Transactions and Relays

SILMARILS-MV supports non-interactive transaction relay, accountability, external verification, and scalable committee certificates. Threshold notarization (TN) reduces certificate size and separates committee decisions from individual-vote attribution.

D. Transactions and Relays

  • Clients sign transactions once for relay through untrusted mempools, and every validator verifies them without interaction or a bound on relay hops.For large committees, clients can instead use arbiter-verified keys and 32-byte signatures checked once per block.Source: D. Transactions and Relays · p. 11

E. Accountability and Slashing

  • Equivocation evidence is accepted with probability 1, while evidence against an honest signer is bounded by Q/q + 1/(q−1) + AdvCR_H.With the purely information-theoretic encoding, the collision-advantage term vanishes; accountability can reveal a signing key on the guilty signer's single index if its capacity is exceeded.Source: E. Accountability and Slashing · p. 11

F. Light Clients and External Auditors

  • External parties without verifier keys can query Resolve, enroll as verifiers, or use TN certificates designed for auditors and light clients.Enrolled auditors count toward ω; TN offers constant-size certificates, microsecond-scale verification, and a collusion bound independent of n.Source: F. Light Clients and External Auditors · p. 11

G. Choosing a Mode

  • Large committees can use pairwise information-theoretic MACs for consensus, TN certificates for external verifiers, and arbiter-verified client keys; accountable TN adds commit votes when slashing is needed.Small committees can instead use IV mode for individually attributable, aggregatable votes.Source: G. Choosing a Mode · p. 12

A. Where the Quadratic Cost Comes From

  • Θ(n2) field elements per validator per block limit individual-vote mode to committees of a few dozen validators; TN removes this growth by making the committee itself the signer.TN uses a single (ω + 1)-vector certificate and lets external verifiers set ω independently of n.Source: A. Where the Quadratic Cost Comes From · p. 12

B. Threshold Notarization

  • ω + 1 field elements suffice for a certificate at every n, while each committee member sends one share per certified slot.Each share is one matrix–vector product, the cost of a signature.Source: Figure 4 · p. 13, B. Threshold Notarization · p. 13
  • Q/q + 1/(q −1) + εagr + AdvCR bounds the probability that an honest verifier or arbiter accepts a certificate without an honest decision; accepted certificates are unique per slot and transferable across any number of hops.With injective certificate encoding, AdvCR vanishes; TN also provides robust certificate recovery under the conditions described in Theorem 4.Source: B. Threshold Notarization · p. 13

C. Arbiter-Verified Keys and Batch Arbitration

Arbiter-verified keys make the arbiter the sole verifier, allowing compact client signatures and batch checking. Fresh random weights bound the chance that a batch containing an unacceptable signature passes.

C. Arbiter-Verified Keys and Batch Arbitration

  • With ω = 0, the arbiter is the only verifier and each signature is a single field element; the committee can check a block of client signatures collectively.Checking an individual signature online costs one multiplication and one opening, plus a preprocessed non-zero mask.Source: C. Arbiter-Verified Keys and Batch… · pp. 14–15
  • (L + 1)/q bounds the probability that batch arbitration accepts a batch containing an unacceptable signature fixed before the random weight is opened.The bound includes the 1/q singular-anchor event and applies to a batch of L signatures.Source: C. Arbiter-Verified Keys and Batch… · p. 15
  • Starting batch weights at r1 does not give the stated bound; the demonstrated counterexample motivates weights beginning at r0.For a single fresh unsigned message with α = 0, the acceptance probability is 3/q−3/q2+1/q3, greater than 2/q.Source: C. Arbiter-Verified Keys and Batch… · p. 15
  • Clients carry 32-byte signatures, while the client-side key material is about 32n bytes per transaction and is the only client-side cost that grows with n.Validators collectively verify block transactions, and the block's TN certificate attests to the outcome for external parties.Source: C. Arbiter-Verified Keys and Batch… · p. 15
  • Two accepted arbiter-verified signatures on conflicting votes for one slot provide equivocation evidence and restore per-validator accountability on top of TN.The committee batch-checks validators' commit-vote signatures; this adds the cost quantified in Section IX-D.Source: C. Arbiter-Verified Keys and Batch… · p. 15

D. Open Verifier Sets

A fresh verifier identifier can be enrolled at any time, including for indices whose slots are past. Security remains bounded by the cumulative number of verifiers corrupted for an anchor matrix.

D. Open Verifier Sets

  • A verifier with a fresh identifier can be enrolled retroactively for any set of indices using local linear maps and robust openings, without multiplication.Enrollment costs (ω + 1)n field elements once per epoch for the verifier key and (ψ+1)n per index.Source: D. Open Verifier Sets · p. 15
  • The security theorems continue to hold under adaptive enrollment and corruption when at most ω verifiers have ever been corrupted for the same anchor matrix.Previously revoked credentials still count toward this cumulative bound.Source: D. Open Verifier Sets · pp. 15–16
  • Enrollment must be admission-controlled because ω + 1 colluding verifiers can forge; with a fresh anchor matrix each epoch, the bound applies cumulatively to verifiers corrupted while that epoch's state is retained.The adaptive statement covers verifier corruption only; committee corruption remains static.Source: D. Open Verifier Sets · p. 16

E. Evolving Committees and Proactive Refresh

Robust redistribution transfers shared state between committees, while epoch-boundary changes can issue fresh signing state without resharing it. The stated security guarantees are narrower than mobile-adversary security and retain specific refresh and history-verification limits.

E. Evolving Committees and Proactive Refresh

  • ΠRS redistributes secrets into degree-t′ sharings with perfect privacy against static corruption of at most t old and t′ new members, with failure probability at most tL/q.The bound is for one committee transition and L secrets.Source: E. Evolving Committees and Proactive… · p. 16
  • Epoch-boundary membership changes require no resharing of signing state when the new committee issues the next epoch with a fresh Γ; retained state alone is reshared.Refreshing with the same committee and erasing old shares is designed to require t + 1 corruptions within one epoch to forge.Source: E. Evolving Committees and Proactive… · p. 16
  • The redistribution result covers a single transition against a static adversary, not a mobile adversary; formal treatment of the latter is future work.Erasure cannot remove copies retained by corrupted members, and refreshing Γ's shares does not reset the cumulative verifier-corruption bound for issued functionals.Source: E. Evolving Committees and Proactive… · p. 17
  • Verifying history without retained secrets relies on collision resistance of the block hash and an authenticated current checkpoint, so that history step is computational.It does not replace information-theoretic verification of old certificates; only the dispute window and indices kept open for retroactive enrollment are reshared.Source: E. Evolving Committees and Proactive… · p. 17

F. Cost of Threshold Notarization

Threshold notarization keeps its per-member issuance cost bounded independently of committee size, while the microbenchmarks report faster signing and verification than the compared standardized schemes. The comparison is a resource comparison: SILMARILS-MV uses secret verifier credentials and admission-controlled verification, unlike public-verification schemes.

F. Cost of Threshold Notarization

  • One committee index costs E rc + E µc + ν(ψ + 1)n field elements, and each certified slot adds n(ω + 1) share elements per combiner.The cost model uses E = (ω + 1)(ψ + 1).Source: F. Cost of Threshold Notarization · p. 17
  • Issuance cost per member is bounded independently of n; the only growing per-member term is O(n) MAC tags for consensus messages.The simulator matches the cost formula within 0.8%.Source: F. Cost of Threshold Notarization · p. 17

B. Microbenchmarks

  • For ψ ≤16, verification stays near or below one microsecond up to ω = 33, while signing costs (ω + 1)(ψ + 1) multiplications.With ψ = 1, signing takes a few hundred nanoseconds; larger ψ trades signing time for fewer indices and smaller verifier storage per signature.Source: B. Microbenchmarks · p. 17
  • Verification is 22× faster than ML-DSA-44 and 27× faster than Falcon-512; signing is 22× and 53× faster, respectively.SILMARILS-MV requires 34 B of secret verifier key material per future signature, issued offline; standardized schemes support unrestricted public verification, so this is a resource comparison, not functional equivalence.Source: B. Microbenchmarks · p. 17, A. Setup · p. 17

C. Ledger-Level Evaluation

The evaluations compare ledger authentication costs across individual-vote and threshold-notarization modes, then measure throughput and cryptographic CPU in a HotStuff prototype. Threshold notarization scales to 1000 validators in the analytic model, while the prototype reports higher throughput and lower cryptographic CPU for SILMARILS-MV than for ML-DSA-44.

C. Ledger-Level Evaluation

  • At n = 31, an aggregated SILMARILS-MV QC is 440 B, versus 49.6 KiB for ML-DSA-44, 13.7 KiB for Falcon-512, and 1.3 KiB for Ed25519.The aggregated QC contains a 352 B vector, a 4 B bitmap, and 84 B of signer indices.Source: C. Ledger-Level Evaluation · p. 18, Figure 5 · p. 19
  • With aggregation at n = 31, the leader sends 23.3 KiB per block versus 1.52 MiB for ML-DSA-44 and 429 KiB for Falcon-512.The comparison is against non-aggregated post-quantum QCs.Source: C. Ledger-Level Evaluation · p. 18, Figure 5 · p. 19
  • At n = 31, dealer-free ΠDKI costs 164 KiB versus 53 KiB per validator per block for ML-DSA-44 under the malicious estimate, or 118 KiB under the semi-honest model.The malicious estimate omits fault-detection and broadcast-emulation terms.Source: C. Ledger-Level Evaluation · p. 18, Figure 5 · p. 19

D. Scalability to 1000 Validators

  • At n = 1000, threshold notarization needs 71 KiB per validator per block, 22× less than ML-DSA-44 in a star topology.The estimate includes 62.5 KiB of MAC tags and about 8 KiB of issuance; counting pre-shared MAC pads raises the total to 196 KiB, still 8× below ML-DSA-44.Source: D. Scalability to 1000 Validators · p. 18, Table VIII · p. 18, Figure 6 · p. 19
  • A threshold-notarization certificate is 544 B at every committee size and takes 2.4 µs for an external verifier to check, including hashing.An ML-DSA-44 QC at n = 1000 is 1.5 MiB and takes 15.5 ms to verify.Source: D. Scalability to 1000 Validators · p. 18, Table VIII · p. 18
  • An arbiter-verified client signature is 32 B, and issuing it costs each validator 0.38 KiB per transaction independently of n.The client receives about 32n bytes of key material per transaction.Source: D. Scalability to 1000 Validators · p. 19
  • In simulation, all 32 certificates per run were valid and accepted by every verifier, and a verifier enrolled after the slots passed checked every historical certificate.The measured issuance cost matched the cost formula within 0.8%; the forgery experiments support Theorem 4(i) but do not prove it.Source: D. Scalability to 1000 Validators · pp. 19–20

E. HotStuff Prototype

  • At n = 100, SILMARILS-MV IV commits 7.97 ktx/s versus 2.88 ktx/s for ML-DSA-44 in the same star topology, while using 24 µs versus 1.61 ms of cryptographic CPU per replica per block.The throughput ratio is 2.77× and ML-DSA-44 uses 67× more cryptographic CPU; the prototype's modes and setup are described in the paper.Source: E. HotStuff Prototype · p. 20, Figure 7 · p. 20

F. Empirical Validation of the Bounds

Small-field Monte Carlo experiments support the paper's attack bounds, while the discussion identifies channel, trust, and liveness conditions that constrain deployment. The conclusion presents SILMARILS-MV and threshold notarization as an information-theoretic authentication approach for large committees, with further security and implementation directions left open.

F. Empirical Validation of the Bounds

  • For Q = 1, forgery success is close to the bound 1/q + 1/(q − 1), and repudiation success matches 1/q within sampling error.The experiments support the analysis but do not prove the bounds.Source: F. Empirical Validation of the Bounds · p. 21
  • At q = 257, the Q-query attack succeeds with probability 0.0045, 0.016, and 0.066 for Q = 1, 4, and 16, respectively, supporting tightness of the leading Q/q term.The small-field experiments support the analysis but do not prove the bounds or their tightness.Source: F. Empirical Validation of the Bounds · p. 21

X. DISCUSSION AND LIMITATIONS

  • Information-theoretic issuance requires private channels; with post-quantum TLS, later breaking the key exchange could expose old keys and permit forgery for old epochs.The paper says indefinitely valid evidence should be anchored in later certificates; QKD or predistributed pads avoid this issue.Source: §X · p. 22
  • Pooling shares from t + 1 committee members can forge for that epoch; security against a mobile adversary across refreshes is not proved.The refresh design assumes no t + 1 members are corrupted within the same epoch, and erasure cannot remove copies retained by corrupted members.Source: §X · p. 22
  • Issuance guarantees output for t < n/3 in synchronous rounds; asynchronous issuance and variants for t < n/2 are outside the paper's scope.Certificate release inherits the liveness of the consensus protocol.Source: §X · p. 22

XI. CONCLUSION

  • SILMARILS-MV uses secret verifier functionals derived from unknown virtual anchors and provides strong unforgeability, non-repudiation, unbounded transferability, and linear aggregation.The stated forgery bound is Q/q + 1/(q − 1), with a tight leading term.Source: §XI · p. 22
  • At 1000 validators, threshold notarization is estimated at 71 KiB per validator per block, 22× below ML-DSA-44 in the admitted-verifier setting.The conclusion also cites arbiter-verified client keys, retroactive enrollment, and robust redistribution.Source: §XI · p. 22
  • Open directions include proving security against mobile adversaries across refreshes and integrating a MAC-based consensus engine with threshold notarization.The latter direction includes proving and testing Byzantine safety and liveness in the deployed configuration.Source: §XI · p. 22

APPENDIX A REPRODUCIBILITY

The reproducibility artifact is publicly available and includes code, simulators, attack checks, benchmark data, and the Rust HotStuff prototype.

APPENDIX A REPRODUCIBILITY

  • The public artifact contains the C core and benchmark, a reference implementation, issuance simulators, Monte Carlo attack code, and exhaustive batch-arbitration checks.The repository also includes raw results and scripts for same-host baselines.Source: Appendix A · p. 24
  • The artifact includes the threshold-notarization simulator and benchmark, scalability model, and Rust HotStuff prototype with experiment and summary scripts.The simulator covers Byzantine members, retroactive enrollment, redistribution, arbiter-key batch arbitration, and a threshold-notarization forgery experiment.Source: Appendix A · p. 24
  • The ledger model generates the paper's tables and figures from raw measurements.Source: Appendix A · p. 24
Loading 2610.31814v1…