Delegation, Forward Secrecy, and What's Not PQ-Safe Yet
Part VI — Gauge Encryption · seven builds, seven receipts
The five constructions in this chapter — four delegation seals, the RG-flow ratchet, and the Čech threshold layer underneath J.4 — all ship in src/ today with named tests and line-counted modules; the right way to read them is to build against them. Each experiment below produces a receipt: a passing test, a timing number, a forged-share rejection, a ratchet step you can plot.
Run it live — GQL console
Point at the public read-only instance (no key needed) or your own engine
(start it with GIGI_CORS_ORIGIN=* for browser access — dev only).
—
E17.1Reproduce the zero-decrypt round-trip on src/delegation.rs
Build
I shipped the \(\mathrm{Aff}(\mathbb{R})\) seal (J) in src/delegation.rs at lines 122–178; write a test that builds a DelegationCapability between two GaugeKeys, applies apply_to_value to a 64-field ciphertext row, and asserts Bob's de-affine pass recovers Alice's plaintext byte-for-byte.
Receipt
cargo test on a new tests/delegation_e17_1.rs passes and the assertion log shows the messenger's alpha.mul_mod(*w, q).add_mod(*beta, q) step never touched key material from either endpoint (verify by counting key references — zero on the messenger's side).
Bonus
Add a NotClosed field to the source chart and confirm build refuses with DelegationError rather than silently succeeding.
E17.2Forge a J/J collusion break and time it
Build
Theorem 4.7.1 says a colluding messenger-and-Bob recover Alice's gauge in \(O(1)\) algebra. Write a small Rust binary that, given two \((w, \alpha w + \beta)\) pairs and Bob's secret, solves the linear system and prints \((\alpha, \beta)\).
Receipt
The binary completes in under one millisecond on a single core and prints the same \((\alpha,\beta)\) that DelegationCapability::build returned in E17.1 — proving the limitation I named for J is real, fast, and exactly why J ships alongside three other seals.
Bonus
Repeat the attack against J.2 in src/pairing_delegation.rs; show that the equivalent two-pair recovery requires a discrete log in \(G_2\) rather than a \(2{\times}2\) linear solve.
E17.3Benchmark the four-seal envelope on the same payload
Build
Take a 4\,KiB ciphertext row, run it through each of the four seals (src/delegation.rs, src/pairing_delegation.rs, src/mlkem_delegation.rs, src/lattice_delegation.rs) with the common DelegationCapability envelope, and record per-call latency over 10\,000 iterations.
Receipt
A four-row table whose ratios roughly match the heuristic I gave earlier: affine in hundreds of nanoseconds, pairing in hundreds of microseconds, ML-KEM-768 encap with \(\geq\)1088-byte ciphertext check, and J.4 paying the Shamir-split-plus-five-ML-KEM-wraps tax. Publish as a CSV alongside the existing module unit tests.
Bonus
Plot the four points on a security-axis vs.\ throughput-axis chart and decide — on paper — which seal you would deploy for a 1\,kHz write channel where Bob is an HSM.
E17.4Stress the Čech cocycle on a \(3\)-of-\(5\) Shamir set
Build
Using the ShamirShare schema at src/threshold.rs:42--66, generate five shares of a 32-byte master key over \(\mathbb{F}_p\) with \(p = 2^{256}-2^{32}-977\). Then mutate one share's value field by a single byte without recomputing the auth_tag. Attempt Lagrange-at-zero reconstruction with the three-of-five quorum that includes the mutated share.
Receipt
The reconstructor rejects the share at the HMAC-SHA256 cocycle-authentication step (Theorem 6.2) before the polynomial interpolation runs; with three honest shares, \(K\) is recovered exactly. Capture both code paths in one test.
Bonus
Repeat with \(K{-}1 = 2\) honest shares only; confirm the conditional distribution of \(K\) is statistically indistinguishable from uniform over \(\mathbb{F}_p\) across \(10^{5}\) samples.
E17.5Instrument the Sprint M ratchet against a no-ratchet baseline
Build
Wire a counter that records the HKDF-chain step inside the RG-flow ratchet for every write on a \(10^{4}\)-row batch. Run the same batch with the ratchet disabled and capture per-write latency plus the six gauge-invariant scalars from src/integrity.rs (\(K\), \(\lambda_1\), capacity, \(\langle\mathrm{Hol}\rangle\), \(\beta_0\), \(\beta_1\)) at the start and end of each batch.
Receipt
A two-column timing CSV plus a passing assertion that the six scalars at the end of the ratcheted batch still satisfy the Hadamard non-vacuity certificate \(\kappa_{\mathrm{soft}} - 2R^{*}\varepsilon(L^{*}) > 0\) that I named. The ratchet must advance the gauge without tearing the certificate.
Bonus
Compromise the post-batch key material and confirm that no offline replay of the captured wire bytes recovers earlier-write plaintext — the river has the wax.
E17.6Refute a forged ML-KEM envelope at the size gate
Build
The decap path in src/mlkem_delegation.rs rejects any KEM ciphertext that is not exactly 1088 bytes. Construct three malformed envelopes — one short, one long, one exactly 1088 bytes but bit-flipped — and feed them to the decap entry point.
Receipt
The short and long envelopes return the size-gate error before the AEAD runs; the bit-flipped envelope fails authentication inside AES-256-GCM-SIV. Three distinct error variants, no plaintext leaks in any path.
Bonus
Add a fuzz harness over the envelope shape and let it run overnight against the 315-line module; report any input that produces a non-error return without valid plaintext.
E17.7Wire the holonomy ledger to witness a delegation chain
Build
Construct a three-link delegation chain across three charts using any combination of J/J.2/J.3/J.4. Telescope-sum the per-link holonomy deltas into the ledger using the test pattern at tests/ledger_v0_3.rs:111, and emit the resulting six-scalar passport.
Receipt
The passport at the end of the chain matches the passport you would have computed had Alice written directly to the final recipient — \(H_n = H_0 + \sum \delta_i\) (Theorem 5.2) holds across the delegated path, witnessed by a Merkle leaf rather than by self-attestation.
Bonus
Introduce a malicious link that fails the Čech triple-overlap coherence; show the ledger refuses to commit the resulting leaf rather than silently absorbing the inconsistency.
% End of Part VI