Poseidon2b Is Secure!

“Poseidon2b is secure” is deliberately an incomplete sentence.

A hash-family name is not a security claim. The claim begins only after fixing the field, state width, rate, capacity, digest width, S-box, round schedule, linear layers, operation mode and attack model. Change one of them and the object under analysis changes with it.

The statement examined here is narrower and testable:

The current published algebraic attacks do not break the exact Poseidon2b instance used by Parano1d.

That is not a promise that no better attack can exist. It is a correspondence between one production implementation and the best relevant published cryptanalysis currently available.

Fix the instance first

Parano1d uses a width-four Poseidon2b permutation over a binary extension field. The production tuple is:

The matrices matter as much as the tuple. At width four, the binary M4 matrix is the complete external MDS layer. The internal layer is the fixed diagonal-plus-ones construction from the production source. Merkle nodes use two-to-one feed-forward compression, not a generic sponge call.

For children $a=(a_0,a_1)$ and $b=(b_0,b_1)$, the node input is

and the output is the first two lanes of $P(x)+x$:

The fixed capacity tag is an affine shift. It does not turn this construction into one of the wide sponge instances from a different attack table.

What the Skipping Class paper actually reaches

Merz and Rodríguez García introduced improved algebraic attacks against Poseidon2 and Poseidon2b in ePrint 2026/306. The result is real. Its scope is also precise.

The paper's main round-skipping family exploits the tensor structure of wide, non-MDS external matrices. Section 3.4 applies that construction to widths $t\in\{12,16,20,24\}$. It does not include $t=4$. In the production instance, M4 is not a repeated sub-block inside that wide construction. It is the entire external MDS layer.

The often repeated $2^{106}$ improvement is not a result for this configuration either. It belongs to the binary sponge parameter set

Transferring that number to a width-four feed-forward compressor discards the very parameters on which the attack depends.

The part that does apply

Ignoring an inapplicable headline attack would be easy. It would also be incomplete. Appendix A of the same paper analyzes MDS two-to-one feed-forward compression, which is exactly the operation mode used by the production Merkle construction.

For $t=4$ and $\alpha=7$, the Appendix A round skip is

Specializing Theorem 5.1 with digest width $d=2$, one skipped full round and no skipped partial round gives

Using the paper's quadratic Gröbner-basis work projection, $\omega=2$, gives

Adaptive matrices attack a different instance

Slipway and Midpoint Reset both construct weak Poseidon parameter sets by selecting an MDS matrix after the round constants are known. Slipway steers a constrained input family through the initial full rounds and into a finite subspace trail. Midpoint Reset uses the same adaptive freedom to construct a full-round collision.

These are useful warnings for anyone generating custom parameters. Matrix checks alone do not prove that a matrix was selected independently of the constants.

They are not attacks on the fixed production instance here. The two production matrices and the complete constant schedule are already part of the pinned permutation. An attacker does not get to replace either matrix. Midpoint Reset also works over an odd-characteristic prime field, while production uses GF(2^128). Neither paper supplies a collision, witness or attack cost for the fixed matrices used by Parano1d.

At width four, S-box skipping skips nothing new

From Round Skipping to S-Box Skipping introduces generalized subspace restriction for the ordinary Poseidon CICO-$k$ model. Its new partial-layer gain is $t-2k$ skipped S-boxes.

The closest geometry to the two constrained production output lanes is CICO-2. At width four,

The paper also models ordinary CICO output constraints rather than the left-input feed-forward equations. It therefore adds no new skipped partial round and no cheaper projection for this compressor. The applicable Appendix A result above remains the relevant round-skip calculation.

Nonlinear subspaces do reach the fixed matrix

Beyond Linear Subspace Trails cannot be dismissed by pointing to a different width or an adaptive matrix. Its compression-mode construction can be specialized to the exact production geometry.

For a digest of two field elements, the available constraint budget is

One S-box is active in each partial round. A linear subspace therefore covers two partial rounds, while the new nonlinear construction covers four. The paper requires a concrete rank check before that longer trail may be used. Partitioning the production internal matrix into $A,B,C,D$ gives

Evaluated in the actual production field, the one-by-one core is

The rank condition holds. The four-round nonlinear trail exists for this exact internal matrix, but it still covers only four of 58 partial rounds.

I then evaluated all four applicable Macaulay models with the production round schedule and the paper's $\omega=2$ projection:

At width four, the extra variables introduced by substitution cost more than the longer nonlinear trail saves. The lowest projection in this family is the no-substitution linear model. It is still far above the $409.873818620410$-bit feed-forward projection from ePrint 2026/306, so the earlier result remains the stronger applicable attack model.

Why Poseidon2b is there at all

The obvious question is why a binary-field system uses Poseidon2b instead of Keccak, SHA-256 or BLAKE2.

Parano1d is not optimizing one isolated prover benchmark. It is a prove-once, verify-everywhere network. A miner constructs one recursive HistoryStep for a block. Every full node verifies it before accepting the block, and the same verification path matters when a new node authenticates current State during synchronization.

The reference Binius implementation benchmark exposes that tradeoff. On its AMD Ryzen 9 7900X setup, Keccak-f proves faster in the listed multithreaded workload and produces a smaller proof, while Poseidon2b at n=128, t=4 verifies much faster:

This is an implementation benchmark, not a theorem that Poseidon2b beats every possible Keccak or SHA circuit. It measures complete circuits inside one Binius stack. Implementation quality and arithmetization are part of the measurement.

They are also part of the engineering decision. The width-four state consumes two 256-bit Merkle children and returns one 256-bit digest in one permutation. PCS values and Fiat–Shamir challenges already live on 128-bit binary-field lanes, so recursive verification stays in the same arithmetic. Keccak remains a legitimate alternative. BLAKE2's ARX additions are less attractive because they introduce carry logic into a binary-field proof.

The choice is not “Poseidon is fashionable.” It is that this exact permutation, in this exact arithmetization, fits the operation that the recursive verifier repeatedly performs.

Make the correspondence executable

A prose audit can silently become stale. The executable cryptanalysis correspondence therefore reads the pinned production profile before evaluating both applicable model families.

It pins:

• field width, state width, rate and digest width;
• S-box exponent and complete round schedule;
• external and internal linear matrices;
• the two-to-one feed-forward Merkle mode;
• every reviewed paper revision and PDF digest.

Change any of those inputs and the old audit fails instead of continuing to display the old conclusion beside a new primitive. The derivation is recorded in the Category 1 soundness document, with the complete paper-by-paper review and the matching production implementation pinned to the same source revision.

The claim

I am not claiming that the word “Poseidon” is a proof of security. I am not turning $2^{409.87}$ into an invented security level. I am not claiming that a better cryptanalysis can never be found.

I am claiming something narrower:

The current published algebraic attacks do not break the exact Poseidon2b instance.

The parameters, matrices, mode, derivation and executable checks are public. A source-pinned open cryptanalysis task accepts a cheaper attack, a production-reachable collision or preimage, or an error in the correspondence.

Do not attack a family name.

Attack the exact instance.