Signatureless authorization binds knowledge of a reusable authority secret to a canonical request through a freshly randomized proof capsule. The public statement contains a request identifier and a 32-byte authority commitment. A binary-field construction combines a masked degree-ten authority reduction with a bank-and-companion code proof. The paper proves source restoration, adaptive simulation and a native quantum fresh-intent security reduction in an address-compatible random-completion model with explicit finite orbit-profile and resource conditions. The combined simulation and extraction loss is below 2⁻⁶⁷ at up to 2²⁴ charged native calls. Recursive composition enforces the selected capsules' equations under exact arithmetic, complete coverage and authenticated statement and transcript bindings. Parano1d supplies the implementation. Four-thread reference measurements give 0.81–0.89 seconds proving and approximately 25.6 milliseconds native verification. The paper and reproducibility artifact accompany the results.
Authority inside a proof of execution
Digital signatures authorize payments, commands and service requests. Shor's quantum algorithm threatens widely used schemes based on factoring and discrete logarithms. Their post-quantum replacements bring different assumptions, key sizes, signature sizes and verification costs. Applications that prove execution must also express that verification inside their proof arithmetic.
Post-Quantum Signatureless Authorization develops a direct construction: an authority publishes a commitment to a reusable secret, then proves knowledge of that secret for each requested action. Fresh randomness protects repeated use. The request and required authority enter the proof transcript together.
The paper establishes algebraic reduction, masking, source restoration, a native quantum chosen-request security reduction and bindings for recursive verification. Its implementation in Parano1d supplies the executable verifier and measurements. The interface also applies to standalone requests with application-defined context, policy and freshness rules.
A reusable secret and a canonical request
Let s be the authority secret, a its public authority commitment and I the canonical intent. The public statement is:
The prover establishes knowledge of a secret satisfying Addr(s) = a. The authority commitment occupies 32 bytes. The intent identifier and commitment both enter the transcript before its proof challenges. Changing either changes the statement the verifier checks.
The intent fixes the application domain, operation, context, action data and execution constraints. The adapter derives the required authority from the checked intent and policy. A service request can bind its audience, parameters and nonce. A device command can bind its target, counter and validity interval. An artifact approval can bind a digest and permitted use.
Execution consumes the applicable nonce, counter or resource reference. This makes freshness an explicit property of the application state. Each authorization attempt samples independent fresh prover randomness, including attempts later abandoned by the client.
| Operation | Responsibility |
|---|---|
Statement(I, context) | Validate intent and authority context, then derive the public statement. |
Authorize(s, x) | Use the authority secret and fresh randomness to produce a capsule. |
CheckAuth(x, capsule) | Check canonical shape, transcript, reduction and code openings. |
Execute(I, state, context) | Check policy, resources and freshness, then produce the permitted successor state. |
For fixed intent, authority and authenticated parameters, capsule verification is independent of public execution state. An execution prover can update the public witness within the intent's constraints while retaining the same capsule. The application checks that the resulting transition satisfies those constraints.
The binary-field construction
The construction uses the subfield GF(2128) embedded in GF(2256). A width-four Poseidon2b circuit maps two secret field elements and two fixed capacity elements to the public authority commitment. Its witness records the initial linear layer, 66 nonlinear rounds and the required input and output boundaries.
A masked degree-ten reduction converts that authority trace into eleven linear claims over a 2,048-cell source bank. Paired terminal pads, a separable Libra mask and dedicated source randomness give the required masking ranks. An independently randomized companion bank supports the linked evaluation proof.
The subfield carries the trace and independent bank randomness. Extension-field challenges supply the masking maps and a challenge support of size 2255. The code argument uses affine Reed–Solomon evaluations and 65 code queries to authenticate the claims. Transcript order fixes each message before the challenge that constrains it.
Each attempt samples 1,536 fresh base-field bank cells and 2,048 fresh extension-field companion cells from operating-system entropy. Exact masking ranks and constant fibers support adaptive simulation across repeated authorizations.
Finite-list source restoration reconnects accepted code openings to the committed bank. The resulting public-coin extractor runs in expected polynomial time, with error at most:
The algebraic argument handles adaptive prover messages. Together, the bank relation and restored source identify secret input lanes satisfying the fixed authority circuit's address equation.
The quantum chosen-request model
The security game gives an adversary the authority commitment and an interface for requesting proofs on adaptively chosen intents. It wins by producing an accepted capsule for a fresh intent under the same authority.
The native theorem fixes the public authority circuit P₀ and its address input slice. The oracle permutation agrees with P₀ on that slice and is sampled as a uniform permutation completion elsewhere. One shared permutation supplies native transcript and commitment operations.
The adversary has quantum workspace and coherent forward and inverse permutation access. Authorization requests, responses and the final forgery are classical. Source, middle and duplex capacity roots are distinct and lie outside the address slice.
The fixed slice has explicit finite orbit-profile conditions. At the maximum authentication height of ten, these are:
These quantities bound inverse orbit fibers, short returns and shifted orbit intersections. The model also fixes resource envelopes for sampling and compressed-oracle analysis. In the sampled ideal-slice setup, the finite-profile setup-failure term is included once in the extraction loss.
The authorization security reduction
Under the finite-profile and resource conditions, with independent fresh prover randomness, the paper proves:
The preimage term measures recovery of a secret for a sampled authority commitment under the same public primitive data and oracle interfaces. The simulation term measures the loss when an adaptive witness-free simulator answers authorization requests. The extraction term measures the loss of recovering a source witness from a successful fresh forgery in that same programmed quantum experiment. The intent-binding term covers canonical semantic encoding and the identifier's binding to a fresh request.
Simulation and extraction share one compressed base state and its classical input-relabeling table. The native extraction argument preserves all thirty response groups and the causal source snapshots through later requests, verification and recording rechecks.
| Charged native-call budget | Combined loss |
|---|---|
| T ≤ 224 | Below 2−67 |
| T ≤ 232 | Below 2−41 |
The budget includes constructors, inverse calls, verification, recording rechecks and nonce-search work. The total forgery bound also includes the preimage and intent-binding terms. For the ideal 256-bit authority-preimage task, constant-success generic quantum search has query scale 2128.
Applying the result to a selected primitive fixes the corresponding authority-preimage and canonical-intent conditions. The paper states the address-compatible random-completion model and its finite slice profiles explicitly, so the claimed reduction and its concrete losses have a precise scope.
Recursive verification
The implemented recursive verifier checks the capsule in compatible binary-field arithmetic. Shared values connect the authority reduction, post-claim relation and linked evaluation proof. Statement pins fix the request and authority. Authenticated transcript and hash regions fix the challenge derivation and commitment openings.
The recursive composition proposition establishes that a satisfying recursive witness enforces every selected capsule's native equations under exact arithmetic, complete tile coverage and canonical statement and capsule bindings. The included execution predicates enforce the intent's state and policy constraints. The enclosing recursive proof system supplies its soundness and authenticated boundary.
The wrapped verifier tile contributes 16,536 incremental rows. Of these, 1,852 cover the authority reduction, post-claim relation and Phase A. Shared hash regions and execution predicates are accounted for in the enclosing relation.
In Parano1d, the wallet produces the capsule and the block prover supplies the public execution witness. Payment adapters bind ordered pages, fees, input incarnations and outputs. Execution consumes those exact incarnations and creates fresh slots. Asset and trade adapters bind their corresponding operations, funding and settlement constraints.
Implementation and measured costs
The reference measurements use an Intel Core i7-1365U, Linux x86-64, Rust 1.96.0 and four Rayon threads. Each fixture has one warmup and five fresh proofs. Each proof is verified three times. Verification statistics are medians of per-proof medians.
| Request fixture | Median proving | Median verification | Observed capsule bytes |
|---|---|---|---|
| Payment: 1 input, 1 output | 893.8 ms | 25.59 ms | 88,760–90,168 |
| Consolidation: 8 inputs, 2 outputs | 814.1 ms | 25.60 ms | 88,888–90,104 |
The maximum canonical capsule size is 92,696 bytes. Proving includes the address trace, fresh entropy, source commitment, proof generation, nonce search and self-verification. The separate verification timer begins after serialization and decoding.
All five sampled proofs in each fixture have distinct encodings. Verification rejects the tested request mutation, which increases the fee and decreases the first output amount by one. It also rejects adding one extension-field unit to the final mask value. The archived measurements include the raw samples and exact environment.
An application-defined authority interface
The same request-bound statement supports service requests, device commands, artifact approvals and ledger operations. Each application supplies the audience, operation, policy and freshness semantics it needs. A standalone verifier checks the capsule directly. A proof of execution checks it through the recursive interface.
This boundary lets the authority remain stable while public execution witnesses evolve within the permitted request. Safe reuse combines independent prover randomness, the proved adaptive simulation and extraction guarantees, and correct application enforcement of the canonical intent.
Paper and reproducibility artifact
The Zenodo publication, DOI 10.5281/zenodo.23778742, contains the 28-page paper and a separate reproducibility archive. The reading PDF accompanies this article.
The artifact includes manuscript sources, exact arithmetic and finite operator checks, recorded measurements, Rust reproduction programs and an authenticated production-source snapshot. Its manifest identifies the 35 production files used for the paper, together with the supporting field sampler. The README records the commands and dependencies.
From the extracted artifact, the mathematical checks run with Python 3.11 or later and the pinned NumPy dependency:
python3 -m pip install -r requirements.txt
python3 checks/run_all.pyThe checks cover finite-field counts, fixed-slice decoding, extraction examples, compressed-query identities, trusted-update bounds, the thirty-stage response inventory and numerical security losses. Separate Rust launchers reproduce the algebra and production measurements against the recorded source revision.