Directional post-quantum healing

Start with the attacker

Q1 is a computational sketch for a specific continuous-lane transition. Its attacker obtains a session-state snapshot, records traffic and can compute X25519 outputs, then becomes passive during the successful healing interval. Neither endpoint is compromised again before the challenged messages. Those assumptions are essential, not footnotes.

The injected epoch secret must be fresh and absent from compromised state. Its target KEM private key must also be generated after the snapshot or otherwise unexposed. Sending a new ciphertext to a stolen private key does not create a secret unknown to its holder.

The causal sequence

Complete_R(e) < Acked_S(e) < Mix_S(e) < Accept_R(e) = Reply_R(e)

An acknowledgement carried by the message that triggers a DH step is absorbed only after that message authenticates. It cannot authorise folding in a step whose entry state did not yet contain the committed acknowledgement. This ordering explains the extra transition in the sketch.

The root argument

The modeled root function returns a new root and directional chain key:

RK(root, ikm) = HKDF-SHA-256(salt=root, IKM=ikm,
                            info="AurisRatchet", L=64)
(new_root, chain_key) = split_32_32(RK(root, ikm))

The sketch assumes the output pair is jointly pseudorandom when a fixed-length input component is hidden, and separately assumes secret-root propagation, chain-key security, AEAD security and a sound authenticated ack/mix pipeline. Failed trial decryptions must not commit tentative state. Q1 depends on those state properties; it does not prove them all.

How this relates to cap9

The released protocol also carries periodic KEM material in protected per-run headers. The Q1 causal argument is not a complete new proof of every current lane and migration path. Simulations found the older chunked lane redundant for healing in selected modeled traffic patterns; that lane still exists in the current implementation. A simulation finding does not establish that removal shipped.

Header protection removes plaintext fields that a simple field-aware dropper could inspect. An attacker may still exploit timing, run boundaries, retained keys or broad loss. Neither encryption nor permutation proves that all selective suppression is impossible. Dropping all required traffic prevents healing altogether.

No universal recovery deadline

Traffic direction, message loss, silence and compromise timing change recovery. This page makes no claim that every conversation heals in 1.5 turns or a fixed number of messages. Signal’s ML-KEM Braid specification likewise distinguishes protocol behavior from a traffic-dependent vulnerable-message set; its analysis is not proof of Auris’s custom ratchet.

An earlier C4 gate excluded non-completing trials from its percentile calculation. The September 5 working-source revision now keeps the full denominator and requires the target fraction to complete by the deadline. That improves measurement validity; the result remains specific to the sampled model and conditions. See measurement and denominators.