security properties
the security of zheng rests on one cryptographic assumption — that hemera behaves as a random oracle (collision resistance for Merkle trees and digests, unpredictability for Fiat–Shamir challenges) — plus information-theoretic arguments (sumcheck, Schwartz–Zippel, Reed–Solomon proximity) whose bounds are proven. the canonical record is the soundness ledger: one row per component, with the assumption, the bits claimed, whether that number is proven or conjectured, the argument, the controlling parameter and the test. this page explains it; the ledger is the source of truth.
one assumption
hemera is Poseidon2 instantiated over the Goldilocks field. its digest is four field elements (32 bytes). the generic bounds for a 4-limb digest are:
- classical collision resistance: birthday on p^4 outputs,
p^2 ≈ 2^128. - quantum collision resistance: Brassard–Høyer–Tapp,
p^(4/3) ≈ 2^85.
these are generic bounds, and hemera's parameters are young, so the ledger lists the hash row as conjectured. two versions matter. the crate pins cyber-hemera 0.3 (0.3.1: 8 full and 16 partial rounds, the inverse S-box in the partial rounds); every gadget, constraint count and measurement in zheng today runs it. the frozen material is hemera 0.4 (hemera#15: x⁷ in every round, 6 + 6 full and 48 partial rounds, frozen 2026-10-16), under a public cryptanalysis campaign; zheng moves to it in PR #69/#73, which wait on one owner decision about the 64 KiB gate of profile 6 (PR #78 against #79). both keep the 32-byte digest; Merkle nodes inside proofs stay 32 bytes.
zheng uses hemera for Merkle trees over Reed–Solomon codewords (the commitment), for Fiat–Shamir challenge derivation, for verifying-key digests and for salted leaves in the zk profile.
there are no elliptic curves. no discrete logarithm assumptions. no bilinear pairings. no structured reference strings generated by ceremonies. the cryptographic surface is one hash function over one field.
post-quantum security
pairing-based proof systems (Groth16, PLONK) rely on the hardness of discrete logarithms, which Shor's algorithm breaks. zheng faces only generic quantum speed-ups: Grover for preimages and BHT for collisions. for a 32-byte hemera digest that leaves about 85 bits of quantum collision resistance — enough for the soundness of a proof that is checked once, and the reason longer digests are proposed for identities that must last.
challenges in the extension field
a challenge in Goldilocks alone (p ≈ 2^64) gives a sumcheck round an
error of about d/2^64, far from 128 bits: the Spartan IOP over
Goldilocks challenges reaches only 2^-56.2 at 2^20 rows (ledger,
informational row). so every challenge and evaluation point of a
production profile is drawn from the cubic extension Fp3, with
p³ ≈ 2^192. the transcript squeezes each limb from 192 bits of hemera
output and reduces it, so every limb is within 2^-128 of uniform.
at the measured sizes the Spartan IOP over Fp3 contributes about
2^-185 (116/p³ at hash.tri, 226/p³ at 2^20 rows): the
IOP is never the weak link.
the profiles
| profile | soundness | set by |
|---|---|---|
| public v3 / state-public v3 | error 0 for the compiled relation: the verifier checks every row of a disclosed witness | the relation compiler (tested, conjectured) |
| succinct (Spartan + WHIR at rate 1/64; the policy admits only parameter sets proven ≥ 128 bits) | ≥ 128 proven bits interactive, grinding counted | the WHIR opening, proven up to the Johnson bound |
| zk "veil" | 128.2 proven bits; honest-verifier statistical zero knowledge, zero knowledge in the random-oracle model after Fiat–Shamir | the hiding opening |
| private MPC-in-the-head (fallback) | 128.1 bits, 219 repetitions | ZKBoo 3-special soundness |
| machine, IVC, wrapped (profiles 4–6) | every per-step reduction ≥ 128 proven bits with grinding | the zerocheck, memory, accumulation, decider and field-native WHIR rows; the composition is conjectured (below) |
Fiat–Shamir soundness
each interactive component is round-by-round sound with per-round error
at most 2^-128 (grinding included). by the round-by-round theorem
(Canetti et al., 2019) the non-interactive proof is then sound in the
random-oracle model: a prover making Q hemera queries succeeds with
probability at most about Q · 2^-128, plus the probability of a hemera
collision in a Merkle tree. "128 bits" in the ledger is this interactive
bound; the non-interactive guarantee degrades by the prover's query
budget, as for every hash-based proof system.
what is not yet proven
- the relation compiler (nox program → CCS) and the nox machine relation are differentially tested against native nox and their malleability analysed, but not proven.
- hemera's concrete security beyond the generic bounds, and with it the binding of a program by its digest (profiles 4–6).
- the composition of IVC and of the wrap levels: knowledge soundness of a recursively composed Fiat–Shamir argument whose random oracle runs inside the relation has no proof in the random-oracle model — the heuristic every deployed recursive system rests on.
- the recursion circuit's agreement with the native verifier is tested, not proven.
the release gate of the repair fails on any conjectured row in a production profile; these rows are why that gate is not yet passed.
the concentration of trust
the single-hash design is simultaneously the greatest strength and the most concentrated risk. auditing zheng's cryptography means auditing hemera. if hemera breaks — a practical algebraic attack on Poseidon2 over Goldilocks finding collisions faster than the birthday bound — the Merkle commitments, the Fiat–Shamir challenges and the zk profile's hiding fail together.
this is why the security analysis of hemera matters more than anything else in the stack. its algebraic analysis lives in the hemera documentation; zheng inherits whatever security hemera provides.