hemera cryptanalysis campaign

gate G3 of soft3/proposals/privacy-frozen.md §5: hemera is the one material consensus rests on — proof of work, block and transaction Merkle trees, particles, commitments, nullifiers and every zheng transcript. the privacy pool switches on only after a public cryptanalysis campaign has run at least 90 days with no result that lowers hemera below 128 bits classical (§6 of that page, condition 3). this page is the campaign: the exact object, the claims, the attack map with margins computed for both candidate profiles, the bounty, the review plan, the pass criterion and the results log. the reproducible tools are in audit/campaign/.

written 2026-10-16 against hemera main at d5f0a09 (crate cyber-hemera 0.3.1; outputs bit-identical to 23f3bbc, the revision pinned by soft3/release/phase1.toml for the 2026-11-05 root chain).

0. the decision that comes first

two profiles are on the table and the campaign can only measure one.

• 0.3 — shipped: x⁷ full rounds 4 + 4, x⁻¹ partial rounds 16. it is what main computes, what the phase-1 chain spec pins and what every vector in vectors/hemera.json encodes.
• v2 — proposed in hemera#15 (roadmap/profile-v2.md, open): x⁷ in every round, full rounds 6 + 6, partial rounds 48, Poseidon2 reference linear layers, digest 6 limbs at t = 16 (or t = 24 with 8 limbs). one profile, no second round count: roadmap/one-pure-hash.md §4 (in #15) and the one-profile paragraph of cyber/whitepaper.md §4.4.

§3 computes the margins of both side by side. the result is lopsided. the 0.3 profile fails the interpolation inequality of the Poseidon2 design rules once the inverse is counted by its rational degree (it would need 51 inverse partial rounds at R_F = 8, it has 16), its one-variable CICO problem has a rational degree of 2^38.46 — below the field size — and the attack that follows from that degree was run here: with both outer layers reduced to one full round and all sixteen inverse rounds kept, a CICO-1 solution was found and checked against the concrete permutation in 92 seconds on one core (§3.2). the full-round instance extrapolates to well under the generic cost. no published bound covers the hybrid S-box, so none of the Poseidon2 literature transfers to it. the v2 profile clears every Poseidon2 inequality with large slack (at R_F = 12 the inequalities need R_P ≥ 14; v2 has 48) and sits inside the instance family that the public literature and the Ethereum Foundation bounty measure.

recommendation. freeze the hemera#15 permutation — x⁷ in every round, R_F 6 + 6, R_P 48, Poseidon2 reference matrices, self-bootstrapped constants that pass the Poseidon2 matrix and subspace checks — before genesis, and point the campaign at it. the reasoning in one line each: the 0.3 profile's only argument (degree p − 2 per inverse round) is withdrawn by the repo's own research and refuted here by a measured attack on its partial layer; the hybrid S-box puts hemera outside every published bound and every bounty, so ninety days of public silence about it would measure only how few people looked; v2 keeps native throughput (~2 304 against ~2 224 multiplications per permutation) and pays only in-circuit (+76 % S-box constraints per permutation), a cost the roadmap shrinks; and rounds are the one parameter that cannot be raised after genesis without rehashing the graph. the digest length (4, 6 or 8 limbs) is a separate parameter that changes no margin in §3 except the generic collision row — choose it for the post-quantum requirement, independently. if the owner keeps 0.3, the campaign below still runs (its instance table covers both), but the results log already opens with a CICO-1 solution through the whole partial layer, and the honest status of 0.3 is a profile with a known full-round distinguisher under measurement: it can meet criterion 2 of §6 only on the estimates of §3.1, and the published subspace-trail reach (≈ 30 internal rounds at t = 16, §3.3) already exceeds its 16 partial rounds, which fails criterion 3.

either way the campaign clock starts when the chosen profile's constants, vectors and this page's instance table are published together; a change of profile restarts it.

1. the object

1.1 parameters

checked here: audit/campaign/hemera_ref.py is an independent Python model of the 0.3 permutation and sponge that reproduces the three hash vectors of vectors/hemera.json and re-derives all 144 constants of rs/src/constants.rs from the five-byte seed.

1.2 modes — every way an input reaches the permutation

the sponge (specs/sponge.md, rs/src/sponge.rs): state ← 0; state[11] ← mode tag; input bytes are packed 7 per limb (every limb < 2^56); each full 56-byte block is added into state[0..8] (field addition) and permuted; the final block is the tail ‖ 0x01 ‖ 0* (a full extra block when the length is a multiple of 56), state[10] ← total byte length (overwritten, not added), permute; output state[0..4]. capacity lanes (specs/capacity.md): state[8] chunk counter, state[9] flags (CHUNK 4, PARENT 2, ROOT 1), state[10] length, state[11] mode, state[12..14] NMT namespace bounds, state[14..16] zero.

the campaign's object is the permutation and these constructions over it. the zheng truncated-permutation modes put full field elements (digest limbs, not 7-byte limbs) into the rate, so instances below use unrestricted inputs.

1.3 defects in the current documents

found while fixing the object; none changes an output bit, all must be corrected before the public launch of the campaign:

• specs/README.md, specs/permutation.md, docs/explanation/parameters.md, roadmap/inversion-sbox.md: "algebraic degree 2^1046, 2^918 margin" — the unreduced composition degree; it is no lower bound on any attack (§3.2).
• rs/src/params.rs header: "collision 256 bits, quantum 170" — the 32-byte digest caps collision at 2^128 classical, 2^85.3 quantum.
• docs/explanation/parameters.md: preimage 2^512 at cap 8 — the digest caps preimage at p^4 ≈ 2^256; docs/explanation/security.md lists "Hemera R_P = 64".
• specs/constants.md prints round constants (round 0 begins 0xD5CCEAC23026433F) that differ from the shipped rs/src/constants.rs (0x7E6EF67C13BC8100); the code matches the bootstrap, the spec page is stale. specs/field.md says 192 constants; there are 144.
• specs/permutation.md x⁻¹ witness equations xy(xy − 1) = 0, (1 − xy)y = 0 accept every (x, 0); the sound pair is x(xy − 1) = 0, y(xy − 1) = 0 (hemera#2, research/inverse-sbox-assessment.md §1).
• specs/matrices.md claims both 16 × 16 matrices are MDS; they are not (zero 2 × 2 minors, hemera#2). this is the Poseidon2 design — its external and internal layers are not MDS at t ≥ 8 by construction — so the defect is the claim; the criteria that matter for M_I are the subspace-trail conditions (§3.5).
• cyber/whitepaper.md §4.2 lists only d = 7 and "algebraic degree 7^64 ≈ 2^1046"; the §4.4 one-profile paragraph exists only as commit a4f57507 on a local checkout of cyber master, not on origin/master.

2. claims

2.1 what hemera claims

the campaign's pass target is the one in G3: no result below 128 bits classical on any property the stack uses. for the 4-limb digest that means collision and preimage attacks below 2^128, second preimages on tree nodes below 2^128, and any structural property of the permutation that yields one of those.

2.2 zheng rows that rest on these claims

from zheng/specs/soundness.md on release/0.4 (09308d7, 2026-10-14):

two rows use more than collision and preimage resistance: the field-native transcript treats the permutation as ideal, and query indices are the low k ≤ 32 bits of single output limbs. a structural property of the permutation — a one-limb CICO solver, a low-degree relation — falsifies "ideal permutation" as a model before it breaks any digest claim. §3.2 shows the 0.3 profile already has one; whether it moves a soundness row is review question R4 (§5).

3. attack surface and margins

conventions. "CICO-k": fix the capacity and all but k rate inputs, ask k chosen output limbs to take target values (the Ethereum Foundation bounty problem). generic cost of CICO-k is p^k permutation calls. margins are log2 of (attack cost / 2^128) for hash-level claims, or rounds left over a stated attack reach. "computed" means derived on this page and reproduced by a script in audit/campaign/; "published" means taken from the cited paper; "estimate" means a degree bound turned into a cost by the usual root-finding complexity, not run.

3.1 margin table — both profiles

the 0.3 column has three rows below the generic level of the problem they measure (interpolation, CICO-1, CICO-2). none is yet a collision or preimage of the 32-byte digest below 2^128; the closest hash-level row is the full preimage estimate, 14.6 to 25.8 bits over the target, on an estimate that ignores every Gröbner improvement since 2023. the v2 column has no row below its target.

3.2 the inverse partial layer — computed and run

the argument for 16 inverse rounds was degree: x^(p−2) has degree p − 2, so sixteen rounds "give" (p − 2)^16. an attacker never meets that degree. carry the state as rational functions of one free input X with a common denominator, x_i = N_i / D. a full x⁷ round maps (N_i + cD)^7 / D^7 and multiplies the degree by 7; an inverse round on x_0 maps x_0 ↦ D / (N_0 + cD), and with the common denominator D · U (U = N_0 + cD) the numerators become D², N_i U: the degree doubles. the whole permutation is therefore a rational function of degree at most 7^8 · 2^16 = 377 801 998 336 ≈ 2^38.46 in any single input limb, on all inputs except the ≤ 16 · D² roots of some inverse argument (probability negligible). the Poseidon paper rejected inverse partial rounds for exactly this growth (ePrint 2019/458: "the inverse function does not provide a sufficiently fast degree growth"; its x⁻¹ interpolation bound counts one bit of degree per partial round); hemera#2 derived the same bound (research/full-round-status.md).

audit/campaign/cico1.py builds N_limb − target · D symbolically with the real constants and matrices, takes gcd(f, X^p − X) by one modular powering, reads off the roots, and checks every root on the concrete permutation (hemera_ref.py, itself checked against the vectors). capacity fixed to a hash's final block (length 168), seven rate limbs fixed at random values, X in limb 3, target output limb 0 = 0. one core of an M4 Max, python-flint 0.9.0, 2026-10-16:

the bound is attained exactly every time: no cancellation saves the defender. a run with no root is the expected ~37 % case of a random polynomial; the attacker changes one fixed limb and repeats. time grows as D^1.0 to D^1.2 over the measured range (2^17.6 → 2^21.6; the machine was shared, so single runs carry noise). extrapolated to the full 0.3 permutation, D = 2^38.46 is 2^16.85 times the largest run: 92 s · 2^16.85 to 92 s · 2^20.2, i.e. 10^7 to 10^8 core-seconds (0.35 to 3.5 core-years) of fast-polynomial arithmetic, ≈ 2^52–2^56 field multiplications, with polynomials of 2^38.46 coefficients (2.75 TB each, order 10 TB working memory). the generic cost of the same CICO-1 problem is 2^64 permutation calls: ≈ 4.7 · 10^5 core-years at the batched 0.80 µs per permutation. memory, not time, is the barrier, and out-of-core NTT arithmetic over Goldilocks is an engineering problem with known solutions (§3.4).

what this does and does not break. it is a full-round distinguisher of the 0.3 permutation and an attack on its one-limb CICO problem at 2^19 to 2^23 below generic; it falsifies "hemera's permutation as an ideal permutation" as a model. it is not a collision or preimage of the 32-byte digest (§3.1). it does not reach the chain's proof of work: the 168-byte header occupies three full blocks, so every header byte passes through at least two permutations before the output (degree D² > p), and sponge rate limbs are confined to 2^56 values (a random root is encodable with probability 2^-8). its reach into the zheng rows that treat the permutation as ideal is open (review question R4).

with x⁷ in the partial rounds the same construction multiplies the degree by 7 per partial round, and the x⁷-only Poseidon2 reference (R_F 8, R_P 22) already has 7^30 = 2^84.2 > p; v2 has 7^60. the univariate route is closed for both.

3.3 published attacks, line by line

each line: the best published result, its instance, and what it means for the two profiles. ePrint numbers and claims were checked against the ePrint abstract pages and poseidon-initiative.info on 2026-10-16; figures that appear only inside PDFs (which returned 403) are marked "per abstract" or "secondhand".

the Ethereum Foundation Poseidon Cryptanalysis Initiative (poseidon-initiative.info) is the yardstick for §4: its 2025 program ($130 000) paid $4 000 / $6 000 / $10 000 / $15 000 for the 24 / 28 / 32 / 40-bit levels of reduced-round CICO instances; the 2026 CICO program pays $6 000 / $10 000 / $15 000 on Poseidon-31 KoalaBear (R_F 6, R_P 6 / 8 / 10), all three claimed by July 2026; a zero-test program ($40 000) was fully claimed in June–July 2026; an attack-reward program pays at least $5 000 per ePrint paper through the end of 2026. the Foundation announced in August 2026 that Ethereum's post-quantum paths will not use Poseidon (secondhand, ZKM blog).

reading the table for the decision: every line that has a published number either binds 0.3 below its generic level or has no bound for the hybrid at all; for v2 every line with a number leaves rounds in hand. the one line where v2's margin is thinnest is the subspace restriction of 2026/1692, because its reach is measured in initial full rounds, not partial rounds; this also means hemera#15's margin rule ("best reach ≈ 14 of 23 partial rounds") rests on a misreading of that abstract — the reported reach crosses all 23 partial rounds of the attacked instance once the initial layer is cut to one full round. the rule should be restated per layer: each outer full layer keeps at least three times the full rounds a published attack crosses or skips (two: the round-skipping technique of Bariant et al.; 2026/1692 crosses one), and the partial layer at least 1.5 times the longest published subspace trail (≈ 30 at t = 16, so ≥ 45). v2 meets both, the first exactly (6 against 3 · 2; 48 against 45); 0.3 meets neither (4; 16).

3.4 Goldilocks-specific structure

• p − 1 = 2^32 · 3 · 5 · 17 · 257 · 65537 is smooth, so F_p has multiplicative subgroups of many orders and NTTs of length up to 2^32 radix-2 and far longer mixed-radix. this is what makes Goldilocks fast for proofs and is equally what makes univariate root-finding and polynomial interpolation over it cheap (the Graeffe-transform attacks of §3.3 use exactly this). it binds wherever a univariate degree is below p — the 0.3 rows of §3.1 — and nowhere else.
• the smallest invertible power map is x⁷ (gcd(3, p − 1) = 3, gcd(5, p − 1) = 5); the degree per round is 7 rather than 3 or 5, which is why Goldilocks Poseidon2 needs fewer rounds than BN254 or BabyBear instances per bit.
• both x⁷ and x⁻¹ map every multiplicative subgroup to itself; constants and the linear layers are what break invariant cosets. the constant checks of v2 (§1.1) must include the invariant-subspace and invariant-coset tests of the Poseidon2 parameter script.
• input encoding packs 7 bytes per limb, so sponge inputs live in a 2^56 subset of F_p; a CICO solution is a sponge preimage only with probability 2^-8 per free limb. the zheng truncated-permutation modes (§1.2) take full limbs and carry no such restriction.
• the 64-bit field makes p² = 2^128 exactly the collision target of a 4-limb digest: the digest carries no margin above 128 bits classical, and 2^85.3 quantum.

3.5 the linear layers

M_I = 1 + diag(d) with the Plonky3 diagonal: rank 16, characteristic polynomial irreducible of degree 16 over F_p, and the rows of [e0; e0 M_I; …; e0 M_I^15] have full rank for every prefix, so no nonzero difference stays inactive at coordinate 0 through 16 partial rounds (hemera#2 research/inverse-sbox-assessment.md §4). this is the necessary part of the Poseidon2 internal-matrix condition; the full condition (no invariant subspace for any power of M_I, the "infinitely long subspace trail" test of ePrint 2020/500) is not yet recorded and is campaign task T2 for either profile. M_E is the Plonky3 circulant form; the ePrint 2026/306 line attacks linear-layer structure and must be read against both matrices (review question R3).

4. the bounty

4.1 tiers

the bounty pays for results on the profile frozen by §0. instances use the frozen constants, matrices and S-boxes with reduced round counts: reduced-round instances keep the first R_F / 2 external constant rows and the last R_F / 2, and the first R_P internal constants (the convention of hemera_ref.permute). the "full" row is the frozen profile.

v2 (recommended) instance table:

0.3 instance table (if the owner keeps it): A1 (2, 8), A2 (4, 12), A3 (8, 12); B1 and B2 at (8, 16) on the truncated permutation and sponge; C at (8, 16) is already met in-house (§3.2, results log entry 1) and pays only for a CICO-1 solution demonstrated on the full permutation or a better complexity; D as above.

4.2 terms

• eligible: the first public, reproducible result on an instance, measured against the frozen profile at the campaign's start date. a result must ship code that runs against audit/campaign/hemera_ref.py or the Rust crate at the pinned revision and prints the solution; CICO solutions are checked by evaluating the permutation, nothing else.
• complexity claims without a solution (tiers C and D) need a written argument, a reduced-round instance where the method is demonstrated, and an extrapolation the reviewers of §5 accept.
• one payout per instance and tier; a strictly better result on an already claimed instance (more rounds, or lower complexity by ≥ 2^8) is a new claim.
• the team, its contractors and anyone paid for §5 review are ineligible for payouts on tiers A–B; reviewers are eligible for C–D.
• results are public: the authors may publish when they wish after the disclosure window below; hemera publishes every accepted result in the results log with credit.
• no claim reaches a payout by moving the target: the instance table is frozen at the start of the campaign and versioned with this page.

4.3 disclosure

• tiers A–C: report publicly (an issue or eprint) or privately; there is no embargo — these instances protect nothing that is deployed.
• tier D, and any result that reaches a deployed mode of §1.2 (the chain's proof of work, Merkle trees, particles, transcripts): report privately first, 30-day window before publication; the team acknowledges within 72 hours, confirms or refutes within 14 days, and states in the results log that a private report exists and its status without its content.
• private channel: a GitHub private security advisory on cyberia-to/hemera ("report a vulnerability"). private vulnerability reporting is currently disabled on the repository — the owner enables it before the campaign starts — and the owner publishes a contact key here:

contact key: [owner publishes an age or OpenPGP public key and its fingerprint]

4.4 payouts

amounts are the owner's decision; the structure is fixed so the decision is one number per row.

payment in CYB or a stable asset at the claimant's choice, released when the result is verified and listed.

5. third-party review

5.1 who

the people who wrote the attacks of §3.3 and the design rules hemera borrows. invited by name, in two rounds: a paid review (two groups) and the open invitation to the rest.

the two paid reviews go to the designers' group and to the Inria/Simula group: together they wrote the design rules hemera borrows and the attacks that moved those rules in 2023–2026. the rest receive the package and the bounty terms. names and affiliations are as printed on the cited ePrint pages; contact goes through the corresponding authors' published addresses.

5.2 what to send

one package, the same for everybody: this page; the frozen profile's specs/ (permutation, matrices, constants, bootstrap, sponge, capacity, encoding); vectors/hemera.json; audit/campaign/ (the Python model, the CICO harness, the round-number script); the zheng hash rows of §2.2; and four questions:

• R1. does any published attack line (§3.3) reach the frozen profile's instance table further than this page says?
• R2. is the self-bootstrap of constants, followed by the Poseidon2 matrix and subspace checks, as good as the reference constant generator (the Grain LFSR of the Poseidon scripts)?
• R3. do the external and internal matrices admit invariant or infinitely long subspace trails (ePrint 2020/500), or the linear-layer structure exploited by ePrint 2026/306?
• R4. do the zheng rows that model hemera as an ideal permutation or read query indices from single limbs (§2.2) lose bits against a one-limb CICO solver, and against the profile's best known distinguisher?

5.3 in-house tasks

run by the team before and during the campaign; each lands as a results log row with its script in audit/campaign/.

• T1. cico1.py on every A instance of the frozen profile, CICO-1 and a two-variable resultant variant for CICO-2, to calibrate the instance table (a v2 instance that falls in-house moves up a tier before day 0).
• T2. the infinitely-long-subspace-trail check of ePrint 2020/500 on M_I and its powers, and the invariant-coset checks of §3.4, for the frozen constants and matrices.
• T3. Gröbner (msolve or F4) and resultant runs on reduced instances with the CICO system written as FreeLunch / ePrint 2026/1905 write it; for 0.3, the same with the inverse as the two cubic relations of §1.3.
• T4. the reach of a one-limb CICO solver into the zheng rows of §2.2 (R4), written as a note in zheng/audit/.

5.4 timeline

6. pass criterion and results log

G3 passes when all of these hold:

1. the campaign has run at least 90 days from day 0 on one frozen profile;
2. no result in the log lowers collision, preimage or second preimage of any §1.2 mode below 128 bits classical (no tier D);
3. no tier-A4 result (for v2: CICO-2 on half the partial budget at full R_F), and the per-layer margin rule of §3.3 still holds against the literature at day 90: each outer full layer at least three times the full rounds a published attack crosses or skips, the partial layer at least 1.5 times the longest published subspace trail;
4. at least one paid third-party review has answered R1–R4 in writing, with no open finding;
5. the zheng hash row (soundness.md) moves from "parameters experimental" to the frozen profile with this page as its argument.

a result that fails 2 stops the campaign and keeps the pool off; a result that fails 3 forces a re-parameterization before genesis or a fork after it, and restarts the clock.

results log

sources

• Grassi, Khovratovich, Rechberger, Roy, Schofnegger. Poseidon. ePrint 2019/458, USENIX Security 2021.
• Grassi, Khovratovich, Schofnegger. Poseidon2. ePrint 2023/323, AFRICACRYPT 2023; round script poseidon2_rust_params.sage, github.com/HorizenLabs/poseidon2.
• Albrecht et al. Algebraic cryptanalysis of STARK-friendly designs: MARVELlous and MiMC. ePrint 2019/419, ASIACRYPT 2019.
• Beyne et al. Out of Oddity. ePrint 2020/188, CRYPTO 2020.
• Keller, Rosemarin. Mind the Middle Layer. ePrint 2020/179, EUROCRYPT 2021.
• Grassi, Rechberger, Schofnegger. Proving resistance against infinitely long subspace trails. ePrint 2020/500, FSE 2022.
• Bariant, Bouvier, Leurent, Perrin. Algebraic attacks against some arithmetization-oriented primitives. ToSC 2022(3):73–101.
• Ashur, Buschman, Mahzoun. Algebraic cryptanalysis of HADES design strategy. ePrint 2023/537.
• Bariant et al. The algebraic FreeLunch. ePrint 2024/347, CRYPTO 2024. Bak et al. CheapLunch. ePrint 2025/2040.
• Liu et al. Collision attacks on round-reduced Tip5, Tip4, Tip4′ and Monolith. ePrint 2024/1900, ToSC 2024(4).
• Yang et al. full-round attack on Anemoi. ePrint 2024/886, ASIACRYPT 2024.
• Grassi, Koschatko, Rechberger. Poseidon and Neptune: Gröbner basis cryptanalysis exploiting subspace trails. ePrint 2025/954, ToSC 2025.
• Sanso, Vitto. Graeffe-based root finding against Poseidon. ePrint 2025/937. Zhao, Ding. ePrint 2025/950. Zhao, Sanso, Vitto, Ding. ePrint 2025/1916.
• Bak, Bariant, Boeuf, Hostettler, Jazeron. Resultant-based attacks on EF bounty instances. ePrint 2026/150. Bak, Hostettler. ePrint 2026/1905.
• Merz, Rodríguez García. Skipping Class. ePrint 2026/306.
• Li, Wang. ePrint 2026/967. Li, Wang, Liu. ePrint 2026/1792.
• Bhati, Tariq, Ashur. How to attack Poseidon via smart subspace restriction. ePrint 2026/1692.
• Ethereum Foundation Poseidon Cryptanalysis Initiative, poseidon-initiative.info (read 2026-10-16).
• ZKM, "Why Ethereum walked away from Poseidon" (August 2026) — secondhand source for the 2^126 / 2^123 figures and the Ethereum decision.
• Brassard, Høyer, Tapp. Quantum cryptanalysis of hash and claw-free functions. LATIN 1998.

internal: soft3/proposals/privacy-frozen.md §5–6; soft3/specs/chain.md §1; zheng/specs/soundness.md (release/0.4); cyber/audit/cryptography-2026-10-08.md; cyber/whitepaper.md §4; hemera#2 (research/permutation-decision.md, research/full-round-status.md, research/inverse-sbox-assessment.md, research/partial_subspace.py); hemera#15 (roadmap/profile-v2.md, roadmap/one-pure-hash.md §4); audit/permutation-performance-2026-10.md.