Refracting Light v3: plain-language glossary with citations

A companion to RL-V3-PAPER.md, for readers who are curious but not mathematicians. Each entry gives what the term means, a tiny example, what we measured, and where to read more.

Part 1: building blocks

Bit, XOR (⊕) A bit is 0 or 1. XOR compares two bits: same → 0, different → 1. Example: 1011 ⊕ 0110 = 1101. XORing the same value twice undoes it: (a ⊕ b) ⊕ b = a.

Rotation (rotl) Slide bits to the left, and the bits falling off the end come back on the right, like a carousel. Example: rotating 10010110 left by 3 gives 10110100.

Hash function A recipe that turns any input (a word, a file, a block) into a fixed-size fingerprint. The same input always gives the same fingerprint; a tiny change gives a completely different one; and you can’t run it backwards. Example: RL v3 turns “Hello World” into the 128-bit fingerprint 49c50aef… (v2) or a new one under v3. Read: Menezes, van Oorschot & Vanstone, Handbook of Applied Cryptography, CRC Press 1996, ch. 9 (free online).

Internal state vs output RL v3 keeps 512 bits of working memory (the state) while it reads the message, then hands out only 128 bits (the output). The 384 bits it never shows are the hidden state, like the gears inside a sealed clock.

The fold How 512 bits of state become a 128-bit output. The state is four 128-bit lanes, L₀ to L₃. Each lane is rotated by a different amount (0, 29, 61, 97), and the four are XORed together: H = L₀ ⊕ rotl(L₁, 29) ⊕ rotl(L₂, 61) ⊕ rotl(L₃, 97) Tiny example with 4-bit lanes and rotations 0, 1, 2, 3:

L₀ = 1010            → 1010
L₁ = 0110  rotl 1    → 1100
L₂ = 1001  rotl 2    → 0110
L₃ = 0011  rotl 3    → 1001
                 XOR → 1001  = the folded output

Think of four beams of light entering a prism at four angles and leaving as one beam: that’s the “refraction” picture.

Fold cancellation (and the kernel) Because the fold squeezes 512 bits into 128, many different states give the same output. Two states fold to the same value exactly when their difference “cancels” in the XOR. The set of differences that cancel is called the kernel; for RL v3 it has 384 dimensions (512 − 128). Example (same 4-bit fold): flipping bit 0 of L₀ and also the bit of L₁ that rotates onto position 0 changes two lanes, but the two flips XOR away, so the output is unchanged. Why it matters: an attacker who could steer two messages into states that differ only by a kernel pattern would get a collision. We measured: seven structured message differences, 20,000 pairs each, never once steered into the kernel, and their differences filled the whole space (full rank 128/128 and 512/512). No foothold.

Finalization Extra mixing steps after the message ends, so the last input bit gets stirred as well as the first. v3 adds 8 blank steps. We measured: v2’s last step was under-mixed (worst output difference 24 bits); with v3’s finalization it reached 41 (a random value gives about 39).

Reed–Solomon / RAID-6 P and Q shards; MDS The message is split into four shards plus two check shards, P (a plain XOR) and Q (a weighted XOR in the arithmetic of GF(2⁸), the 256-value number system computers use for bytes). It’s the same idea that lets RAID-6 disk arrays survive two dead drives. Our code is MDS (maximum distance separable): any change to the message alters at least 3 of the 6 symbols in its column, so every difference gets fed into the hash at least three times. Read: Reed & Solomon, “Polynomial codes over certain finite fields”, J. SIAM 8(2), 1960; H. P. Anvin, “The mathematics of RAID-6”, kernel.org, 2007; Daemen & Rijmen, The Design of Rijndael, Springer 2002 (branch number).

Part 2: what we tested

Avalanche Flip one input bit and count how many output bits change. A good hash changes about half, here 64 of 128, unpredictably, like one snowball setting off a whole slope. The term comes from Horst Feistel. We measured: mean 64.0 bits, spread 5.66 (exactly what coin tosses give), no weak input position. Read: H. Feistel, “Cryptography and computer privacy”, Scientific American 228(5), 1973.

Strict avalanche criterion (SAC) Stricter than avalanche: for every pair of one input bit and one output bit, flipping the input should flip that output exactly half the time. We measured: all 16,384 pairs between 45.6% and 54.7%, the range random noise gives for 2,000 samples. Read: Webster & Tavares, “On the design of S-boxes”, CRYPTO ‘85, LNCS 218, 1986.

Bias A bit is biased if it comes out 1 more (or less) often than 50%. A biased output bit is a crack: an attacker can guess it better than a coin toss. We count ones for each output bit over many random messages and use the chi-square (χ²) score, which adds up how far all 128 bits stray from 50%: about 128 ± 16 is normal; well above about 180 would be suspicious. We measured: χ² = 104 (v2) and 149 (v3); largest single-bit deviation |z| ≈ 2.3, all normal.

z-score (|z|) How many “typical wobbles” (standard deviations) a result sits from what pure chance predicts. Values within ±2 to ±3 are everyday luck; with thousands of checks, a few around 4 are still expected. We compare every z with that expectation.

Differential test Does a particular input change always produce the same output change? If yes, an attacker can predict outputs from inputs. We measured: 4,000 messages per bit position gave 4,000 different output changes. Nothing repeated even twice. Read: Biham & Shamir, “Differential cryptanalysis of DES-like cryptosystems”, J. Cryptology 4(1), 1991.

Linear mask test Pick a few input and output bits and XOR them together. For a good hash the result is 0 half the time. A combination that leans one way is a “linear approximation” an attacker can use. We measured: 6,128 combinations, none leaning more than chance allows. Read: M. Matsui, “Linear cryptanalysis method for DES cipher”, EUROCRYPT ‘93, LNCS 765, 1994.

SAT solver attack Turn the hash into a giant logic puzzle and hand it to a program that is very good at logic puzzles (here z3). If the hash had algebraic shortcuts, the solver would find inputs faster than guessing. We measured: z3 was thousands of times slower than brute force and stalled after 8–12 steps (real messages go through 112 or more). Read: Mironov & Zhang, “Applications of SAT solvers to cryptanalysis of hash functions”, SAT 2006, LNCS 4121; de Moura & Bjørner, “Z3: an efficient SMT solver”, TACAS 2008.

Collision, preimage A collision is two different inputs with the same output. A preimage is an input that produces a chosen output, which is what you’d need to fake someone’s address. Collisions are always easier to find.

Birthday bound In a room of 23 people, two probably share a birthday, far fewer than 365. Likewise, for an n-bit hash a collision appears after about 1.25 × 2^(n/2) tries, not 2^n. For RL v3’s 128 bits that’s about 2⁶⁴. We measured: real collisions on the top 40, 48, 56 and 64 bits took 0.88 ± 0.08 times the birthday amount (SHA-256 control: 0.92 ± 0.08). Same as ideal. One 64-bit pair took 2 h 13 min on a laptop. Read: Handbook of Applied Cryptography, §9.7; van Oorschot & Wiener, “Parallel collision search with cryptanalytic applications”, J. Cryptology 12(1), 1999 (the search method we used).

Part 3: quantum terms

Grover’s algorithm A quantum search that finds a needle among N possibilities in about √N steps instead of N. It halves the exponent of preimage attacks: 2¹²⁸ becomes 2⁶⁴. It is provably the best possible for “black-box” search. We measured: a simulation matched the theory exactly; a full RL v3-128 preimage would need about 1.45 × 10¹⁹ Grover iterations of a 600-step quantum circuit. Read: L. K. Grover, “A fast quantum mechanical algorithm for database search”, STOC 1996 (arXiv quant-ph/9605043); Boyer, Brassard, Høyer & Tapp, “Tight bounds on quantum searching”, 1998 (arXiv quant-ph/9605034); C. Zalka, “Grover’s quantum searching algorithm is optimal”, 1999 (arXiv quant-ph/9711070).

BHT (quantum collision search) A quantum method that finds collisions in about 2^(n/3) steps in theory (its practical cost is debated, because it needs a huge quantum memory). Read: Brassard, Høyer & Tapp, “Quantum cryptanalysis of hash and claw-free functions”, LATIN 1998 (arXiv quant-ph/9705002).

Shor’s algorithm A quantum method that finds the hidden repeating pattern (period) in certain maths problems, which breaks factoring (RSA) and elliptic curves (Bitcoin’s signatures). It does not break hash functions. In E46 it only affects the QTL time-delay puzzle, which is why that part has a hash-chain backup. Read: P. W. Shor, “Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer”, SIAM J. Computing 26(5), 1997.

Part 4: the partner hash and the chain

SHAKE256, sponge, capacity SHAKE256 is from the SHA-3 family. It works like a sponge: it soaks up the message in 136-byte gulps into a 1,600-bit state, stirring with the Keccak permutation each time, then “squeezes” out as many output bits as you ask for. The 512 bits never directly touched by input or output are the capacity, its hidden state, which sets its security ceiling. Read: NIST FIPS 202 (2015); Bertoni, Daemen, Peeters & Van Assche, “On the indifferentiability of the sponge construction”, EUROCRYPT 2008.

Concatenation (RL ‖ SHAKE) Putting two hash outputs side by side. To fake an E46 address, an attacker must match both halves at once, so the address is as strong as the stronger hash. Read (the limits of this trick for collisions): A. Joux, “Multicollisions in iterated hash functions”, CRYPTO 2004.

SLH-DSA The post-quantum signature scheme E46 uses. It’s built only from hash functions, so Shor can’t break it. Read: NIST FIPS 205 (2024).

Bech32m The address format with a readable prefix (e46…) and a checksum that always catches a mistyped character. Read: Bitcoin BIP-173 and BIP-350.

Time-lock puzzle A lock that takes a known amount of computer work to open. QTL uses repeated squaring (RSW), with a hash-chain backup. Read: Rivest, Shamir & Wagner, “Time-lock puzzles and timed-release crypto”, MIT LCS TR-684, 1996; Mahmoody, Moran & Vadhan, “Time-lock puzzles in the random oracle model”, CRYPTO 2011.

Argon2id A password hash that deliberately uses lots of memory, so guessing passwords is expensive even with many machines. Read: IETF RFC 9106 (2021).

---

Citations are given from the project team’s knowledge and should be checked against the original sources before formal publication. Measurements refer to PHASE3-RESULTS.md (sections A–L).