CryptoMasterXY

Jedes Compliance-System muss entscheiden, was passiert, wenn es unter Stress gerät – wenn die Operatoren überlastet sind oder ein Ansturm von Anfragen die Bewertung ausbremst. Die meisten Systeme beantworten diese Frage mit einer reduzierten Durchsatzleistung: Es wird langsamer, aber die Regeln bleiben gleich. Newtons Litepaper beschreibt eine andere Antwort. Seine genannte Gegenmaßnahme für Denial-of-Service-Bedingungen umfasst das Betreiben mehrerer Operator-Cluster, fehlertolerante, rate-limitierte Wiederholungsversuche – und eine Fallback-Strategie, und zwar anhand des konkreten Beispiels niedriger Transaktionslimits.

I'd already worked out that Newton's Prepare-phase median is computed from whichever operators respond fastest, not from the full registered operator set, because the gateway starts computing the moment quorum is met.
What I hadn't found until now is whether that speed advantage is an accident of network latency, or something the protocol actually selects for.

Newton's litepaper answers that directly, in a phrase easy to skim past: operator selection for a task is described as permissionless to join, but "performance-weighted" in how operators actually get chosen to work on a given task.
That's a different claim than "whoever answers first wins." It says the protocol is designed to route tasks toward operators with better track records in the first place, before any race to respond even begins.


I want to flag exactly where this claim comes from, because it matters for how much weight to put on it: this is from Newton's litepaper, a higher-level design document, not the technical reference pages that describe the exact tolerance-check and median-computation mechanics I'd traced earlier.
It's reasonable to treat this as the stated design intent rather than a guaranteed description of exactly how the current deployed system weights selection.
But taking it as intent still changes the analysis, because it tells you what the system is supposed to be optimizing for.

Here's why that reshapes the earlier concern instead of just repeating it.
If fast responses were purely a byproduct of who happens to have good infrastructure, the concentration of the same operators winning the median calculation would be an emergent side effect — unintended, and at least in principle correctable by, say, adding more geographically diverse operators to the network.
But if selection is explicitly performance-weighted, the system is pointed at exactly the same outcome on purpose: better-performing operators get chosen for tasks more often, which means they respond fast more often, which means they make up more of the quorum that computes the median more often.
The two mechanisms — performance-weighted assignment, and early-exit-on-quorum — aren't independent quirks that happen to compound.
They're aimed at the same target from two different stages of the pipeline: who gets assigned the work, and who finishes first once assigned.

The litepaper adds one more relevant detail on top of this: quorum size isn't fixed network-wide.
Apps choose a "risk-graded" quorum — the example given is roughly two-thirds of a "Retail" operator set versus three-quarters of an "Institutional" one.
That fraction sounds like a real safety margin. But a fraction is only as meaningful as the group it's a fraction of, and if performance-weighted selection means the same well-performing operators are disproportionately the ones assigned into an app's "set" in the first place, then two-thirds of that set could still be a small, recurring group of specific operators — not two-thirds of a large, rotating cross-section of the network.


What I can't determine from either document is the thing that actually decides whether this is a real risk or a non-issue: how strongly "performance-weighted" is applied.
If it's a soft weighting — a lottery where good performance improves your odds but everyone still gets picked with some regularity — the operator set feeding into each task's quorum stays reasonably diverse over time, and this concern mostly dissolves back into statistical noise.
If it's closer to a strict ranking — the top performers get selected essentially every time — then the same handful of operators could end up as the effective, permanent core of quorum for a given app, regardless of what fraction the app requires, because the fraction is computed over a set that performance-weighting has already narrowed before quorum is even considered.


So the open question is specific, and it's the one neither document answers: is performance-weighted operator selection designed to rotate meaningfully across the eligible operator pool over time, or does it converge toward a small, stable set of repeat performers the longer the network runs?
That's not a question about cryptography or consensus math. It's a question about a selection algorithm's actual weighting curve — and it's the detail the entire "risk-graded quorum" safety story is quietly resting on.
@NewtonProtocol #Newt $NEWT $ALLO $1000XEC

Newton's Prepare phase works like this: operators independently fetch the external data a policy needs, report back unsigned, and once enough responses arrive to meet quorum, the gateway takes what it has, throws out the highest and lowest values, and computes a median.
That median becomes the one canonical number every operator evaluates the policy against for the rest of the task.

"Median" is doing a lot of reassurance in that sentence. It's the word you reach for when you want to say a value can't be dragged around by one bad actor.
So I wanted to know, specifically: a median of how many numbers?

The answer, based on how the mechanism is described, isn't "all registered operators."
It's whichever operators happen to respond fast enough to fill the quorum, because the gateway starts computing as soon as quorum is met — that's the entire point of the early-exit design, to not wait around for stragglers.
So the sample feeding the median isn't the full operator set. It's however many operators are needed to reach quorum, and no more.

That distinction matters more than it sounds like it should, because of how a median actually behaves as a statistic.
A median resists manipulation up to a point — roughly, an attacker needs to control something close to half the sample before they can drag the median wherever they want.
That's true regardless of sample size, as a fraction. But as an absolute headcount, it's a completely different question.
Half of a sample of forty operators is twenty. Half of a sample of five is three. The percentage protection is identical. The number of individual operators someone would actually need to influence is not.

So here's the arithmetic that matters: if quorum can be met with a small handful of fast responders, then controlling the canonical data that every policy evaluation on Newton depends on for that task doesn't require compromising or colluding with a meaningful fraction of the network's registered, staked operator set.
It requires controlling roughly half of whichever small group happens to win the race to respond — and winning that race, as I'd traced separately, tends to favor the same well-connected operators repeatedly. Put those two things together and the actual number of operators an attacker needs a foothold in could be startlingly small compared to what "the network reaches consensus on this data" sounds like it promises.
"The network" and "whoever answered first" aren't the same group, and the median only ever sees the second one.


I want to be exact about what I don't know here, because this is the part that decides whether the observation is alarming or beside the point: I don't have the actual numbers.
I don't know what quorum size Newton requires relative to how many operators are registered and staked in total.
If quorum requires, say, two-thirds of a large, actively-participating operator set every time, this concern mostly dissolves — the absolute headcount stays large even though the fraction is fixed.
If quorum can be met by a small number out of a much larger registered set, the gap between "the median is robust" and "the median is robust against roughly two people" becomes real and specific.

So the open question isn't rhetorical, and it isn't something I can resolve by reasoning about the design in the abstract — it's a number that either exists in Newton's operator registry data or doesn't get published: what is the ratio between the quorum size that triggers median computation and the total number of operators actually registered and eligible to respond?
Because the tolerance mechanism's entire claim to safety is calibrated, in people's heads, to the larger number — and the arithmetic that actually runs is calibrated to whatever the smaller one turns out to be.
@NewtonProtocol $NEWT #Newt $DEXE $DODO

Wenn eine Aufgabe auf Newton erstellt wird, müssen zwei Parteien ihr Einverständnis geben, bevor das Gateway fortfährt: der Nutzer und die Anwendung, die in seinem Auftrag handelt. In der Dokumentation wird dies als eine Kette beschrieben – die Unterschrift der Anwendung soll etwas Bestimmtes bedeuten: „Wir haben die Zustimmung des Nutzers gesehen, sie überprüft und erst dann haben wir unsere eigene hinzugefügt.“ Ich wollte herausfinden, ob die tatsächliche Erstellung dieser zweiten Signatur diese Reihenfolge erzwingt oder sie nur behauptet.

So wird es beschrieben. Beide Signaturen verifizieren gegen dieselbe zugrunde liegende Nachricht – einen Digest, der aus dem Policy-Client und dem Intent-Hash erstellt wird, wobei die Datenreferenzen eingearbeitet werden. Der Nutzer signiert sie. Die Anwendung signiert sie ebenfalls. Das Gateway akzeptiert die Aufgabe, sobald beide Signaturen mit ihren jeweiligen öffentlichen Schlüsseln überprüft wurden. Und der angegebene Zweck der Signatur der Anwendung ist es zu bestätigen, dass sie die Zustimmung des Nutzers erhalten und verifiziert hat, bevor sie ihre eigene Genehmigung hinzufügte.

Newton's privacy layer makes a precise security claim: when private data is encrypted and uploaded, the ciphertext is cryptographically tied to a specific policy and a specific chain.
Try to replay that same encrypted envelope somewhere else — a different policy, a different chain — and the authentication check fails outright.
Decryption is refused. I wanted to see exactly what "tied to" covers, and, just as importantly, what it doesn't.

Here's the actual formula.
The additional authenticated data attached to the encryption is computed from exactly two inputs: the policy client and the chain ID, hashed together.
That hash becomes part of what the encryption algorithm authenticates alongside the ciphertext itself.
If either input changes — a different policy, a different chain — the entire authentication tag breaks, and the algorithm refuses to decrypt.
That's a strong, well-scoped guarantee, and it's exactly the kind of protection you'd want against someone trying to lift a valid encrypted payload and reuse it in a context it was never meant for.


But the upload call that carries this ciphertext doesn't carry only the ciphertext and those two bound values.
It also carries a time-to-live — a value that determines how long this piece of data is meant to remain valid or retrievable before it expires.
And when I checked what actually goes into the authenticated data formula, the TTL isn't in it.
The formula covers exactly two things: policy client, chain ID. Nothing else.

That's a real distinction, not a technicality. An authenticated field is one where tampering breaks the cryptographic proof and gets caught automatically.
An unauthenticated field is one the system simply trusts as stated, because nothing in the encryption itself is watching it.
The policy client and chain ID sit in the first category.
The TTL, based on what's documented, sits in the second.

Which raises a specific, testable question: if someone with the ability to intercept or resubmit this upload request changed only the TTL — leaving the ciphertext, the policy client, and the chain ID completely untouched — would the authentication check even notice?
Based on the formula as written, it shouldn't.
The ciphertext would still decrypt cleanly, because nothing about TTL manipulation touches the two values the algorithm is actually checking.
The data would still be exactly what the original sender encrypted. Only its shelf life would have quietly changed.

That matters more than it might first appear, because TTL isn't cosmetic metadata — it's a security control in its own right.
It's presumably what limits how long a piece of sensitive, encrypted data remains something the system will still act on, still retrieve, still treat as current.
A shortened TTL could cause legitimate data to expire early and quietly fail workflows that depend on it.
A lengthened one could keep sensitive data alive and retrievable well past when the original party intended it to matter.
Neither requires breaking the encryption.
Neither trips the one integrity check the system is documented to perform.


I want to be precise about what I'm not claiming.
I don't know whether this gap is actually exploitable end to end — that depends on things the documentation doesn't cover, like whether the Gateway independently commits the TTL on-chain at the moment of upload in a way that can't be altered afterward, whether the upload request itself travels over a channel with its own transport-level integrity protection that would catch tampering before it ever reaches this layer, or whether TTL is treated as advisory rather than security-critical in the first place.
Any of those could close the gap entirely, and none of them would show up in the AAD formula itself, because they'd be protections layered on top of it rather than inside it.

So the open question is exact: is the TTL value committed anywhere immutably and checkably at the time of upload — on-chain, or inside some other authenticated structure — or is it accepted at face value as a parameter of the RPC call, trusted the same way any unauthenticated request field is trusted?
The documentation is precise about what the encryption itself protects.
It says nothing about what protects the one time-bound value that determines how long that protection is even supposed to last.
@NewtonProtocol #Newt $NEWT $SKL $B

Newton makes a specific security promise about its threshold decryption system: an operator's day-to-day signing key and their piece of the network's private decryption key are cryptographically unrelated. Compromise one, the documentation says, and the other stays safe. I wanted to see if that independence held all the way through, or only some of the way.

Here's the actual architecture. Newton's threshold decryption key is produced once, through an interactive ceremony among operators, and split into shares — no single party, not even the gateway, ever holds the whole thing. Reconstructing it requires a quorum of operators cooperating. That secret is mathematically its own thing, generated independently of any operator's existing keys. On that specific point, the independence claim is airtight: you cannot derive someone's share of the threshold secret from their ordinary signing key, because the two were never mathematically connected in the first place.

But shares have to move. When operators cooperate to decrypt something, they exchange their individual shares with each other, encrypted so only the intended recipient can read them in transit. And that's where I found the chain the "independence" framing doesn't mention.

Each operator's key for receiving those encrypted shares isn't generated independently at all. It's derived, deterministically, directly from that same operator's ordinary signing key — through a documented three-step process: the signing key seeds a key-derivation function to produce a second key, and that second key is hashed once more to produce the actual encryption key used for receiving shares. Same input every time produces the same output every time, by design, so that operators don't need to run a separate ceremony just to talk to each other.

Which means there are really two separate claims bundled into one sentence, and only one of them is true without qualification. "You can't derive the secret share's value from the signing key" — true, verifiably, because they come from unrelated mathematical origins. "Compromising the signing key doesn't threaten the threshold system" — that second claim only holds if you also assume the attacker never gets to see the encrypted traffic those keys are meant to protect. If someone steals an operator's ordinary signing key — through a cloud misconfiguration, a leaked backup, a compromised key-management system, none of which have anything to do with the threshold-decryption system itself — they can run that same three-step, fully documented derivation on their own and produce the exact key that operator uses to receive shares. At that point, anything encrypted to that operator becomes readable to the attacker too, provided they can also get hold of the ciphertext moving across the network.

That second condition matters, and it's the honest caveat here: stealing a signing key alone isn't the whole attack. It has to be paired with visibility into the actual message traffic — something a compromised relay, a logging misconfiguration, or a man-in-the-middle position could plausibly provide, but which the documentation doesn't describe a specific defense against beyond the encryption itself. So this isn't a proven break. It's a dependency that "independence" implies doesn't exist, but does.


And it compounds in a way worth sitting with: the threshold system is built so that a single operator's compromise shouldn't matter — that's the entire premise of requiring a quorum before anything reconstructs. But if an attacker compromises enough operators' ordinary signing keys — say, exactly as many as the quorum requires — and separately gets visibility into their share traffic, they've reconstructed the very thing the quorum requirement was supposed to make impossible for anyone short of that number to do honestly. The threshold system's core guarantee rests on the assumption that operator compromises are independent events. But if every operator's transport key traces back to the same signing key that a routine, off-protocol breach could expose, then "independent" compromises might not be as independent as the design assumes.

So the open question is specific, and I don't think it's answerable from the architecture alone: is there a separate safeguard — network-level encryption, key rotation tied to signing-key rotation, an isolation boundary between where signing keys live and where this derivation runs — that keeps a routine signing-key breach from ever reaching this path in practice? If there is, it isn't part of what's documented as the threshold system's own guarantee. And if there isn't, "key independence" is describing the math correctly while quietly resting on an operational assumption the math itself can't enforce.
@NewtonProtocol #Newt $NEWT $TAG $US