RANNTA X-Chain Hybrid Security Evidence
This record documents implementation-enforced behavior on RANNTA X-Chain Mainnet across two protected security layers: native HybridRequired authorization and validator-sensitive HybridRequired transport. Authorization binds classical secp256k1/ECDSA evidence and ML-DSA-65 evidence to the same protected operation. Validator-sensitive transport uses X25519 + ML-KEM-768 + HKDF-SHA256 + AES-256-GCM with fail-closed rejection behavior.
1. Native Hybrid Authorization Evidence Matrix
The table below records the enforcement behavior represented by the native authorization implementation. "Implemented" or "Enforced" means the behavior is present in the authorization code path; it does not mean an independent auditor has certified it.
| Security case | Expected behavior | Implementation signal | Status |
|---|---|---|---|
| Valid hybrid authorization Valid ECDSA and valid ML-DSA-65 evidence under the correct context. | Authorize the protected request for execution processing. | status=authorized_pending_execution | IMPLEMENTED |
| Classical-only authorization on a HybridRequired account | Reject instead of silently falling back to legacy authorization. | hybrid_required | ENFORCED |
| Invalid ML-DSA-65 signature | Reject the authorization. | invalid_ml_dsa_signature | ENFORCED |
| Invalid secp256k1/ECDSA signature | Reject the authorization. | invalid_ecdsa_signature | ENFORCED |
| Duplicate transaction / replay | Reject a transaction hash already recorded as executed. | duplicate_transaction_hash | ENFORCED |
| Reused key-lifecycle operation identity | Reject reuse of an operation identity already consumed by registration or rotation. | duplicate_transaction_hash | ENFORCED |
| Key version rollback | Reject registration or rotation that does not move to an allowed higher key version. | key_version_rollback | ENFORCED |
| Wrong PQ key version | Reject authorization bound to a different registered PQ key version. | wrong_pq_key_version | ENFORCED |
| Wrong chain identity | Reject evidence that is not bound to RANNTA X-Chain Chain ID 13113. | wrong_chain_id | ENFORCED |
| Expired or premature validity window | Reject authorization outside its configured block-validity window. | expired_transaction / premature_transaction | ENFORCED |
| ML-DSA backend unavailable | Fail closed rather than treating missing PQ verification as success. | ml_dsa_backend_unavailable | ENFORCED |
2. Canonical Context and Replay Binding
Hybrid authorization is not treated as two unrelated signatures. The native path binds authorization evidence to a defined RANNTA X-Chain security context. The implementation includes chain identity, transaction/account fields, validity bounds, PQ key version, authorization policy version and operation identity in the protected authorization flow.
Domain separation
The native hybrid domain is versioned as RANNTA-XCHAIN-HYBRID-NATIVE-V1.
Transaction replay state
Executed transaction hashes are tracked and duplicate insertion is rejected.
Operation replay state
Used operation IDs are tracked for protected key-lifecycle operations.
3. Key Registration, Hybrid Activation and Rotation
The native authorization registry records the account authorization mode, ML-DSA-65 public key, public-key hash, key version, registration block, activation block, policy version and rotation counter.
Authenticated registration
Key registration binds classical account authority and ML-DSA-65 proof to the canonical key operation.
HybridRequired activation
Once the account is placed in HybridRequired mode, legacy-only authorization is rejected on the protected native path.
Versioned rotation
Rotation requires an incremented key version; rollback or non-incrementing rotation is rejected.
4. Wire-Level Failure Signals
The implementation exposes deterministic error codes for security-relevant rejection paths. Selected examples:
hybrid_required hybrid_required_irreversible invalid_ecdsa_signature invalid_ml_dsa_signature ml_dsa_backend_unavailable duplicate_transaction_hash key_version_rollback wrong_pq_key_version wrong_chain_id expired_transaction premature_transaction invalid_block_authorization_evidence
5. Mainnet Hybrid Post-Quantum Transport Evidence
Production status: RANNTA X-Chain Mainnet enforces hybrid post-quantum protection across validator-sensitive authorization and transport paths. The active transport policy is HybridRequired.
Hybrid key establishment
X25519 + ML-KEM-768 are combined for the protected validator-sensitive transport handshake.
Key derivation and records
HKDF-SHA256 derives transport keys and AES-256-GCM provides authenticated record protection.
Production policy
HybridRequired is active on the Mainnet node for the protected transport path.
| Production acceptance case | Observed result | Status |
|---|---|---|
| Encrypted validator-sensitive protected record | encrypted_record_ok=true | PASS |
| Plaintext-sensitive command | plaintext_rejected | PASS |
| Classical-only peer authentication | Rejected under HybridRequired | PASS |
| Replay / duplicate record sequence | RecordReplay | PASS |
| Modified ciphertext | RecordAuthFailed | PASS |
| Modified AAD / chain binding | ChainMismatch | PASS |
| Wrong session ID | SessionMissing | PASS |
| Wrong transport direction | DirectionMismatch | PASS |
| Reconnect | Fresh session established | PASS |
| Public RPC compatibility after activation | Chain ID 0x3339, net version 13113, blocks progressing | PASS |
Production artifact: active Mainnet node SHA-256 f4a9e7556f1e89ff947d10b26f5249debee4d8432b81d573c6e924dd28454296. Final acceptance completed with ROLLBACK_USED=NO and block progression observed from 0x6d766 to 0x6d767.
Scope: the transport claim is limited to validator-sensitive protected paths. Public JSON-RPC remains compatible and is not described as universally ML-KEM-encrypted traffic.
6. Consensus Scope
RANNTA consensus engineering implements HybridRequired authorization surfaces across validator-sensitive proposal, vote and finality paths. Broader distributed validator deployment is the topology-scale expansion of this implemented authorization model.
The HybridRequired consensus authorization model is implemented independently of validator-count growth. Network expansion broadens distributed participation without redefining the protected authorization path.
7. Public Reproduction Status
PUBLISHED
Implementation behavior and production transport acceptance signals are documented in this record.
LIVE
RANNTA X-Chain public RPC and explorer are available for network-level inspection.
ACTIVE MAINNET
HybridRequired validator-sensitive transport is active on the production Mainnet node.