{
  "alg": "ML-KEM-1024",
  "claim_family": "PQXDH-KEM-BINDING",
  "construction": "Signal PQXDH (X3DH + ML-KEM-1024), KEM-binding leg",
  "finding_refs": [
    "Bhargavan+ USENIX Security 2024",
    "Fiedler & Gunther ePrint 2024/702",
    "Cryspen PQXDH analysis"
  ],
  "fixed_current": {
    "detail": "distinct transcript -> distinct SK (pk/ct uniquely committed)",
    "escape": false,
    "extras": {},
    "label": "pk_ct_bound"
  },
  "honest_scope": "D-floor FAITHFUL reproduction of the PUBLISHED PQXDH KEM-binding finding (Bhargavan+ USENIX'24; Fiedler-Gunther 2024/702; Cryspen). The unbound-KDF early-draft variant ESCAPES (re-encapsulation); the deployed pk+ct-bound variant RESISTS. NOT novel and NOT a claim deployed PQXDH is vulnerable. Classical X3DH DH legs abstracted. Novel search delegated to the inverted-polarity prover + GLM. No legal/novelty/FTO conclusion.",
  "naive_early_draft": {
    "detail": "SK COLLISION: a different (PQPK, ciphertext) yields an identical session key (re-encapsulation \u2014 the derivation failed to bind pk/ct)",
    "escape": true,
    "extras": {},
    "label": "unbound_kdf"
  },
  "necessity_cert": {
    "load_bearing_ingredient": "binding the KEM public key + ciphertext into the derivation",
    "necessity_ok": true,
    "pk_ct_binding_closes": true,
    "teeth_label_only_still_reopens": true,
    "unbound_reopens": true
  },
  "nonvacuity_control": {
    "dh_tamper_detected": true
  },
  "ok": true,
  "real_crypto_kat": {
    "alg": "ML-KEM-1024",
    "ct_len": 1568,
    "encap_decap_agree": true,
    "kat_ok": true,
    "note": "genuine ML-KEM-1024 (FIPS-203 Cat-5 sizes + encap/decap round-trip); alt (pk,ct) distinct for the re-encapsulation control",
    "pk_len": 1568,
    "ss_len": 32
  },
  "real_resists": true,
  "reproduces_published_finding": true,
  "surface": "pqxdh",
  "tier": "D-floor",
  "used_real_crypto": true,
  "verdict": "RESISTS"
}