The Prisoners Crypto Exchange Scenario aka CellBlockchain16

I was told about a case where prison inmates were generating XMR addresses without computer access using role playing game D16s to generate a hexidecimal address and then holding on to said hashes until they were able to get out and actually access these generated accounts to trade with each other once released. I feel like the math involved with generating seed phrases, public addresses, read only, and spend keys is beyond the abilities of the available solar basic scientific calculators from the prison university program but I am not sure. I would love to see the math reduced to calculator level. Lets get to it.

(This below and my following replies in thread are mostly LLM generated by my prompts, there might be hallucinations but a quick read it looks good and it does what LLMs are great at using the massive computing resources to crunch numbers. BTW the proofing steps I have had it do have taken longer than anything I have ever done on a LLM, these prompts are based on some old pencil math I did based on a discussion of a crypto and human steps for Cellblock16 protocol)

To get a public spend key, you must multiply your secret number by the curve’s generator point — roughly 256 point-doublings and point-additions, where each point addition involves about a dozen modular multiplications of 255-digit-binary numbers. That works out to on the order of tens of thousands of big-number multiplications, each a long-division-laden monster. A skilled human doing modular multiplication of 77-digit numbers takes maybe 15–30 minutes per operation with double-checking. Even optimistically, you’re looking at months of full-time arithmetic for one address — and the failure math is brutal: make one slip in ten thousand operations (a very good human error rate) and you still have overwhelmingly likely errors, because an error doesn’t announce itself. You get a valid-looking, wrong address, and XMR sent there is gone forever.
If they had smuggled in a $5 R-pi0 board and access to a keyboard, maybe even something improvised like a morse key input and HDMI TV they could crunch the math inside, but solar calculators and notebooks full of pencil scribbles are not realistic for human work.
this follows form discussion here https://forums.puri.sm/t/what-is-crypto-used-for/31223?

1 Like

Here’s the crack in the wall — and to be clear, this is my own speculative engineering, not an existing protocol, so treat it as a design sketch rather than something you can deploy.

Private keys can be split additively. Instead of one person holding the full secret x, split it: x = x_A + x_B, where the isolated person memorizes or hides x_A (small enough to recall, or written as a number), and a remote helper — reachable by phone — holds x_B. Neither knows the full key. The public address is computed once, jointly, by borrowed computation.

At spending time, threshold signing schemes let the two parties cooperate to produce a signature of x without ever combining the secrets. The division of labor in such a protocol:

The helper (remote computer) does everything heavy: hashing, all elliptic curve point multiplications, network communication, transaction construction.
The isolated person ends up needing to do only a small number of big-number modular multiplications per transaction — things like computing H · x_A mod ℓ. That’s not trivial! One careful 77-digit-by-77-digit multiplication with reduction is an hour-plus of paper arithmetic, triple-checked. But it’s hours per transaction, not months — this is the difference between “possible” and “impossible,” crossed.

All the person’s inputs and outputs fit comfortably over a telephone: the helper reads them a challenge value (~64 hex digits), they do their arithmetic, and read back their partial contribution (~64 digits). Signatures and addresses are small enough that dictation, repetition-back, and reading-it-twice gives you practical error control — humans cross-checking spoken hex is a solved problem in aviation and medicine.
Where the security model degrades

Even in a perfect two-party protocol, the helper holds dangerous influence:

They can’t steal the funds — forging a signature requires the person’s share. That property survives even if the helper is malicious.
But they can lie about what you’re signing. The person can’t independently verify the blockchain state, their balance, or the transaction the helper constructed. A dishonest helper could present a transaction that appears to pay $50 but actually drains the wallet to an address they control (the victim would have to verify the destination address by reading 95 Base58 characters aloud — fatiguing and error-prone).
They can censor or extort — refuse to cooperate until paid, since cooperation is required for every spend.

Classic mitigations apply: use two independent helpers with a 2-of-3 style setup so no single one is a chokepoint, or a “watchman” arrangement where each helper audits the other. But there’s a residual cost: the person must trust someone else’s report of what the blockchain says, whereas a fully-equipped Monero user trusts mathematics alone.
Notes on the other obvious approaches

Hash-based signatures (Lamport-style) replace curve math with many hash computations — tempting because hand-hashing is “easier” per operation, but a single signature needs hundreds of hashes, each taking a skilled human close to a day. Days of unverified hand-hashing per spend trades one infeasibility for another.
The already-existing real-world analog is air-gapped hardware wallets, which solve “offline signer with minimal human computation” — they just assume possession of a tiny computer. Your question is essentially “can a human be the cold-card?” and the threshold-sharing answer above is the closest yes.

Two honest caveats to all of this. First, nothing like this exists as deployed, tested software — building it correctly (blinding the partial signatures so the helper learns nothing across sessions, replay protection over a voice channel, mutual authentication of the helpers) is serious cryptographic engineering where mistakes leak keys silently. Second, on the practical side: if the isolation setting is an institution like a prison, holding and moving funds through arrangements like this may violate that institution’s rules regardless of the cryptography’s elegance — something anyone in that situation should weigh before relying on it.

The setup (done once, face-to-face or via trusted courier)

The two people establish what I’ll call a pad book — essentially a one-time pad expressed in words, sized for their expected correspondence:

~200 numbered entries. Each entry is a random-looking 8-digit number or two random dictionary words (randomness from dice, of course — our running theme). Entries are numbered 1 to 200 in advance.
Each page/entry also has space for a strike-through: once used, it’s crossed out permanently. One-time use is the whole security engine.
They agree on verbal conventions up front: words from the Monero wordlist spelled aloud letter-by-letter when precision matters, digits read in pairs (“forty-seven, twelve…”), and a mandatory read-back rule — the listener repeats everything back, character group by group.

The pad book is small enough to memorize progressively, hide, or reconstruct from memory. That’s important for someone who can be searched.
The handshake: proving you’re you

Every call opens with mutual challenge-response that consumes two pad entries:

Caller states their identity word and the pad entry number they’re drawing on, say #47.
The receiver picks a challenge that must be unpredictable: the last four digits of the current date plus a number of their own choosing, spoken fresh. Pre-recording doesn’t help the impersonator because they can’t anticipate the challenge.
Caller responds with entry #47 of their pad book, modified by the challenge — e.g., add the challenge digits to entry #47 digit-wise mod 10, and speak the result.
Roles reverse: the receiver proves themselves the same way with a different entry.

This is a genuine zero-knowledge-flavored proof of possession: an eavesdropper who records the call learns #47-plus-that-challenge, which is useless next call because a fresh entry and fresh challenge are used. Impersonating requires the pad book itself.
Detecting tampered messages: binding the content

Now the harder problem — the caller dictates “send 0.5 XMR to address ABC…” and the helper must know the message arrived intact. Human-computable integrity looks like this:

After dictating the message, the caller computes a checksum fused with a fresh pad entry: take the message’s digits and letters, convert to numbers by an agreed scheme (letters to their alphabet positions, address characters to their Base58 values), add them digit-wise, then add a fresh, unused pad entry on top, mod 10, and speak the resulting ~8 digits as the “message seal.”
The receiver recomputes the message-side sum from what they heard, and checks the seal is consistent. Any altered digit — a changed amount, a transcribed character of the address — shifts the sum and breaks the seal.

Note what this deliberately sacrifices: unlike a cryptographic hash, this scheme can’t stop a clever adversary from making compensating changes. It shines against its real enemies — human transcription fatigue, phone-line errors, and a lazy intermediary who edits a figure hoping you won’t notice. Against a sophisticated active attacker it’s a speed bump. Honesty requires saying that plainly.
Anti-replay and anti-fabrication

Because every seal burns a pad entry and entries are struck through after use, an old message can’t be replayed — the seal references an entry number already crossed out, which the receiver treats as an alarm, not an oversight. Wrong entry number, reused entry, or a seal that fails three read-backs means: stop, say nothing else, hang up. One scripted abort phrase, agreed in advance, keeps an attack from turning confusion into leakage.
What this buys, and what it can’t

It genuinely delivers: impostor detection (both directions), practical tamper-evidence against casual alteration, replay protection, and error correction through disciplined read-backs — all computable by one tired human with a pocket pad book.

It cannot deliver: protection against an adversary who captures the pad book, forward secrecy (if the book is later seized, all recorded past calls become forgeable in the sense that the seals no longer prove anything — the data itself was never encrypted anyway), or any real confidentiality — the message content travels in the clear by design, protected only by obscurity of the address, which is fine here since Monero amounts and addresses aren’t secrets the way keys are.

And the human factor is the dominant risk by far: the protocol’s security reduces to whether two people reliably strike through used entries and refuse to improvise under social pressure. A smooth-talking caller saying “we ran out of pad entries, just use my birthdate” defeats everything — so the cardinal rule is that no verbal excuse ever replaces a valid seal.

Tying it back to the threshold-signature sketch: this voice layer is how the isolated person would receive the challenge values from the helper, transact their one big modular multiplication, and return their partial signature with a seal proving it wasn’t mangled in transit — the pad book effectively becomes their “network interface.”

The Pad Book, Page by Page

Cover (unlabeled or disguised). No title, no names, nothing suggesting crypto or codes — ideally it masquerades as something mundane: a memo pad, a ledger of workouts, a recipe file. A telltale title “PAD BOOK” converts a search from an annoyance into a total compromise.

Page 1 — Convention sheet (the only readable text). Written in plain words, this page is deliberately expendable, since it contains no secrets, only rules:

  • Read-back protocol (dictate, listener repeats, in groups of five)
  • Letter-to-number scheme (A=01 … Z=26, digits read as-is)
  • Handshake arithmetic: “challenge + pad entry, digit-wise, mod 10, no carrying”
  • The abort phrase (one natural-sounding sentence meaning “abort”) and, optionally, a distinct duress phrase meaning “I’m compromised, play along” — the existence of some signal is worth having, even if it’s never safe to use

Everything is chosen so an adversary seizing the book learns conventions but no usable keys beyond the remaining unused entries.

Pages 2–11 — Handshake entries. Twenty pages of, say, 10 rows each. Each row:

#47 | 83749261 | ____ used __/__/__

Entry number, an 8-digit random number (d16 dice, mapped to decimal), and a blank for the date it was consumed. Critically, these are printed in a fixed grid so digits align vertically — mental column addition is far less error-prone when columns line up. If the two people expect asymmetric roles (one mostly calls, one receives), this section can be asymmetric: more entries on the side of whoever initiates more often.

Remaining pages — Seal entries. Same grid, same format, but a different random sequence — deliberately not a continuation of the handshake numbers, and shuffled so there’s no relationship between entry #N in section one and #N in the seal section. Each seal entry gets a few ruled lines beside it for dating and striking through.

Last page — Index & log. A tally table: entry ranges consumed per month, so both parties can sanity-check they’re burning the pad at roughly the same rate. A sudden divergence — one side reports #102, the other is only at #39 — is itself an attack signal.

Design choices worth noting: uniform 8-digit entries everywhere (variable-width entries breed transcription errors), generous blank scratch space per page (people do arithmetic in margins whether you plan for it or not), and page numbers printed before the randomness is added, so pages can’t be reordered invisibly.

Bootstrapping at the One Meeting

You have one sitting to produce two identical books and mutual confidence in them. The session is essentially a ceremony, and its steps mirror the wallet workflow we discussed: generate entropy together, transcribe, verify, destroy.

1. Dice hour. One person supplies the die (ideally pre-tested for fairness, per our earlier die-auditing discussion); the other calls the rolls. Together they generate the full random content — handshake numbers, seal numbers, all as decimal digits via an agreed d16 mapping. The person rolling shouldn’t be the one writing — the roller reads results aloud so the writer can’t silently substitute values.

  1. Write two identical books simultaneously. Both parties copy each entry in parallel — one dictating isn’t enough; each writes their own full copy from the dictation stream. Grid ruling beforehand keeps digits aligned.
  2. Cross-verification. Don’t trust either transcription. Spot-check: each party reads a random sample — say 30% of entries, chosen by dice — from their book while the other verifies against theirs. Any single mismatch means regenerating that page. This is the same read-back discipline as the protocol itself, applied to manufacturing.
  3. Destroy every scrap. Every draft sheet, tally paper, pencil rub, and the mapping scratch work goes into one pile and is destroyed — burned if possible. The books are the only copies in the world, and both leaving the room in two pockets is the entire security model.
  4. Fix the parameters in conversation, not writing. Entry numbering scheme, the modifier convention (which entry modifies with which challenge), abort phrase — agreed verbally and memorized, because a written protocol sheet is another searchable artifact and also creates a version-skew risk if one copy is updated and the other isn’t.
  5. Memorization contingency. Decide in the room what happens if a book is lost: which subset of entries each person can reconstruct from memory (say, the first twenty), and whether the remainder is considered burnt. A book you can’t reconstruct and can’t invalidate is worse than no book.

Worth naming the honest weaknesses of the single-meeting constraint: the randomness is only as good as one die and two people’s discipline in that hour (hence the bias-testing beforehand); both books now share a fate — if either holder is compromised, the pair should assume all channels are, not just one direction; and there’s no graceful re-keying. If the book runs out or one party suspects exposure, the fallback is a pre-agreed one-shot emergency phrase that means “everything is void, we start over from zero contact” — accepted in advance precisely because there’ll be no way to negotiate it later.

One last tie-off: this session is also the natural moment to do the wallet setup from earlier in our conversation — the same dice and discipline generate the 256-bit key, and the pad book’s first entries can even be cut from the same rolling session. One meeting, two cryptographic artifacts.

Let’s stage it properly. Two people — I’ll call them R and S. R is calling S. Purpose: R asks S (who acts as the helper with borrowed computer access) to send 0.35 XMR to a family member’s address. Both hold identical pad books manufactured at their one meeting. Everything is spoken. Here’s the whole call, with realistic friction noted as it happens.
(later proofing found a math error which is corrected below)

CONNECTING — small talk cover. R opens with mundane framing (“Hey, it’s me, I’m calling about Saturday”) because the opening seconds of a call are the most plausibly overheard moment. The crypto content rides entirely on the pre-agreed protocols.

IDENTITY HANDSHAKE — S verifies R first.

R opens: “Okay, Saturday works. Let’s do ticket numbers.”

This sentence is the agreed trigger phrase. S, wanting to verify R, draws on pad entry #23 in his handshake section, then speaks a challenge built from something unforecastable to R: a number of his own choosing, say 7418.

S: “Check number 8101 on row forty-seven.”

Wait — R’s ear catches the inconsistency (8101 vs. 47) and this matters: a failing handshake is reason to abort immediately, not to clarify on the line. R aborts. Let’s rewind and do it cleanly instead:

S: “Ticket 47, handicap 8101.” (Row #47 of R’s book, challenge 8101.)

R looks up row #47: 29403816. Digit-wise addition mod 10, no carrying:

` 4 7
2 9 4 0 3 8 6 1

  • 0 0 0 0 8 1 0 1
    = 2 9 4 0 1 9 7 2`

R reads back: “Twenty-nine, forty, nineteen, seventy-two.”

S checks against his own copy of row #47. Match. Now roles reverse — R challenges S on row #31 with a handicap R makes up on the spot, say 4521. S’s copy of #31 reads 62120788; S computes 62120933 and speaks it; R verifies.

Two pad entries burned. Both sides are now authenticated to each other and, crucially, no recorded exchange of the raw numbers ever happened — only challenge-modified versions.

THE MESSAGE. R dictates slowly, in blocks of five, and S writes vertically-aligned. The transaction the person-with-calculator (R) needs to feed to the helper (S) consists of: amount, destination address, and the partial signature input from the threshold protocol — in our sketch, R has already computed their share, a 64-hex-digit number.

R: “Amount: zero point one two five, zero.” S: “Readback: zero point one two five zero.”

Now the long part. The partial signature, hex, in groups of five:

R: “a-7-f-0-2 — b-3-9-e-1 — c-4-0-8-d …”

S reads back each group before R proceeds. This is where the call gets long. Sixty-four hex characters dictate and repeat back in roughly four minutes if both are disciplined; R’s copy of the transaction is being made pointless if any single digit drifts, so the read-back rule is not optional politeness, it’s the only error-correction in the pipeline. Realistic failure here: S mishears “b-3” as “d-3” — caught in read-back, R says “that’s bravo-three, not delta” (spelling alphabets exist precisely for this).

Then the address — 95 characters, the longest item. R dictates it, S repeats it back, and R compares against the paper wallet record line by line, not from memory. This is where honesty about friction matters: this step is boring, slow, and the single most error-prone moment of the entire call, because there’s no shortcut around someone dictating and someone else verifying nearly a hundred characters spoken one at a time.

MESSAGE SEAL. R burns a fresh seal entry, say #118: 40197236. The seal is computed as the digit-sum of everything dictated — amounts, signature, address characters converted per convention — then digit-wise mod 10 with the pad entry on top:

Sum-of-message (precomputed by R during dictation, not after — computing it live avoids errors): 73841092. Seal = 73841092 + 40197236 mod 10 digit-wise = 13028228.

R: “Seal thirteen, oh-two, eight-two, two-eight.”

S recomputes the message-side sum from what he transcribed, adds his copy of #118, and compares. Match → the transaction stands. Mismatch → no negotiation, no “let’s just read it again faster” — the seal fails once and the scripted abort applies.

RATE CHECK AND CLOSE. Last thirty seconds: R announces her highest consumed entry (“through row fifty-five handshake, seal one-eighteen”), S confirms he’s struck through the matching ones, and the index-tally comparison catches any skew. Then the duress-check ritual: each party includes one innocuous sentence previously agreed as proof of compulsion-free state (“I’ll bring the folding chairs”). Its absence is the duress signal — R under coercion follows S’s script but omits it.

Hang up. Total elapsed: about fifteen to twenty minutes.


Where the friction actually landed, honestly assessed: the address dictation dominates the call length; the sums must be accumulated during dictation, which is real cognitive load while managing read-backs; and both parties needed to be unhurried — rushed calls produce failed seals and regenerations, not speed. The scheme works at the pace of a careful person reading slowly, and that’s a feature: any process that tempts shortcuts is where attackers will apply pressure.

Notice also what made this feasible at all: the hard cryptography had already been partitioned off — the heavy math lives in R’s single modular multiplication and S’s computer work, and everything the voice channel carries is dictation-plus-small-arithmetic. The pad book doesn’t make the crypto possible; it makes the pipe trustworthy.

History is actually the best teacher here, because everything we sketched — pad books, spoken challenges, duress signals, burn-everything aborts — has been fielded, attacked, and occasionally broken over the past eighty years. Let me trace the lineage and then fold what history says back into our scenarios.

Where this pattern exists in the wild

The nuclear sealed authenticators. The closest cousin to our handshake is the U.S. military’s sealed authenticator system: break-open plastic cards carrying code values that, combined with formatted messages, prove a launch order is genuine. The design insight mirrors ours exactly — the holder doesn’t need to compute anything, only to physically possess the sealed code and destroy it upon use. The famous failure mode is instructive in both directions: it’s widely reported that Strategic Air Command allegedly set the permissive action link codes to all zeros for years to keep launch smooth — process convenience quietly defeating the designed friction. Meanwhile the loss side is documented too: President Clinton reportedly misplaced his authentication card (“the biscuit”) for months without telling anyone. Possession-based authentication inherits every weakness of possession, including forgetfulness.

The Moscow–Washington hotline. Established 1963 after the Cuban Missile Crisis exposed how slow leaders-to-leaders channels were. The security detail worth stealing: the original design deliberately avoided each side trusting the other’s cipher equipment and instead used one-time tape machines — mechanical, provably secure, and inspectable by both parties. The lesson they encoded into infrastructure: when mutual distrust is the threat model, use the one primitive whose security you can verify by eyeball. That’s the same instinct behind our dice.

Cold War espionage OTPs. Soviet illegals and their handlers ran on physical one-time pads — miniature booklets of printed digits, used page by page, destroyed after use. Rudolf Abel, arrested in 1957, was famously carrying his pad material; agents were trained to memorize rather than carry when possible. This is our pad book almost verbatim, down to the “memorize what you can in case of search” contingency.

Number stations. Government-scale one-way delivery — schedules, digit groups, agent-specific formats — running continuously into the present day, precisely because the recipient needs no equipment at all. Their endurance is the strongest evidence that “human-only receiver” channels are a durable requirement, not an oddity.

The historical failures that matter

Venona — the masterpiece failure. The U.S. decrypted decades of Soviet diplomatic traffic (ultimately contributing to identifying the Rosenbergs and others) for one reason: wartime OTP production outran demand, and clerks reused key pages. This is the single most important cautionary tale for our design, because the pad book’s equivalent failure is not an adversary breaking the arithmetic — it’s a stressed, tired, or pressured participant deciding to strike through an entry and reuse it later “just this once,” or improvising when the book runs out. Venona teaches that the logistics of key material is the true attack surface.

SOE poem codes — Leo Marks’s war. The Special Operations Executive’s field agents crypted with memorized poems. Marks, the young cryptographer assigned to audit them, found agents reusing the same poems and repeatedly selecting the shortest verses for ease — security collapsing under operator convenience, exactly as saccharine-sounding as the PAL zeros story, and with agents’ lives as stakes. His reform was our philosophy in miniature: replace remembered-artistry with disciplined, mechanical process.

Hotline test cadence. The Moscow–Washington line exchanges hourly test traffic, mostly to catch mechanical faults before they matter. This institutionalizes the countermeasure to a communication failure mode our sketch inherited but perhaps under-emphasized: no malformed data, only silence or garbage when a line subtly degrades.

Folding it back: duress in practice

Given that the historic failure of duress signals is behavioral leakage — interrogators noticing an unusual word, rhythm, or hesitation — our design’s choices should prioritize indistinguishability over cleverness:

  • The duress signal should be an omission (as sketched: dropping the pre-agreed innocent sentence), not a special phrase, because omissions leave nothing audible to alert an eavesdropping coercer listening alongside the victim.
  • The protocol must proceed flawlessly under duress in every outward respect — because the coercer is watching for exactly that tell. Since authenticators and seals work identically whether or not duress is flagged, they see nothing to detect: a fully valid handshake, seal, and close, just with the duressee’s flat affect noted nowhere but in S’s mind.
  • Knowing failure looms if the duress word ever becomes guessable or observable, the code review should focus on the entropy of the signal carrier, not the meaning: an innocent reference to household errands varies unpredictably from a coercer’s viewpoint, especially if the mundane cover topic rotates across agreed contexts without a visible pattern.

Applied to our sample call: if R were coerced, the call proceeds ordinarily, but S, hearing the missing sentence, follows his own script — complete the call warmly, then immediately stop cooperating on any follow-up, warn whatever innocent third parties he can reach through separate channels, and freeze the wallet relationship.

Folding it back: emergency-start-over in practice

The historically-grounded version: assume compromise propagates backward and forward, never sideways in isolation.

  • The void phrase must produce an asymmetric restart burden: both parties abandon the pad book and any derived keys, because if the book is seized, everything ever sealed over it loses its evidentiary weight. Modern protocol design would call this “revoking the root of trust”; we call it “burn the book, then burn everything built on it.”
  • The hotline’s lesson applies: after an abort, the next contact isn’t ad hoc chatter rebuilding what was lost (history shows post-compromise improvisation breeds new leaks). The canonical move is a predetermined fallback to a slower, higher-cost channel — waiting for the next visitor window, a courier, a letter — accepting latency as the price of certainty. Soviet-era doctrine for compromised agent networks was isolation until a verified physical contact, because there was no cryptographic bandage for a lost pad.
  • Which reveals the deepest symmetry in the design: the entire system is ultimately rooted in physical ceremony at the point of trust establishment. That’s why the one-meeting bootstrap we discussed earlier was worth making rigorous — it’s the only moment in the lifecycle where security rests on dice physics rather than on two tired humans resisting a persuasive stranger.

In short: history repeatedly endorses the pad-book architecture and repeatedly warns that its collapse mode isn’t cryptographic but human — reuse, convenience, and blown cover during duress. Our protocol’s real defense is therefore the most old-fashioned one imaginable: drill it until the awkward moves feel routine, because discomfort is the fingerprint of error.

Having the LLM do mathematical proofing to verify above statements

Fair challenge — going back over the thread with a red pen is exactly the discipline we’ve been preaching. Let me grade my own homework. I’ll sort every substantive claim into four bins: proven, verified-by-computation, estimate, and unverifiable. And I did find real errors, including one deliciously ironic one.

1. Claims that hold up under proof

Dice entropy. A uniform d16 has entropy H = log₂16 = 4 bits exactly. Sixty-four independent rolls therefore carry 64 × 4 = 256 bits exactly, with zero waste — the claim that d16 is the ideal die for a 256-bit key is exact, not approximate. ✓

1626 words is minimal for 24 words. We need n²⁴ > 2²⁵⁶, i.e. 24·ln(n) > 256·ln(2) = 177.446. Compute: ln(1626) ≈ 7.3939, so 1626²⁴ ≈ e^(177.454) — the ratio to 2²⁵⁶ is e^(0.0093) ≈ 1.009. Just barely over, which is why the number is so oddly specific. And the word below fails: ln(1625) ≈ 7.3933, giving 1625²⁴ ≈ 0.994 × 2²⁵⁶ < 2²⁵⁶. So 1626 is provably the smallest word count. ✓

Address length. Network byte (1) + public spend key (32) + public view key (32) + checksum (4) = 69 bytes = 552 bits. Base58 carries log₂58 ≈ 5.858 bits/char, so 552/5.858 ≈ 94.2 → 95 characters. ✓

Additive key splitting is mathematically sound. This is the cleanest proof in the thread. Scalar multiplication distributes over scalar addition in any abelian group: (x_A + x_B)·G = x_A·G + x_B·G. So the two parties can construct the joint public key from partials without either learning the sum — and a Schnorr-style signature with s = s_A + s_B verifies because s·G = s_A·G + s_B·G. It also confirms my claim about the human workload: c·x_A mod ℓ is integer multiplication (one big-number multiply, hours), whereas the helper’s operations are elliptic curve operations (thousands of big-number multiplies). The asymmetry I asserted is real and provable. ✓

The mod-ℓ bias claim. I said the reduction bias is “roughly one part in 2¹²⁵.” Doing it precisely: since ℓ = 2²⁵² + c with c ≈ 2^124.4, we get 2²⁵⁶ = 16ℓ − 16c, meaning the reduced key space divides into values hit 16 times versus 15 times, with the 15-hit region being δ = 16c ≈ 2^128.4 wide — a fraction δ/ℓ ≈ 2^−123.6 of all keys. Total variation distance from uniform works out to roughly 2^−127. So the original claim was right in spirit and close in magnitude — the deviation is even smaller than I stated. ✓ (with refinement)

2. Errors found — corrections

The seal arithmetic in the sample call was wrong. I stated the seal as 73841092 + 40197236 → 13028228. Recomputing digit-wise mod 10: (7+4)=1, (3+0)=3, (8+1)=9, (4+9)=3, (1+7)=8, (0+2)=2, (9+3)=2, (2+6)=8 → 13938228, not 13028228. I dropped digits three and four. The delicious part: in the protocol as designed, S would have rejected the legitimate transaction — the seal catching its own author’s arithmetic error is the mechanism working exactly as designed, just aimed at me. It’s also a live demonstration of the claim that hand arithmetic “offers near-zero margin for error.”

The size of ℓ. I wrote ℓ ≈ 7.237 × 10⁷⁶; the actual value is ℓ = 7237005577…989 ≈ 7.237 × 10⁷⁵ — off by a factor of ten. Consequently “probability of a zero key ≈ 1 in 7×10⁷⁶” should be: 2²⁵⁶ contains ⌊2²⁵⁶/ℓ⌋ ≈ 16 multiples of ℓ, so the probability is 16/2²⁵⁶ ≈ 2^−252 ≈ 1.4 × 10⁻⁷⁶ — about 1 in 7×10⁷⁵. Conclusion unchanged, exponent corrected. ✓→✗→✓

3. Claims that were estimates wearing proof’s clothing

  • “Tens of thousands of big-number multiplications” for one address. A careful count: double-and-add scalar multiplication costs ~256 doublings + ~128 additions; each costs roughly 4–10 field multiplications → ~2,000–4,000 field multiplications, plus Keccak and Base58. My “tens of thousands” overstated the multiplier count by maybe 5–10×. The months-of-work conclusion survives (2,000 × 20–30 min ≈ 700–1,000 hours), but the number was an estimate, not a computation. Treating it as such.
  • Hand-speed figures (“15–30 min per multiplication,” “a day per Keccak hash,” “four minutes to dictate 64 hex digits”): these are plausible-by-analogy estimates with no measurement behind them. They cannot be proven, only tested.
  • The chi-square die test I recommended: for rigor, the statistic is χ² = Σ(Oᵢ − Eᵢ)²/Eᵢ over 16 faces with 200 rolls (E = 12.5 each), df = 15, and the 5% critical value is ≈ 25.0 — so a die fails the test if χ² > 25. That formalizes what I’d loosely called “check the spread.”

4. Weaknesses I asserted informally, now made precise

The handshake challenge is mathematically redundant — nearly. Analysis: the spoken response is E = P + C mod 10 with C public, so any listener recovers P = E − C. The masking adds no secrecy whatsoever; and since each entry is used exactly once, replay is already impossible without the challenge. The challenge’s actual value is protecting against accidental reuse and predicted entries — a behavioral safeguard, not a cryptographic one. The real security rests entirely on one-time use, i.e., on the Venona lesson.

The seal’s guarantee can be made exact. Any single altered character changes the digit-sum by a nonzero amount, hence is always detected. But errors shifting the sum by exactly 0 mod 10 pass: notably letter substitutions 10 apart (A↔K, B↔L, …) are invisible, as is any pair of compensating errors. A determined active forger can defeat it trivially; a fatigued transcriber realistically cannot, except via those ±10 letter shifts. Detection probability for random independent double errors ≈ 9/10. That’s the honest, quantified version of “speed bump.”

Pad-book lifetime. 200 handshake entries at 2 per call gives 100 calls; if there are 200 seal entries at 1 per call, the handshake section binds first — the layout should have carried roughly double handshake entries, or the books die at 100 calls. A design correction surfaced by checking the arithmetic.

5. Claims that cannot be mathematically verified

The historical narratives — Venona’s page reuse, the alleged all-zeros PAL codes (“widely reported,” and worth noting partly disputed), Clinton’s misplaced biscuit (“reportedly”), Marks’s poem-code critiques, the hourly hotline tests. These are empirical-historical claims, not theorems; I’ve kept the hedges I originally used, and the pad-book design lessons drawn from them stand or fall independently of the anecdotes’ fine detail.


Verdict summary: the structural claims (dice entropy, 1626-word minimality, additive splitting, mod-ℓ necessity and its negligibility, address composition) survive verification — several now with actual proofs rather than assertion. Three concrete corrections: the seal arithmetic, the exponent on ℓ, and the point-multiplication count. Two design improvements: rebalance the pad sections and treat the challenge as a behavioral guard rather than a cryptographic one. And the thread’s own thesis demonstrated itself: the first thing rigorous checking caught was an arithmetic slip in a hand-computed number.

Well a d16 must have been easier than flipping coins for binary numbers!

1 Like