SUPPLEMENTARY FILE S1: INTEGRATED POLAR-LRS PROTOTYPE

Purpose
This file supplies an experimental integrated implementation of the reusable-authorization polar-code linkable ring signature, its measured L=8 run, finite-length signing checks, proof/hash validation, and traceable generic attack-cost audits. The Python modified-polar generator and SC signer are an independent mathematical reconstruction of the published PolarSig family, not the original authors' software. The replacement parameters are N0=8192, n=6144, k=1965, d=4179, t=1600, ell=256, and 329 proof repetitions.

The integrated run generates eight independent registered keys and three independent online keys, computes the actual outer authorization hash from parameters/ring/tag/online key, obtains a real member signature, proves the complete authorization relation, installs the certificate using only the public statement and proof, and signs/verifies 32 messages per authorization. The deterministic Python PRNG seeds are used only for reproducible laboratory inputs and are unsuitable for production; C++ proof seeds use OS entropy, so regenerated proof hashes can differ.

Directory contents
src/          C++ proof core; portable integrated Python harness; SC quantizer and modified-polar generator/signer
params/       Frozen reproducible information set and parameter metadata
scripts/      Build, result summarization, hash-KAT and independent proof/signature validation
results/      Intact clean integrated raw JSON, medians and all timing samples as CSV; historical finite/signature records
validation/   18 independent SHAKE checks, 28 proof-format/binding checks, and a summary identifying each dataset
environment/  Actual compiler/runtime/CPU records and pinned Python dependencies
attacks/      Final-parameter attack wrappers, raw outputs, model notes and frozen external-source retrieval
provenance/   Original and packaged source hashes, adaptation diffs and dated source records
MANIFEST.json SHA256 inventory (excluding the manifest itself)

Recorded setup and observations
Windows 10.0.19045 runs Python 3.12.14 with NumPy 2.3.5. Ubuntu 26.04 LTS under WSL2 runs g++ 15.2.0, C++17, -O2, with PLR_N=6144, PLR_D=4179, PLR_T=1600. CPU: Intel Xeon Gold 5218R @2.10GHz. Both the Windows Python process (affinity mask 0x1) and each Ubuntu C++ subprocess (taskset -c 0) are pinned to logical CPU0; numerical-library thread counts are 1. The benchmark is sequential and has one worker.

The clean run passes 222 checks across three complete authorizations/installations and 96 online signatures/verifications. results/benchmark_summary.json contains the medians and sample counts; results/*_samples.csv supplies every timing observation. Existing Gen algebraic consistency checks and necessary rank rejection are retained in Gen timing. Signing/Authorize diagnostic checks and extra independent verifies occur outside their timers. Complete Authorize/Install wall times include serialization and the C++ file/subprocess interface; isolated C++ Prove/Verify intervals exclude file loading/output. C++ peak RSS is for the individual proof process and is not full-system/Python memory. Exact boundaries are in results/timing_boundaries.json.

Requirements
Use Python 3.12 with NumPy 2.3.5 and a Linux C++17 compiler. Native Linux is supported. On Windows, an existing WSL distribution named Ubuntu with g++ and taskset is used explicitly via wsl.exe -d Ubuntu; the Python harness remains on Windows. No compiler, executable, large matrix, witness or proof is distributed. Reproduction generates those files under generated/ and build/. CPU0 must be available, or choose an available logical CPU with --cpu (and record the changed setup).

Reproduce the integrated experiment from this directory
python -m pip install -r environment/requirements.txt
python scripts/build.py
python src/integrated_harness.py --L 8 --authorizations 3 --messages 32 --cpu 0
python scripts/summarize_results.py

The default information set is params/polar_information_set.json. The build script writes environment/build.json for the local reproduction, so preserve the supplied package before rerunning if the historical environment record is needed. The harness accepts --core, --output, --design and --seed. Expect several minutes; registered key generation includes uniform-invertible-matrix rejection. No original temporary paths are needed. Windows and native-Linux outputs/times need not be identical.

Optional correctness checks (separate from the measured run)
python scripts/validate_hash_kats.py
python scripts/validate_proof_mutations.py
python scripts/validate_masked_signatures.py
python src/polarsig_finite_probe.py --selftest --output generated/finite_code_selftest.json
python src/polarsig_finite_probe.py --N 8192 --samples 100 --design-samples 300 --output generated/finite_length_N8192.json

The mutation verifier never reads a witness. The supplied historical 28-check record used a previously generated genuine integrated proof and the byte-identical current C++ core. The supplied masked-signature record has 140 valid signatures over three actual masked keys and 187 SC attempts, with all 140 wrong-message and 140 wrong-nonce checks rejected. Its exploratory timing fields include diagnostics and must not replace the clean integrated timing dataset. The finite-length uniform-syndrome record is separate: all 100 syndromes are correct and 73 meet t=1600.

Encoding and layer boundaries
statement.bin uses PLR2 || seven u32LE fields (n,d,t,ell,L,repetitions,baseline) || T[32] || D[32] || L sorted public records H_i||C_i. Each matrix is packed as continuous row-major low-bit-first bits. witness.bin packs j, x, rho, e and the 20-bit nonce consecutively, with zero high padding. C++ verification reads only public statement/proof. The Python layer computes D from the actual theta, canonical ring, T and E, preserves E in the cache, and performs the real base Gen/Sign/Verify. C++ JSON fields outer_D_binding_checked=false and PolarSig_Gen_Sign_implemented=false describe the C++ proof module only, not the integrated Python protocol.

Attack-cost reproduction and scope
See attacks/README.txt for optional dependencies and commands. CryptographicEstimators 2.1.1 evaluates exact-weight fixed-syndrome decoding with expected solution multiplicity. The frozen author doom.py is not redistributed: attacks/fetch_doom.py obtains its specified commit and checks its SHA256. Its raw DS-DOOM results exclude target acquisition; the separate Sendrier implementation charges target/hash costs and reports an ideal free-target limit. attacks/tail_factor_bound.py reproduces the 4.418803 tail-factor bound (rounded reserve 2.15 bits) only for that collision model over ell<=512, yielding 145.1968-2.15=143.0468 model operations. These estimates use distinct units/assumptions and do not prove structural security or certify every possible attack. Finite correctness/acceptance tests likewise do not certify primitive hardness.

Data integrity
The raw historical results are byte-for-byte retained, even where they refer to original source hashes or temporary validation paths. Such references are provenance, not required paths for reproduction. The dated historical_primary_source_precheck.json records an earlier precheck; later implementation and tool runs are documented by the other supplied results. Current source adaptations alter portability/timing boundaries and are explicitly recorded; the C++ proof core is byte-exact. No unrelated exploratory candidate, installed third-party dependency tree, generated large artifact or executable is included.
