BNR · bTunGsTeN · bDroP 0001
Genesis edition · 9 October 2026
Public evidence. Informed consent.
Our first bDroP begins with a commitment to preserve what was observed without pretending it establishes more than it does.
Preserve reproducible findings and measured results. Keep observed behavior separate from inferred consequences.
Public experimental code stays public. Findings follow the BNR Auditors issue protocol. This record is not a substitute protocol, a security certification, or an announcement that upstream issues have been filed.
The experiment and its limits
RB01 is an experimental benchmark adapter. Its functional and performance results do not establish suitability for sensitive data or production use.
RB01 is the Swanky circuit-PSI benchmark lane associated with BNR PR #372. PSI means private set intersection: the experiment compares inputs using a privacy-oriented protocol. A measured result from that experiment is not, by itself, evidence that the complete composition is secure. [S1]
The public upstream revision examined for this record is:
GaloisInc/swanky@409d1ceb0831e2de11eb8da1b8f961f59a8b5276
The associated BNR provider revision previously inspected in this review is:
beehive-nature/beehive-nature@f43ffdcd3f756b983289a692fdf1576240510d78
These are revision identifiers, not claims about either repository's current head. [S1–S3]
Observation is not inference
The constructors initialize separate RNG consumers from the same seed. The reporting seat observed overlapping streams within each party and matches between some generated bytes and protocol traffic. The security consequences remain unverified.
Item 6's security impact remains UNVERIFIED unless further evidence establishes it.
The constructor pattern is visible in the pinned PsiGarbler::new and PsiEvaluator::new source: each initializes a consumer for the garbling machinery and a retained consumer from the same supplied seed. [S2, S3]
The execution observations belong to the reporting seat. “Within each party” does not mean that the two parties share a seed with each other. This edition makes no claim of demonstrated input disclosure, secret recovery, or exploitation.
The reported findings, with their measured limits intact
Provenance: The following is an attributed synopsis of the reporting seat's synthetic-input experiments supplied for this record. The preparation of this edition did not independently rerun those experiments. The original harness files, raw logs, RNG instrument, and complete trial matrix were not supplied with this edition. This is not a self-contained reproduction bundle. [R1]
| Item | Reporting-seat observation | Boundary retained in this record |
|---|---|---|
| 1 — Unequal set sizes | With evaluator size 256, tested garbler sizes through 320 were correct in 20/20 runs. At 352, 1/20 runs panicked; at 384, 5/20 panicked; at tested sizes 448 and above, every run panicked. The reported site was oprf-kmprt lib.rs:211. No run in the reported sweep produced a wrong count. | Observed trial outcomes, not a safe-size ratio or an estimate of all possible failures. The reporting seat identified an internal same-size comment; documentation and error handling must be assessed against that precondition. The full tested-size matrix is not included here. |
| 2 — Repeated garbler elements | Debug builds panicked at oprf-kmprt lib.rs:202. The reported release runs did not finish within 60 seconds. Direct use of swanky-oprf-kmprt showed the same behavior. Sampling located repeated execution in the resampling loop at lib.rs:243, with 14.25 million RNG draws in 10 seconds in the sampled run. | Duplicate values violate set semantics. Preserve the input shape, debug/release difference, measured timeout, and loop evidence separately. A finite timeout is not itself a proof of nontermination. |
| 3 — Repeated evaluator elements | Two copies counted as two; three counted as three. Four copies did not complete in the reported reproduction. Sampling located repeated execution in the cuckoo key-refresh loop at receiver.rs:110. | Keep cardinality behavior distinct from the four-copy non-completion. Do not infer multiset support or merge the two parties' different loop mechanisms into one explanation. |
| 4 — Empty evaluator set | Both parties panicked: a garbler-side divide-by-zero at cuckoo.rs:133 and an evaluator-side size assertion at bit-matrix-transpose lib.rs:83. Both sets empty also panicked. An empty garbler set with a nonempty evaluator set returned zero. | Both parties' failures belong in the record. Correctly returning zero in the opposite empty-set configuration does not erase those failures. |
| 5 — Variable-length input encoding | [01] and [01 00] encoded to the same value. The reporting seat traced the encoding function to the PSZ, PSTY, and circuit-PSI paths. | Report an input-encoding ambiguity for variable-length keys, not a demonstrated cryptographic hash collision. The example does not establish this particular ambiguity for a fixed-width input domain. |
| 6 — Reused seed across consumers | The source initializes separate consumers from the same seed. The reporting seat observed identical streams within each party and matches between some generated bytes and protocol traffic. Its garbler instrument recorded an identical initial 29,728 bytes across the two consumers. | The source pattern was inspected separately for this edition. The instrumented measurements remain attributed execution evidence. Security impact: UNVERIFIED. No private-input exposure or attack outcome is claimed. |
A successful characterization test can demonstrate that it detected a failure. It does not turn the affected behavior into a passing security result.
The next evidence record should link the actual reproducible harness, toolchain and lockfile identifiers, input fixtures, commands, raw outputs, and exit statuses. Missing artifacts remain named as missing; they are not replaced by invented receipts.
Informed consent always with an operation
Informed consent always with an operation.
Before execution, disclose the operation's purpose, data handling and recipients, established results, unresolved risks, resource and cost bounds, and reversibility. Execution must remain within the authorized scope. Existing bounded authorization can cover repeated operations; a material expansion must not happen silently.
Consent to an experiment is not consent to every future use of its data. Consent also does not transform UNVERIFIED into PROVEN, replace another participant's consent, or establish production suitability.
Public experimental code and public evidence do not require publishing real private inputs, credentials, or session secrets. This record contains the supplied synthetic-experiment synopsis, not anyone's private dataset.
Eternal means preserving the record and its corrections
For this bDroP, “eternal” names the continuity commitment: preserve the original edition, identify its exact bytes, and link later corrections and new evidence rather than silently replacing what was said.
BNR's existing Hive-debut document already calls for a SHA-256 record of the text and for edits to fork rather than silently mutate. This edition follows that publication principle; it does not declare a new BNR issue protocol. [S4]
A blockchain publication can record that a statement was published. It does not prove that the statement is true. Long-term availability remains a preservation responsibility, not a guarantee supplied by the word “eternal.”
Future evidence may strengthen, narrow, or refute today's interpretation. Preserve that change as part of the public record. Until supporting evidence establishes item 6's security consequences, its impact remains UNVERIFIED.
Public code. Public evidence. Explicit uncertainty. Execution within informed consent.
Sources and provenance
[S1] BNR RB01 provider, pinned revision. Provider source. PR #372 is a discussion link, not an immutable receipt or an assertion of its current status.
[S2] Swanky garbler constructor, pinned revision. PsiGarbler::new.
[S3] Swanky evaluator constructor, pinned revision. PsiEvaluator::new.
[S4] Existing BNR Hive publication principle. BQUEENBEE_HIVE_DEBUT.md. This source supplies the version-preservation principle, not the separately named BNR Auditors issue protocol.
[R1] Reporting-seat narrative supplied by the publisher in the preparation conversation. The numerical outcomes and runtime observations above are preserved from that narrative. No public URL for the original execution receipts was supplied. The table is a synopsis, not a verbatim raw log. No upstream submission, response, fix, or independent execution is asserted by its inclusion.
Provenance: AI-assisted drafting and source inspection. The reporting seat's measured observations, source-visible construction, and unverified security consequences remain explicitly distinguished.