Architecture note
Security Is a Chain, Not a Label
“Post-quantum” is useful only when attached to a named layer and assumption. PayMoney's target avoids elliptic-curve authorization in the vault and notary layers. It cannot make a bank's current TLS certificate post-quantum by proving what that TLS session contained.
Layer-by-layer account
| Layer | Target primitive | What security depends on |
|---|---|---|
| Epoch and action proofs | Circle STARK over M31 / QM31 with Stwo | STARK soundness and pinned hash parameters |
| Commitments and nullifiers | Poseidon2-M31 and Blake2s domains | Collision and preimage resistance |
| Account authority | Hash-preimage knowledge and hash-based thresholds | Secret knowledge, distinct shares, complete action binding |
| Notary authorization | Stateful VaultHBSv1 hash-based signatures | Unforgeability and never reusing a signing index |
| Notary trust | Two of three independent operators | Fewer than two collude or share a failure domain |
| Aggregator selection | Hash-based indexed VRF | Hash assumptions and bonded-set liveness |
| Bank origin | The bank's TLS server-authentication stack | Whatever RSA or elliptic-curve cryptography the bank deploys |
The honest summary is therefore: the vault settlement and notary-authorization layers are post-quantum-plausible; bank-origin authenticity inherits the bank's TLS cryptography. The total system is only as strong as the weakest critical layer.
Why the notary signature is hash-based
TLSNotary provides the MPC-TLS session and transcript-commitment machinery. Its native signing path does not automatically provide the target's authorization scheme. PayMoney specifies VaultHBSv1: a stateful, generalized-XMSS construction with fixed-step, target-sum Winternitz encoding over the same pinned Poseidon2-M31 permutation used by the proof system.
That choice avoids verifying secp256k1 arithmetic inside an M31 circuit and removes a Shor-breakable notary key from the settlement path. It also creates a severe operational duty: a Winternitz signing leaf may be used once. State is advanced and durably persisted before a signature is released. If a notary cannot prove which indices were consumed, that key root must refuse to sign permanently.
VaultHBSv1 is protocol-specific, not a drop-in banking standard. Its public specification, security reduction, conformance vectors, independent audit, crash tests, rollback tests, clone tests, and concurrency tests are launch gates.
Why three notaries are not just three keys
The evidence proof accepts at least two attestations only when they bind the same adapter, request, transaction record, and normalized payment fact. One compromised notary cannot settle a false payment.
The quorum claim is meaningful only if the operators are genuinely independent. Hosting accounts, administrative credentials, durable signing state, deployment pipelines, and operational control must not create one shared compromise domain. Two colluding or jointly compromised notaries can still forge evidence; the architecture states that residual risk instead of hiding it.
What the proof actually authenticates
The circuit proves that an admitted bank adapter extracted an exact fact from authenticated HTTP response ranges in a notarized session. It binds offsets, lengths, request semantics, response structure, final status, recipient, fiat currency, integer minor-unit amount, memo, claimant, rail, adapter, and unique bank transaction identifier.
It proves what the bank interface reported. It does not prove metaphysical fiat finality. A bank that exposes a misleading status, later reverses a supposedly final transfer, rewrites the memo, or changes transaction identifiers can make a cryptographically faithful proof certify the wrong real-world assumption. Bank-specific semantic and legal admission is therefore part of security, not paperwork after it.
The privacy/security trade
External bank evidence is isolated in its own public proof class. Within that class the concrete adapter, rail, participants, amount, destination, offer, claim, and transaction stay hidden. The class occurrence remains public so ordinary vault actions do not pay the worst-case cost of a bank transcript verifier.
Hiding even that occurrence would require global maximum padding or a larger anonymity set. The target chooses sustainable proof cost and states the leakage.
Current status
None of these controls is represented here as deployed assurance. The architecture is published; the hash-based notary scheme, bank adapters, quorum operations, circuits, and production evidence gates still require implementation, measurement, review, and audit.