{"id":"3d2d2db9-2ca2-44d1-83c2-8dba3a273bde","arxiv_id":"2510.23457","paper_version":3,"verdict":"REJECT","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"BORG authenticates 5G SIB1 broadcasts with a compact hierarchical threshold signature, while showing NIST post-quantum signatures require impractical fragmentation — but its fail-stop forgery detection fails against DLP-solving attackers.","lead":"This paper proposes BORG, a threshold-signature method for authenticating 5G base-station broadcast messages inside a single 372-byte packet, and measures why standard post-quantum signatures cannot fit. The efficiency story is plausible, but the advertised post-quantum forgery detection has a proof gap that breaks the main security claim.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 2's fail-stop detection is bypassed by DLP: public E,D reveal e,d, so a quantum adversary forges with the honest R_j and PoF returns 'Not A Forgery'.","rationale":"The paper's headline contribution is a fail-stop threshold signature that gives post-mortem verifiable forgery detection even against quantum adversaries who break the underlying classical assumptions. The reader's weakest assumption correctly identifies the chokepoint: Theorem 2 reduces detection to second-preimage resistance of H1, but the public commitments make the exponents recoverable via DLP, so the adversary can reproduce R_j without any preimage attack. This is not a matter of an overly strong adversary model; it is precisely the model in Section II-B ('quantum-capable adversaries with the potential to break conventional signatures') and Section I-B's claim. Once DLP is broken, the adversary computes e,d from E,D, recomputes R_j, uses the public key to get sk, and signs any message; PoF sees R_j equal to the honest R_j and returns 'Not A Forgery'. Thus the advertised post-mortem detection inverts: instead of proving the signer innocent, PoF vouches for a forgery. The internal inconsistency between Algorithm 2 and Algorithm 4 (ID vs message in the H1 preimage) compounds the problem: even a classical honest-signer test of PoF would fail to reconstruct commitments, which suggests the fail-stop logic was not validated. The PQC feasibility study and efficiency measurements appear sound and are a useful contribution, but the paper's core 'future-proofing' claim fails. The reader's REJECT verdict is appropriate, perhaps with an invitation to re-scope or fix; since the verdict already matches, I recommend UNCHANGED.","tokens_in":32751,"tokens_out":6219,"duration_ms":62056,"concrete_test":"Use the public BORG implementation; generate a (2,3) key set and Preprocess one message index j. In a simulation script, recover e_{i,j},d_{i,j} from the public E_{i,j},D_{i,j} by solving the discrete logs in a small group (e.g., 56-bit prime) or, equivalently, by reading the local signer's nonce state for the exponents. Compute sk_ID_k from the public group key. For a fresh message m*, compute R_j from the recovered exponents, set h=H2(R_j||QID_k||m*) and z=log_g(R_j)+h·sk_ID_k; check that MVerify accepts. Then run BORG.PoF with the honest signers' nonces on this forged signature. If the output is 'Not A Forgery', Theorem 2 is falsified. Also run PoF on a genuine signature to check whether the Algorithm 2/4 hash-input mismatch breaks reconstruction.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing premise of Theorem 2 (Section V) is that 'any successful forgery must reproduce these commitments without access to the original random nonces.' This is false for the exact adversarial scenario BORG claims to handle. The commitments E_{i,j}=g^{e_{i,j}}, D_{i,j}=g^{d_{i,j}} are broadcast publicly in Preprocess (Algorithm 2). A quantum-capable adversary who can solve DLP — the very classical assumption whose failure the fail-stop mechanism is supposed to detect — can recover e_{i,j},d_{i,j} directly from E_{i,j},D_{i,j}. It can then compute the honest R_j (Algorithm 3, lines 3–4), recover the group secret sk_ID_k from the public verification key, and forge (R_j,z_j) satisfying MVerify. Running BORG.PoF (Algorithm 4, lines 9–10) on this forgery compares R'_j with the reconstructed R_j and outputs 'Not A Forgery', so the forgery is undetectable. The proof's reduction to second-preimage resistance of H1 is thus bypassed without finding any preimage. Additionally, Algorithm 2 hashes nonces with ID_{k,i} while Algorithm 4 line 5 hashes with m_j; as written, PoF cannot even reconstruct the committed values for honestly generated signatures.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper evaluates the feasibility of embedding NIST post-quantum signatures into 5G SIB1 broadcast authentication, concludes that direct PQC adoption is impractical due to packet-size, fragmentation, and latency constraints, and proposes BORG, a hierarchical identity-based threshold signature scheme with a fail-stop (FS) mechanism intended to provide distributed trust, post-mortem forgery detection, and post-quantum audit logging. The feasibility analysis and over-the-air testbed measurements are presented as the first comprehensive study of NIST-PQC integration into 5G bootstrapping. The central security claim is that even if classical assumptions such as DLP are broken by a quantum adversary, honest signers can still detect and prove forgeries. The manuscript also includes an open-source implementation and a real 5G testbed evaluation.","tokens_in":33006,"tokens_out":6297,"duration_ms":61773,"significance":"If the security claims were correct, BORG would be a practically relevant alternative to direct PQC for 5G bootstrapping, offering compact signatures, distributed trust, and post-mortem accountability. The PQC feasibility study with concrete packet-size and latency numbers, and the reproducible over-the-air measurements, are useful contributions. However, the central future-proofing property—post-mortem forgery detection when DLP is broken—is not established. The fail-stop mechanism can be bypassed by exactly the adversary it targets, and the PoF procedure is internally inconsistent. As a result, the main advertised contribution of the paper is unsupported, and the protocol cannot be considered a future-proof authentication framework as claimed.","major_comments":[{"comment":"The proof assumes that any successful forgery must reproduce the commitments without access to the original nonces, reducing fail-stop security to second-preimage resistance of H1. This assumption is false for the paper's own threat model. In Algorithm 2 (lines 4–5), the commitments E_{i,j}=g^{e_{i,j}} and D_{i,j}=g^{d_{i,j}} are public group elements; Section IV-C3 states the commitment list may be published, and Section II-B grants the adversary control of the wireless medium. An adversary with a DLP solver—the precise quantum-era break the fail-stop property is meant to handle—can recover e_{i,j},d_{i,j}, reconstruct the honest R_j (Algorithm 3 lines 3–4), and forge a valid signature with the same R_j. Running BORG.PoF (Algorithm 4 lines 9–10) then outputs 'Not A Forgery', so the forgery is undetectable. This bypasses the proof without finding any preimage and invalidates Definition I","section":"Section V, Theorem 2 / Algorithm 4"},{"comment":"The preprocessing algorithm hashes nonces with the participant identity: e_{i,j} <- H1(\\hat e_{i,j} || j || ID_{k,i}) (Algorithm 2 line 4). The forgery-detection algorithm re-derives the same values using the message: e_{i,j} <- H1(\\hat e_{i,j} || j || m_j) (Algorithm 4 line 5). For an honestly generated signature, PoF reconstructs different E,D values and therefore a different R_j, causing lines 9–12 to flag a valid signature as a forgery. As written, PoF cannot reconstruct the committed values used in Algorithm 3. The hash inputs must be made consistent before any security analysis is meaningful.","section":"Section IV, Algorithms 2 and 4"},{"comment":"Definition II.4 excludes adversaries that have 'obtained the commitment values ... from uncorrupted signers', but the protocol makes those commitment values available by design: Algorithm 2 line 6 sends them to the other n−1 signers, and Section IV-C3 explicitly allows publication of the commitment list. Under the stated threat model of a wireless adversary with eavesdropping capability, a quantum-capable adversary can observe the commitments. The security definition therefore does not cover the protocol's own operational setting, which contributes to the failure of Theorem 2 and should be addressed explicitly.","section":"Section II-D, Definition II.4 vs. protocol"}],"minor_comments":[{"comment":"Typographical errors: 'faul-tolerant' should be 'fault-tolerant', and there is a duplicated 'and and' in the description of the audit logging phase.","section":"Section IV-C4"},{"comment":"The word 'commitmetn' appears in the formal definition of HITFS.Preprocess; should be 'commitment'.","section":"Definition II.1"},{"comment":"The paper reports averages over 10,000 iterations for cryptographic timings but only 10 iterations for the over-the-air testbed. Reporting standard deviations or ranges for the testbed measurements would strengthen the comparison, especially for ML-DSA's 5282 ms upper bound.","section":"Tables I and II"},{"comment":"The paper refers to FN-DSA as a NIST-PQC algorithm, but FN-DSA is not a finalized NIST standard. Please clarify the status of the referenced schemes and align the terminology ('NIST-PQC', 'NIST candidate', 'NIST standard') throughout.","section":"Section III-A"}],"recommendation":"reject","confidential_remarks":"The PQC feasibility study and the open-source testbed are valuable, but the core BORG design does not deliver its advertised future-proofing property. The PoF hash-input inconsistency alone would require a major revision; the DLP-bypass argument shows that the fail-stop mechanism cannot be repaired locally. The central contribution of the paper is therefore untenable, and I do not see a path to acceptance for this manuscript as it stands."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe paper has two genuinely useful pieces: the SIB1 fragmentation analysis for NIST-PQC signatures (with real over-the-air measurements) and the efficient threshold HIBS construction that fits in a single SIB1. The code is open-sourced and the performance numbers look reasonable. Those parts deserve credit.\n\nThe soft spot is the paper's headline: post-mortem verifiable forgery detection against quantum adversaries. The proof of Theorem 2 misses a trivial bypass. The commitments E_{i,j}=g^{e_{i,j}} and D_{i,j}=g^{d_{i,j}} are public (Algorithm 2). A quantum adversary who can solve DLP—the exact break the fail-stop mechanism is supposed to catch—recovers the exponents e,d directly, computes the honest R_j, and forges a valid signature with the same R_j. BORG.PoF then reconstructs the same R and outputs 'Not A Forgery.' The honest signer cannot prove anything. The reduction to second-preimage resistance of H1 is therefore irrelevant; the adversary never needs a preimage.\n\nThere is also a concrete internal bug: Algorithm 2 hashes nonces as H1(ê_{i,j} || j || ID_{k,i}), but Algorithm 4 line 5 recomputes them as H1(ê_{i,j} || j || m_j). For honestly generated signatures these will not match, so PoF would flag honest signatures as forgeries. The pseudocode is inconsistent.\n\nThe correctness of the verification equation checks out, and the PQC feasibility results likely stand. But the future-proofing claim is load-bearing and it does not hold. A revised paper could re-scope to a threshold HIBS with audit logging and drop the fail-stop assertion, or fix the PoF algorithm and prove a different security property under a properly defined adversary. As written, it should not be accepted.\n\nThe PQC fragmentation measurements could be useful to cite separately, but I wouldn't cite BORG as a future-proof scheme. Worth a serious referee because the problem is important and the flaws are substantive but not disqualifying as a research direction.","headline":"The PQC feasibility study is solid, but BORG's fail-stop forgery detection does not survive its own threat model, and Algorithm 4 has an internal hash-input mismatch.","tokens_in":33594,"tokens_out":5208,"would_cite":false,"duration_ms":52078,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"BORG claims that 5G base-station bootstrapping can be secured against compromised base stations and future breaking of classical cryptography by using a hierarchical identity-based threshold signature with fail-stop properties, at a cost of","keywords":["5G bootstrapping security","base station authentication","SIB1 broadcast integrity","threshold signatures","hierarchical identity-based signatures","fail-stop signatures","post-quantum signature feasibility","audit logging"],"falsifier":"Take the public commitments E_i,j and D_i,j from the preprocessing phase, compute their discrete logarithms in the actual group used in the parameter selection (e.g., a small-order or known-order subgroup), construct a BORG signature whose R'_j equals the legitimate R_j, and run BORG.PoF; if PoF returns 'Not A Forgery' for this adversarially produced signature, the post-mortem forgery-detection claim is refuted.","tokens_in":32599,"feed_emoji":"📡","tokens_out":5589,"duration_ms":60113,"temperature":0.7,"pith_summary":"The paper's central claim is that 5G's initial bootstrapping — the moment a phone decides which base station to trust — can be future-proofed without paying the packet-size penalty of standardized post-quantum signatures. It first shows that standard lattice-based post-quantum signatures run to thousands of bytes and produce end-to-end delays near five seconds, making them unusable inside the 372-byte SIB1 broadcast constraint. It then proposes BORG, a hierarchical identity-based threshold signature with fail-stop properties, which lets any t of n base stations jointly sign SIB1 with 144 bytes of cryptographic overhead and roughly three milliseconds of latency, while adding post-mortem forgery detection and a post-quantum-protected audit log. If correct, BORG would give operators distributed trust, tamper-evident accountability, and a way to prove that a forgery occurred even after the underlying classical assumptions are broken.","feed_headline":"64-byte signature thwarts fake 5G base stations","feed_subtitle":"Distributed base-station signing and post-mortem forgery detection fit inside one SIB1 packet, without fragmentation and without certificate","key_machinery":"The central object is the HITFS scheme — a Hierarchical Identity-Based Threshold Signature with Fail-Stop property. It layers Schnorr-style threshold signing over hierarchical identity-based key derivation, so no certificates are broadcast: each base station holds a key share, and any t of n shares can be aggregated into one compact signature. The fail-stop layer uses preprocessing commitments E_i,j and D_i,j computed as powers of a generator from hashed secret nonces; the shared nonce component R_j is built from these commitments, so after a suspected forgery the signers can reveal their nonces and a higher authority recomputes R_j to check whether the signature was genuinely produced by th","core_discovery":"On its own terms, the paper establishes a feasible middle path for 5G bootstrapping security: distributed, accountable authentication that is not real-time post-quantum but detects forgeries after the fact. The discovery is that a Schnorr-style hierarchical identity-based threshold signature can be augmented with a fail-stop layer — preprocessing commitments and nonce revelation — so that a quorum of base stations produces one compact (R, z) signature verifiable by a phone with a pre-installed master public key, while a forgery proof can later be generated and checked by a higher authority. The paper reports that this fits into a single SIB1 packet, avoids fragmentation, keeps UE verificatio","pith_inferences":["An adversary who can solve the discrete-logarithm problem on the public commitments E_i,j and D_i,j can recover the underlying nonce exponents and forge a signature with the same R_j; BORG.PoF would then output 'Not A Forgery', so the advertised fail-stop guarantee may vanish precisely in the post-quantum scenario it targets.","The accountability story depends on at least t honest signers willing to reveal nonces and on the audit logs surviving tampering; in a widely compromised RAN these preconditions may fail simultaneously.","BORG is naturally a policy gate before 5G-AKA rather than a replacement for it, so it could be adopted incrementally by operators already running multi-connectivity deployments.","The same compact fail-stop design could apply to other broadcast trust roots with strict packet limits, such as V2X safety messages or IoT firmware announcements, where compromise inevitability and size constraints are similar."],"forward_implications":["Standardized lattice post-quantum signatures (around 2,420 bytes for the signature alone) cannot fit inside a 372-byte SIB1 packet and create end-to-end delays of 0.66 to 5.28 seconds, so direct replacement is protocol-breaking.","With BORG, compromising fewer than t of n base stations is insufficient to forge a valid SIB1 signature, removing the single point of failure of today's single-BS trust.","After classical assumptions like discrete-logarithm hardness fail, honest signers can reveal their commitment nonces and prove that a suspicious signature is a forgery, allowing the core network to halt and attribute the breach.","Audit logs sealed with a post-quantum threshold signature remain tamper-evident and support non-repudiation, closing the accountability gap in current base-station logs.","The total cryptographic overhead of 144 bytes fits in one SIB1 without fragmentation and keeps UE-side verification at roughly 1.27 ms, comparable to existing classical hierarchical schemes."],"fun_headline_variants":["Compact signature fits SIB1, catching fake 5G base stations","Distributed threshold signing stops fake 5G base stations","Post-mortem forgery detection for 5G without heavy PQC","One-packet authentication thwarts rogue 5G base stations"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The whole construction rests on discrete-logarithm hardness for day-to-day unforgeability, and the fail-stop layer additionally assumes that no adversary can recover the random nonces behind the public commitments E_i,j and D_i,j — an assumption that disappears exactly when the discrete-logarithm problem is solved.","fun_headline_variants_meta":{"raw":{"variants":["Compact signature fits SIB1, catching fake 5G base stations","Distributed threshold signing stops fake 5G base stations","Post-mortem forgery detection for 5G without heavy PQC","One-packet authentication thwarts rogue 5G base stations"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000281,"raw_usage":{"total_tokens":1561,"prompt_tokens":862,"completion_tokens":699,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":606,"completion_tokens_details":{"reasoning_tokens":625}},"tokens_in":606,"tokens_out":699,"duration_ms":6674,"temperature":1.0,"reasoning_tokens":625,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-04T07:50:34.754830+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take the public commitments E_i,j and D_i,j from the preprocessing phase, compute their discrete logarithms in the actual group used in the parameter selection (e.g., a small-order or known-order subgroup), construct a BORG signature whose R'_j equals the legitimate R_j, and run BORG.PoF; if PoF returns 'Not A Forgery' for this adversarially produced signature, the post-mortem forgery-detection claim is refuted.","supporting_citations":[],"review_version":1}