Position against prior work

Every mechanism in this stack has a paper behind it, and for most of them the paper is older than the stack. That is not a problem to hide; it is the thing to be precise about. The position is an applied one: no new primitive, no security proof, no better asymptotic. What is claimed is a composition, the measured cost of every link in it, and a small number of findings that only appear once it is built.

source: defmi/POSITION.md, qomm/POSITION.md · all five papers read from the paper, not the abstract

The claim

A request-for-quote market can be run so that no participant, the venue included, learns a maker's pricing policy or the losing quotes, while anyone can verify afterwards that the quote returned was the best of those submitted and that the trade settled at that price. The contribution is the composition and the measured cost of every link in it, including the links that turned out to be unaffordable.

At a glance

Every prior work audits "the circuit was evaluated correctly". This audits "this was the best price of those offered", and then carries the same unopened commitment into settlement.

Two rows carry the argument. Everything else is a choice of regime, and on most of those axes somebody else is stronger.

Three claims this does not make

Each was claimed in an earlier draft and is retracted.

Baum, Damgård, Orlandi 2014: where the mechanism comes from

Input providers publish Pedersen commitments; the SPDZ online phase is linear openings, so an auditor replays them on the commitments. That is the construction the quote proof instantiates, not a variant. Six differences, two of them cryptographic: the corruption model is honest majority (a weaker assumption that buys an information-theoretic online phase); the input parties are not the computing parties, which is what creates the share-to-engine gap; the field problem is theirs too, and here it has a number (2.00× traffic); the audited statement is a market statement; the output has to settle; and what is published is noised.

Baldimtsi, Kiayias, Zacharias, Zhang 2020: separate inputs, weaker guarantee

Structurally the nearest: clients provide input, servers compute obliviously, and order-book matching is on their motivating list. They go further on the threat, withstanding subverted servers, CRS and client devices. The price is that correctness stops being exact and they prove it must: only a spreading relation is achievable. An argmin over prices is the opposite of Lipschitz, so the only spreading relation available is trivial. But the threat they defend against is absent here: a market maker is a firm with a machine, and the committed policy is the ground truth the firm is bound by. That is why exact correctness is available here and not to them. No implementation.

Rivinius, Reisert, Rausch, Küsters 2022: the strongest argument against this choice

Threshold, publicly verifiable, accountable and robust, on lattice commitments, with the measurement everyone else lacks: 11× to 20× the online phase against plain SPDZ. Their appendix argues against exactly what this stack does. Their first argument, that the plaintext space must grow with the commitment's security, is sound for their BGV preprocessing and does not transfer to Shamir, which has no lattice preprocessing; the 2.00× here is the wire format. Their second argument, that computational binding decays over the life of a commitment and an auction is where that bites, is this stack's exact shape and is recorded as the strongest reason for a post-quantum direction. What they have that this does not: accountability and robustness, at their measured cost.

Prime Match 2023: the closest thing running

In production at J.P. Morgan. Secure against malicious clients and a semi-honest bank at the hub of a star; here there is no semi-honest party. Their computation is a two-party minimum invoked n² times at about 10 symbols per second, every 30 minutes; ours is a seven-party tournament over M committed policies with range, freshness and inventory checks, at 3.6 s per quote at 15 ms RTT. Nothing here is faster than Prime Match. Their outcome is not third-party auditable, which is the axis this stack is on. Their two-round malicious comparison with no preprocessing is what should be read next.

Baum and Zok 2026: the newest, and it takes the idea

Replaces 2014's Pedersen commitments with VOLE-in-the-Head, so auditability rests on a random oracle only; UC-secure, post-quantum, no benchmarks. The cryptographic idea is theirs and not claimed here. What exists here is the implementation they lack: on host-a, n=30, 167 committed values, Pedersen proves in 18.6 ms with a 5,440 B proof and VOLEitH in 73.1 ms with 45,616 B, of which 88% is VOLE consistency corrections that are bits over F₂ and 16-byte elements over a 127-bit prime. Their commitments are one-time, and a maker's policy is opened against every quote; the prover refuses a second opening rather than allowing it.

The settlement leg, which none of the five has

Publicly auditable MPC ends when the output is opened, and a quote settled in the clear has leaked everything. Every gadget in zkPI and DeFMI is standard: Pedersen, Bulletproofs, Groth–Kohlweiss, Zcash-style nullifiers, FROST, confidential-transaction balance arithmetic. What is not standard is that the settlement leg is bound to the audited computation: the price commitment the quote proof shows is minimal is the same commitment the quorum signs, the instruction carries, and the ledger's product proof consumes. One value, four proofs, never opened. The nearest published thing is DvP on DLT, which assumes the price is public.

OCLOB against Rialto, P2DEX, Renegade

"A DEX that matches secret orders in MPC" is not new. Rialto handles unit-quantity orders in fixed rounds; P2DEX evaluates fixed-quantity price matching in SPDZ2k with UC security and misbehaving-server compensation that OCLOB lacks; Renegade crosses anonymous orders at midpoint between relayers that see their own orders in plaintext. OCLOB's candidate difference is one state machine combining continuous processing, variable quantity and partial fills, arrival order fixed 5-of-7 before content is opened, a per-level aggregate public book, and pre-authorised settlement through zkPI into DeFMI. A formal novelty claim waits for the security definition.

Four questions that would make this a cryptography paper

1. A publicly verifiable linearly homomorphic commitment over F_p that opens more than once, on a random oracle only. The sharpest, and the one the measurements point at. Pedersen opens many times on DLOG; BDLOP on SIS at kilobytes; VOLEitH once on a random oracle. The missing row has an application that forces it.
2. Comparison without slack in a field that also holds a group order. Rabbit removes slack over rings; Prime Match has two-round malicious comparison; neither is stated for seven-party Shamir with a matched field.
3. Public accountability in an honest majority, priced. The honest-majority number does not appear to exist, and there is a reason to think it is small here. A hypothesis, not a result.
4. Robust reconstruction: built, run, reproduced. The operative line is n ≥ 4t+1, a decoder suffices, measured at nine nodes on two machines. The remaining non-robust phase is input, and no decoding helps there.

Two of the five papers were found through a third paper's related-work section rather than a search of our own. That has now happened twice in this project, and it is written down.