Why sixteen bytes: the security ledger of ROUTE_SHARD

Reading the Draft · No. 1 · Source: draft-li-rttp-iqa-addressing-00 §4.4 · Sister pillars: rttp:// (CRI 27) · iqa:// (CRI 28)

Review any addressing scheme and the first number gets questioned: in the Resonant Time Transfer Protocol (RTTP), the address ROUTE_SHARD keeps the first 16 bytes of SHA-256 — why not the full digest? Why not shorter? Section 4.4 states it plainly: "ROUTE_SHARD = SHA-256(ASCII(canonical_authority))[0:16]", followed by four properties: deterministic (the same authority always yields the same address), pure computation (no DNS, no registry, no network), one-way (the authority cannot be recovered from the address), and action-independent (different actions on one authority share one address).

Here is the ledger. To impersonate an in-use authority, an attacker must find a second authority string that derives the same 16-byte address — a second-preimage attack, priced at 2^128. Not 2^256, because truncation halves the search space: that is the true price of truncation, and we state it in full on the label.

The birthday side of the ledger reads 2^64: finding any colliding pair in a 2^128 address space costs roughly the square root of the space. But 2^64 is not the end of the story — for a collision to matter, it must pass a second gate: the collided new authority has to be adopted by at least one relying party — cited, referenced, written into a configuration — before hijacking is even on the table. The address is freehold; adoption is sovereignty. An unadopted collision is a numerical coincidence. Behind both gates, the realistic cost of a birthday attack sits far above its theoretical floor.

Why not keep all 32 bytes? Because the role of the address is explicit in the specification — it is not a proof of identity. Section 6.1: "The derived address is an entry fingerprint, not a proof of identity." Identity is carried by the subject's AID; the proof is carried by the second pillar's envelope. The address only needs to reliably separate two different authorities at the entry layer — 128 bits of discrimination, behind two gates, is a sufficient budget for that role. The other 128 bits would not make the address any more "true"; they would make every hand-written, printed, and cross-checked occurrence heavier.

Why not shorter? The specification supplies the counter-example boundary on the iqa side: an 8-hex-digit display-form subject occupies a 32-bit space, where the birthday floor drops to 2^16 — which is why Section 5.2 rules that "the hexadecimal subject form is a routing hint, not evidence," and no client may treat it as a unique identifier. The length red line is not an arbitrary constant; it is another page of the same ledger.

One line: sixteen bytes is a two-gate checkpoint — impersonation costs 2^128, and an unadopted collision is useless; the budget is spent exactly where the attacker must pay and the verifier need trust no one.