Skip to content

OrbitalProof · Wi-Fi security

A memory ceiling for post-quantum Wi-Fi, proved in a model

In the lab’s model of its admission-control module (the code that decides which sign-ins an access point accepts), a machine-checked proof that an access point’s memory for half-received quantum-resistant sign-ins stays capped, however many devices an attacker connects.

Who did this. The lab’s AI agents did the research and engineering. Nick Harris, founder. CTO of VivaMed BioPharma; co-founder of MedSim.ai, FastRead.io and Formulai. The lab’s track record.

What we showed

In the lab’s hand-written Lean model of its admission module, the access point never holds more than 64 KiB for half-received sign-ins from devices it has not yet verified, and never more than 4 half-finished sign-ins at once, however many devices an attacker connects. Lean is a program that checks mathematical proofs; the model was written to mirror the lab’s Python code, and nothing extracts it from that code.

Limit.
In the lab’s model the access point reserves four 16 KiB slots and refuses a fifth; the lab’s account is that four unfinished sign-ins therefore block other devices. Whether slots expire is not stated in the files we serve. Measured on the lab’s Python reference path: no radio, no real access point.

The problem

In the lab’s model, an access point keeps half-received quantum-resistant sign-ins in memory until the devices sending them are verified. In that model, capping the memory per connection alone does not stop an attacker who opens many connections at once from exhausting the access point’s memory.

What it means for a buyer

If you build access points or their firmware: in the lab’s model, capping the memory per connection does not stop an attacker who opens many connections at once from exhausting the memory held for half-received sign-ins. A simple reservation rule, proved by machine, caps the total. In the lab’s model the access point reserves four 16 KiB slots and refuses a fifth; the lab’s account is that four unfinished sign-ins therefore block other devices. Whether slots expire is not stated in the files we serve. So this is a proof of the cap, not a finished design.

Who we expect would buy

Teams we expect would care (no customer or pilot yet): enterprise Wi-Fi access-point and controller vendors, and Wi-Fi chipset firmware teams, preparing for quantum-resistant sign-in.

Why now

NCC Group’s 2026 write-up “WPA3 Denial of Service: SAE Resource Exhaustion” describes how an access point with too many sign-in exchanges pending can stop accepting new costly attempts and ask for a token instead. It is about today’s WPA3 sign-in, not the quantum-resistant one this result concerns.

Why you can trust the check

The Lean proof checker, a tool the lab did not write, confirms that the proof follows from the lab’s model. The model is written by hand to mirror the lab’s Python code, so a buyer would want the same cap checked against their own firmware.

No outside firm has audited it. How this result’s check works, step by step.

What this does not show yet

  • It holds for a hand-written Lean model of the lab’s admission-control module, not its code, and not for the lab’s full set of repairs as shipped.
  • In the lab’s model the access point reserves four 16 KiB slots and refuses a fifth; the lab’s account is that four unfinished sign-ins therefore block other devices. Whether slots expire is not stated in the files we serve.
  • It was measured on the lab’s Python reference path: no radio, no real access point.
  • The proof is about a hand-written Lean model that mirrors the Python code. Nothing extracts the model from the code, so the link between them is a check of the shared constants, not a proof.

Prior work

Named in the lab’s prior-art search for this result, and credited here.

The exact wording, for a technical reader

The lab’s own sentences and figures for this result, word for word, its limits in plain words where the lab’s text cannot be reprinted and its formal statement: A memory ceiling for post-quantum Wi-Fi, proved in a model, exact wording. The formal statements of all the results are on one page.

Check it yourself

  • This result’s file: every sentence and figure on this page that is the lab’s own, copied from its current record at the commit the file names.
  • The lab’s result file, copied from its codebase at the commit it names.
  • The file this result’s statement is checked against (a proof, a certificate or a measurement record; the formal statements page says which).
  • The formal statement, set as a formula.
  • pqc-bounds-lean (open source): A machine-checked post-quantum memory bound, in the Lean proof assistant.
  • pqc-explorer (open source): Is your post-quantum reassembly cap safe? One click.
  • OrbitalProof, the company that carries this result.

All resultsContact / M&A

How we show numbers

Every number on this site links to the file it comes from. How each result is checked

  • We never show a number before its file has loaded.
  • A question we have not checked yet is marked as unchecked.
  • A check that found nothing says so.
  • A file with no value for a question says so.
  • A number whose file is missing or has changed is not shown.
  • Two files that disagree about what a number describes are both flagged.
  • A number from too few samples shows its sample size.
  • Two files that give different values are both shown.
  • A file we cannot publish is listed by its fingerprint only.
  • A measurement more than a week old shows its age.
  • A question that does not apply to a page is left off it.
  • A measurement whose program failed is shown as failed.