QALS Wiki · the qalarc networkgenerated 2026-09-06 · qalcode autonomous research

Curl, Troika, Setun — the ternary saga · 02_ternary_systems/TERNARY_RESEARCH.md

TERNARY COMPUTING AND IOTA'S TERNARY HISTORY

A Deep Technical + Historical Review — with Implications for the Qals Project

Version note: this is the comprehensive canonical version. A tighter ~2,500-word variant with extra details (Curl-P 243-trit rate and Winternitz-signing impact; Qubic's modern KangarooTwelve + FourQ stack) is preserved at archive/TERNARY_RESEARCH_20260906_v2_concise.md.

Date: 2026-09-06 · Author: research agent (superlocal) · Status: complete Method: live web sources (Wikipedia, IACR ePrint, arXiv API, IOTA wiki, Wayback Machine) + first-hand reading of local code clones in ~/projects/GLM_projects/crypto_currency/repos/ (entangled, bee, iota-sdk, iota). Code citations reference files that were actually read. Claims that could not be verified from a primary source are tagged [UNVERIFIED].

PART 1 — TERNARY COMPUTING FUNDAMENTALS

1.1 Radix economy: the math (and its limits)

The standard cost model. To represent an integer up to N in base b you need about log_b(N) digits. If hardware cost of a digit cell is roughly proportional to the number of states it must distinguish (i.e. cost ≈ b per digit), the total cost is:

E(b, N) = b · log_b(N) = (b / ln b) · ln N

So for large N, cost efficiency is governed by the factor b/ln(b) (see Optimal radix choice, Wikipedia). Evaluating it:

base b b / ln b relative to optimum E(b)/E(e)
2 2 / 0.693147 = 2.88539 1.0615
e 2.71828 / 1 = 2.71828 1.0000
3 3 / 1.098612 = 2.73072 1.0046
4 2.88539 1.0615
10 4.34294 1.5977

Base 3 is the integer radix closest to the optimum. The continuous optimum is a classic calculus exercise (posed and solved by Jakob Steiner in 1850): minimize x/ln x, whose solution is x = e; equivalently, maximize x^(1/x) → e^(1/e) ≈ 1.44467. Among integers, b/ln b is minimized at b = 3: binary costs ~5.7% more than base 3 (ratio 1.0615), while base 3 is only ~0.46% off the theoretical optimum (ratio 1.0046). These are exactly the figures from the prompt and they check out against the Wikipedia table (which also cites the 1950 engineering text High-Speed Computing Devices, whose triode ring-counter analysis concluded "the radix 3, on the average, is the most economical choice, closely followed by radices 2 and 4").

Caveats — be honest about them: - The cost model assumes digit cost grows linearly with b. Real CMOS gates don't price that way: a binary inverter is not "half" a ternary threshold gate. Noise margin shrinks as b grows, so reliability cost grows faster than linear. - Brian Hayes ("Third Base", American Scientist 89(6), 2001 — JSTOR) both popularized and deflated the argument; Underwood Dudley's Mathematical Cranks (MAA, 1992) outright mocks "base e is best" numerology. The 5.7% figure is a statement about idealized components, not about computers. - Where the model is legitimately useful: decision trees and menus (optimal branching factor ≈ 3 — ternary search trees, IVR menus), d-heaps (d = 3–4 optimal in practice), and any storage where states genuinely cost ∝ states (multi-level flash, which industry happily uses — see §1.4).

1.2 Balanced ternary: the pretty number system

Trits. Balanced ternary digits ("trits") are {-1, 0, +1}, conventionally written T, 0, 1. Any integer has a unique representation Σ tᵢ·3ⁱ with tᵢ ∈ {-1,0,+1}. Example: 5 = 9 − 3 + 1 = (1, T, 1)₃bal. A tryte is 3 trits (27 values), a convenient byte-analogue; IOTA used exactly this (§2.2).

Elegances (all verifiable on paper): - No sign bit. Negation = digit-wise inversion (1↔T). Subtraction is addition of the inverted operand. Every integer from −(3ⁿ−1)/2 to +(3ⁿ−1)/2 is representable symmetrically — no overflow asymmetry like two's complement. - Multiplication table is tiny and sign-symmetric:

× T 0 1
T 1 0 T
0 0 0 0
1 T 0 1

(compare: binary needs two products per bit; balanced ternary's is exactly the sign rule). - Addition carries at most ±1: 1+1 = 1·3 + T (write T, carry 1); T+T = T·3 + 1 (write 1, carry T). - Rounding = truncation. To round a balanced-ternary fraction to the nearest integer, delete the trailing trits. The most significant discarded trit is ≥ 1 exactly when the value is ≥ 1/2, so truncation is round-to-nearest. (Also: no separate rounding half-cases.) - Donald Knuth, TAOCP Vol. 2 (Seminumerical Algorithms, §4.1): calls balanced ternary "perhaps the prettiest number system of all", notes a number needs only log₃2 ≈ 63% as many digit positions as binary, and speculates its "symmetric properties and simple arithmetic... will prove to be quite important some day." - Douglas W. Jones (Univ. of Iowa) maintains the canonical English-language engineering treatment ("Douglas W. Jones on Ternary Computing" / "The Ternary Manifesto"): balanced ternary cuts interconnect wires by ~36%, but he also showed ternary addition needs ~62% more logic gates than binary at equal speed — the trade that keeps resurfacing.

1.3 Historical machines: Setun and Setun-70

Prehistory. Thomas Fowler built an all-wood balanced-ternary calculating machine in 1840 (Glusker, Hogan & Vass, IEEE Annals of the History of Computing, 2005), and mused in a letter to Airy that computing history might have been different had ternary been adopted early. Claude Shannon discussed the symmetric notation in "A Symmetrical Notation for Numbers" (Amer. Math. Monthly, 1950).

Setun (1958). Developed at Moscow State University under Sergei Sobolev with Nikolay P. Brusentsov as executive designer (project initiated 1956; first machine 1958) — see Wikipedia: Setun and Brusentsov et al., "Development of ternary computers at Moscow State University" (Russian Virtual Computer Museum). Key facts: - 18-trit words; 81 words of ferrite-core RAM + 1,944 words on magnetic drum; named after the Setun river. - How ternary from binary parts: each trit was stored in a pair of magnetic (ferrite) cores wired in tandem, giving three stable states out of four possible — Brian Hayes's critique: "A pair of cores could have held two binary bits, which amounts to more information than a single trit, and so the ternary advantage was squandered." The machine's real win was simplicity/reliability (fewer elements, ~1/7 the elements of comparable binary designs per Brusentsov, low power), not radix economy. - ~50 units built at the Kazan Mathematical Machines Plant (1959–1965). It worked well in the field (universities, weather forecasting, plant management; teaching tool in 30+ universities), and a replacement binary machine cost 2.5× as much. - Why it was killed — bureaucracy, not technology: the Kazan plant leadership disliked the low sale price and resisted production (a 1961 act forced the director to keep producing); the Ministry of Foreign Trade never filled foreign orders; production stopped in 1965 at ~15–20 machines/year when the plant refused to continue. Later, a new university rector deemed Brusentsov's work "pseudoscience"; his lab was moved to an attic in a student dormitory and the original Setun prototype was destroyed. - Setun-70 (1970): Brusentsov's redesign around 6-trit "syllables" (~9.5 bits), structured-programming-oriented instruction model (independently of RISC ideas); its architecture lives on via DSSP, a Forth-like stack language emulating Setun-70 on binary hardware.

Douglas W. Jones has written the standard retrospective analyses of Setun's technology and of ternary arithmetic design; his pages remain the main English reference outside the Russian Virtual Computer Museum.

1.4 Modern ternary research (state through 2025–2026)

1.5 HONEST VERDICT: why binary won, and when ternary makes sense

Binary won because of ecosystem economics, not math: Boolean algebra maps perfectly onto noisy switching devices; binary noise margins are maximal; CMOS foundries, EDA flows, libraries, verification and testing are all binary-optimized; every ternary gate is built from binary transistors and pays for the privilege. Daniel Etiemble & Michel Israël's VLSI comparison (Computer, 1988) concluded: "Multi-valued circuits and two-valued circuits must not be seen as competitors. If they are seen as such, two-valued circuits have already won." Douglas Jones's own arithmetic (36% fewer wires vs. 62% more logic) shows the radix-economy dividend being eaten by gate complexity.

Ternary genuinely makes sense when: (a) states are cheap but digits/wires/energy are expensive (flash storage, on-chip interconnect, optical channels); (b) symmetric signed data dominates (ternary weights in AI; analog computing); (c) levels come for free in the physics (qutrits in transmon hardware); (d) aesthetics/pedagogy. A general-purpose ternary CPU in 2026 remains a hobby (e.g. Triador, 5500FP projects) [UNVERIFIED beyond project pages].

PART 2 — IOTA'S TERNARY ERA (2014–2021)

2.1 Jinn Labs and the origin story

IOTA's four founders — David Sønstebø, Sergey Ivancheglo ("Come-from-Beyond", co-author of NXT's proof-of-stake), Serguei Popov (mathematician), Dominik Schiener — first organized in Norway around 2014 as Jinn, a startup aiming to build balanced-ternary microprocessors for IoT (sensors that natively compute in trits). Jinn ran a token sale in September 2015; when the hardware path proved impractical, the team pivoted the token economics into IOTA, whose public crowdsale (Nov–Dec 2015) raised ~1,337 BTC (≈ US$500k at the time) — Wikipedia: IOTA says "approximately 1300 BTC... approximately US$500,000". The Jinn token was later mapped/redeemed into IOTA tokens [UNVERIFIED — commonly recounted in community histories; I could not reach a primary Jinn source; the archived jinn.io (Wayback 2018/2019/2021) is now a parked domain]. Hardware never shipped; Jinn as a company is dead. The ternary-computing dream survived as Qubic (Popov/Ivancheglo, 2017 whitepaper — ternary oracle/computing layer on IOTA; the name is usually glossed as "qu-balanced trit-coded inputs and outputs" [UNVERIFIED]). Qubic later left the IOTA orbit entirely and launched as its own ledger (2022) [UNVERIFIED]; the 1337 (leet) figure and dates above should be double-checked against contemporaneous Bitcointalk threads before quoting.

Ivancheglo resigned from the IOTA Foundation board in June 2019 (founder dispute, his Medium account); Sønstebø was parted from the Foundation in Dec 2020 — both departures bracket the ternary era's end.

2.2 The trinary data model (from the actual code)

All quoted from repos/entangled (IOTA's C library for the trinary era, IOTA Stiftung, Apache-2.0):

2.3 Curl: the ternary sponge (code walkthrough)

File: repos/entangled/common/crypto/curl-p/curl_p.c (header trit.h, constants const.h/const.c, index table indices.h; "(c) 2016 Paul Handy, based on code from come-from-beyond").

2.4 The 2017 MIT DCI controversy — both sides, fairly

The finding. On 7 September 2017, Ethan Heilman (Boston University) and Neha Narula et al. of MIT's Digital Currency Initiative published "IOTA Vulnerability Report: Cryptanalysis of the Curl-P Hash Function". The peer-reviewed version — Heilman, Narula, Tanzer, Lovejoy, Colavita, Virza, Dryja, "Cryptanalysis of Curl-P and Other Attacks on the IOTA Cryptocurrency" (IACR ePrint 2019/344; published at FSE 2020) — abstract states: practical attacks on Curl-P-27 allowing fast generation of colliding messages (even equal-length), a break of the EU-CMA security of the IOTA Signature Scheme (ISS), and in a chosen-message setting the ability to forge signatures and multi-signatures of valid spending bundles. The attacks used Curl-P's structure (the 2-block absorb) to inject controlled differentials — a fault-injection-style collision costing laptop-scale compute, against the then-deployed scheme.

IOTA's response (their strongest points first, as fairness requires): 1. The "copying bug" claim. IOTA asserted that the public JavaScript Curl implementation the DCI analyzed differed from deployed code — the copy was missing a final transform after the last absorb — and therefore the demonstrated forgery did not transfer to mainnet as-is. This had some technical substance: there was a discrepancy in the circulated reference code, and DCI's disclosure (a few days' notice) arrived while IOTA claimed to be mid-refactor. 2. Timing/disclosure. IOTA said DCI had not coordinated responsibly and that a responsible window was needed because ~$2B of user funds were exposed. 3. Conflict-of-interest allegation. IOTA claimed MIT DCI had received donations from projects competitive with IOTA, framing the report as biased. No evidence of technical misconduct was ever produced; this was widely read as deflection. 4. Tone and retaliation. This is where IOTA damaged itself most: legal posturing by a founder against a researcher (FT Alphaville, "FUD, inglorious FUD", 2018), leaked internal emails mocking cryptographers (Vice: "A $5 Billion Cryptocurrency Has Enraged Cryptographers", Mar 2018), the infamous claim that the implementation discrepancy was a deliberate "copy-protection" honeypot (i.e., funds routed through copied-but-buggy code could be seized) — which Neha Narula called deeply concerning. UCL's Centre for Blockchain Technologies severed ties with the IOTA Foundation over the threats to researchers (TNW, Apr 2018).

Adjudication (my reading of the record): DCI's core cryptographic claim was sound and eventually peer-reviewed at a top venue (FSE 2020); Curl-P-27 was broken for its intended purpose (hash-then-sign bundle integrity). IOTA's "copy bug" point affects exploit logistics, not the conclusion — the authors' own paper title says "the cryptography formerly used", and its practical forgery is demonstrated on IOTA's scheme. Meanwhile IOTA's behavior — rolling its own unkeyed ternary hash, then responding with legal threats and a conflict-of-interest smear — became the canonical industry case study of why you don't roll your own crypto. Crucially, IOTA's subsequent engineering (§2.5–2.6) is itself an admission: addresses moved to Kerl within months; ternary left the protocol entirely in 2021.

2.5 Kerl: SHA-3 wearing a trinary coat

With Curl discredited for addresses/signatures, IOTA introduced Kerl — Keccak-384 (SHA-3) wrapped in a trinary interface, so 243-trit values in, 243-trit values out, binary proven crypto underneath. Local code: repos/entangled/common/crypto/kerl/: - kerl.h: typedef struct { Keccak_HashInstance keccak; } Kerl; (FIPS-202) with kerl_init/absorb/squeeze/reset on trits. - converter.c: convert_trits_to_bytes() does a full base-3 → base-256 big-integer conversion (12×uint32 limbs) of the 243 trits into 48 bytes (384 bits ≈ 3^243), handling the all-(−1) edge case (null hash) with the HALF_3 constant; the inverse conversion folds bytes back to trits. - Cost: each Kerl absorb pays a trit→byte conversion + Keccak-384 + byte→trit — proof that once you need real security, the trinary interface is pure overhead.

2.6 Troika: the last ternary hash (and its cryptanalysis)

repos/entangled/common/crypto/troika/troika.{h,c} ("(c) 2019 IOTA Stiftung / Cybercrypt A/S") and mam/troika/: - Design: ternary sponge, rate 243 trits, state 729 trits organized as 9 columns × 3 rows × 27 slices (troika.h: NUM_ROUNDS 24, TROIKA_RATE 243; troika.c macros COLUMNS 9, ROWS 3, SLICES 27, STATESIZE 729, NUM_SBOXES 243), round function = ternary S-box layer (sub_trytes) + shift_rows + shift_lanes + add_column_parity + add_round_constant, 24 rounds, 0x1 padding, plus a variable-rounds API for cryptanalysis. - Per Boura, Funk & Rotella (ePrint 2023/036), Troika was designed in 2019 by Kölbl, Tischhauser, Bogdanov and Derbez (CYBERCRYPT ApS, Denmark) for IOTA's ternary architecture. - The competition: IOTA announced the "International Troika Hash Function Competition" (2019) with an academic jury, inviting cryptanalysis/designs [UNVERIFIED — jury membership and outcome; the competition site is offline and not in the Wayback index under troika.iota.org]. Nothing met the bar before the project pivoted; Troika never entered production. The local README is blunt: "should be regarded as alpha and should not be used in production yet". - Was it broken? Reduced-round, yes; full, no — but it was never deployed, so "broken" is moot: - Liu & Isobe, "Preimage Attacks on Reduced Troika with Divide-and-Conquer Methods" (ePrint 2019/618, Jun 2019): preimages on 2–3 rounds. - Boura, Funk & Rotella, "Differential analysis of the ternary hash function Troika" (ePrint 2023/036, Jan 2023): differential/internal-differential cryptanalysis of reduced-round Troika; noted there were "almost no analysis tools for ternary designs". - The "2023 Ravi et al. Troika attack" in the tasking brief: not found. IACR ePrint's full-text search for "troika" returns exactly the two papers above. (Prasanna Ravi has published on other IOTA-adjacent crypto, e.g. fault attacks on its signing stack, but not a 2023 Troika break [UNVERIFIED for Ravi's IOTA papers — flagged so we don't mis-cite].) The accurate citation for 2023 is Boura–Funk–Rotella. - Also in entangled: common/crypto/ftroika/ (a "fast Troika" tryte-oriented variant) and the ISS signature code (common/crypto/iss/v1|v2/iss_curl.c) — ternary Winternitz one-time signatures over Curl/Kerl, used by IOTA until Chrysalis.

2.7 Chrysalis (28 April 2021): ternary is dead, long live ed25519

IOTA 1.5 "Chrysalis" went live 28 April 2021 and, per Wikipedia, removed "controversial decisions such as ternary encoding and quantum-proof [Winternitz one-time] cryptography... replaced with established standards": Ed25519 (EdDSA) signatures, BLAKE2b-256 hashing, plain binary transactions, 64-char iota1... bech32-style addresses. Holders had to migrate tokens from WOTS/Curl addresses to EdDSA addresses (the bulk of supply migrated; ~85% figure commonly cited [UNVERIFIED]). Context: the 2020 Trinity wallet hack ($2M, coordinator shutdown 12 Feb–10 Mar 2020) and the coordination/enterprise push made the binary rewrite politically possible. The ternary hardware lineage was already gone: Jinn dead, Qubic independent, Ivancheglo and Sønstebø out of the Foundation (2019/2020). In public statements IOTA developers settled on the blunt verdict that ternary was abandoned for the sake of standards and auditability — "ternary is dead" is a fair paraphrase of the Chrysalis spec cycle [UNVERIFIED as a verbatim quote].

2.8 Ternary remnants in the 2026 codebases (checked locally)

Summary: in 2026, trinary survives in IOTA's orbit only as (a) legacy PoW scoring (CurlP behind a feature flag), (b) migration receipts, and (c) historical repos. Everything cryptographic that matters is ed25519 + BLAKE2b + Keccak-family, in binary.

PART 3 — WHAT THIS MEANS FOR QALS

Recommendation

Do not put ternary anywhere in Qals' cryptography or consensus. Full stop. The evidence is unusually one-sided: the one major project that bet its protocol on base 3 needed a custom hash (Curl), got it broken by MIT DCI (FSE 2020), handled disclosure so badly that UCL cut ties, paid for two protocol rewrites (Kerl 2017–18, Chrysalis 2021), and by 2026 runs a Sui-derived binary stack while still executing CurlP only to compute spam scores. "Radix economy" saves 5.7% on an idealized hardware cost model — it buys nothing in software, where trits cost a byte (or a bit-packing hassle) and every primitive must be hand-audited. A 2026 chain should ship ed25519/BLAKE2b/Keccak or equivalent standard, audited primitives.

What ternary can legitimately buy Qals: 1. Naming & homage (cheap, fun, safe). Smallest unit = 1 trit; ladder in powers of three (1 trit, 27 trits = "tryte", 243 trits = "packet"); docs can tip the hat to Setun and to IOTA's cautionary tale. Zero protocol risk. 2. Ternary weights, not ternary bytes. If Qals ships any on-device AI (the compute-marketplace angle, folder 07_compute_marketplace), {−1,0,+1} quantization (BitNet 1.58-bit line) is the one place balanced ternary is commercially winning right now. 3. A qutrit watchlist, not a roadmap. Qutrit QEC results (2025–2026 arXiv output above) are the first credible "ternary done right" — because physics gives the third level for free. If Qals' long-term differentiator is brokering compute, track qudit/QEC platforms; revisit only when a qutrit machine exists that a customer could actually rent. 4. An honesty box in the whitepaper. One paragraph: we did Steiner's 1850 math (b/ln b minimized at 3, within 0.46% of e vs. binary's 5.7% penalty), we admire Setun, and we still chose binary — because ecosystem, tooling, and auditability beat radix economy every time. That paragraph costs nothing and inoculates Qals against exactly the criticism that hobbled IOTA.

What to avoid: conflating with TCAM's "ternary" ({0,1,X}); any trit-based address or hash scheme; any claim that ternary improves cryptographic security (it never has — Curl-P is the standing counterexample).

Key sources

← Bank & ExchangeAdjacent Utility Systems →