Similarity is not lineage
Over late 2023 and early 2024, KyberSlash, a secret-dependent division timing flaw, affected multiple Kyber implementations at once, including implementations derived from or incorporating code from the reference implementation. One flaw, many products, and an assessor’s obvious next move is the inference that if they fall together, they must be family.
The framework’s layer 2 exists to catch shared ancestry, so the temptation to record it here is strong, and it needs a rule strong enough to stop it.
The Universal Framework supplies the rule in one sentence. Similarity of vulnerability alone must not be treated as evidence of shared lineage. Two implementations can make the same mistake independently. Similarity never creates a reach edge on its own.
Why the leap tempts, and why it fails
A shared CVE is the most visible correlation an assessor will ever see, and it arrives pre-packaged with a component list. But a bug class is a property of the problem, not of the pedigree. Timing leaks in a division operation, padding-oracle behaviour, nonce misuse under a particular API shape. All of these recur wherever engineers meet the same hard corner of the same specification, in codebases that never exchanged a line.
Recording every co-vulnerable pair as kin would fill the reach table with fiction, and fiction in a reach table is not conservative. It is wrong in both directions at once. Some failure domains inflate with members that were never inside them, and every reader who catches one invented edge learns to discount the table that names the real ones, which is the more expensive of the two damages.
Nineteenth-century anatomy solved this classification problem first. The wings of birds, bats and insects do the same job with the same physics and share no ancestor, the relationship Richard Owen’s vocabulary called analogy. A whale’s fin and a human hand look nothing alike and descend from one limb, which it called homology.
The test outlived the century because it separates two claims that look identical from the outside. The biologists’ test was never resemblance of function. It was evidence of descent, and layer 2 runs the same test on code.
What does create an edge
Lineage is established by descent evidence, graded. Source or build provenance establishing that the relevant code is present in the descendant. Reproducible binary-to-source provenance. A supplier’s engineering attestation, corroborated by an independent record such as a certification security policy. A plain binary signature match evidences presence, not descent, and runtime observation cannot establish ancestry at all, which is why the evidence table marks it inadmissible for this claim.
The rule also cuts the other way, and the second edge matters as much. Evidenced divergence severs an edge: recorded commits or patches rewriting the relevant primitive, reproducible source comparison, corroborated attestation covering the code paths in question. And where two implementations resemble each other but the direction of derivation cannot be established, the framework records them as variants and treats the shared membership as bounded. The honest uncertainty stays visible without becoming a claim.
Both failure modes are real in the field. KyberSlash reads at layer 2 where derivation is evidenced, one shared code path crossing independently maintained products.
The 2017 ROCA event ran the converse, one generation design behind a brand-diverse estate that resembled nothing so much as healthy competition. An assessor who infers lineage from similarity gets the first case wrong in advance and has no method left for the second. A table full of invented kinship cannot pick out the real family when it appears.
So the analyst’s move is unglamorous and exact. Record the co-vulnerability at the layer it belongs to. Record the candidate relationship as variant, bounded. Then request provenance, because a bound has a published price and an answer moves it.
The census methodology applies the identical grammar to a whole market, which is why its silent share is a figure rather than a footnote. The reach table stays evidence a supervisor can cite, which is what the table exists to be.