Author: Jack Kowalski https://entropment.com Patent Pending Analysis of hardness, security, disadvantages, advantages and applications for: Code structure and loop with explanations: https://entropment.com/media/downloads/PAPERS_RIPA_QCO_EN.txt Original mathematical explanations: https://entropment.com/media/downloads/PAPERS_notes_for_QCO_in_order.txt In standard cryptography (AES, RSA, ECC, post-quantum lattice, etc.) security is formulated (in simplified terms) as follows. There is a clearly defined computational problem. It is assumed that solving it requires a certain amount of work (e.g. 2^{128} operations with the best known attack). An upper bound on the cost of the attack can be estimated (argmax in practice). The adversary knows when he has “finished” - either he has broken it or he has exhausted his budget. Certifications (FIPS, Common Criteria) and audits rely on this model: “algorithm X has Y bits of security under assumption Z”. Regulated clients, integrators, auditors and compliance departments use such a finite model of Y for X under Z. In the RIPA/QCO model, security arises from other things: Loss of genealogy through FPU projection (many histories → one observable state). Controlled BER - on the correct key ~2–2.5% (correctable), on an incorrect key significantly higher. Deniability - fake blocks and (optionally) band multiplexing make the true signal statistically similar to noise. Cost asymmetry - the receiver with the correct HSM/key filters cheaply (AO_check). An attacker without the key must explore the combinatorics of paths, keyring rotation and possible ERR collisions. Lack of a clear stopping point - there is no moment at which the adversary can say “I have searched everything that can be efficiently searched”. An early error spoils further synchronisation, and fakes and rotation increase the number of hypotheses. As a result: There is no classical “X bits of security”. There is no guaranteed cost of success that can be optimised (no argmax Y for X under Z). The adversary does not know in advance how many resources he must expend to have a reasonable chance of success - and whether a practical budget even exists at which success becomes probable, nor can he define a probability measure in order to consider it in computational terms at all (open set of communication length). Security is more “cost + risk of no stop + deniability” than “hardness of a problem”. It protects among other things by the fact that the adversary has no guarantee of how many resources must be used for an attack with guaranteed (or even high-probability) success, and this cost cannot easily be optimised in the classical way. Most recipients (especially in the regulated, high-assurance, enterprise, and parts of AAA games sectors) are accustomed to the classical model. “This is not based on a hard computational problem, but on loss of information, controlled BER and deniability” they interpret as “weak / non-certifiable”, “it cannot be entered into an audit threat model”, “we do not know how to compare it with AES-256”. Therefore conscious communication and consistent materials are needed: Clear distinction: RIPA does not replace a cipher, it only adds a transport/cover layer over an existing ciphertext. Concrete descriptions of attack scenarios and cost asymmetry (instead of “it is secure”). Comparisons with other deniability / cover traffic / steganography mechanisms (so as to place it in a known category, even if it is not an exact match). Documentation of limitations (identical toolchain, no standard certification as a cipher, threat model based on cost and deniability). Examples of for whom it makes sense (air-gap, diplomacy, offline DRM, special radio/mesh), and for whom it does not. Without this the market will try to force the solution into frameworks it does not fit (“is this a kind of cipher?”) and reject it because it does not meet the expectations of the classical model. With education - it becomes an understandable tool in niches where deniability and open-ended attack cost are precisely what is desired. Attack scenarios on RIPA RIPA does not base its security on a classical hard problem, so the attack scenarios differ from typical attacks on AES/RSA. The main surfaces are: distinguishing true blocks from fakes, exploration of state paths (keyring + rotation), attacks on the HSM, and problems with toolchain synchronisation. Below are concrete scenarios arising from the described protocol (CRYPT_MSG_V3, INFUSE_FALSE_RANDOM_BLOCKS, AO_CHECK, rotate_keyring, optional band multiplex). Attack on distinguishing true/fake (traffic analysis / statistical matching) Goal: find which blocks in the stream are true. The adversary observes a sequence of packets {scale, msg, ERR}. He tries to distinguish true from fake by bit statistics (entropy, distribution), ERR patterns (triple NaN/in/out), correlations between successive blocks. Fakes are format-identical. With an RS-based generator (from the technical plan) their input statistics are closer to true buffers than pure random. The E_f ≠ E_0 sieve prevents ERR collisions. The adversary has no oracle (an oracle does not exist at all) “this is a true block” without the key. Low effectiveness with a well-chosen fake generator. It may increase if the fakes are purely random (statistically distinguishable from true messages, which is why an RS source is used instead of random - the messages are true but fabricated and for the legitimate user invisible/skippable) and the adversary has a lot of data within analytical capability (rapid filling of the pool with fakes for analysis destroys this, after all communication does not have to contain any information transmitted for the legitimate receiver). Enumeration of paths (combinatorial attack on the true/fake sequence) in order to reconstruct the sequence of true blocks and synchronise with the keyring state. With T true blocks and F fakes the adversary must consider ((T+F) choose T) possible paths. For each path he assumes which blocks are true, tries to reconstruct the keyring rotation (requires extraction of G from K1, which he does not know - circular problem), checks whether the resulting sequence gives consistent BER / correct AO_check. Every error in the choice of a true block spoils further rotation. K1 never leaves the HSM and is never transmitted. With band multiplex the cost grows by an additional factor of n (choice of active band in each tick). The cost of path enumeration depends on the proportion of T (true) to F (fake) and on how many hypotheses the adversary must consider. This is the main mechanism raising the attack cost. The adversary must choose which blocks in a sequence of length N = T + F are true. The number of possible subsets is: (N choose T) = ((T+F) choose T) = ((T+F) choose F) Each wrong hypothesis spoils further keyring rotation (because G extracted from K1 and state mutation depend on the correct true blocks). Therefore the cost is proportional to the number of hypotheses that must be checked before the correct path is hit (or before desynchronisation becomes obvious). Proportion Behaviour (T+F choose T) Comment F → 0 (almost only true) ≈ 1 Attack cheap - it is known which blocks to take (all of them) T ≫ F, F constant ≈ T^F / F! (polynomial in T) Cost grows, but polynomially F ≈ T (similar number) ~ 2^(T+F) / √(π(T+F)/2) Exponential in the length of the sequence F ≫ T (many fakes) Large, but the adversary can reject after the first errors Still expensive, because wrong choices spoil the state The strongest combinatorial effect occurs when the density of fakes is significant (does not tend to zero) and the sequence is long. Then the number of subsets grows exponentially with N. That is, a constant, open communication channel regardless of whether anything is transmitted or not. Seriously raises the attack cost the number of hypotheses (T+F choose T) - the more fakes in a reasonable proportion, the more paths. Penalty for error - one wrong decision spoils further keyring rotation and the selector (if there is band multiplex). It cannot be “undone” cheaply. No oracle - the adversary does not know in advance whether a given subset is correct until he checks BER / AO_check consistency on subsequent blocks. K1 and mutation - even knowing the seed, without the correct sequence of true blocks he will not reconstruct the further state, because K1 is not transmitted. If F tends to zero, this mechanism almost does not work - what remains is mainly the cost of the seed itself and possible attacks on the HSM. Therefore in practice the “paranoia” parameter (how many fakes to inject) matters, not the number of true blocks itself. The effectiveness of the enumerative attack depends on the number of hypotheses (T+F choose T). It grows exponentially with the length of the sequence at significant fake density; at F→0 it drops to trivial. This is the main mechanism raising the cost, provided the fakes are sufficiently numerous and a wrong path is penalised by state desynchronisation. Attack on the seed / initial keyring (brute-force with limitations). The goal is: finding the initial seed (≤ 2⁵²). The adversary searches the seed space, for each generates parameters (Flist, QCOpool, Enoise etc.) and tries to demodulate the first blocks. After the first true block the state mutates on the basis of the message content (via G from K1). Finding the seed alone is not sufficient - the true blocks must still be correctly identified in order to continue. The toolchain must be identical (otherwise residuals diverge). Theoretically possible with a short seed, but practically limited by state mutation and fakes. This is not a classical 2^{128} search. In classical brute-force (e.g. on an AES-128 key) we have a key space of 2^{128}, a verifying function that for each candidate says “yes/no” in constant time, and the possibility of parallel search without dependencies between trials. In RIPA this does not exist, because the seed is not a session key. The seed (≤ 2^{52}) serves only to initialise the keyring. After the first true block the state mutates on the basis of the message content (via G extracted from K1). Finding the initial seed does not automatically give access to further blocks. No independent oracle. To check whether a given seed is correct, the adversary must generate HSM parameters (Flist, QCOpool, Enoise…), demodulate blocks, while simultaneously guessing which blocks are true (because fakes are in the same format), check whether AO_check passes and whether the BER after RS is low, and then continue with the mutated state. One seed trial is not cheap and independent - it is linked to the hypothesis about the true/fake path. Toolchain as part of the secret (but we assume it is public and does not constitute part of the secret). Residuals depend on the exact implementation of libm/FPU. Even a correct seed on a different toolchain produces garbage. This is an additional dimension that does not exist in classical search. The problem for the adversary is that a short seed can theoretically be searched (2^(52) is ~4.5 × 10¹⁵, which with large resources is achievable). But each trial requires simultaneous solution of the path enumeration problem (case 2). A wrong hypothesis about true blocks spoils further rotation, so it is not possible to “check the seed on the first block and forget”. K1 never leaves the HSM, so state mutation is unpredictable without the correct sequence. As a result the effective cost is not 2^{52}, but something in the direction of 2^{52} * (cost of verifying one path) * (number of true/fake hypotheses that must be considered). It is not possible to give a single number “so many bits”, because it depends on protocol parameters. The order of magnitude can however be estimated. Component Typical order Comment Seed space 2⁵² Upper bound from the documentation (≤ 2⁵² − 1) Cost of one verification 2¹⁰–2²⁰ Demodulation + AO_check + RS on a few blocks + generation of Flist Multiplier from fakes (T+F choose T) With moderate fake density can give an additional 20–40+ effective bits Multiplier from band multiplex nᵀ If used - additional factor per true tick Toolchain constant or small If the parties have a locked toolchain, the adversary must also have it (we assume he does) With a short seed and a small number of fakes the attack is realistic (especially if the adversary can observe a long session and has an identical toolchain). With a reasonable number of fakes and state rotation the effective cost quickly goes beyond the practical range of classical 2^(80) to 2^(100), even if the raw seed has only 52 bits. It is not a classical 2^(128) search, because: the space is smaller, but verification is expensive and dependent on other hypotheses, there is no guarantee that after finding the seed one can continue. Numerical example of how a 2^(52) seed grows ad absurdum Effective attack cost for approx. 2^(52) * (T+F choose T); we ignore the constant cost of verifying one path; in practice it adds a few to a dozen bits, but the binomial dominates; (T+F choose T) is the number of hypotheses the adversary must consider (which blocks are true). Each wrong hypothesis spoils further state rotation. T (true), F (fake), N = T+F, log₂(C), Effective bits (52 + log₂(C)), Regime 10, 0, 10, 0, 52, Trivial (pure seed) 20, 0, 20, 0, 52, Trivial 20, 5, 25, 15.7, 68, Still easy 20, 10, 30, 24.8, 77, Still practical 20, 20, 40, 37.0, 89, Starts to be inconvenient 30, 30, 60, 56.7, 109, Problematic 40, 40, 80, 76.5, 128.5, ~2¹²⁸ 50, 50, 100, 96.3, 148, Above 2¹²⁸ 60, 60, 120, 116.2, 168, - 80, 80, 160, 156.0, 208, - 100, 100, 200, 195.9, 248, Close to 2²⁵⁶ 150, 150, 300, 295.6, 348, Above 2²⁵⁶ 200, 200, 400, 395.4, 447, Close to 2⁵¹² 100, 50, 150, 133.9, 186, - 200, 100, 300, 271.1, 323, - It follows that F = 0 → always exactly 2⁵². No combinatorial protection. Small F with moderate T (e.g. T=20, F=10) → still in the practical regime (~2⁷⁷). F ≈ T and N ≈ 80 → we already exceed the classical 2¹²⁸. F ≈ T and N ≈ 200 → we are at ~2²⁴⁸ (close to 2²⁵⁶). F ≈ T and N ≈ 400 → ~2⁴⁴⁷ (approaching 2⁵¹²). The growth is very rapid, because (2k choose k) ≈ 4ᵏ / √(π k). With an equal number of true and fake every additional ~20–25 blocks adds another ~20–30 effective bits. This is a lower bound from the binomial alone. In reality the cost of generating Flist, demodulation, checking AO_check and RS on each candidate is added - which adds further bits. With band multiplex the multiplier is even larger (additional factor dependent on n and the number of ticks). The adversary does not always have to check all hypotheses to the end - he can reject after the first few blocks. But with good fake density and the desynchronisation penalty a great deal of work still remains. If F is constant and small, and T grows - the growth is only polynomial, not exponential. Let us therefore take an example tweet. Stage, Size Tweet (plaintext), ~240 characters ≈ 288 B After AES-256 (+IV+tag), ≈ 336 B = 2688 bits After RS (~15–20% overhead), ≈ 400 B = 3200 bits 480-bit blocks, T = 7 true blocks Fakes ×7, F = 49 Total, N = 56 blocks Cost of enumerative attack: (56 choose 7) ≈ 2.32 × 10⁸ log₂(56 choose 7) ≈ 27.8 Effective bits ≈ 52 + 27.8 = 79.8 Interpretation Pure seed 2^(52) after adding fakes in the proportion 7:1 → ~2^(80). This is still below the classical threshold of 2¹²⁸. For such a short message (one tweet) even an aggressive mul7 proportion does not take the attack beyond the practical reach of a well-equipped adversary. If however we have continuous communication, and we transmit 14 blocks per second constantly, of which in the course of an hour there is one tweet, the matter becomes dramatically more complicated Assumptions: Constant stream: 14 blocks/s In the course of an hour: 14 * 3600 = 50400 blocks In this hour only one tweet → T = 7 true blocks The rest are fakes / cover: F ≈ 50 393 The enumeration cost is 50400 choose 7 which is approximately 2^97. Effective bits ≈ 52 + 97 = 149. This is already clearly above the classical threshold of 2^(128). The adversary must indicate exactly those 7 positions out of 50 400 at which the true blocks are located. Every other combination of 7 blocks leads to wrong keyring rotation and desynchronisation. There is no cheap way of “checking one after another” - a wrong hypothesis spoils the state. With a continuous cover traffic stream the density of true data is very low, the number of hypotheses grows rapidly even with small T, the mere fact that “something went into d(t)” does not say when. If however we send a photograph in standard format in such a mode, the number of T grows sharply. And then in the mul7 F proportion we are in a completely different place. Parameter, Value After AES-256 + RS, "~1.8 MB ≈ 14.4 Mbit" 480-bit blocks, T ≈ 30 000 With mul7, "F = 210 000, N = 240 000" "log₂(C(N,T))", ≈ 130 455 Effective bits, ≈ 130 500 This is already an order of magnitude at which path enumeration is completely beyond any practical (and theoretical) reach. Not 2²⁵⁶ nor 2⁵¹² - we are talking about a number with hundreds of thousands of bits in the exponent. Message, T (approx.), With mul7: effective bits, Regime Tweet, 7, ~80, Still practical Small photo (~100 KB), ~2 000, ~8 700, Absurd "Normal photo (1.5 MB)", ~30 000, ~130 500, Completely out of reach Continuous stream + 1 tweet/h, 7, ~149, Already above 2¹²⁸ In continuous mode when sending a photo in a stream of 14 blocks/s the photo itself takes ~36 minutes of continuous transmission (but it occupies 7k bits per second, let us assume that bandwidth is customarily wider today), in this window the density of true blocks is high (either all, or true+fake according to mul7), the adversary does not have to guess “which 7 out of 50 000”, he only has to correctly identify a long, dense sequence of true blocks among the fakes in the proportion 1:7. With T = 30 000 and F = 7×T the number of hypotheses is so large that even very aggressive pruning of wrong paths after the first few blocks does not save the situation - an astronomical amount of work remains. Short message (tweet) + continuous cover → the cost grows mainly through the rarity of true blocks in a long stream (~2¹⁴⁹ with 1 tweet/h). Photo + mul7 → the cost explodes through the length of T itself. We are orders of magnitude beyond any sensible enumerative attack. Bandwidth with T = 7 (one tweet) in the course of an hour: Bandwidth, N (blocks/h), "log₂(C(N,7))", Effective bits 7 kb/s, 50 400, ~97, ~149 100 kb/s, 750 000, ~130, ~182 1 Mb/s, "7.5 million", ~163, ~215 10 Mb/s, 75 million, ~196, ~248 For a photo ~1.5 MB (T ≈ 30 000) with mul7 the cost is astronomical in any case (~130 000 effective bits). Wider bandwidth only shortens transmission time: Bandwidth, Time to send photo (T=30k), Effect on cost 7 kb/s, ~36 min, Cost still absurd 100 kb/s, "~2.4 min", No change in order of magnitude 1 Mb/s, ~14 s, No change in order of magnitude 10 Mb/s, "~1.4 s", No change in order of magnitude Rare, short messages (tweet once in a while) in a continuous stream: wider bandwidth increases the attack cost, because the adversary has more positions to search. Large objects (photos, files): the cost is already extreme through T × mul7 itself; wider bandwidth mainly shortens transmission time, does not change the order of magnitude of protection. 7 kb/s was a conservative, narrow example. On today’s links (even 100 kb/s–1 Mb/s) the cover traffic effect for rare messages is even stronger. A short seed (two 52-bit numbers) gives real, practical advantages, and the level of protection can be high. Two 52-bit numbers are a total of 104 bits ≈ 13 bytes (or ~20–25 characters in hex/base32 notation). This can be written on a piece of paper, transcribed by hand, transferred on paper, microSD, or even memorised in parts, loaded into the HSM without any electronic channel. One can also use string-to-number where two 52-bit numbers can be derived from a password/sentence through any deterministic function (e.g. hash → split into two 52-bit values, or a simple KDF with truncation). For example: "siadła_mysz_chmura_trójkąty_ganiać_dywany" → hash/KDF → two numbers ≤ 2⁵²−1 → NEW_KEYRING_INITIATE. Easy to memorise or write on paper in human-readable form. There is no need to transfer the raw numbers - the sentence is enough. Still air-gap: the sentence can be passed orally, on paper, without electronics. After loading the HSM can immediately erase the source (or the user destroys the paper). Strength depends on the entropy of the sentence. A short, predictable phrase lowers the effective seed size. A longer, less predictable one (or with a random addition) preserves the full ~104 bits. This is the standard passphrase vs. raw key trade-off. It is then appropriate to add options in the HSM: NEW_KEYRING_INITIATE - loads two 52-bit numbers and initialises the keyring. KEYRING_DESTROY / reset button - zeroes the memory (explicit zeroization). After the session the final state (two new 52-bit numbers) can be read and transferred further on paper, or the HSM can simply be erased and a fresh seed loaded from a new physical source. Level of protection (in bits). The seed itself is only 2^(52) (or 2^(104) if we treat both numbers as the full secret). True protection comes from path enumeration in the continuous stream, not from the length of the seed. With continuous communication at low density of true blocks the effective protection is significantly higher than the length of the seed. The seed is only the starting point; the rest is done by the combinatorics of true block positions + state mutation. Protection does not sit in the seed, but in the manner of use (continuous cover + fakes + rotation). If someone sends many true blocks without cover, the cost drops. It requires operational discipline giving a continuous stream, controlled true density, erasure of the HSM after the session. An identical toolchain is still needed on both sides. The advantages are serious. A short, physically transferable seed + HSM with the possibility of manual loading and erasure gives a model closer to a “one-time pad on paper” than classical key management, and at the same time - with continuous cover traffic - effective protection can exceed AES-128/256 without the need for long keys. This is a strong, practical aspect of the construction where low starting weight + high attack cost resulting from the protocol, not from the length of the secret. Restart from the same seed (passphrase as a case worth considering) does not weaken security in a significant way, provided the protocol operates normally. After the first true block the keyring mutates on the basis of the message content (via G from K1). A different message → different G → different state trajectory. Fakes additionally differentiate the paths. An adversary who knows the seed must still solve the problem of enumerating the positions of true blocks in the given stream. Knowledge of the starting point alone does not give him the further state. Conditions for security of seed reuse are different messages / different sequences of true blocks. Continuous cover traffic (low true density). HSM erased between sessions or the final state is not reused as a starting point in a predictable way. Conditions of weakening of reuse are identical message + identical sequence of fakes + the same toolchain → deterministic replay. Then an adversary who has once broken the session can replay it. In practice with random/RS-based fakes and different messages this case does not occur. Feature, Advantage, Strength Seed from sentence, "Easy physical / memory transfer, air-gap", High (with good phrase entropy) Reuse of the same seed, No need to generate a new secret for each session, High - state mutation + fakes isolate sessions Short seed + HSM erasure, "Low operational cost, no long-term secret in the device", High "Protection mainly from the protocol, not from key length", Effective bits >> seed length with cover traffic, High The sentence as initialiser and the possibility of restart from the same seed fit into the model and strengthen practical usability without significant weakening of protection, provided cover traffic discipline and state mutation are maintained. Physical / side-channel attack on the HSM Goal: extract the KeyRing from the external module. Fault injection, power analysis, EM on the dongle (Pi Zero / STM32). Attack on the USB interface (if the protocol has gaps outside the whitelist). Attempt to read memory before/after provisioning (if the port has not been physically removed). It is hindered because the keys never leave the module. Communication is filtered (only defined commands + parameter packet). The plan assumes lockdown, read-out protection, zeroization, constant response times. Effectiveness depends on the quality of the HSM implementation. This is a classical attack on a hardware module, not on the RIPA channel itself. Attack through toolchain desynchronisation in order to prevent correct demodulation or force errors. If the parties have different libm, order of FP operations, roundings or FPU (e.g. differences in pow/sqrt), residual trajectories diverge. The adversary can try: to inject packets from a different toolchain, to use platform differences to detect which block is “true” (if the parties are not ideally synchronised). High effectiveness if the parties do not have an identical environment. This is a limitation of the construction, not a classical cryptographic attack. Attack on the ECC layer / BER control in order to recover the buffer despite an incorrect key or increase the chance of a false success. The adversary tries to demodulate with a key candidate and checks whether after RS the residual BER drops to an acceptable level. On an incorrect key the BER is deliberately high (~40%+). RS is chosen so as to correct ~2–2.5%, and to fail at high BER. Fakes additionally do not pass AO_check. Low effectiveness with correct calibration of nsym and interleaving. Active attack (injection / modification of packets) in order to desynchronise the parties or force incorrect rotation. The adversary modifies or injects packets in the channel (if he has access to the medium). He tries to change ERR so that a true block is rejected, to inject a fake that accidentally passes AO_check, to disturb the sequence so that keyring rotation goes in the wrong direction. The receiver accepts a block only with matching AO_check. Incorrect rotation quickly leads to permanent desynchronisation (both parties must have the same state). Effectiveness depends on whether the adversary controls the medium. With air-gap between the medium and the demodulator it is hindered. An additional communication layer (bidirectional) negates this attack to the level of ineffective communication between users, but without information about the adversary’s success (transmission continues, the keyrings simply stand in place of “history make” and keep resetting while transmitting fakes). Attack on band multiplex (if used) in order to guess the active band b*(t) in each tick. The adversary hears n bands. For each tick he must choose which band to demodulate and treat as potentially true. A wrong choice spoils further state (rotation + band selector). Multiplies the number of hypotheses by a factor of n per tick. Local success on one band does not say whether it was b*, or an ERR collision on a foreign seed. Attack, Cost for the adversary, Cost for the legitimate receiver, Main defence mechanism Traffic analysis true/fake, High (statistics), Low, Format + RS fakes + ERR sieve Path enumeration, Exponential in the number of true blocks, Constant (AO_check), Fakes + rotation via K1 Brute seed, Large + state mutation, Low, Mutation dependent on the message Physical on HSM, Classical (hardware), Not applicable, Air-gap + lockdown Toolchain mismatch, Not applicable, Desync, Requirement of identical FPU/libm Active injection, Medium–high, Low, AO_check + desync The most important scenarios that realistically raise the cost are path enumeration (point 2) and attack on the HSM (point 4). The rest is either hindered by construction, or results from limitations of the model (toolchain). Summary. On this basis a computational reference in bits can be made, but the result looks absurd relative to the weight of the seed, and these are some numbers for assessment. The appearance of a reference in bits should be caveated. Under clearly defined assumptions the effective cost of the enumerative attack can be calculated and expressed in bits (tables discussed earlier): Scenario, Effective bits, Seed weight "1 tweet/h, 14 blk/s", ~149, 52 "1 tweet/h, 100 kb/s", 182, 52 "1 tweet/h, 1 Mb/s", ~215, 52 "Photo 1.5 MB + mul7", ~130 000, 52 Relative to standard tools (AES-128/256, where “128 bits” means roughly 2^(128) work under a known model) these numbers look absurdly high with a 52-bit seed. This is not an error of calculation but a consequence of the fact that the cost sits in the enumeration of positions, not in the key space. A computational connection with security models exists, but it is partial and conditional: One can assume “under the assumption of continuous cover traffic of a given density, the cost of finding the correct path of true blocks is approximately 2^(x)”. But not “the system has X bits of security” in the classical sense, because there is no reduction to a known hard problem, the bound is open (the adversary has no guarantee of success at a given budget), the model depends on operational parameters (true density, proportion of fakes, session length), which the adversary may not know exactly, but which the operator must choose. Hence the strong impression of “this is not how it is done” - classical models choose a closed, lower bound independent of the manner of use. Here the lower bound is strongly dependent on the manner of use. Criterion, Assessment, Comment Novelty of the mechanism, High, FPU residuals + deniability + path enumeration is not a standard primitive Practical usefulness air-gap, High, Short seed from paper/sentence + erasable HSM Attack cost with cover traffic, High (computationally), With low true density effective bits >> 128 Dependence on operational use, High (risk), "Protection drops if the operator sends many true without cover", settable "paranoia" parameter; Certifiability, Low, Does not fit into FIPS/CC as a cipher Implementation maturity, Medium, "Requires identical toolchain, careful HSM, BER calibration" As a deniability/cover layer over existing encryption it is worth considering, especially where air-gap, physical seed transfer and hindering of traffic analysis are more important than classical certification. This does not change the security already established by encryption, acting in a different place. RIPA does not replace AES (or another cipher). It operates on the ciphertext. Compromise of RIPA (successful finding of the path) does not give the plaintext - the encryption layer still has to be broken. Compromise of the encryption does not automatically give knowledge of which blocks were true in the RIPA stream. The layers are compositional: confidentiality security remains with AES; RIPA adds the cost of traffic analysis and deniability. The construction does not raise the lower bound of confidentiality established by the encryption layer. It does however supply an additional, parameterisable cost for an adversary trying to determine which fragments of the stream carry true data, and facilitates the operational air-gap model with a short, physically transferable seed. With maintenance of low true block density the computational cost of enumeration can exceed typical 128/256 bit thresholds, however this value is conditional and does not constitute a classical security reduction. The solution is worth considering as a transport-deniability layer, not as a replacement or reinforcement of the encrypting primitive. Large objects (SAR, photos, other “pictures”) Synthetic Aperture Radar and similar data are typically large files (tens–hundreds of MB, sometimes more). T is very large (for 1.5 MB already ~30 000 blocks of 480-bit; for true SAR - many times more). With maintenance of the proportion of fakes (mul7 or even smaller) ((T+F) choose T) becomes astronomical. Effective bits go into tens or hundreds of thousands. Protection is extremely strong regardless of whether the stream is continuous or the transmission is bursty. The length of T × the proportion of fakes dominates. Small texts of low density where protection does not come from large T, but from the rarity of positions in a long cover stream. Example from earlier tables: 1 tweet (T=7) per hour, stream 14 blocks/s → ~2¹⁴⁹, stream 100 kb/s → ~2¹⁸², stream 1 Mb/s → ~2²¹⁵. This is still clearly above the classical thresholds of 128/256 bits. The adversary must find the correct 7 positions among tens or hundreds of thousands of blocks; a wrong hypothesis spoils state mutation. Protection is strong, provided the cover stream is continuous (or sufficiently long), true density remains low, fakes are present in a reasonable proportion. Type of transmission, Source of protection, Strength (with correct use), When it weakens SAR / large pictures, Large T + proportion of fakes, Extreme, Almost never (with maintenance of fakes) "Small texts, low density", Enumeration of positions in long cover, High (>128–256 bits), When true density rises or cover is short/absent "Small texts, high density / no cover", Almost only seed 2⁵², Weak, Always in this regime Applications SAR and other large “pictures” - a case of very strong protection. Here the construction gives a huge margin. Small texts of low density - it is not unjustified. With continuous cover traffic the effective cost remains high. This is precisely the scenario in which deniability and path enumeration work best. It becomes unjustified only when small texts are sent densely, without cover or with a very small number of fakes - then what remains is mainly the short seed. Implementation-wise: the core is deterministic operations on double + libm, a simple binary protocol, HSM as a filtered external module, RS as a separate tool. There is no complicated asymmetric cryptography or certificate management. Computationally the attack cost can be estimated by 52 + log2((T+F) choose T) (plus constants). The model is atypical, but the calculation itself is elementary. Atypical strength model. Protection sits in the enumeration of true block positions, state mutation dependent on content, deniability through fakes and cover. And not in key length or in a hard problem. Effective bits can be very high with a short seed - under the condition of appropriate use. Optional advantages of key transfer. Seed = two 52-bit numbers (or sentence → KDF). It can be transferred on paper / orally. The HSM can be loaded manually and erased after the session (NEW_KEYRING_INITIATE + KEYRING_DESTROY). Restart from the same seed does not significantly weaken protection, because a different message → different mutation. Operational advantage (air-gap, one-time use, low weight). Disadvantages and requirements! Requirement / disadvantage, Significance Identical FPU + libm + order of operations, Critical. Difference of toolchain = desynchronisation. Operational discipline, Protection depends on true density and presence of cover/fakes. Without this mainly 2⁵² remains. Lack of classical certification, Does not fit into FIPS/CC as a cipher. More difficult in regulated environments. BER calibration, "The number of operations and RS must be chosen so that ~2–2.5% on a good key, and high on a bad one." HSM must be properly made, "Command whitelist, zeroization, no key leakage, resistance to simple side-channel." Side-channel on modulating devices, "Timing/power when rejecting fakes - requires attention (constant times, dummy work)." Lack of standard reduction model, Harder to convince an auditor; security is conditional. //END