Author: Jack Kowalski https://entropment.com Patent Pending The idea of a security model appeared during the analyses. Notes from the reasoning leading to formalization. I note that due to the lack of a domain (there are no security models for channels because they are carriers) the calculations are presented in a form appropriate for another domain (cryptographic analysis), but due to the lack of properties expected there and the focus on the main task, one should not be guided by the numerical results but carefully read the model in order to understand in what way thinking about a reductive closed space limits the max cap of the formal security obtained and what is given by removing the reductive maxcap. Each element can be studied separately; these elements are the embedding and residual FPU, QCO-like powers, sedenion multiplications, the inconsistency threshold, keyring mutation, fake blocks. In the implementation they do not operate separately. They are coupled alternately where the state (key) determines whether a block will give a consistent residual. A consistent residual allows a fragment to be read and simultaneously mutates the state further. Mutation of the state changes the conditions for the next block. Fake blocks and the lack of a positive oracle mean that it is not known whether we are currently in the coupling. The authorized user cheaply recognizes when he is not and skips. In order to read anything at all, one must maintain this coupling through many blocks. The couplings exclude successive reductions because one cannot cheaply check one block without the state, one cannot cheaply check the state without many blocks, one cannot separate the “signature” from the fact of reception, one cannot perform an early cutoff because the signal is late and dependent on the entire path. What remains is one coupled apparatus. This is an emergent property where the cost of entering the path and maintaining it is cascading, and “verification” is identical with access. Because spelling out the logic indicates that access is a form of “signature” — if you see the message then it means that the shared secret (here the fiber of the trajectory of states) is correct. That is, it was a message “for Your eyes.” The interleaving is not accidental. The elements are coupled so as to exclude successive classical reductions. Operational coupling. Operations (marked with letters) Letter, Operation, Where in the code A, Embedding: mapping 30-bit values to the center of IEEE-754 buckets (val * Enoise + Enoise*0.5 / Mbd), exe_crypt_msg_v3_HMS B, "QCO-like forward: powers 2/4/8 on selected axes (f_scale_QCO_Like_v3_HMS(..., ""fwd""))", exe_crypt_msg_v3_HMS C, Normalization + sequence of sedenion multiplications controlled by the key (single_euclid_rot_16 × Rounds), exe_crypt_msg_v3_HMS + sedenion_multiply D, "Packing: (scale, 16 floats) + writing of ERR (NaN / in-range / out-of-range counters)", exe_perform_entropment E, Decoding: inverse rotations + reverse QCO-like + floor to 30 bits, exe_decrypt_msg_v3_HMS F, "Inconsistency control: exe_check_deciph_struct_val_NaN → (NaN_sum, ViR_Sum, VooRSum)", after each decoding G, Extraction of numbers for mutation: exe_extract_num_for_HMS_from_deciph (only non-NaN), in the entropment loop H, "Keyring mutation: exe_HMS_rotate_keyring - shifts + adding values to keys, only if array_length(struct_get_names(_num_gets)) > 1", after decoding of “current_1” I, Injection of fake blocks: exe_infuse_false_random_block (random buffers + crypt/decrypt + check of interference with the true key), "in the loop, before and after the true block" J, "HMS / keyring state (HMS_simulator.current.hmsKeyRing) - source of angles (_Flist), parameters (_Enoise, _Mbd, _QCOpool) and object of mutation", "global, read/written by A–H" Relations and couplings Main loop (exe_perform_entropment, one pass = one block): I (fake) → A→B→C→D (fake cipher) → E→F (check whether it interferes with the true key). If it interferes → skip. Otherwise the fake goes into the packet. // this operation may have a “until success” loop, but its practical randomness with interference introduces noise, which is an advantage; of course there may exist an external loop generating fakes themselves on idle transfer; A→B→C→D (true block, controlled by the current J). E→F (decoding of the true block with its own key) → writing of ERR to D. E→F→G (decoding of the same block, but with the “current_1” key) → if G returns ≥2 numbers → H (mutation of J). I (next fake) → decrement of the block counter. Circular / cascading couplings (between blocks) J → (A,B,C) → D → E → F → G → H → J The keyring state determines whether the block will give a consistent residual. A consistent residual (threshold on G) mutates the state. The new state determines the next block. This is a cycle: state → residual → mutation of state. I is interwoven into this cycle when fake blocks are generated and checked against the current J, but do not mutate it (because they do not pass the threshold on the true key, and upon interference they are rejected). Thanks to this the attacker has no cheap way to “jump into” the cycle with a false block. F (inconsistency control) is not a positive oracle. It is only a filter for entry into H. The lack of positive confirmation + the dependence of H on G means that a single block does not determine membership in the fiber. A sequence of blocks is needed for the cycle to be maintained. The cycle is between blocks, not inside one block: J_n ──► A/B/C ──► D ──► E/F/G ──► H ──► J_{n+1} ▲ │ └──────────────────────────────────┘ Additionally I (fake) is injected into the loop and checked against the same J, but does not close the cycle (does not mutate). In order to maintain the path and read the sequence one must hit the true blocks at the proper state for many consecutive steps. One block is not enough to confirm that we are in the coupling — hence the cascading increase in cost. This follows directly from the code: the condition array_length(...) > 1 before exe_HMS_rotate_keyring, injection of fakes before and after the true block, and the fact that ERR is only a counter, not a “correct” flag. Access of the external observer - layers and air-gap What is visible (layer 0 - channel) Object / operation, Access, Layer, Remarks "D - packet (scale, 16 floats) + ERR", Yes, 0, Continuous stream of blocks (true + fake). ERR is three numbers (NaN / in-range / out-of-range). Order of blocks in the stream, Yes, 0, It is not known which are true; all are credible (generator condition). Timing / length of stream, Yes, 0, Depending on the channel. Layers behind the air-gap Object / operation, Access, How many air-gaps, Why "J - keyring state (hmsKeyRing, _Flist, _Enoise, _Mbd, _QCOpool)", No, 1 (logical), The state mutates only upon the threshold on the true block. The observer does not see the evolution. "A, B, C - embedding, QCO-like, sedenion rotations", No, 1, They execute internally. Only the result D is visible. "E, F, G - decoding and extraction of numbers", No, 1, The receiver does this locally. The observer does not see intermediate states. H - keyring mutation, No, 1, "Occurs only upon array_length > 1 on the true block. From outside it is not visible whether and how the state changed." "I - decision which blocks are fake", No, 1, Fakes are injected and checked locally. In the stream they look like the rest. Internal FPU state / order of roundings, No, 1–2, Dependent on the toolchain. With hardware air-gap unavailable. Air-gap in the model 1. logical air-gap - lack of positive oracle and lack of visibility of the state. The observer has only the stream D. 2. hardware air-gap (in the full implementation on Pi/STM32 as HSM) - lack of remote access to FPU, cache, internal timings, substitution of libm. In the documentation (Product Plan, hardness models) the air-gap is part of the resistance model. Whether in the full implementation there exists a practical attack path Goal, Practical path, Conditions Distinguishing true blocks from fakes in the stream, Not in the model, Requires a cheap distinguisher on D or an early signal. Measurements on the prototype indicate that the signal is late (NaNs on wrong paths only at the end of the full sequence). Reconstruction of state J from the stream alone, Impractical, The cycle J → A/B/C → D → … → H → J requires hitting true blocks through many steps. One block does not confirm the coupling. Forcing mutation H with a false block, Extremely rare, The code rejects interference; the inverse is broader than inference; Algebraic reduction of the angle ↔ residual relation, Impractical under the present coupling, The relations are strongly dependent on the state. Approximation comes out too broad to bypass the full sedenion computation. Attack with access to hardware (side-channel, debug, FPU substitution), Yes, This is already outside the model. Therefore in the documentation the air-gap is required. Attack on extracted ciphertexts after composition through RS, Not as the first step, First one must find in the stream the fragments that compose at all under a given state (needles in a haystack). The cost is dominated by searching, not by breaking an already extracted ciphertext. The external observer has access exclusively to the stream D (layer 0). All operations controlling the state and the decision about the truth of a block are behind at least one logical air-gap. In the full implementation with HSM (second, hardware air-gap) there is no practical attack path in the “attack only on the channel” model. Practical paths appear only upon violation of the hardware air-gap or upon finding a cheap distinguisher on the stream — which the prototype and measurements on it do not show, because the pipeline was constructed for that. Mermaid diagram: flowchart TB subgraph Warstwa_0["Layer 0 - channel (visible to the observer)"] D["D: stream of blocks
(scale, 16 floats) + ERR
(NaN / in-range / out-of-range)"] end subgraph AirGap1["Air-gap 1 - logical
(no oracle, no visibility of state)"] direction TB J["J: keyring state
(hmsKeyRing, Flist, Enoise, Mbd, QCOpool)"] A["A: embedding
(center of buckets)"] B["B: QCO-like forward
(powers 2/4/8)"] C["C: normalization +
sedenion multiplications"] E["E: decoding
(inverse rotations + reverse QCO)"] F["F: inconsistency control
(check_deciph_struct_val_NaN)"] G["G: extraction of numbers
(extract_num_for_HMS)"] H["H: keyring mutation
(only if ≥2 numbers)"] I["I: injection of fake blocks
(+ interference check)"] end subgraph AirGap2["Air-gap 2 - hardware
(HSM / Pi / STM32, no remote access to FPU)"] FPU["Internal FPU state
order of roundings
libm / timing / cache"] end %% Coupling cycle (between blocks) J -->|"controls"| A J -->|"controls"| B J -->|"controls"| C A --> B --> C --> D D -->|"observer sees only this"| D D --> E --> F F --> G G -->|"threshold ≥2 numbers"| H H -->|"mutates"| J %% Fake I -->|"generates and checks
against J"| D I -.->|"does not mutate the state"| J %% Hardware C -.->|"executes on"| FPU E -.->|"executes on"| FPU %% Style classDef visible fill:#e8f5e9,stroke:#2e7d32 classDef hidden fill:#fff3e0,stroke:#ef6c00 classDef hardware fill:#fce4ec,stroke:#c2185b class D visible class J,A,B,C,E,F,G,H,I hidden class FPU hardware Legend Green (Layer 0) - the only thing the external observer sees. Orange (Air-gap 1) - operations and state inaccessible from the channel. The cycle J → A/B/C → D → E/F/G → H → J is logically closed. Pink (Air-gap 2) - hardware layer in the full implementation. Upon its violation (side-channel, debug, FPU substitution) the “channel only” model ceases to apply. Fake (I) enter the stream but do not close the state-mutation cycle. The graph shows that the observer is cut off from the coupling cycle by one logical air-gap, and in the target implementation additionally by a hardware one. Annotation concerning numerical tests and reliance on data. There were more numerical tests during the work than needed for the results presented here. They were necessary for calibration of QCO-like; it is a sufficiently complicated operation that the obtained numerics and their analyses are a by-product significantly exceeding the demand for drawing conclusions. The process was inverse — calibration produced functions that ensure the absence of a surface for analysis (for example a quasi-attractor as a separate project “so that one is not exactly one”). All tools (test loops) are contained in the open code, available from the IDE. The tools contained in the code allow one to immediately establish whether tinkering with the calibration for a given fpu+libm configuration is going in the right direction and to confirm the obtained BER needed for setting the ECC. This process generates more analytical data than needed for conclusions about “security,” because on its basis loops are constructed whose effect is flat graphs of statistical tools. In the code there are also prototypes of older functions that allow much higher conditional security (condition — you send pictures and do not worry about occasional bad-pixels resulting from BER), i.e. raising the coding bits from 30 to 31 or 32 (max of reason), throwing out ECC and treating the transmitted format as an interpreted stream of pixels directly. There is no point in keeping or publishing gigabytes of data — in the code there are tools to recreate these stacks of numbers for analysis at one’s own discretion. Calibration is much simpler on a simulated fpu with u1024 instead of u64 (80 in fpu) I/O register. One can then use QCO of the original form directly. And conversely — scaling this to u32 or u16 violently increases the level of “security,” but will be a calibration nightmare and RS may turn out heavier than the channel modulator itself. Generator condition. The fake generation function can be bound to theoretical statistical attacks. For example generate completely true series of messages encrypted from another bunch of keys (instead of from random) and throw them in when there is no inference (or hold and check next fake keyring when there is) obtaining in one stream several completely true, mutually interleaving fibers, of which only one is read by the authorized user (the starting keyring + evolution of the state is in this case the authorizing secret). The adversary even finding some unknown method of distinguishing them will not necessarily first attack the fiber that is the subject of protection. --------------------------- Attack vector on the stream (from the adversary’s point of view). The adversary sees only D as a continuous stream of blocks (scale, 16 floats) + ERR. He does not know which blocks are true, does not see the state J, has no positive oracle. Step, What he must obtain, Why, Cost in the model 1, Candidates for true blocks, "Fakes (I) are indistinguishable in the stream. One must choose a subset that can be a path.", Combinatorial (choice of positions) 2, Candidates for state J (keyring / _Flist / parameters) for those blocks, A/B/C are controlled by J. Without the proper state the residual will not be consistent., Key space × number of blocks 3, Full computation of the sequence for each candidate, The signal (low residual instead of abundant NaNs) appears only after the full sedenion rotations. No cheap early cutoff., Flop-heavy (developed further, each candidate = full C) 4, "Confirmation that one is in the coupling", "One block is not enough — F/G does not return “yes, this is the proper path.” One must maintain the threshold through many consecutive blocks so that H advances the state and the cycle closes.", Cascading (many blocks × full cost) 5, (Optionally) Extraction of the ciphertext after RS, "Only after composition of a consistent residual does RS give a ciphertext with which one can work further.", Secondary — dominated by steps 1–4 Attack path Stream D │ ├─► Choose candidates for true blocks (combinatorics) │ ├─► For each candidate guess state J (key space) │ ├─► Compute the full sequence A→B→C→E→F→G (expensive, late signal) │ ├─► Check whether G exceeded the threshold (if not — reject) │ └─► Repeat for subsequent blocks, maintaining the cycle (cascade) │ └─► Only then can RS compose something that looks like a ciphertext First one must find that ciphertext at all after composition by RS at the end of the process. One cannot cheaply reject a candidate after a partial trajectory (late signal). One cannot force mutation of the state (H) with a false block (interference is rejected, false positives extremely rare). The adversary does not see whether he is currently in the coupling until he has gone through many blocks. The cost is dominated by searching the stream and maintaining the coupling cycle, not by an attack on the ciphertext after RS. In the “attack only on the channel” model (behind the logical air-gap, and in the full implementation also the hardware one) there is no practical path that bypasses this cascade. Flop-heaviness — it is worth stopping on this topic because it will turn out to be key for formalization of the security model; The weight is in the sequence of sedenion multiplications (I naturally put this into the construction “by chance” not at all suggesting the selection of such an operation that would block the fpu longer creating a clear, non-removable cost without an optimization bypass of the kind: https://entropment.com/media/downloads/PAPERS_tensors_to_algebra_cookbook.txt ). Let us break down the cost of one sedenion multiplication S16 (because I also considered S32 and S64, but they complicated ECC and caused the RS structure to dominate the signal). The Cayley–Dickson construction in the code is sedenion_multiply calls 4× f_okt_mul each f_okt_mul calls 4× f_quat_mul together that is 16 quaternion multiplications per one sedenion multiplication, textbook, no tricks. f_quat_mul (Hamilton) is 16 floating-point multiplications and 12 additions/subtractions Per one sedenion multiplication we have about ~256 FP multiplications and ~200–250 FP additions/subtractions plus conjugations, gluing, sqrt(15) when building the rotation element. QCO-like (power with exponent 2/4/8) and embedding are cheap compared with this (a dozen to several dozen operations per block). Per one block (true) from the call exe_HMS_return_current_0 _rounds ≈ key_length + (a*b+c) mod 17 → typically 52–68 rounds. We take 60 rounds as a representative value. We obtain (on average, representative approximation): 60 × sedenion multiplication ≈ 15 000 FP multiplications + ~13 000 additions; plus the inverse sequence upon decoding (another ~15 000 multiplications); together for the full block cycle (crypt + decrypt for control): ~30 000 FP multiplications; Fake blocks add a similar cost upon generation, but the adversary must anyway compute full sequences for his candidates. Cycle estimate (optimistic hardware optimization). Let us adopt the following optimistic assumptions: modern CPU/GPU with good FMA, FP64 multiplication ~4 cycles (or better with pipelining / SIMD), addition ~1–2 cycles, ideal utilization of units, no GameMaker interpreter overhead (i.e. already after transfer to C/Zig or shader). Operation, Quantity per block (crypt+decrypt), Cycles per op (optim.), Cycles total FP multiplications, ~30 000, 4, ~120 000 FP additions, ~25 000, 1.5, ~37 500 power / sqrt / rest, < 1 000, 10–20, < 20 000 Total per block ~150–180 thousand cycles At 60 rounds and full crypt+decrypt. This cannot be omitted in any way; that is where the “chaos” is generated. The number of errors preimage→projection grows avalanche-like there and one must carry out the forward process; the lack of reduction turns out to be an advantage. The adversary, in order to check one candidate on one block, pays this cost (he has no choice). In order to maintain the path through k blocks (in order to know at all whether he is in the coupling), he pays k × this cost, without a cheap early cutoff. Under optimistic hardware optimization one block is of the order of 10⁵ cycles. With thousands–millions of candidates (combinatorics of positions + state space) the cost quickly becomes dominant relative to breaking an already extracted ciphertext itself. This is a lower estimate — the real code in GameMaker is slower; after transfer to native code with SIMD one can come down to the vicinity of the above numbers, but not lower by orders of magnitude, because the Cayley–Dickson tree has limited parallelism. This gives enough, i.e. ~150–180 thousand cycles for the full cycle of one block (crypt + decrypt) under optimistic optimization; this is not “a lot” for a single check on a modern CPU. It is the order of microseconds. The problem is not the cost of one block, but that there is no cheap early cutoff — the adversary pays the full ~10⁵ cycles for each candidate, one block does not state whether you are in the coupling — the adversary must maintain the path through many blocks (to the finish in an effective RS), the combinatorics (which blocks true + what state) multiplies the number of candidates, fake blocks and the lack of an oracle give no shortcut. With thousands or millions of candidates the cost ceases to be negligible. With tens of thousands of blocks to check in the stream (in order to find needles in a haystack) this becomes the dominant computational expense — greater than a typical attack on an already extracted AES ciphertext. The sedenion multiplication itself is not extremely expensive. But one has to do it blindly, many times, without the possibility of early rejection of most of the work. In this model that is enough to regard searching as impractical relative to alternatives. Let us calculate this more precisely on the example from https://entropment.com/media/downloads/PAPERS_hardness_models_en.txt Cost in cycles (based on ~160 thousand cycles per full block cycle as we established above; that is a fair value from the distribution 150k-180k). We then have the following operations. First choice of candidates for true blocks. Combinatorics of positions. With a stream of length N and k true blocks to maintain the path: the number of subsets grows as (N choose k). Each subset still requires further steps — the choice itself does not yet have an FP cost, but multiplies everything below. Guessing of state J for the chosen blocks. State space per block (simplified, after taking mutation and fakes into account). With an effective space of order 2^b per step: number of state candidates = 2^b per block. Full computation of the sequence for each candidate ~160 000 cycles per one candidate per one block. With M state candidates per block: M * 160000 cycles per block. No early cutoff — the adversary pays the full amount for each. Maintenance of the coupling through many blocks. In order to know whether you are on the path, a sequence of k consecutive blocks is needed. Cost: k * M * 160000 cycles. At k = 8–12 (typical range in which a stable signal appears) and M already of the order of thousands: tens–hundreds of millions of cycles per one path attempt. With the necessity of checking many starting positions in the stream the multiplier grows further. Composition through RS is secondary. The cost of RS is negligible relative to the above (thousands of cycles). It appears only after steps 1–4 have already been paid. The cumulative effect is the cost of entry into the coupling ≈ (number of position attempts) × (number of state candidates) × k × 160 000 cycles. At realistic combinatorial values (fake blocks + lack of early signal) one obtains an order of 10^9 to 10^12 + cycles for searching a fragment of the stream — before anything at all appears that RS can compose into a ciphertext. Assumptions (from https://entropment.com/media/downloads/PAPERS_hardness_models_en.txt , example of a photo) Photo ~1.5–1.8 MB after AES-256 + RS. Blocks 480-bit → T ≈ 30 000 true blocks. mul7 proportion: F = 210 000 fake, N = 240 000 blocks total. log_2 (N choose T) ≈130455 → ~130 500 effective bits for the combinatorics of paths alone. Cost of full check of one block (crypt+decrypt, optimistically): ~160 000 cycles. Aggressive pruning after the first few blocks is possible in theory (which does not yet exist, but let us assume it is imaginable), but at this density and the penalty for desynchronization there still remains an astronomical amount of work. Cost of the attack in cycles under pure path enumeration without any pruning (which we will further estimate): 2^130500 hypotheses × 160 000 cycles ≈ a number with exponent ~130 500. Even under the very aggressive assumption that the adversary rejects 99.999% of hypotheses after the first block and further prunes exponentially, there remains a space of order 2^(100+) full multi-block checks. With the necessity of maintaining the coupling through even a few dozen–a few hundred blocks (in order to know at all whether the path is alive) the multiplier k enters the exponent or the base. Practically: the cost is dominated by 2^130500 and does not descend to anything computable. Let us take extremely optimistic hardware: 10^12 block checks per second (a thousand times more than a single high-class CPU at 160 thousand cycles/block and 5 GHz). 2^130500 / 10^12 seconds ≈ 2^(130500 - 40) seconds gives an order of 2^130460 seconds. For comparison the age of the Universe (the cosmogonic thesis accepted conciliatorily) ≈ 2^59 seconds; 2^130460 seconds is a number about ~39 000 orders of magnitude larger than the age of the Universe. Even if one managed to reduce the effective space by a factor of 2^1000 (a very generous assumption for reductive surfaces + pruning), there remains still something of the order of 2^129500 — rather out of reach. At the parameters from the hardness model (1.5 MB, mul7, T≈30k) the cost of the enumerative attack on the paths is impractical by tens of thousands of bits. The working time of any realistic (or even fantastic) machine does not change this order of magnitude. At these parameters it is absurdly much. At the start we have at least 104 bits (K1 + K2); after the combinatorics of paths at T ≈ 30 000 and mul7 one obtains ~130500 effective bits for a one-and-a-half-megabyte photo of a “sweet kitten.” This is an explosion of ~130400 bits exclusively from the necessity of indicating the proper sequence of blocks among the fakes and maintaining the coupling of the state. Every error in the choice of a block spoils the further rotation of the keyring. In order to descend to values that can be considered at all a sharp pruning is needed. Goal, Required reduction, Order of magnitude To 2^256 (“don’t even try” level), 2^(130500−256)=2^130244, ~39 200 orders of magnitude To 2^128 (practical boundary), 2^130372, ~39 250 orders of magnitude To 2^80 (breakability with large resources), 2^130420, ~39 260 orders of magnitude That is, a theoretical reductive attack would have to shorten the space by more than 130 000 bits (i.e. by a factor of 2^130000) in order to descend into the vicinity of anything that in the literature we consider “within reach of an attack.” This is not a difference that is settled by a better algorithm, better pruning or an algebraic approximation by a constant factor. This is a difference that would require a fundamental collapse of the model (cheap oracle, early cutoff independent of the state, or a way of bypassing the dependence of keyring mutation on the content of the block). At the parameters from the 1.5 MB example the combinatorial coupling of paths alone gives a margin at which even very strong reductions leave the cost outside any practical or near-practical reach. Under the assumption that the proportion T:F remains as in the example (mul7, T ≈ 30 000), I have no idea for a reduction of order 2^130000. But we hope that someone has and will derail the whole idea in the direction where its place is — i.e. the nerds had an idea, but a stupid one. In order to descend by that many bits something would have to occur of the kind of a cheap, early oracle stating “this block is true / this state is proper” independently of the full sequence, a way of bypassing the dependence of keyring mutation on the content of the block (so that an error on one block does not spoil the entire further path), or an algebraic / statistical structure that allows treating thousands of blocks as one short equivalent instead of as a cascade. //Digression This last one I know how to bite into in the case of open and ordered sets of a million records. That is, I know how to extract structures and I have realized another algorithm for another purpose, but adaptation would be possible. Only that... for a million records it took about 100gb of cache memory of the ordering data alone (creation of an ultrametric taxonomy of records) and about two months of continuous work on six cores without optimization for an ordered and open test set in which there were no ambiguities, no malice, only couplings. In effect it would allow demonstrating a relational taxonomy between blocks. Perhaps. That is, it is imaginable for me constructively and I have done similar things ( https://entropment.com/media/downloads/PAPERS_Hierarchical_Metric_Flow_on_Data_Graphs.txt ), but such logical pruning does not at all have to mean a gain in time — it may last longer than the combinatorial brute-force attack and the only benefit will be the revelation of some order, not necessarily the proper and correctly defined one, but it will save combinatorics later (smaller and better arranged subsets). On the other hand counteraction against such a solution is cheap and is contained in the logic of generating fakes as concurrent fibers of true messages (properly processed cipher→RS) as sources of fakes; see above “Generator condition.” which will force combinatorics of projective x0s in an unknown number smaller (significantly smaller) than the whole set. //end of digression; From the code and from the measurements nothing of the kind follows. The signal is late (NaNs on wrong paths only after full rotations), one block does not confirm the coupling, fake blocks almost never give a false threshold for mutation (then they are rejected), the angle–residual relations are strongly coupled with the state. Reductions that realistically come to mind (better distinguisher on residuals, algebraic approximation, pruning after a few blocks) can at most cut a constant factor or a few dozen–a few hundred bits, but not 130 000. At these parameters the margin is so large that even the discovery of a non-trivial reductive surface leaves the cost still completely out of reach. I do not see a path that would change this without breaking the basic properties of the construction (lack of early oracle + path-dependent state + penalty for desynchronization). But perhaps someone will notice one. Classical tools give a hard problem with a cap + reduction + positive oracle + separate verification. Here we have consciously created an open problem without an early oracle, security from the coupling of paths (state ↔ residual ↔ mutation of state), verification identical with the fact of correct reading, cascading cost from the combinatorics of true/fake. This is not a strengthening of AES nor a new assumption in the style of discrete logarithm. This is a different construction in which the lack of classical properties (bijection, oracle, independent signature) is a feature, not a deficit. At large T the combinatorial margin comes out extreme precisely because these couplings are looped. Not to replace existing tools, because it does not carry the needed properties, but to secure access against attacks on existing tools. //Digression Besides, from childhood (in the face of the entire home library on encryption) it puzzled me that imposing one cipher on another gives nothing, because it is only a transfer of the symbol changing the function symbol→symbol and in no way hindering the inversion as far as the number of steps is concerned. And many times I considered what one should wrap the ciphertext in so that it would not be only a one-way transcription table S→S'. Within cryptography there is no such solution and there cannot be by definition. I have just thought about this; I recalled the first programs making such or other toy ciphers when I was recreating various historical variants and with colleagues we played at breaking them with paper and pencil fishing out sets of symbols under the mixing grates. For over 30 years this problem must have been nagging me. The construction I created here began from numerical play with projection errors and defects of orthonormalization. The whole product is following a series of accidents at work that intrigued me with the lack of constructive reversibility. //end of digression --------------------------- Change in reasoning. I will begin from the standard reasoning about the construction of security where I choose a hard problem with a clear cap (discrete logarithm, factorization, AES, lattice…). I reduce my security to it in order to obtain a reference level for measures. I create a positive oracle / correctness test so that I can cheaply check the result while the attacker cannot. I keep the layers as independent as possible (encryption separate, signature separate, key separate) so that they can be analyzed and composed. In this way I obtain systems in which the cost of attack is limited by the cost of the best attack on the assumption, and early cutoff and oracles are a desired feature. And now I reverse the reasoning. I do not look for a hard problem with a cap — it is to be open so that one cannot create a sensible measure of distance from success. I build a deterministic but non-injective trajectory in floating-point arithmetic in which many paths land in the same bits, and the useful signal (low residual) appears only at the end of the full sequence. I do not give a positive oracle (because I have no measure of distance; the problem is open and always escapes, even from the legitimate user). The only signal is the lack of obvious inconsistency of the coupling with the previous mutation. The attacker cannot cheaply confirm success because no one can; this notion is always “beyond the horizon” in an open problem. I couple the state with the content, and mutation of the keyring occurs only when the block gives a consistent residual. An error on one block spoils the further path. One cannot analyze blocks independently because they are coupled. I interweave fake blocks so that the stream does not betray which positions are true, and accidental entry into the coupling is extremely rare and does not return information about the effectiveness of entry because of the lack of a measure of distance. By definition I reject early cutoff and independent layers. Security is to result from the fact that the cost of entry into the cycle and of maintaining it through many blocks is cascading. The effect of this is qualitative. Instead of “cost of attack ≤ cost of breaking the assumption” I obtain “cost of attack = combinatorics of paths × full cost of the sequence × penalty for desynchronization.” At large T (example 1.5 MB) the mere necessity of indicating the proper sequence among the fakes and of maintaining the coupling of the state gives ~130 500 bits applying the measures standardly used for this, but not because the key is long, only because an error in any place spoils the entire further path, and there is no cheap way of detecting this earlier (and it was quite frustrating when I encountered this problem). This is the change where security is not a reduction to something known, but an emergent property of a coupled, non-injective, path-dependent process without an oracle. Hence the “coupled absurdity” at growing T is not a strengthening of a classical primitive (S→S'), but a consequence of a different way of building the cost. Instead of a difficult logical problem (with reduction and cap) there is here an incremental computational problem when each candidate costs a full, expensive sequence (sedenions + residual control). In order to know whether I am on the proper path it is necessary to maintain the coupling through many consecutive blocks. This was a quite long and serious problem in the tests, in the calibration so that the error would exist but would not desynchronize. I even created a whole apparatus for listing this desynchronization, because at a certain stage it spoiled the whole construction in unexpected places. An error in any place spoils the further state when one cannot “start over” cheaply nor prune most of the work earlier. Fake blocks multiply the number of hypotheses that must be checked blindly. This is for the adversary a proof-of-work where he pays with computations for each attempt and has no sensible shortcut. Ordinary PoW has a clear and cheap verifier (“does the hash have enough zeros?”). And here the verifier does not exist because the only signal is the lack of inconsistency after the full path, and the state mutates anyway only upon the threshold. That is, opening the message means that you have traversed the path, so it was for you. At large T the cost is not “a lot of work,” but combinatorially absurd (2^130000+) in the 1.5 MB example, because every wrong path hypothesis is almost free to reject only after paying the full cost, and the space of hypotheses is huge. Breaking requires something in the kind of proof-of-work, only without a cheap check and with a cascading penalty for a mistake. At the parameters from the hardness model this “PoW” is so expensive that it ceases to be a practical attack vector. For the stream the effect is even stronger because the longer the transmission at a constant proportion of fakes, the more hypotheses one must check blindly in order to hit the coupling and maintain it. Weakening by tens of thousands of bits still leaves the cost out of reach at T of the order of thousands. There exist limitations (not an error in the calculation, only in the scope) under which the reasoning about the cost holds as long as there does not appear a cheap oracle or an early cutoff independent of the full path and the state, the mutation of the keyring remains dependent on the content of the block (an error spoils the further path), fake blocks do not give a practical way of “jumping into” the cycle. If any of these conditions falls, the margin may shrink. Under the present construction and measurements on the prototype nothing of the kind is visible. Therefore even a significant weakening of a single mechanism does not pull the whole down to practical reach as long as the coupling and the lack of an early signal remain. This does not give a proof that a better attack does not exist, but a fairly reliable observation that the cost model has a very large reserve and that this reserve grows with the length of the transmission. That is, “security” results from escaping forward. For this construction a classical security proof (reduction to a known assumption + clear cap) is most probably unconstructible, or constructible only in a form that contributes nothing. Security does not result from the difficulty of one mathematical problem, but from the emergent cost of a coupled process (non-injective trajectory + path-dependent state + lack of oracle + combinatorics of fakes). In order to “prove,” one would have either to find a reduction that survives all these couplings, or formally to show that no cheap oracle / early cutoff exists. The latter is close to a proof of non-existence of an algorithm and is therefore practically unfeasible. An oracle would require a generalization about residuals over F and we would solve with it the unending problems with floating-point errors, and not only some silly modulator. Such a generalization would be a revolution in CS. The properties that give the margin (late signal, penalty for desynchronization, rarity of false thresholds) are engineering and measurable on the prototype, not algebraic. This is a consequence of the way in which the cost was built as a property of an engineering system, and not as a consequence of a mathematical assumption. A proof in the classical sense will probably not arise. What remains is empirical validation and analysis whether someone will find a way of breaking one of the conditions that hold the cascade, significantly reducing its speed of escape (crippling the pipeline). Defense by making the process of composing and verifying the path absurdly expensive without knowledge of the state. Something of this kind will have to be formalized. In the literature there is no standard primitive nor model that would describe this exactly. It is an experimental concept of security based on cascading cost instead of on reduction. As a way of thinking about the construction of cost it is qualitatively different from the dominant approach. There is no mature cryptographic theory that would treat the expansion of cost through the coupling of a non-injective trajectory + path-dependent state + lack of oracle as a basic security mechanism (instead of reduction). What we have falls into the gap between PoW, deniable protocols and experimental dynamic constructions. It has some conceptual connection with deterrence. In strategy, deterrence often consists not in making the attack impossible, but in making it irrationally expensive or risky relative to the gain. I do not have (and most probably cannot have) a proof that the attack is impossible, only that the cost of entry and of maintaining the path grows so quickly that a rational adversary will give up after burning resources on tests. In strategy deterrence usually assumes that the adversary is able to assess the cost and the risk, and here the assessment is hindered precisely by the lack of an oracle when the attacker pays before he learns whether he is going in the right direction at all. This makes “deterrence by cost” even more asymmetric, but also more difficult to close formally. Also for the adversary — he does not know the cost of the attack, he does not know whether the goal of the attack exists in the stream at all (because he may attack an idle stream of pure fakes). //joke; As it happens, defense by deterrence has in STEM a long tradition forcing one to read proofs after class. Professor at a lecture on analysis: - This theorem is completely obvious. Does anyone have doubts? (silence) - Good. Either you believe me, or I will prove it for two days at the blackboard and will not let anyone out for pizza. The decision is yours. (after a moment) - Exactly. We go further. This is a long tradition: https://www.onlinemathlearning.com/math-jokes-mathematical-proofs.html //end of joke --------------------------- There is a concept; time for a sketch. Participants and information are distributed as follows. The defender possesses the state S_t (keyring) evolving only upon consistent blocks. The adversary sees exclusively the stream D = (d_1, d_2, …). He does not observe S_t, has no oracle, does not see which blocks are true. Attacks of the adversary are invisible to the defender until the moment of eventual success (no side-channel on attempts). Until the moment of success the cost is borne exclusively by the adversary. Adversary’s cost function. Let C(h) be the cost of checking the hypothesis h (choice of subset of blocks + state candidate). From the construction: C(h) ≥ k · c_0 where c_0 ≈ 1.6 × 10⁵ cycles (full block cycle), and k is the number of blocks needed in order to know at all whether the path is alive. The space of hypotheses ℋ satisfies |ℋ| ≥ 2^{b(T)}, where b(T) grows with the number of true blocks T (in the 1.5 MB example b(T) ≈ 130 500). Lack of assessment of cost and risk. The adversary does not possess a function V: ℋ → {good, bad} of low cost. The only signal appears after paying C(h). Hence the expected cost to the first success: 𝔼[cost] ≥ |ℋ|/2 · k · c_0 in the absence of a possibility of prioritization of hypotheses better than random. Invisibility and costlessness until success. The defender does not observe the attempts → he cannot react, throttle or ban. The cost on the defender’s side remains constant (filtering of his own state). The asymmetry is extreme: the defender pays O(1) per block, the adversary pays exponentially in T before he learns whether any hypothesis was good. The condition of deterrence, which holds when for a rational adversary the following conditions are satisfied. 𝔼[cost] > U where U is an upper bound on the value of success (e.g. the value of compromising the stream). At b(T) ≳ 128 and the lack of a cheap oracle the inequality is satisfied for any realistic U, even under aggressive pruning by thousands of bits. The model holds as long as: 1. there does not exist a cheap predicate V independent of the full path and the state, 2. the mutation of the state remains dependent on the content of the block, 3. the density of fake blocks does not allow a practical “jumping into” the cycle. If any condition falls, 𝔼[cost] may fall below the deterrence threshold. In the present construction none of them is violated. One can formalize a model of deterrence through unobservable, unverifiable cost: the adversary bears an exponential expense, being unable to assess progress, and the defender does not see the attack until the moment of eventual success. Security does not result from reduction, but from the fact that a rational adversary does not undertake the attempt because he is unable to estimate either the risk or the moment at which the cost will cease to grow. Or from the fact that he will undertake it and lose resources regardless of whether he achieves success, and whether it was definable at all (attack on idle transmission, face spamming). Architecturally it makes sense, but it depends on whether independent analysis will not find a cheap way of breaking the conditions that hold the expansion of the cost. There exists a working implementation that realizes this model, plus a set of open threads (density of fakes, calibration of the residual, variants of state mutation, multiplexing of bands, transfer to HSM) that can be further strengthened without changing the basic mechanism. This shifts the status from “idea” to “construction with a prototype and space for iteration.” An attempt to squeeze this into a standard model would either contribute nothing or would require a proof of non-existence of a cheap oracle. It reverses the typical reasoning because instead of reducing it expands the adversary’s cost; instead of giving an oracle it deprives him of the possibility of assessing progress; instead of defending a primitive it attacks the attacker with an invisible and unverifiable expense. Session boundaries exist only for the receiver. This is a different way of building asymmetry than AES or lattices. The direction itself (security through unverifiable expansion of cost) is rarely studied and worth looking at. If someone wants to formalize this, most probably a new definition will arise (or a variant of an existing game based on cost), and not an assignment to IND-CCA or similar. Some attempt should be made. --------------------------- Class: Unobservable Cost-Expansion Deterrence (UCED) Definition A scheme belongs to the class UCED with respect to the parameter T (number of true blocks / length of the session) if for every adversary 𝒜 limited to observation of the stream D the following conditions hold simultaneously: 1. Lack of a cheap progress oracle There does not exist a predicate V computable in time essentially smaller than the full cost of the path such that Pr[V(D, h) = “on the path”] is indistinguishable from guessing for hypotheses h that are not the proper path of the state. 2. Cascading cost The expected cost of finding and maintaining the proper path satisfies 𝔼[C_𝒜] ≥ 2^{b(T)} · k · c_0 where b(T) grows at least linearly with T, k is the minimal number of blocks needed to confirm the coupling, and c_0 is the cost of full processing of one block. 3. Invisibility of attempts The defender receives no information about the attempts of 𝒜 before eventual success. The cost on the defender’s side remains O(1) per block independently of the actions of the adversary. 4. Penalty for desynchronization Every incorrect hypothesis of a block spoils the further evolution of the state. There does not exist a strategy that allows the adversary to cheaply “rewind” or localize the error without paying the cost again from the point of divergence. Guarantee. If the scheme is in UCED and b(T) exceeds the practical threshold (e.g. 128), then a rational adversary does not undertake the attack: he is unable to assess progress, his attempts are invisible, and the expected cost grows exponentially with the length of the transmission before he obtains any signal of success. Remarks The class is not comparable with IND-CCA / EUF-CMA — it measures something else (practical unprofitability of the attempt, not negligible probability of breaking). Membership in UCED is a property of the construction and the parameters, not a reductionist theorem. Breaking of the class occurs through violation of one of the four conditions (cheap oracle, sub-cascading cost, visibility of attempts or lack of penalty for desynchronization). --------------------------- At very short sessions (small T) the combinatorial margin is smaller — the model is strong at longer transmissions and high density of fakes. Security depends on the length of the message — the longer the greater. For the carrier (channel) this is a sensible equivalent of a guarantee in the threat model. There is currently no certification for communication channels independently, and all “trusted channels” are always realized by cryptographic protocols: TLS, IPsec, SSH, DTLS, HTTPS etc. In Protection Profiles (Network Device, VPN Gateway, OS, MDM etc.) there is almost always an explicit requirement for the use of these protocols. The channel has never until now defended the carried content independently. The communication channel as such (carrier, transport layer, modulator, synthetic channel) does not have its own mature security certification. One certifies either the cryptographic protocol + its implementation (TLS, IPsec…), the cryptographic module (FIPS 140), the whole system (CC for the device/network), the physical layer (TEMPEST). The goals have existed for a long time, the methods too, but they were almost always realized through cryptography or through steganography/cover traffic based on cryptography. RIPA fills a real gap, although it is not the first attempt to solve these problems. Deniability of the fact of communication (“was anything important flying at all?”). Deniability of the path / metadata (who with whom, when, how long). Short, portable secret + growing cost of attack with the length of the transmission. Verification of the sequence with detection of desynchronization. Friendliness for air-gap / low bandwidth / environments in which you do not want to leave cryptographic traces. Approach, How it works, Why it does not fill the same gap as RIPA "Deniable encryption (Canetti et al. 1996, Rubberhose, TrueCrypt hidden volumes)", "Two (or more) keys — one gives a decoy, the other the true data" "Concerns storage, not the channel. The adversary sees that something is encrypted." Steganography + cover traffic, "You hide the message in a picture, video, HTTP traffic, timings", Classical stego is statistically detectable at longer transmissions. Cover traffic is expensive. Covert channels (Lampson 1973+), "Hiding in timings, in unused fields, in errors", "Low throughput, easy to detect under statistical analysis." "Deniable messaging (OTR, Signal)", "Deniability of the content of the message (one cannot prove that it was you who wrote it)", "Does not hide the fact of communication nor the path. The adversary sees that the conversation took place." Mixnets / Tor / onion routing, Hiding of the path through layers, "Expensive, slow, requires infrastructure. Does not give deniability of “whether anything was flying at all.”" Information-theoretic deniability (works on “deniable communication over noisy channels”), Hiding in the noise of the channel, "Theoretical, low rate (√n), requires a noise model." "Traffic analysis resistance (padding, constant-rate, fake packets)", Masking of traffic patterns, Usually requires continuous cover traffic and does not give strong deniability at low load. Classical solutions are either cryptographic (and through that leave a trace “here something encrypted is flying”) or are steganographic/cover-based (and at longer transmissions can be detected statistically) or require continuous, expensive cover traffic. In RIPA deniability is built into the carrier itself (the stream of true + fake look the same) not being an additional layer. It relies on a coupled, path-dependent process with fakes that does not give a cheap oracle instead of on hiding in noise. The cost of attack grows with the length of the transmission (combinatorics of paths) at a short secret. The goals existed. The methods too. But precisely because they were realized mainly by cryptography or steganography, a gap arose for a transport layer that is neither a cipher nor steganography, and yet hinders analysis of the path and of the fact of communication. It is not another variation on known themes (deniable encryption, stego, covert channel, traffic analysis resistance). The component elements existed separately, but their combination in this way did not. I have here a different way of building the cost and deniability on the transport layer through cascading, unverifiable expansion of cost in a coupled process based on FPU residuals. Not some “another covert channel” or “another deniable encryption.” It is not something completely detached from existing methods, but a non-trivial combination that produces properties that individual existing methods do not give. Variations and direct applications of known methods. Fake blocks / cover traffic — known from stego, traffic analysis resistance, mixnets. Deniability of the fact of communication — a goal known for a long time (deniable encryption, covert channels, information-theoretic deniability over noisy channels). Path-dependent state — ratchets (Double Ratchet, OTR) also evolve the state. Controlled BER + ECC — standard channel engineering. HSM + air-gap — standard. Computational cost as a barrier — PoW, brute-force, combinatorics of paths. If I took only these elements separately I would have “stego + ratchet + cover traffic.” The difference lies in the way of coupling, and not in the individual components. As a security mechanism it is not rebranding. RIPA does not hide the message in an external cover. The stream of blocks itself (true + fake) is the channel. Fake blocks are not ordinary cover traffic. They are generated and checked against the current keyring state, but do not mutate it (or are rejected upon interference). RIPA couples these properties in one state operator, so that the state (keyring) is the shared secret, its evolution is dependent on the content of the block (only a consistent residual mutates further), fake blocks are checked against the same state but do not close it, without knowledge of the state one cannot cheaply separate “which blocks are true” from “what is the current state” from “whether the residual is consistent.” The problem was in maintaining the coupling so that one could not cheaply extract them. Classical reductions (check one block → check the state → check the residual) cease to work because one block does not confirm the coupling, the state without many blocks says nothing, the residual without the state is broad (many NaNs), fake blocks do not give a cheap entry into the cycle. Desynchronization was a real problem and one had to build an apparatus for listing desynchronization. The calibration had to be such that the error would exist but would not spoil the path for the authorized user, and at the same time would spoil it for the adversary. The state is of “size of the message + cover” of the space of hypotheses, because the bits of the secret themselves are short. It is the operator (choice of subset + evolution of the state) that becomes the dominant cost. Without the secret (initial state) one cannot cheaply “cut it.” A coupled operator in which properties that in classical tools can be analyzed separately have been mutually blocked in such a way that one can no longer extract them without the secret. This required conscious design of the couplings (and not only the composition of ready blocks). No one previously had the motivation to do it this way, because the standard design goals in cryptography and communication go in the opposite direction of reversibility (key → bijection), of a cheap correctness oracle (“yes, this is the proper key / proper path”), of reduction to a known hard problem, of independent layers (cipher separate, signature separate, channel separate), of minimization of numerical errors. Creating successive and separable attack surfaces in algorithms increasingly packed with properties, for which ailments the only solution was lengthening the key to infinity. The main gain (deniability of path/fact + cascading cost growing with length) is valuable only in a narrow niche, but precisely in the one that is usually defended to the end. In most remaining applications AES + TLS + possibly padding is enough. In this niche not necessarily, because there exists the uncertainty “and what if they are reading us?”. Driving away this obsessive doubt requires a different reasoning — let them lose the desire to want to read. In environments in which metadata and the very fact of communication are equally sensitive (or more) than the content. There the loss of the path or the revelation of the fact of transmission may be more serious than the breaking of the cipher itself; one accepts a short, portable secret (phrase) + growing cost of attack with cover traffic; air-gap and control of the toolchain are natural (they do not get in the way); certification of FIPS/CC of the whole system is not a necessary condition because what is more important is that one cannot cheaply establish whether and what was flying; systems are defended “to the end,” because the consequences of leakage of metadata are strategic, and not only operational. In such environments classical tools (AES + TLS + possibly padding/stego) leave a trace “here something encrypted is flying” or require continuous, expensive cover traffic. RIPA aims precisely at the gap between “the content is encrypted” and “it is not known whether anything important was flying at all and along which path.”