Security notice. ITB is an experimental symmetric cipher construction without prior peer review, independent cryptanalysis, or formal certification. The construction's security properties have not been verified by independent cryptographers or mathematicians.
PRF-grade hash functions are required. No warranty is provided.
No bespoke cryptography. ITB introduces no cryptographic primitive of its own — no custom S-box, permutation, or round function. It is a const ruction over existing primitives, much as PGP composes standard ciphers rather than defining one. Such constructions are not the object of algorit hm-level cryptographic certification: national regimes (NIST CAVP/FIPS in the US, GOST/FSB in Russia, OSCCA's SM-series in China, IC3S in India, S OG-IS/EUCC and national lists in the EU, ASD's ISM in Australia, CRYPTREC in Japan, KCMVP in South Korea) certify primitives and the **modules ** built on them, not compositional schemes. Eligibility for regulated use is therefore inherited from the primitives ITB is configured with, not conferred by ITB itself.
This document records the adversarial re-verification of the shipped ITB construction. The construction under test is Triple Ouroboros — the byte-level 3-snake split — over the 8-seed constellation, with the always-on Interlocked Barrier as its non-disableable core. There is no Single Ouroboros, no overlay toggle, and no Bit Soup mode.
The prior empirical record — the wider primitive shelf under Single Ouroboros with the overlay optional — is preserved verbatim in archive/REDTEAM.md and is cross-referenced by phase throughout for archived detail that is not re-inlined here.
FAQ.md — quick plain-language questions and answers on the most-asked cryptanalytic scenarios (a three-line jokeHash, GF(2)-linear CRC128, T-function FNV-1a), tracing the reasoning arrows that lead to the null-recovery observations recorded below.
Every verdict below is read against the full barrier, which is two layers acting in series, not one. Treating either part in isolation misstates what the construction resists.
Part 1 — the 48-bit interlock permutation (interlock48.go). Before COBS framing and pixel encoding, the interleaved payload is chunked into 48-bit (6-byte) words. Each chunk is partitioned into three disjoint 16-of-48 lanes by a balanced mask triple (m0, m1, m2) — popcount(mᵢ) = 16, m0 ∪ m1 ∪ m2 = 2^48 − 1 — drawn per chunk from a space of ≈ 2^70.20 balanced partitions, PRF-keyed by the lockSeed and the nonce (rankToMaskTriple48, chunk48lock, splitForTriple48LockedCfg). The mapping from a plaintext bit to the lane it lands in is a hidden per-chunk secret. Part 1 alone is a keyed permutation: it re-orders bits but does not XOR key material into them.
Part 2 — the per-pixel absorption stage (process_pixels.c). Each pixel packs 56 payload bits into 8 channel bytes of 7 data bits each. Per pixel, keyed by the dataSeed / noiseSeed ChainHash outputs, the encode path (Phase 3 XOR, Phase 4 rotate, Phase 5 noise-insert; scalar tail at the same phase structure) applies, per 7-bit field: a channelXOR with 7 PRF-mask bits, a rotate7 by a per-pixel amount in [0,6], and insertion around a per-pixel noise bit taken from the original CSPRNG container byte at a per-pixel noisePos. The decode path inverts exactly (noise-strip, inverse rotate, XOR). rotateBits7 and the noise merge are the core of Proof 1 / Proof 4 / Proof 5 / Proof 7. Part 2 alone is an XOR-with-key-material-plus-noise stage: it whitens each byte to the 1:1 signal/noise floor but does not permute bit-to-position.
Together the two parts close the COA / KPA / CPA families under the PRF assumption. Part 1 denies the attacker a stable bit-position-to-lane anchor; Part 2 denies a per-byte observation channel (P(observed | hash) = 1/2). A crib that is known plaintext still reaches neither a fixed position (Part 1) nor an observable byte (Part 2). Neither part alone is sufficient — Part 1 alone is invertible once a primitive is inverted, Part 2 alone leaves a fixed bit-position map — and the shipped construction never runs either alone: both are always on and non-disableable.
8-seed isolation (seed256.go / seed512.go). 8 seeds are drawn as independent CSPRNG components and enforced pairwise-distinct at the API by byte-level Components comparison in addition to pointer identity (so byte-identical material reaching the API through blob import or the Low-Level constructors is rejected on the same gate): noiseSeed, lockSeed, dataSeed1..3, startSeed1..3. No seed is reused across the three snakes. A dedicated per-message interlock nonce, drawn beside the main nonce, is absorbed once per session through the full ChainHash chain by deriveInterLockSeed (seed256.go:171-176): the dedicated interlock domain tag 0x04 plus the interlock nonce feed the chained hash, and the barrier's per-chunk masks are keyed from that output; the tag is disjoint from the 0x02 tag deriveStartPixel binds to, so the two derivations stay decorrelated even for byte-identical seed material. Full knowledge of any seed subset yields zero bits on the rest; the lockSeed that keys Part 1 is isolated from the noiseSeed that keys the noise channel and from the per-snake dataSeed/startSeed.
Three-snake construction. Each of the three snakes has its own startPixel, derived from its own startSeed and the nonce, and different per snake. None of the three is transmitted. An attacker holding the container does not know where any snake's payload begins, so no plaintext boundary is visible in any snake; there is no start marker and no end marker on the wire.
Every track drives the shipped core Triple entrypoints (Encrypt3x256Cfg / Encrypt3x512Cfg and their decrypt duals, or the streaming EncryptStream3xCfg / EncryptStreamAuth3xCfg families) over the 8 mandatory distinct seeds. Parallax and the outer cipher wrapper are independent layers above the barrier; except where a probe explicitly toggles the wrapper, the measured surface is the barrier layer alone.
Discipline carried on every claim. Every empirical verdict is sample-bounded: a null result means no measurable signal above the finite-sample floor at the stated sample size N under the stated threat model, never that no signal exists. PRF-grade closure claims are PRF-conditional. The independent-stream reference throughout is the byte-equal rate of two uniform random streams, 1/256 ≈ 0.00391.
Nonce-Reuse is a lab-only assumption. A caller cannot force nonce reuse — the nonce is drawn from crypto/rand on every call — but it is the only condition under which the empirical record has ever measured signal, so several probes below adopt it to give the attacker its best case.
Attacker-realism. Every recovery decision uses only attacker-visible inputs (ciphertext bytes, the public crib, the public nonce and dimension header, the seed-independent public per-pixel const); ground-truth seed values appear only in terminal-stage audit printouts, never in a decision.
Barrier constants (architectural, from the Part 1 mask-space counting argument; the single canonical numeric reference):
| Constant | Value |
|---|---|
| Chunk width | 48 bits / 6 bytes |
| Mask triple | three balanced 16-of-48 partitions |
| Mask-space cardinality per chunk (A · B) | ≈ 2^70.20 |
| Partition constants A = C(48,16), B = C(32,16) | 2,254,848,913,647 · 601,080,390 |
| gcd(A, B) anti-collapse trap | 66,861 = 3² · 17 · 19 · 23 |
| Preimage count per chunk (fresh-nonce under-determination) | ≈ 2^57.80 |
| Per-chunk bias | ≈ 2^-57.8 |
| Per-message accumulated bias | ≈ 2^-34.4 |
| Distinguisher sample budget | ≈ 2^115.6 chunks (beyond attainable) |
Derivation of the cascade 2^70.20 → 2^57.80 → 2^-57.8 → 2^-34.4 → 2^115.6: Proof 11.
The container floor is uniform across all modes: the minimum pixel count is ceil(keyBits / log2(7)) (MinPixelsAuth, aliased by MinPixels), so plain and MAC Authenticated paths share one envelope.
KL matrix — end-to-end indistinguishability from /dev/urandom. A construction-level Mode B χ² / pairwise-KL distinguisher measures, for the shipping wire under every combination of plaintext size and Barrier Fill margin, whether the ITB body bytes are separable from /dev/urandom bytes of matched length. Fixed BLAKE3 keys the ChainHash (a single representative PRF-grade primitive suffices per the closure argument in PRF-grade closure). Each cell of the 11 sizes × 6 Barrier Fill values grid draws 25 ITB samples plus 25 /dev/urandom samples at matched body size, computes the mean discriminator ratio on each side, and z-scores the difference by the pooled standard deviation.
| Size ↓ / BF → | 1 | 2 | 4 | 8 | 16 | 32 |
|---|---|---|---|---|---|---|
| 1 KB / 4 KB / 8 KB / 32 KB / 64 KB / 128 KB / 256 KB / 512 KB / 1 MB / 2 MB / 4 MB | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
All 66 cells satisfy |z_ratio| ≤ 1.0 (indistinguishable at 1 σ). Peak z_ratio across the grid is 0.51 (1 KB, BF = 2) and peak z(χ²) is 0.62 (8 KB, BF = 16); every other cell sits below those bounds. Minimum Barrier Fill margin for the indistinguishability verdict is BF = 1 for every size measured — the shipped default DefaultBarrierFill = 1 is already sufficient across the 1 KB → 4 MB payload envelope, and increasing BF up to 32 produces no measurable improvement in the discriminator.
The empirical result matches the architectural expectation above: the mask-space cardinality per chunk (≈ 2^70.20) and the per-chunk bias (≈ 2^-57.8) are architectural guarantees; the KL matrix is the deployment-shape observation that a Mode B distinguisher against the attacker-visible wire cannot separate ITB from /dev/urandom bytes at any size × BF in the shipping envelope. Reproduce via:
python3 scripts/redteam/itb/theory/_common/kl/kl_matrix.pyOutput lands in ~/scratch/kltest/matrix.md (grid + per-cell ratios / z-scores) plus matrix.jsonl (raw per-cell records).
Each verdict assumes the full barrier active (shipped default, non-disableable) and, where it invokes primitive strength, the PRF assumption and fresh per-message nonces. BLAKE3 is the representative PRF-grade primitive; the closure argument consumes only the PRF property, not any BLAKE3-specific structure, so a single representative generalises across the PRF-grade registry subset (see PRF-grade closure). Empirically corroborated: across the tested primitive spectrum no PRF-grade member produced a distinguishable wire from the BLAKE3 representative at the tested sample sizes (archive/REDTEAM.md § Phase 1; this cycle's re-verification via the KL matrix above).
| Attack | Threat model | Verdict | Basis |
|---|---|---|---|
| COA | ciphertext only, fresh nonce | closed | Part 2 absorption + Part 1 permutation; wire uniform at the sample floor |
| Crib KPA | public-schema crib, fresh nonce | closed under PRF | crib reaches no fixed lane (Part 1) and no observable byte (Part 2) |
| Full KPA | complete P/C pairs, fresh nonce | closed under PRF | instance-formulation under-determination; ≈ 2^57.80 preimages/chunk |
| Partial KPA | partial known plaintext, fresh nonce | closed under PRF, a fortiori | superset of Full KPA candidate sets; gcd(7,8)=1 byte-splitting adds a factor |
| CPA | chosen plaintext, fresh nonce | closed under PRF | fresh nonce re-draws masks / noise / rotation / startPixels per message |
| Nonce reuse | dual-slot collision (lab): both, main-only, or interlock-only | plaintext-recovery null across all three scenarios; near-identical-pair traffic-analysis residue only under dual-slot collision | mask-scrambled per-snake XOR under-determines the demasker's (noisePos, rotation) anchor; classical keystream-reuse recovers 0/n bytes across every attacker-realistic probe; partial-collision scenarios inherit the fresh-nonce closure on the un-collided axis |
| Related-seed | 1-bit seed Δ (lab) | outside shipped API; diffused | 8-seed isolation; Δ avalanches, no low-weight trace |
| Related-nonce | 1-bit Δ on the main or interlock nonce, same seeds (lab) | diffused; χ² inside df=255 uniform band | main-nonce Δ perturbs 7 of 8 seed-derivation slots (noisePos, per-snake rotation / channelXOR, per-snake startPixel); interlock-nonce Δ perturbs the lockSeed-keyed per-chunk mask draw |
| Differential | XOR-differential probe (lab) | neutralised on primitive-attributable axes | barrier diffuses; PRF-grade axes leave no followable characteristic |
Every «closed under PRF» verdict above is instance-formulation-bounded and sample-bounded per the per-attack sections that follow; total PRF inversion falls outside the barrier's protection (Proof 4a Asymmetry note).
Under passive observation the wire is [main_nonce][interlock_nonce][W][H][container]. The container bytes are individually uniform: every 7-bit data field is XOR-masked and rotated (Part 2) then bit-permuted across lanes (Part 1), and each channel byte carries a fresh CSPRNG noise bit. Measured container-body byte-equal and zero rates sit at the 1/256 floor at the tested sample sizes; the only non-uniform bytes on the wire are the fixed cleartext dimension header (§4.0), which restates the container size the wire length already exposes. No plaintext, key, or boundary channel is present.
Threat model. Crib / Full KPA under the PRF assumption with fresh nonces; the Nonce-Reuse variant is treated separately. Verdict — closed at the instance-formulation layer, sample-bounded. The 4-probe minimum drives BLAKE3 through the 256-bit core Triple entrypoint (redteam_prf_blake3_test.go, go test -run TestRedteamPRF -v ./, combined wall-clock under one second):
| Probe | Threat model | Sample | Observable | Floor | Verdict |
|---|---|---|---|---|---|
| 1 — Crib KPA, fresh nonce | Crib KPA, PRF, fresh-nonce | N = 200, 4 KB, shared crib | crib-region byte-equal 0.00430; |Pearson| 0.01023 | 0.00391 | null — crib anchors nothing |
| 2 — Nonce-reuse | Nonce-Reuse, lab-only (dual-slot collision) | N = 200, both header nonces forced identical | full-wire byte-equal 0.03259; |Pearson| 0.01871 | 0.00391 | correlation dominated by the deterministic dual-nonce header bytes (2·N = 128 B match under Scenario A); container-body statistics track the barrier verdict — see Nonce reuse |
| 3 — Related-seed Δ | Related-Seed, lab-only | N = 128, 1-bit Δ, fixed nonce | dataSeed1 Δ bit-diff 0.24057; lockSeed Δ 0.47728 | diffused | null for exploitability |
| 4 — Full KPA, shared state | Full KPA, PRF, fresh-nonce | N = 64 pairs, shared bundle | pairwise byte-equal 0.00464; all round-trips exact | 0.00391 | null — no aggregable correlation |
The architectural reason is the two-part composition. Part 1: each 48-bit chunk draws its mask triple from ≈ 2^70.20 balanced partitions, so a crib fixes no bit-position-to-lane mapping a solver could anchor; even granting the 48 known bits of a chunk under Full KPA, the mask has ≈ 2^57.80 preimages and is unobservable without the lockSeed, so no per-bit constraint can be written down. Part 2: the per-pixel 1:1 signal/noise ambiguity (Proof 1) leaves no observed byte that ranks candidates. Seed recovery is instance-formulation-bounded, not solver-bounded — the seed-recovery brute force the architecture rules out is documented, not run against wall-clock. The residual honest caveat: systematic partial PRF inversion is raised in cost but not eliminated, and total PRF inversion circumvents the barrier entirely. Archived obstacle detail (Proof 4a, the Phase 2b KL floor, the Phase 2c startPixel rank-fraction ≈ 0.5) is preserved in archive/REDTEAM.md.
No dedicated probe is run: the result follows a fortiori from the Full / Crib KPA null. A Partial KPA attacker holds strictly less known plaintext, so its achievable-key sets per pixel are a superset of the full-crib sets and its cross-pixel intersection can only be larger — it recovers no key where the stronger full-crib attacker recovers none. The gcd(7,8)=1 byte-splitting obstacle (every plaintext byte spans two channels; a missing adjacent byte blocks per-channel candidate formulation) is an additional independent factor active only under Partial KPA.
Under fresh-nonce CPA the attack surface reduces to statistical ciphertext properties. Each message draws fresh masks (Part 1), fresh noise positions, rotations, and startPixels (Part 2); chosen plaintext gives no observable handle on any of these because the lane assignment is a hidden per-chunk secret and each byte is at the 1:1 floor. The archived empirical record placed ITB ciphertext at the finite-sample statistical floor — indistinguishable from /dev/urandom within the tested tolerance — across the full primitive spectrum on every statistical surface measured (archive/REDTEAM.md, Phase 1 / 2b / 3a / 3b). The verdict is closure under the PRF assumption with fresh nonces, sample-bounded. The statistical-floor claim applies to the wire container body and the payload-channel probes; the cleartext dimension header (§4.0) is the one non-uniform structural field and carries no plaintext or key channel.
Nonce reuse is not reachable through the shipped API — the dual-nonce header carries two independently drawn CSPRNG nonces (main_nonce and interlock_nonce) and generateNoncePairCfg re-draws whenever both are on the CSPRNG path. Forced via the two test-only overrides ([testNonceOverride] / [testInterlockNonceOverride]), three collision classes surface distinctly, each mapping to which of the two independent nonce-driven axes the attacker holds fixed across the compared pair:
- Scenario A — dual-slot collision. Both nonces collide across the pair, with
main_nonce ≠ interlock_noncewithin each message (the shippedgenerateNoncePairCfgdistinctness invariant, held under lab override). Every nonce-bound derivation slot repeats: per-pixelnoisePosand per-snake rotation /channelXOR/startPixelfrom the main-nonce path, and the per-chunk 48-bit interlock mask triple from the interlock-nonce path. Reproduces a full nonce-reuse event under the dual-nonce header — the maximum leverage a lab attacker can force. - Scenario B — main-only collision.
main_nonceis fixed across the pair;interlock_nonceis drawn fromcrypto/randper encrypt. Reproduces a buggy caller who reuses the sevenmain_nonce-keyed derivation slots but leaves the eighth (lockSeed-keyed per-chunk mask draw) PRF-parameterised. The interlock permutation differs across the pair. - Scenario C — interlock-only collision. Mirror of B —
interlock_nonceis fixed across the pair;main_nonceis drawn per encrypt. The interlock mask triple repeats; the seven main-nonce-keyed derivation slots re-parametrise independently.
Under all three scenarios the fresh CSPRNG noise bit that Part 2 inserts at each pixel's noisePos and the fresh CSPRNG tail-fill beyond the COBS terminator are drawn per-encrypt and do not repeat. Under Scenario A, C1 XOR C2 on the container body carries rotate7(snake_XOR_bits, r) at every non-noise bit position and a fresh random bit at the noise position — the classical two-time-pad structure a stream cipher would present, present only up to the barrier's Part 1 permutation of the plaintext bits into three lane-scrambled snake payloads. Under Scenarios B and C, one of the two independent axes is PRF-re-parametrised across the pair, so even that lane-scrambled two-time-pad structure disappears from the container body statistics.
Empirical re-verification — redteam_nonce_reuse_dualnonce_test.go, dual primitive spectrum: BLAKE3 PRF reference and FNV-1a below-spec stress on every one of the 8 seed roles (independent random component vectors per seed; the probe drives both primitives through the 128-bit HashFunc128 interface). All measurements are attacker-visible — every statistic reads container-body bytes and the public wire header only. The deterministic dual-nonce header bytes are stripped from every statistic so under Scenario A the collided-header bytes do not swamp the barrier signal by contributing perfectly correlated bytes.
Two shapes stress the pair: random (independent uniform plaintexts) as the null-baseline distinguisher control, and near_identical (P2 = P1 ⊕ 1_bit at the middle byte) as the maximally-adversarial pair shape — the shape the archived Layer A residue surfaced at 4.9×–16× the 1/256 floor on 128–512 B plaintexts.
| Scenario | Primitive | Shape | Plaintext | Body byte-equal (floor 1/256) | |Pearson(c1_body, c2_body)| | Hamming bit-diff | χ² vs uniform df=255 |
|---|---|---|---|---|---|---|---|
| A (both collide) | BLAKE3 | random | 4 KB | 0.00451 (1.16×) | 0.01116 | 0.49876 | 454.2 |
| A (both collide) | BLAKE3 | near-identical | 512 B | 0.06298 (16.12×) | 0.10000 | 0.44792 | 1 052 598 |
| A (both collide) | BLAKE3 | near-identical | 4 KB | 0.43432 (111.19×) | 0.75088 | 0.11961 | 57 998 250 |
| A (both collide) | BLAKE3 | near-identical | 16 KB | 0.46962 (120.22×) | 0.81463 | 0.08916 | 250 612 293 |
| A (both collide) | FNV-1a | random | 4 KB | 0.00454 (1.16×) | 0.01174 | 0.49911 | 480.7 |
| A (both collide) | FNV-1a | near-identical | 16 KB | 0.46975 (120.26×) | 0.93573 | 0.08942 | 447 205 425 |
| B (main only) | BLAKE3 | random | 4 KB | 0.00437 (1.12×) | 0.01003 | 0.49968 | 340.9 |
| B (main only) | BLAKE3 | near-identical | 4 KB | 0.00604 (1.55×) | 0.03362 | 0.48262 | 11 606 |
| B (main only) | FNV-1a | near-identical | 4 KB | 0.00603 (1.54×) | 0.04344 | 0.48171 | 14 468 |
| C (interlock only) | BLAKE3 | random | 4 KB | 0.00403 (1.03×) | 0.01129 | 0.49991 | 255.8 |
| C (interlock only) | BLAKE3 | near-identical | 4 KB | 0.00391 (1.00×) | 0.01123 | 0.49986 | 243.0 |
| C (interlock only) | FNV-1a | near-identical | 4 KB | 0.00395 (1.01×) | 0.01085 | 0.50007 | 222.7 |
All cells: N = 200 pairs, container body only. The df = 255 uniform band top at N large is approximately 292 (p = 0.99). Near-identical rows scale with plaintext-to-container-body ratio, not with a recovery channel — the mechanism is detailed in the second bullet below. The full 3 × 2 × 3 × 2 grid emits per-cell records to ~/scratch/redteam/nonce_reuse_dualnonce/dualnonce_matrix.json (override the parent directory via REDTEAM_NONCE_REUSE_DUALNONCE_OUTPUT_DIR).
Three axis-attributions the matrix isolates:
- Random-plaintext container-body statistics track the 1/256 floor under all three scenarios. Byte-equal ratio stays in
[1.02×, 1.16×], |Pearson| below 0.013, Hamming bit-diff within 0.001 of the ideal 0.5. The residual chi² excess in Scenario A (~450 vs uniform-band top 292) is the same "CSPRNG-noise-bit + fill artefact" the related-seed / related-nonce no-Δ floor probes measured — a per-position deterministic pipeline whose byte histogram tilts on the noise-bit contribution, not a plaintext-recovery channel. - Near-identical-pair residue is a Scenario-A-only signature and scales with plaintext-to-container-body ratio. Under Scenario A at 4 KB,
bodyByte-equal ≈ 0.435— every deterministic byte carries seven identical data bits with one fresh CSPRNG noise bit, so ~1/2 of body bytes are equal by construction and the plaintext-difference contribution is confined to the ~0.15 % of chunks around the single-bit flip. Under Scenario B the interlock mask redraws per encrypt and disperses the identical chunks across different lane positions per message, dropping the residue to 1.2×–1.6× floor. Under Scenario C the entire Part 2 per-pixel pipeline redraws per encrypt (channelXOR, rotation, noisePos), dropping the residue to floor-level — indistinguishable from an independent-pair control. - Both primitives track the same numbers. BLAKE3 and FNV-1a-per-role differ by at most a few percent on every cell, confirming that the barrier's per-scenario behaviour is architectural — the residue floor and its scaling with plaintext-to-container ratio do not depend on the primitive.
- COBS-alignment probe — the 1-bit-flip near-identical shape does not shift container geometry across the user-facing Barrier Fill range. Container size depends on per-snake COBS-encoded lengths (
containerSizeAuth3_128Cfg(..., cobsLens),auth128.go), and a 1-bit flip that transitions the flipped plaintext byte to / from0x00shifts the COBS overhead by one byte; the alignment probe (TestRedTeamNonceReuseDualNonceCOBSAlignmentProbe, 200 pairs per cell under Scenario A) sweeps Barrier Fill ∈ {1, 4, 8, 16, 32} × plaintext ∈ {512 B, 4 KB, 16 KB} = 15 cells and measures 0/200 container-body length mismatch at every cell — even for the two 16 KB pairs whose middle byte flipped to0x00(reproducible across every BF row), the container is quantized by pixel (total_pixels × Channels) and the ±1-byte COBS overhead perturbation sits below the pixel-boundary quantization step across the full BF range measured. The byte-equal residue statistic is therefore not deflated by misaligned-body comparisons at any user-configurable BF: the 16× → 111× → 120× floor ratios reflect the underlying determinism.
Cross-message plaintext-recovery closure — architectural, held across all three scenarios. The archived Single Ouroboros / barrier-off configuration under the identical threat model (Full KPA + forced nonce reuse) yielded ~99.17 % raw byte match on the colliding pair via nonce_reuse_demask.py (archive/REDTEAM.md § Phase 2d). Against the shipped always-on 48-bit interlock, the demasker's Layer 1 constraint match requires known snake-payload XOR bits at each pixel; those bits are PEXT48(P1_chunk XOR P2_chunk, m_i_per_chunk) where m_i_per_chunk is drawn from the ≈ 2^70.20-per-chunk mask space keyed by the unobservable lockSeed. Under Scenario A the masks repeat across the colliding pair but the attacker still does not observe them — the archived mask-oracle upper bound (Layer B′ of the prior probe suite, ≈ 96 % recovery under a lab peek that reveals lockSeed directly) is the direct measurement of what the barrier's mask secrecy alone withholds. Under Scenarios B and C the per-chunk mask triples differ across the pair, so even the mask-oracle upper bound loses its coherent alignment; the plaintext-recovery closure is strictly weaker to the attacker than Scenario A. In every scenario, no attacker-realistic path anchors a per-pixel (noisePos, rotation, channelXOR) triple against the observed body-XOR bytes.
SAT-based lockSeed recovery is structurally unmeasurable at attacker-realism. Unlike the fresh-nonce regime, the nonce-reuse constraint is formulable under Scenario A: C1 ⊕ C2 cancels the per-pixel additive mask and hands a Full KPA attacker the known M1 ⊕ M2, so each per-chunk observation is a genuine constraint on the interlock permutation with a true satisfying model. Recovery is nonetheless dominated by the rankToMaskTriple48 combinadic unrank keyed by the lockSeed chain, not by the FNV multiply chain a structure-aware solver accelerates: a single 48-bit chunk observation admits ≈ 2^57.80 mask preimages, and collapsing that ambiguity requires coupling many chunks through the shared lockSeed chain against the SAT-hostile unrank arithmetic. Under Scenarios B and C the constraint is no longer formulable in that form — each pair carries a different mask triple, so the shared-mask cancellation does not apply.
The reuse SAT instance is formulable only when Part 2's per-pixel derivations are granted (seven of eight seeds via lab peek — noiseSeed, three dataSeed_i, three startSeed_i), because otherwise the lockSeed → per-chunk mask path runs through two live PRF calls — lockKey = ChainHash(0x04‖nonce, lockSeed), then prf_i = h(0x03‖i, lockKey) per chunk (interlock48.go, seed128/256/512.go) — before the combinadic unrank produces the mask triple, and the instance reduces to PRF preimage recovery on h dominated by the primitive's SAT-hardness rather than the interlock's. But a granted-7/8 attacker is not the nonce-reuse-realistic attacker, who holds only the ciphertext pair and public nonce. The measurable instance and the reuse-realistic instance are disjoint by construction: isolating Part 1's unrank hardness requires stripping Part 2, which no reuse-reachable attacker can do. The SAT avenue is therefore not merely unrun but structurally unmeasurable at attacker-realism — the closure is PRF-conditional by construction, consistent with the two-layer binding traced above. The empirical closure rests on the attacker-realistic distinguisher null (matrix above) and the archived mask-oracle upper bound.
Verdict — plaintext-recovery null across all three scenarios, sample-bounded; near-identical-pair traffic-analysis residue under Scenario A only. No attacker-realistic probe recovers a byte of a third message encrypted under any of the three dual-nonce collision classes at the tested sample sizes on either primitive. The near-identical-pair body-histogram is the residual signature of Scenario A and scales with plaintext-to-container ratio (16× the 1/256 floor at 512 B → 120× at 16 KB); an outside observer of two Scenario-A ciphertexts can therefore distinguish "near-identical plaintexts" from "independent plaintexts" but the excess bytes carry no plaintext bit, no key bit, and no noisePos / rotation / channelXOR value — every deterministic body byte is plaintext_snake_bit_i XOR channelXOR_i at 7 of 8 positions with a fresh random bit at the 8th. Scenario B weakens the residue nearly to floor (~1.5×) and Scenario C dissolves it fully (floor-level) by redrawing one of the two independent axes per encrypt, and the barrier's plaintext-recovery closure holds a fortiori because the attacker's constraint on the un-collided axis is fresh-nonce-strength. Dual-slot nonce reuse remains a usage precondition the barrier does not architecturally remove at the traffic-analysis layer — the mandatory internal nonces are API discipline, and the outer cipher (when engaged) additionally whitens the wire against the near-identical-pair distinguisher.
Reproduction:
go test -tags redteam -run TestRedTeamNonceReuseDualNonce -v -timeout 1800s ./
ITB_NONCE_REUSE_COBS_ALIGN_PROBE=1 go test -tags redteam -run TestRedTeamNonceReuseDualNonceCOBSAlignmentProbe -v -timeout 300s ./ # COBS-alignment artefact null-check for the near-identical residue cells (~1-3 s)
Archived demasker / NIST STS PRF-separation detail is in archive/REDTEAM.md § Phase 2d — Nonce-Reuse; the archived detail applies to the retired Single Ouroboros / barrier-off construction under the single-nonce wire and does not re-cross to the shipped dual-nonce line.
Neither is reachable through the shipped API — the 8-seed intake draws independent CSPRNG components and rejects both pointer and byte-level Components collisions, and the nonces are internal. Forced in the lab (a seed or nonce and its 1-bit-delta twin, every other input fixed): a dataSeed1 delta produces a ciphertext bit-diff fraction of 0.24057 — structurally scoped to one snake's third, then diffused by Part 1's permutation and the COBS / interleave, landing above the one-snake floor (≈ 0.167). A lockSeed delta re-draws every mask triple and reaches 0.47728, approaching full avalanche (0.5). Neither channel leaves a low-weight, position-predictable differential — the 8-seed isolation made observable: each seed's influence is scoped to its own channel and the barrier diffuses the delta rather than localising it. A related-nonce delta perturbs the derivation slots keyed by whichever of the two per-message nonces is touched — a main-nonce Δ perturbs per-pixel noisePos, per-snake rotation and channelXOR, and per-snake startPixel (7 of the 8 seed-derived outputs); an interlock-nonce Δ perturbs the interlock overlay key through deriveInterLockSeed — and diffuses at least as thoroughly (empirical re-verification below). Any residual related-seed exposure would be an upstream key-management defect (a defective KDF supplying correlated seeds), not a barrier property.
Empirical re-verification at the archived measurement angle — redteam_related_seed_test.go, below-spec primitives CRC128 + FNV-1a on every one of the 8 seed roles (one at a time; independent random keys per role). The archived Phase 2e sweep recorded a per-primitive axis-hit ciphertext-XOR byte-histogram χ² against df=255 uniform of CRC128 42.5M / FNV-1a 56.7M on Single Ouroboros with the overlay disengaged, over a 6.1M neutralised cluster attributed to the architectural noisePos permutation signal (archive/REDTEAM.md § Phase 2e). The same measurement angle, driven through the shipped Encrypt3x128Cfg with the always-on interlock:
| Probe | Threat model | Sample | Observable | Verdict |
|---|---|---|---|---|
Positive control — process128Cfg (Single, overlay-off) |
data-axis bit_high Δ, fixed nonce | 1 pair, 512 KiB plaintext | CRC128 χ² 42.48M (drift +0.06% vs archive); FNV-1a χ² 56.85M (drift +0.29%) | probe reproduces archive Phase 2e — filter is sensitive |
No-Δ floor — Encrypt3x128Cfg |
identical seeds, forced fixed nonce | 1 pair, 512 KiB plaintext | CRC128 χ² 41.9M; FNV-1a χ² 56.3M — the architectural CSPRNG-noise-bit + fill artefact of two independent encrypts | reference floor against which every Δ cell is compared |
8-axis Δ matrix — Encrypt3x128Cfg |
8 axes × 3 Δ patterns × 2 plaintext kinds × 2 primitives = 96 cells | 1 pair per cell, 512 KiB plaintext | lockSeed axis peak χ² 635 / 550 (CRC128 / FNV-1a) — within a few multiples of the df=255 uniform band top (mean 255, one-sided 3σ ≈ 323); noiseSeed / dataSeed_i / startSeed_i axes peak χ² 42.1–42.5M / 56.2–56.3M — at the no-Δ floor, not above it | lockSeed Δ collapses to uniform; every other axis lands at the CSPRNG artefact floor |
The archived 42.5M / 56.7M axis-hit numbers were Single Ouroboros primitive-attributable leaks (7-bit channelXOR bias propagating through the affine CRC128 chain and the FNV-1a top-bit-preserving multiply). The shipped API produces a numerically similar ceiling on noiseSeed / dataSeed_i / startSeed_i axes, but the ceiling is the architectural floor of two independent encrypts under the 3-snake Triple design: any single seed's Δ leaves 2 of 3 snake dataSeed / startSeed chains unchanged, and the touched pixels of those unchanged snakes emit 7 identical data bits plus 1 fresh CSPRNG noise bit at each fixed noisePos — a highly non-uniform per-byte distribution. The no-Δ floor probe measures the same ceiling with no seed Δ at all. Δ patterns that randomise the changed snake's data bits (bit0 / bit_mid on either primitive) drop χ² below the floor by diluting the noiseMask signal on 1/3 of touched pixels — the barrier does its diffusion job even when the perturbed primitive is below-spec.
Only the lockSeed axis moves χ² across the barrier's diffusion boundary. A 1-bit lockSeed Δ re-derives the interlock's per-chunk 48-bit mask triple entirely — the plaintext-byte-to-snake split avalanches, every touched pixel byte carries different data bits in the two ciphertexts, and the byte histogram collapses to a few multiples of the df=255 uniform band top (max χ² 635 CRC128 / 550 FNV-1a vs the ~42-56M non-lockSeed axes) — a residual small enough to be attributed to nonzero permutation-boundary effects at 512 KiB sample size, not primitive leakage. The gap between the top and bottom axis is ≈ 66,881× for CRC128 and ≈ 102,486× for FNV-1a on the max χ² axis ranking. The barrier's related-seed diffusion property is confined to the lockSeed axis: every architectural benefit of the always-on interlock at this measurement surface routes through lockSeed alone; the other seven seeds' Δ propagates through their own orthogonal channels (noisePos, per-snake channelXOR, per-snake startPixel) at whatever bias profile the primitive itself carries, and the barrier does not re-invoke on such Δ paths. This complements the Nonce reuse closure — the plaintext-recovery closure lives in lockSeed secrecy (mask-oracle upper bound), and the differential-diffusion closure lives in lockSeed as well. Both re-parametrise on lockSeed per session, so a production caller's fresh CSPRNG seeds always route both closures through the barrier.
The lockSeed-vs-other axis contrast holds identically across CRC128 and FNV-1a (structural, not primitive-conditional), across bit0 / bit_mid / bit_high Δ patterns (delta-position-independent), and across random / ASCII plaintext (no crib-amplified axis). The archived 6.1M neutralised cluster description — architectural noisePos permutation signal, not primitive leak — has its shipped analog in the ~42-56M no-Δ floor, primitive-conditional through noiseSeed's ChainHash shape influencing noisePos derivation but not a primitive-attributable Δ leak. Archived 1008-cell single-axis sweep detail is in archive/REDTEAM.md § Phase 2e; reproduction of the shipped probes is one command:
go test -tags redteam -run TestRedTeamRelatedSeed -v -timeout 1800s ./
scripts/redteam/itb/related_seed/run.sh # same, with JSON aggregation
Empirical re-verification — related-nonce axis — redteam_related_nonce_test.go. Each message draws two independent CSPRNG nonces carried side-by-side in the cleartext header: the main nonce gates 7 of the 8 seed-derived outputs — noiseSeed's per-pixel noisePos through blockHash(pixIdx || main_nonce), each dataSeed_i's per-pixel dataRotation and channelXOR through the same pixIdx || main_nonce buffer, and each startSeed_i's per-snake startPixel through ChainHash(0x02 || main_nonce); the independent interlock nonce gates the eighth, lockSeed's Interlocked Barrier per-chunk overlay key through ChainHash(0x04 || interlock_nonce) (the 0x04 domain tag is disjoint from the 0x02 tag deriveStartPixel binds to). The probe drives the worst-case joint 1-bit Δ, forcing both header nonces to the same base and then to the same base ⊕ Δ value via the setBrokenTestNonce lab hook, so a single Δ propagates through all 8 seed-derivation slots simultaneously — a strictly stronger perturbation than a single-seed Δ or a single-nonce Δ.
| Probe | Threat model | Sample | Observable | Verdict |
|---|---|---|---|---|
No-Δ floor — Encrypt3x128Cfg |
identical seeds, identical forced nonce | 1 pair, 512 KiB plaintext | CRC128 χ² 41.90M; FNV-1a χ² 56.28M — reproduces the related-seed no-Δ floor within 0.1 % | reference floor |
6-Δ matrix — Encrypt3x128Cfg |
6 Δ patterns × 2 plaintext kinds × 2 primitives = 24 cells | 1 pair per cell, 512 KiB plaintext | CRC128 max χ² 283.3 (mean 257.1); FNV-1a max χ² 263.4 (mean 247.8) — every cell inside the df=255 uniform band (mean 255, one-sided 3σ ≈ 323) | nonce Δ collapses to uniform on every cell |
Six systematic Δ positions sample nonce byte-word structure: LSB of byte 0, MSB of byte 0, MSB of byte 7 (first 64-bit word boundary), LSB of byte 32 (middle byte), LSB of byte 56 (start of last 64-bit word), MSB of byte 63 (top bit). Max χ² varies by 4–9 % across the six positions within each primitive — no Δ pattern dominates. Random and ASCII plaintexts produce χ² within 2 % of each other per primitive — no plaintext-kind sensitivity. The Δ_over_no-Δ-floor at the matrix maximum is -41.9M for CRC128 and -56.3M for FNV-1a: five orders of magnitude below the CSPRNG-noise-bit + fill artefact, confirming full absorption at the tested sample size.
The nonce-Δ collapse is tighter than the related-seed lockSeed-axis collapse (max 283 vs 635 CRC128, max 263 vs 550 FNV-1a) — consistent with the superset structural finding: the co-perturbation of the noiseSeed / dataSeed_i / startSeed_i derivation slots randomises the touched-pixel channelXOR / noisePos / startPixel further, dissipating the small residual permutation-boundary contribution the lockSeed-axis-only Δ leaves at 512 KiB. The barrier's related-seed diffusion property is confined to the lockSeed axis, and the nonce enters that axis (plus seven others) — so the nonce-Δ diffusion inherits the same lockSeed-routed absorption, and the additional seven-slot perturbation drives the residual toward uniform. Both closures re-parametrise on the fresh CSPRNG nonce per session; a production caller cannot force this Δ because generateNoncePairCfg draws every dual-nonce pair from crypto/rand.
Empirical two-way decomposition — redteam_related_nonce_dualnonce_test.go. Extends the joint-Δ probe above by isolating the two independent nonce inputs the shipped wire carries — main and interlock — under three scenarios: dual-slot (both nonces receive the 1-bit Δ), main-only (only main_nonce receives the Δ; interlock_nonce matches across the pair via setBrokenTestNoncePair), interlock-only (mirror). Each scenario runs the same 6-Δ × 2-plaintext × 2-primitive matrix as the joint probe — 12 cells per (scenario, primitive) pair, 72 cells total, 512 KiB plaintexts. Result summary (χ² min / mean / max across the 12 cells per (scenario, primitive) pair, df=255 uniform band ≈ [220, 292] for p ∈ [0.01, 0.99]):
| Scenario | Primitive | min χ² | mean χ² | max χ² | Verdict |
|---|---|---|---|---|---|
| A — dual-slot Δ | CRC128 | 215.6 | 252.5 | 288.5 | inside df=255 uniform band |
| A — dual-slot Δ | FNV-1a | 231.5 | 261.6 | 299.2 | inside df=255 uniform band |
| B — main-only Δ | CRC128 | 199.2 | 255.4 | 280.1 | inside df=255 uniform band |
| B — main-only Δ | FNV-1a | 196.1 | 258.7 | 291.7 | inside df=255 uniform band |
| C — interlock-only Δ | CRC128 | 267.0 | 358.5 | 505.8 | slight excess at one-sided 3σ (~323); no bit-balance signal above noise |
| C — interlock-only Δ | FNV-1a | 249.0 | 371.9 | 547.8 | slight excess at one-sided 3σ (~323); no bit-balance signal above noise |
The dual-slot (A) and main-only (B) collapses are indistinguishable from the joint-Δ table above — both sit inside the one-sided 3σ band and match the joint-Δ mean within a few percent. The interlock-only (C) cells sit slightly above the +3σ band because only the lockSeed-keyed permutation slot varies while the seven main-nonce-keyed slots stay deterministic, so the residue is more concentrated on the permutation-boundary contribution the joint case dissipates; the maximum bit-balance is 0.00453 (well below any measurable signal), and no cell yields a Δ that survives to a plaintext-recovery channel. The decomposition confirms the joint-Δ verdict is the additive combination of the two halves — neither slot on its own leaves an exploitable Δ, and their sum does not either.
Scaling probe (4× N, 2 MiB, TestRedTeamRelatedNonceDualNonceScenarioCScaled). Split by plaintext kind: random-plaintext cells plateau (max χ² 300 CRC128 / 378 FNV-1a — within the one-sided 3σ band ≈ 323), confirming the permutation-boundary attribution for the random axis. ASCII-plaintext cells grow sub-linearly (505.8 → 855 CRC128 / 547.8 → 885 FNV-1a, ratio ≈ 1.65× for 4× data — well below the 4× a proportional-signal channel would produce). Bit-balance on both axes stays sub-noise (< 0.004).
Entropy-ordering probe (2 MiB × three input-entropy points, TestRedTeamRelatedNonceDualNonceScenarioCLowEntropy). χ² scales strictly monotone with the inverse of input-byte entropy — CRC128 random (≈ 8 bits/byte) 267 → ascii (≈ 4.5) 754 → two_symbol (≈ 1 bit/byte, bytes drawn independently from {0x00, 0xFF}) ≈ 1.53 × 10⁷; FNV-1a 288 → 728 → ≈ 1.89 × 10⁷. The monotone ordering measures the sub-linear ASCII growth as input-distribution coupling under the interlock-only Δ, not a channel that scales with data volume. Under the pathological two_symbol regime bit-balance lifts to ≈ 0.22–0.27 as a mechanical consequence of the plaintext's per-byte extremity — this is not a plaintext-recovery channel because the two_symbol plaintext byte distribution is degenerate by construction and carries no per-byte information for the attacker to recover.
Direct recovery probe under two_symbol (TestRedTeamRelatedNonceDualNonceScenarioCTwoSymbolRecovery). The elevated bit-balance is closed empirically by attempting per-byte plaintext recovery under Scenario C + two_symbol with a family of naive attacker decoders. Setup: N = 2000 independent trials, fresh 8-seed bundle and fresh two_symbol pt (512 bytes) per trial, Scenario C interlock-only Δ pair, 1024000 total per-decoder guesses; 3σ null bound = 0.501482. Decoder family (each a total function of (ct0_body, ct1_body) → guessed pt byte in {0x00, 0xFF}): D0 constant 0x00, D1 high-bit(ct0[i]), D2 high-bit(ct0[i] ⊕ ct1[i]), D3 popcount(ct0[i]) < 4. Measured recovery rates: D0 0.500081 / D1 0.500062 / D2 0.500203 / D3 0.500190 — every decoder sits within the null 3σ band. Recovery = 0 / 1024000 verified over the tested decoder family; the elevated bit-balance is a distributional artefact confined to the pt-distribution axis and does not translate to a per-byte recovery channel. Reproduction:
go test -tags redteam -run TestRedTeamRelatedNonce -v -timeout 1800s ./ # joint-Δ matrix
go test -tags redteam -run TestRedTeamRelatedNonceDualNonceHeadline -v -timeout 300s ./ # 3-scenario headline smoke
ITB_RELATED_NONCE_DUALNONCE_MATRIX=1 go test -tags redteam -run TestRedTeamRelatedNonceDualNonceMatrix -v -timeout 3600s ./ # full 72-cell matrix
ITB_RELATED_NONCE_DUAL_SCENARIO_C_SCALED=1 go test -tags redteam -run TestRedTeamRelatedNonceDualNonceScenarioCScaled -v -timeout 2400s ./ # 4× N scaling probe (Scenario C only, 24 cells × 2 MiB)
ITB_RELATED_NONCE_DUAL_SCENARIO_C_LOWENT=1 go test -tags redteam -run TestRedTeamRelatedNonceDualNonceScenarioCLowEntropy -v -timeout 1200s ./ # 3-entropy ordering probe (Scenario C only, 36 cells × 2 MiB)
ITB_RELATED_NONCE_DUAL_SCENARIO_C_LOWENT_RECOVERY=1 go test -tags redteam -run TestRedTeamRelatedNonceDualNonceScenarioCTwoSymbolRecovery -v -timeout 300s ./ # two_symbol per-byte recovery null-check (~4 s)
The below-spec lab controls stress the shipped construction with the hardest algebraic weaknesses available: a fully GF(2)-linear primitive (CRC128, two keyed CRC64 lanes) and an invertible non-linear one (FNV-1a, a bijective multiply over Z/2^128 with a triangular low-lane T-function). Neither is a production hash; neither appears in the shipped registry. They lead this discussion because the methodology seeks the hardest stress cases, not the easiest PRF wins.
FNV-1a and CRC128 were broken in the archived record, but only under a construction that no longer ships: Single Ouroboros with the barrier disabled — a configuration the shipped API removes (the Interlocked Barrier is always-on and non-disableable). Under that legacy configuration the GF(2)-linear collapse recovered a CRC128 compound key in about one second (archived Phase 2f), and a SAT solver recovered an FNV-1a lo-lane state in about eight single-core hours (archived Phase 2g). Under the shipped always-on barrier, no algebraic leakage from either control is measurable at the tested sample sizes, and the linear / SAT instance cannot be formulated at all. This is a scope statement, not a safety claim for FNV-1a: the primitive remains below spec, the closure is an instance-formulation argument under the barrier, and total inversion of the primitive still circumvents the barrier.
The recovery is ported from the archived CRC128 Crib KPA (crib_crc128_kpa.py / crib_crc128_kpa_full.py) and run as go test -tags redteam -run TestRedTeamBrokenCRC128CribKPA ./ (≈ 0.09 s): a 625-candidate startPixel scan against a four-pixel crib, recovering the observable 56-bit compound key over all noise-position and rotation guesses — a strictly stronger attacker than the archived algebraic filter.
Verdict — null. Against a legacy Single, barrier-off control encode the ported filter anchors exactly one shift and returns one survivor (the true key), confirming sensitivity. Against the shipped Encrypt3x128Cfg ciphertext the filter anchors zero shifts and returns zero survivors across all 625 candidate startPixels; the ciphertext round-trips, so it is a genuine encryption. Part 1 permutes the plaintext into the snakes before pixel encoding, so the crib bytes the attacker substitutes as "pixel p's plaintext" are the wrong bytes and there is no fixed bit-position-to-lane anchor for the linear system. Under a forced nonce collision (TestRedTeamBrokenCRC128NonceReuse, ≈ 0.01 s) the Crib KPA still returns zero survivors from either colliding ciphertext: nonce reuse repeats the masks but does not hand the attacker the permutation, so the crib remains unanchored.
Scoped absorption claim — the archived Phase 2f no-nonce-reuse structural attack. The current Interlocked Barrier absorbs the archived Phase 2f-family no-nonce-reuse CRC128 Crib KPA attack on public-schema JSON plaintext under this test — 0 / 625 anchoring shifts, 0 surviving compound-K candidates, 0 bytes recovered, no functional K claimed. Absorption mechanism under the sample-bounded reading: Part 1's mask permutation dislocates the crib bytes below the attacker's predicted post-split positions (Barrier crib-anchor displacement — CRC128: 1 in 180 leading crib bytes at the assumed position, below the ≈ 0.0385 same-symbol coincidence floor of the 26-symbol crib). The predecessor construction (retired Single Ouroboros / overlay-off, archive/REDTEAM.md § Phase 2f) recovered the compound key in one anchoring shift with one surviving candidate in the same test run, confirming the filter is sensitive on the retired configuration and the null is a genuine absorption result, not a filter-implementation defect. The claim is bounded by what this specific filter's Step-1 anchoring gate detects and does not generalise to unrelated attack families; total inversion of the primitive still circumvents the barrier.
Threat model — fresh nonce Full KPA, FNV-1a on every seed role. Each of the 8 mandatory seeds (noiseSeed, lockSeed, dataSeed1..3, startSeed1..3) is keyed by FNV-1a with independent random key material; nonces are fresh per message. The archived record recovered a functional FNV-1a lo-lane compound key in ≈ 8 h single-core against Single Ouroboros with the overlay disengaged, yielding 83–85 % byte-level plaintext recovery on JSON / HTML holdouts (archived Phase 2g; detail in archive/REDTEAM.md § Phase 2g).
Verdict — null anchoring at every candidate startPixel across every attacker regime, sample-bounded. The redteam_broken_fnv1a_sat_test.go probes drive FNV-1a on all 8 seeds through Encrypt3x128Cfg on a 157-byte JSON crib (public-schema prefix — identifier field, ISO timestamp) and measure the naive-crib SAT anchoring at three regimes:
| Probe | Regime | Sample | Observable | Verdict |
|---|---|---|---|---|
| F1 pre-anchor structure | attacker-realistic (no seed peek) | 3 snakes × 208 candidate startPixels × 6 crib pixels | per-pixel achievable xor_mask56 set size mean ≈ 55.8; max cross-pixel set intersection over every candidate startPixel: 0 / 0 / 0 | the archived CRC128-style compound-K intersection filter yields no anchor reduction; discriminator moves to SAT |
| F2 true-anchor upper bound | [lab-peek: true_seeds] noiseSeed + dataSeed_i granted |
3 snakes × 208 startPixels × 6 crib pixels × 8 channels | full-channel anchor shifts 0 / 208, 0 / 208, 0 / 209; max per-shift channel matches 3 / 48 (fraction 0.063, vs per-channel chance floor 0.375 — observed 6× below floor) | even the oracle attacker with (np, r) handed over fails at chance floor; naive-crib xor_mask56 never equals the true dataHash prefix |
| F4 startPixel-peek | [lab-peek: sp_i] + [lab-peek: true_seeds] |
3 snakes at disclosed sp_i | channel matches at true sp = 0, 4, 0 / 48; shift-averaged floor = 0.32, 0.41, 0.39 | disclosing per-snake startPixel does not restore the anchor; match count at sp_i is at the same floor as any other shift |
The mechanism is multi-seed joint coupling: every attacker-visible byte is the composition of independent contributions from noiseSeed (per-pixel noisePos), lockSeed (per-chunk 48-bit mask triple over ≈ 2^70.20 space), dataSeed_i (per-pixel channel-XOR + rotation), and startSeed_i (per-snake sp_i). No per-chain observation channel exists. Even granting 5–6 of the 8 chains as lab peek (F2 + F4 posture, corresponding to a hypothetical break of noiseSeed + dataSeed_i + startSeed_i) leaves the joint constraint under-determined by the interlock permutation, which continues to move the crib bytes off every attacker-predicted position.
Instance-formulation closure, not solver-throughput closure. The archived SAT harness (sat_harness_4round.py) anchored on the Single Ouroboros mapping "plaintext byte K → container pixel (startPixel + K/7) mod totalPixels, channel K%7". Under the shipped barrier that mapping does not hold: the 48-bit interlock permutation displaces the assumed crib bytes at nearly every position, corroborated by the F5 displacement measurement on the same JSON crib (per-snake fractions 1/53, 0/52, 1/52, at or below the ≈ 1/40 same-symbol coincidence rate of the 40-symbol JSON alphabet). The archived SAT instance thus cannot be written down against the shipped construction — no chain-inversion tooling converts an unformulable instance into a solvable one. The T-function / Triangle solver at scripts/redteam/itb/theory/fnv1a/ (100–1000× faster than Bitwuzla on the isolated FNV-1a lo-lane chain by exploiting its ×0x13B carry-up-only triangular structure) faces the identical observation-layer wall as Bitwuzla against the barrier: the closure is bounded by what the attacker can observe, not by how fast a chain inverter runs.
Bitwuzla SAT run corroborates. A compact adaptation of the archived harness under scripts/redteam/itb/fnv1a_sat/sat_probe.py encodes the naive-crib SAT anchor as a symbolic FNV-1a 4-round chain (256-bit dataSeed_i lo-lane unknown) plus per-pixel disjunction over the 56 (np, r) tuples chained through the bit-slice + rotation constraint. Under the maximum-peek attacker regime (true (np, r) granted via lab peek — 5 of 8 chains inverted for free — and true sp_i disclosed as the Layer 3 exception), Bitwuzla 0.9.1 returns UNSAT on all 3 snakes at N = 2 crib pixels in ≈ 7–10 s per snake. Even the strongest-attacker single-chain SAT — attacker granted every seed except the dataSeed_i lo lane — fails to find a satisfying dataSeed_i under the naive-crib anchoring premise. The full coupled-8-chain SAT (all 8 chains unknown plus the ≈ 2^70.20 per-chunk interlock mask triples symbolic) is trivially harder; the isolated-chain UNSAT is a strict upper bound.
Positive control corroborated. TestRedTeamBrokenFNV1aCribKPAControl drives the same 8-seed FNV-1a configuration through the low-level process128Cfg encoder (Single Ouroboros, barrier off — not reachable through the shipped API) and confirms the anchor logic recovers the true xor_mask56 at every one of the first 6 crib pixels under true (sp, np, r), matching the archived SAT anchoring premise bit-exact. The barrier null is contrasted against a filter that IS sensitive on the retired configuration.
The passive Full KPA block above closes an attacker who sees plaintext and ciphertext but does not choose either. The chosen-plaintext posture is a distinct attacker capability — reachable through the shipped API (an attacker with an encryption oracle), unlike the lab-forced 1-bit seed / nonce deltas the related-seed and related-nonce probes assume. The redteam_cpa_broken_test.go probe measures whether the barrier's closure holds when the attacker chooses the plaintext freely and each Encrypt call draws a fresh CSPRNG nonce, with FNV-1a substituted onto every one of the 8 mandatory seed roles.
Threat model. Fresh-nonce chosen-plaintext against Encrypt3x128Cfg, all 8 seed roles keyed by FNV-1a with independent random component vectors; the reference arm keys the same 8 roles with BLAKE3 through the HashFunc128 interface (keyed BLAKE3 wrapped at the low 16 bytes of the 32-byte digest). No testNonceOverride is installed — every encrypt draws its nonce from crypto/rand. The attacker fixes one plaintext per kind then queries the oracle N = 2000 times per (arm, plaintext kind) cell. The load-bearing observable is the two-sample byte-histogram homogeneity chi² between arms at each plaintext kind, computed on the container-body region of the wire (the fixed dimension header carries no primitive-attributable channel and is excluded).
| Probe | Threat model | Sample | Observable | Verdict |
|---|---|---|---|---|
| Homogeneity — 7 chosen-plaintext kinds × 2 arms | fresh-nonce CPA, FNV-1a on every seed role vs BLAKE3 reference | 2 arms × 7 kinds × N = 2000 messages, 512-byte plaintext, pooled body bytes ≈ 19 600 000 per cell | FNV-1a↔BLAKE3 two-sample chi² per kind: 214.8 – 265.8 (dominant kind fill_7f at 265.8); df = 255, one-sided 3σ uniform band top ≈ 323 |
null — every cell inside the uniform band |
| Per-arm body — 7 kinds × 2 arms | pooled body byte histogram vs df = 255 uniform | 14 cells | FNV-1a body chi² 200.0 – 284.6; BLAKE3 body chi² 214.3 – 286.0 | container body at df=255 uniform band on both arms |
| Per-arm pair byte-equal — 7 kinds × 2 arms | position-wise byte-equal fraction across successive ct pairs | N / 2 pairs per cell | FNV-1a rate 0.00388 – 0.00393; BLAKE3 rate 0.00385 – 0.00394 — every cell at the 1/256 ≈ 0.00391 independent-stream floor | fresh-nonce independence held per arm |
Seven chosen-plaintext kinds stress the attacker-choice axis: zeros, fill_7f, single_bit_low (bit 0 of byte 0 set), single_bit_mid (bit 3 of byte 256 set), structured_json (public-schema JSON prefix + padding), structured_html (HTML boilerplate + padding), random_control (deterministic random 512-byte control). Homogeneity chi² varies by ≈ 21.4 % across kinds on the FNV-1a↔BLAKE3 comparison — no plaintext kind surfaces a primitive-attributable channel; the crib-anchored structured_json and structured_html cells sit at chi² 214.8 and 224.8, comparable to the trivial zeros cell at 244.1 and all inside the same df=255 uniform band. Under fresh nonces each Encrypt call redraws the per-chunk 48-bit interlock mask triple (via lockSeed + fresh nonce → deriveInterLockSeed → rankToMaskTriple48), the per-pixel noisePos (via noiseSeed per pixel), the per-pixel channelXOR + dataRotation (via each dataSeed_i per pixel), and each snake's startPixel (via each startSeed_i + fresh nonce), so no chosen plaintext byte lands at an attacker-predictable wire position and every wire byte is at the 1:1 signal/noise floor per pixel — the primitive's algebraic weakness has no observation channel to project onto.
Cross-attack synthesis. Combined with the passive Full KPA null on the same seed configuration (F1 / F2 / F4 above), the closure covers the passive → active attacker-capability spectrum against the below-spec primitive: passive KPA yields no anchoring at any candidate startPixel; active CPA yields no distinguishable wire versus a PRF-grade reference at the tested sample size. Under fresh-nonce CPA against Encrypt3x128Cfg with FNV-1a on every seed role, the barrier produces a container-body wire whose byte distribution is indistinguishable from the BLAKE3-keyed reference wire at the same plaintext kind. Chosen-plaintext freedom does not restore the observation channel FNV-1a would otherwise offer, because the observation channel is structurally routed away from the primitive's ChainHash output by the barrier's Part 1 permutation and Part 2 whitening.
The Fresh-nonce CPA block above closes an active attacker who chooses one plaintext and observes one ciphertext at a time. The cross-message posture is a distinct attacker capability — the same encryption oracle, but the attacker submits a pair of near-identical plaintexts and observes the pair of ciphertexts, then tries to distinguish "near-identical plaintexts encrypted under distinct fresh nonces" from "independent plaintexts encrypted under distinct fresh nonces". A distinguisher here is a real traffic-analysis leak: knowing P1 ≈ P2 from (C1, C2) alone reveals inter-message relationships even when no plaintext byte is recovered. The Nonce reuse block above records this signature at ≈ 16.128 × the 1/256 floor at 512 B on the near-identical pair shape under a colliding nonce; the redteam_near_identical_fresh_test.go probe measures the same pair shape under fresh nonces to isolate the "the mandatory internal nonce alone closes the traffic-analysis distinguisher" claim from the "nonce reuse remains the only condition surfacing any signal" scoping.
Threat model. Fresh-nonce chosen-plaintext-pair against Encrypt3x128Cfg, all 8 seed roles keyed by FNV-1a with independent random component vectors. No testNonceOverride is installed — every encrypt draws its nonce from crypto/rand. The attacker submits (P1, P2) where P2 = P1 XOR delta_mask for a chosen bit-position delta_mask (near-identical category) or independent-random (P1', P2') (independent-pair control category), receives (C1, C2), and the load-bearing observable is the two-sample byte-histogram homogeneity chi² between the pooled near-identical body(C1) XOR body(C2) aggregate and the pooled independent-pair-control aggregate at every (size, delta position) cell. The container body region is measured; the fixed dimension header carries no primitive-attributable channel and is excluded.
| Probe | Threat model | Sample | Observable | Verdict |
|---|---|---|---|---|
| Cross-category homogeneity — 4 sizes × 6 delta positions | fresh-nonce chosen-plaintext-pair, FNV-1a on every seed role | 2 categories × 4 sizes × 6 delta positions × N = 80 pairs, plaintext sizes 128 B / 512 B / 4 KB / 16 KB, pooled body-XOR bytes 784 000 per cell at 128 B / 512 B / 4 KB and 1 600 000 at 16 KB | near-identical↔independent-control two-sample chi² per (size, delta): 193.94 – 298.29 (dominant cell size = 512 B, delta = end_bit7 at 298.29); df = 255, one-sided 3σ uniform band top ≈ 323 |
null — every cell inside the uniform band |
| Per-category byte-XOR uniformity — 48 cells | pooled body(C1) XOR body(C2) byte-histogram vs df = 255 uniform |
48 cells | near-identical body-XOR chi² 215.53 – 279.82; independent-control body-XOR chi² 220.34 – 288.23 | pair-XOR byte distribution at the df=255 uniform floor on both categories |
| Per-category byte-equal floor ratio — 48 cells | position-wise byte-equal fraction per pair | 48 cells | near-identical rate 0.00373 – 0.00400 (0.953 × – 1.022 × the 1/256 floor); independent-control rate 0.00377 – 0.00408 (0.964 × – 1.043 × floor) | fresh-nonce independence held on both categories; contrast with the nonce-reuse Layer A 16.128 × floor at 512 B on the same pair shape |
Six systematic delta positions stress the attacker-choice axis on the pair shape: byte0_bit0 (LSB of the first plaintext byte), byte0_bit7 (MSB of the first plaintext byte), mid_bit3 (bit 3 of the middle plaintext byte), end_bit0 and end_bit7 (LSB / MSB of the last plaintext byte), and spread_hw4 (Hamming-weight-4 delta distributed at bytes 0 / N/4 / N/2 / 3N/4 — a multi-bit probe rather than a single-bit flip). Cross-category homogeneity chi² spans a 104-point interval across the 24 (size, delta) cells (193.94 at size = 4 KB, delta = mid_bit3; 298.29 at size = 512 B, delta = end_bit7) — the full range sits inside the df=255 uniform band with the dominant cell 24.7 points below the band top. No delta position dominates the ranking: end_bit7 produces the maximum at 512 B but drops to 230.37 at 16 KB, and spread_hw4 produces the second-highest cell at 16 KB (277.17) but the fourth-lowest at 4 KB (210.98). Size sensitivity is flat: per-size mean chi² is 250 / 272 / 235 / 240 across the four sizes, no monotone trend as plaintext size scales two orders of magnitude. Under fresh nonces each Encrypt3x128Cfg call redraws the per-chunk 48-bit interlock mask triple (via lockSeed + fresh nonce → deriveInterLockSeed → rankToMaskTriple48), the per-pixel noisePos (via noiseSeed per pixel), the per-pixel channelXOR + dataRotation (via each dataSeed_i per pixel), and each snake's startPixel (via each startSeed_i + fresh nonce), so the two pair wires share no per-position determinism and the near-identical delta on the plaintext cannot survive the independent Part 1 mask redraws.
Nonce-reuse contrast. On the same near-identical-pair shape under forced nonce reuse (see Nonce reuse Layer A), the byte-equal rate reaches ≈ 0.063 ( ≈ 16.128 × the 1/256 floor) at 512 B — the archived traffic-analysis residue Phase 2d surfaced. Under fresh nonces the same shape sits at the 1/256 floor across every tested (size, delta) cell, at a matrix-maximum near-identical floor ratio of 1.022 × at size = 4 KB, delta = byte0_bit7. The independent-pair control's floor ratio maxes at 1.043 × on a different cell (size = 512 B, delta = byte0_bit7), higher than the near-identical maximum — the two categories are indistinguishable at this resolution because the finite-sample sampling noise across cells is larger than any near-identical-vs-independent contrast the barrier permits under fresh nonces. The near-identical-pair distinguisher is a nonce-reuse-only artefact. The mandatory internal nonce alone is the load-bearing discipline against the cross-message traffic-analysis distinguisher — a ≈ 15.8 × collapse of the near-identical floor ratio between the two regimes on the 512 B reference cell; the outer cipher (when engaged) is a further whitening layer for format deniability against the wire dimension header, not the mechanism that closes this residue.
Cross-attack synthesis. The passive Full KPA null (F1 / F2 / F4), the single-message CPA null (FNV-1a↔BLAKE3 homogeneity in-band on every chosen-plaintext kind), and the cross-message pair-shape null (this probe) together cover the passive → active × single-message → cross-message attacker-capability spectrum against the below-spec primitive under fresh nonces. Chosen-plaintext-pair freedom does not restore an observation channel any more than chosen-plaintext-message freedom did, because each Encrypt3x128Cfg call redraws every derived per-message secret from the fresh nonce and neither the single-message wire byte distribution nor the pair-shape byte-XOR distribution surfaces a primitive-attributable handle.
A structural probe (TestRedTeamBrokenBarrierDisplacement, ≈ 0.07 s; holds true seeds to observe what the barrier did, not an attack path) encrypts a fully attacker-known structured crib and measures the fraction of leading crib bytes still sitting at their assumed post-split position. For both the GF(2)-linear (CRC128) and the non-linear invertible (FNV-1a) control the fraction sits at or below ≈ 0.0056 (CRC128: 1 in 180; FNV-1a: 0 in 180), below the ≈ 0.0385 same-symbol coincidence rate of the 26-symbol crib. Anchor destruction is primitive-agnostic — it does not depend on any algebraic property the primitive lacks, which is why the same mechanism closes the CRC128 linear collapse and the FNV-1a lo-lane SAT.
go test -tags redteam -run TestRedTeamBroken -v ./ # all broken-primitive probes
go test -tags redteam -run TestRedTeamBrokenCRC128CribKPA -v ./
go test -tags redteam -run TestRedTeamBrokenBarrierDisplacement -v ./
go test -tags redteam -run TestRedTeamBrokenCRC128NonceReuse -v ./
go test -tags redteam -run TestRedTeamBrokenFNV1a -v ./ # FNV-1a lo-lane SAT probes F1..F6
go test -tags redteam -run TestRedTeamCPABroken -v -timeout 7200s ./ # fresh-nonce CPA under FNV-1a on every seed role
go test -tags redteam -run TestRedTeamNearIdenticalFreshNonce -v -timeout 3600s ./ # fresh-nonce cross-message near-identical pair-shape distinguisher
./scripts/redteam/itb/fnv1a_sat/run.sh # aggregate the FNV-1a probes + optional Bitwuzla SAT
./scripts/redteam/itb/cpa_broken/run.sh # aggregate the CPA probe
./scripts/redteam/itb/near_identical_fresh/run.sh # aggregate the fresh-nonce near-identical pair-shape probe
The harness is redteam_broken_test.go (CRC128 + shared adapters), redteam_broken_fnv1a_sat_test.go (FNV-1a probes F1..F6), redteam_cpa_broken_test.go (fresh-nonce CPA matrix), and redteam_near_identical_fresh_test.go (fresh-nonce cross-message near-identical pair matrix), package itb; the CRC128 / FNV-1a adapters and the ported filter carry inline provenance comments pointing at the retired lab scaffolds and the Python arsenal routines they adapt. The compact Bitwuzla harness lives at scripts/redteam/itb/fnv1a_sat/sat_probe.py; it consumes the corpus emitted by TestRedTeamBrokenFNV1aCribKPAEmitCorpus under ~/scratch/redteam/fnv1a_sat/f6_corpus_bundle.json (override the parent directory via REDTEAM_FNV1A_SAT_OUTPUT_DIR) and runs against the maximum-peek attacker regime described above. The CPA probe emits its record to ~/scratch/redteam/cpa_broken/cpa_broken_matrix.json and the cross-message near-identical pair probe emits its record to ~/scratch/redteam/near_identical_fresh/near_identical_fresh_matrix.json, both for their aggregators.
Under the always-on barrier both primitive classes converge to the same observable outcome — no measurable signal at the tested sample sizes — by two different mechanisms.
PRF-grade branch — definitional closure, one representative sufficient. For a PRF-grade primitive the null is a definitional consequence of the PRF assumption, not an accident of the tested sample: a secure PRF's ChainHash output is computationally indistinguishable from random before the barrier is ever applied, so the attack surface reduces to statistical ciphertext properties already at the finite-sample floor. The barrier adds instance-formulation under-determination on top of an already-null primitive; the PRF assumption alone would suffice, and the barrier is redundant-but-additive on this branch. Each registry member enters the construction through the same ChainHash interface and is consumed by the same barrier; expanding empirical breadth across every member would multiply runs without changing the argument. The representative-primitive approach documents the null rigorously on BLAKE3 and generalises through the shared assumption. Probe 1 and Probe 4 corroborate the null empirically. The archived spectrum (deliberately broken controls through paper-grade PRFs) recorded that no PRF-grade primitive was broken at any phase, under any threat model, and no break survived engagement of the overlay (archive/REDTEAM.md, Phase 2 tables); the plaintext-recovery breaks were obtained only against below-spec primitives, only against Single Ouroboros, and only with the overlay disengaged.
Below-spec branch — architectural under-determination, primitive-independent. The below-spec primitive leaks in isolation, but under the always-on barrier the attacker cannot formulate the linear or invertible system at all: the bit-position-to-lane mapping is a hidden per-chunk ≈ 2^70.20 secret, so the GF(2)-linear pixel-independent collapse that broke CRC128 under the retired Single Ouroboros / barrier-off configuration has no known analogue against the shipped construction. The closure is an instance-formulation argument that does not invoke the PRF assumption for the primitive itself — it rests on the barrier's own reduction arithmetic and its per-chunk PRF-keyed mask draw, and holds under fresh nonces conditional on the absence of a structural shortcut against that arithmetic. It is not an independently certified result.
Equivalence of outcome. The barrier's mask-formulation under-determination is the dominant term across the tested primitive spectrum. For a PRF the primitive supplies the null and the barrier is redundant-but-additive; for a broken primitive the barrier supplies the null the primitive fails to.
This phase targets the construction itself — properties that do not depend on which hash keys the barrier. Each probe drives either the Triple facade wire or the barrier kernels directly and reports a sample-bounded verdict; every wire statistic is computed from bytes an attacker holding the ciphertext already has. The probes ship as Go tests (harness_test.go for kernel probes, triple/harness_wire_test.go for wire probes), gating their full-sample loops behind ITB_HARNESS_FULL=1.
The barrier-only wire ([main_nonce][interlock_nonce][W][H][container], wrapper off) is uniform at the byte-value level except for the cleartext container-dimension header. The container body is individually uniform: every payload byte — COBS data, the COBS terminator 0x00, and the CSPRNG tail fill alike — passes through Part 2 (channelXOR + rotate7 + noise-insert) and Part 1's lane permutation before reaching the wire, so no payload byte survives as its pre-barrier value. Measured at N = 3000–4000 256-byte messages, the container-body zero rate sits at the 1/256 floor (≈ 0.391 %), and no payload-derived byte value is over-represented above the sampling floor.
The one structural signature is the big-endian W and H dimension fields written in cleartext ahead of the container (out = main_nonce ‖ interlock_nonce ‖ W ‖ H ‖ container in Encrypt3x256Cfg). For a fixed plaintext size the container is a deterministic size, so these four bytes are identical across messages: their high bytes are 0x00 and their low bytes are the dimension value. Pooled over many messages this over-represents the 0x00 bin (the two high bytes) and one companion value (the shared low byte) by a relative ≈ +5 % each — an absolute excess of roughly 0.02 percentage points on the 0x00 rate. A byte-histogram chi-square, the sharp instrument for granular bias, detects it (barrier-only per-profile χ² ≈ 1890–2130 at N = 8000, df = 255, uniform band [142, 368]); Shannon entropy stays ≈ 7.99998 bits/byte and the wire is incompressible (flate ratio 1.0002).
Two consequences fix the scope of this signature:
- It is not a confidentiality leak. The dimension header restates the container size, which the wire length already reveals. The COBS terminator is not on the wire — it is absorbed by Part 2, so its position (set by the secret per-snake
startPixeland the payload length) is nowhere observable. The signature carries no plaintext, no key, no terminator position, and no startPixel. Confidentiality against COA / KPA / CPA is delivered by the barrier composition itself, not by any wire-whitening pass. - The outer cipher removes it for format deniability. Engaging the wrapper encrypts the whole wire including the dimension header, dropping the byte chi-square into the uniform band (≈ 254–260) and the
0x00deviation from +5 % to ± 0.05 %. The outer cipher delivers wire-level format deniability — a traffic-analysis / format-fingerprint property — not confidentiality, which is the barrier's job. This scopes every "indistinguishable from random" byte-histogram claim: at the barrier-only layer the claim holds for the container body and the payload-channel probes; the cleartext dimension header is the sole exception and is whitened by the wrapper.
The finding is primitive-agnostic: the dimension header is written identically regardless of which hash keys the seeds, so a broken primitive and a PRF-grade primitive produce the same signature when the wrapper is off. It is not a primitive leak.
Question. Can a wire observer tell the Streaming AEAD MAC profile from the Non-AEAD profile from byte statistics alone? The mode-ambiguity doctrine ships both with a wire-identical envelope so a MITM cannot assume a MAC-check oracle exists.
Setup. The facade encrypts N = 8000 fresh-random 256-byte messages under each profile, parallax off, at both wrapper postures. The load-bearing statistic is the two-sample homogeneity chi-square between the AEAD and Non-AEAD pools (df = 255).
| Posture | AEAD wire χ² | Non-AEAD wire χ² | 0x00 dev (both) |
AEAD↔Non-AEAD homogeneity χ² |
|---|---|---|---|---|
| Wrapper off (barrier only) | 1889.6 | 2126.9 | +5.3 % | 244.8 |
| Wrapper on (outer cipher) | 268.8 | 256.6 | ±0.1 % | 286.5 |
Verdict — mode ambiguity holds (sample-bounded). The homogeneity chi-square is inside the uniform band whether or not the wrapper is engaged (244.8 / 286.5, band top 368). The two modes carry one identical container law — the dimension-header signature is identical in both, so it cancels in the two-sample test — and no wire byte statistic separates them at the tested sample size. The MAC rides inside the encryption envelope; the Non-AEAD path fills the corresponding region with CSPRNG dummy of matching length. Positive control: the barrier-only per-profile chi-square (1890 / 2127, far above the band) confirms the probe detects the signature that is actually present, so the in-band homogeneity result is a real null. Empty input is rejected at the triple.Pipeline layer with ErrEmptyInput, so no zero-payload wire exists to distinguish across profiles; mode ambiguity is trivially preserved across all valid input sizes.
Question. Does the per-chunk mask-triple derivation realise the architectural ≈ 2^70.20 balanced-partition space, or does an implementation detail collapse it? This is a white-box structural harness, not an attack.
Result. Over N = 200000 random draws (gcd witness at N = 500000): every triple satisfies popcount = 16 per lane, m0 | m1 | m2 = 0x0000_FFFF_FFFF_FFFF, and pairwise-disjoint lanes (100 % of draws); per-bit balance within 2.18 σ across all 48 positions; reduced-index chi-square 228.7 / 241.5 (band [142, 368]). The gcd anti-collapse trap: under the shipped two-step reduction the fraction landing on idx0 ≡ idx1 (mod 66861) is 1.600 × 10⁻⁵, matching the full-space expectation 1/66861 ≈ 1.496 × 10⁻⁵; the rejected same-rank double-mod would confine every draw to that diagonal.
Verdict — null structural deviation. The mask space is full and balanced and the two-step reduction avoids the residue-class trap, corroborating the Part 1 cardinality claim at the derivation layer. This is a structural-correctness result under the standing assumption that the lockSeed's PRF output is indistinguishable from uniform, not a security proof. Primitive-agnostic; the per-attack tracks cite C2 rather than re-running it.
The Non-AEAD profile (wrapper off) encrypts N = 8000 wires at plaintext sizes {1, 6, 32, 4096} bytes. Entropy stays 7.99998 and flate 1.0002 at every size; the dimension-header 0x00 relative deviation ranges only over [4.87 %, 5.24 %] across the four-order size span. Verdict — null size-leak: the tail-fill-dominated small-plaintext wire carries the same container law as the payload-dominated large-plaintext wire, so no size-dependent fill anomaly is present at the tested sample size beyond the length the wire already reveals.
The kernel probe (C4b) drives chunk48lock with N = 200000 random chunks under fresh mask triples; the wire probe (C4a) aligns N = 30000 wires column-wise. C4b: max |r| = 0.00545 against the sampling floor 0.00224 — cross-lane correlation at the floor. C4a: max |r| = 0.01853 against floor 0.00577 — ~3.2× the floor, below the 8× threshold; the attribution is the marginal dimension-header / container-framing residual, not a barrier cross-snake leak (the kernel probe, which bypasses framing, shows none). Verdict — null cross-snake coupling at the barrier; a small container-framing residual at the wire the outer cipher would remove.
The kernel probe pools lane-output bits over N = 300000 chunks; the wire probe pools N = 4000 4096-byte wires at both postures. C5-core: max per-bit deviation 2.240 × 10⁻³ against floor 1.826 × 10⁻³ (maxZ 2.45) — the architectural per-chunk bias 2^-57.8 is ~15 orders of magnitude below detectability. C5 wire: barrier-only 2.582 × 10⁻⁴ (container tilt), wrapped 1.612 × 10⁻⁴ against floor 1.588 × 10⁻⁴. Verdict — no measurable cumulative bias at the tested sample size (turning the granularity into a distinguisher needs ≈ 2^115.6 chunks); the small barrier-only tilt is the dimension-header signature the outer cipher removes.
A single session encrypts the same 256-byte plaintext N = 10000 times (fresh internal nonce per call). Result: 10000 distinct wires out of 10000, mean pairwise Hamming distance 0.4999 of the body bits (ideal 0.5). Verdict — null collision: the internal per-call nonce drives fresh masks, noise positions, and per-snake offsets, so the wire body is effectively an independent random draw per message — empirical corroboration of the fresh-nonce under-determination without enumerating the ≈ 2^57.80 preimage space.
| Probe | Layer | Sample | Verdict |
|---|---|---|---|
| C1 mode ambiguity | facade wire | 8000 msg × 4 cells | Modes indistinguishable (homogeneity in-band); outer cipher whitens the dimension-header signature |
| C2 mask-space | barrier kernel | 200k–500k draws | Full balanced space; gcd trap avoided; null deviation |
| C3 tail-fill | facade wire | 8000 msg × 4 sizes | Size-stable; null size-leak |
| C4 cross-snake | kernel + wire | 200k / 30k | Null coupling at barrier; small framing residual at wire |
| C5 cumulative bias | kernel + wire | 300k / 39.6 M B | No measurable bias; tracks sampling floor |
| C6 nonce freshness | facade wire | 10000 msg | All wires distinct; ~50 % pairwise Hamming |
Every construction-level probe returns a null or an explained-structural result. The one non-trivial finding — that the barrier-only wire carries a cleartext dimension-header byte signature that the outer cipher, not the barrier, whitens — is a scoping clarification, not a weakness: it names the layer that delivers wire-level format deniability and confirms that the COBS terminator and every payload byte are absorbed by the barrier itself. All results are conditional on the configured primitive behaving as a secure PRF and on fresh nonces, and all statements are bounded by the tested sample size.
Reproduction.
ITB_HARNESS_FULL=1 go test -tags redteam -run 'TestHarnessC[245]' -v ./ # kernel probes C2, C4b, C5-core
ITB_HARNESS_FULL=1 go test -tags redteam -run 'TestHarnessC[13456]' -v ./triple/ # wire probes C1, C3, C4a, C5, C6
go test -tags redteam -run TestHarness ./ ./triple/ # fast smoke run
The tracks converge on one sample-bounded, PRF-conditional outcome — no measurable signal at the tested sample sizes under the stated threat models — reached through complementary evidence.
Both primitive classes converge by two mechanisms. For a PRF-grade primitive the primitive supplies the null and the barrier is redundant-but-additive; for a below-spec broken primitive the barrier supplies the null the primitive fails to, because the bit-position-to-lane mapping is a hidden per-chunk ≈ 2^70.20 secret. The broken-primitive empty shadow-K survivor sets and the PRF-grade floor-level crib / pairwise byte-equal rates are two halves of one finding.
The shared barrier core is measured once. Both tracks rest on the ≈ 2^70.20 Part 1 mask-space cardinality and 3-snake independence, corroborated at the derivation and kernel layers by Probe C2 and Probe C4.
Wire-level scoping. §4.0 establishes that the barrier absorbs every payload byte including the COBS terminator; the sole non-uniform wire byte is the cleartext dimension header, a length-restating structural field the outer cipher whitens for format deniability. Confidentiality against COA / KPA / CPA is delivered by the barrier composition, and every "indistinguishable from random" byte-histogram claim is scoped to the container body and the payload-channel probes.
The re-verification pass produces a uniform null verdict at the tested sample sizes: the broken-primitive controls yield empty shadow-K survivor sets with no anchoring crib shift; the PRF-grade representative sits at the independent-stream floor on the crib and Full KPA probes; and every construction-level probe returns a null or an explained-structural result. The one condition that surfaces any signal is nonce reuse — a lab-only assumption a caller cannot force — and even there the correlation stays far below a plaintext-recovery channel.
The architectural closure narrative rests on the two-part barrier: Part 1 (the 48-bit interlock permutation) moves the KPA / CPA closure to the instance-formulation layer — a known crib anchors no fixed bit-to-lane mapping, and the mask has ≈ 2^57.80 preimages per chunk with no ranking signal among the ≈ 2^70.20 masks — while Part 2 (per-pixel channelXOR / rotate7 / noise) denies a per-byte observation channel at the 1:1 signal/noise floor. The layer-attribution finding closes the pass with a scoping correction: the cleartext dimension header is the only structural wire byte, the outer cipher whitens it for format deniability, and confidentiality is the barrier's own contribution.
All verdicts are sample-bounded and, where they invoke primitive strength, PRF-conditional. The closure is an architectural claim corroborated by these measurements and by the archived evidence for the shared pixel construction, not an independently certified result. Total or systematic PRF inversion circumvents the barrier; nonce reuse leaves a near-identical-plaintext traffic-analysis distinguisher the barrier does not remove but no attacker-realistic plaintext-recovery channel at the tested sample size; and upstream key-management, side channels, key compromise, implementation defects, and CCA via a deployment decryption oracle sit outside what the barrier itself closes and are treated at the construction level in SECURITY.md and PROOFS.md. The complete archived empirical detail remains in archive/REDTEAM.md.