Abstract

TSCR - Top Secret Chrono Crypt - was developed around its own Chrono-Entropic Encryption Engine and the hypothesis that the practical attack problem does not have to reduce solely to finding a key over a single, previously known and static transformation. If the encryption itself already exhibits strong, variable and difficult-to-predict observable properties, the absence of a complete transformation/state specification deprives the attacker of useful information and introduces an additional model-reconstruction/acquisition problem. This POC was created to test that hypothesis, not to assume it.

The behaviour of the final compiled TSCR v2.5.0.0 was first tested aggressively: repeated/chosen plaintext, minimal plaintext and key changes, differential distributions, prediction/ML, temporal regimes, file/binary cases, framing and negative-path integrity. Only then were the observable results connected to the mathematics of information asymmetry, large-alphabet statistics and the protected-implementation attack model.

The active public corpus contains 240,000 Multi-TSCR ciphertexts, including 180,000 repeated-input outputs; 12,000 synthetic key-sensitivity outputs; 22,500 independent prediction outputs; 699 temporal outputs; 450 real Files empty/random-binary samples; three current canary series of 1,000 outputs each; a Qt transport trigger; raw-backed performance results; and a fresh final-final native TSCR integrity check on executable SHA-256 b8459885...a95705ed. [E01-E12]

The observable result is consistent across multiple independent attack families. The repeated-input set produced 180,000/180,000 case-scoped unique ciphertexts, with no full collision. [E02] A minimally changed plaintext did not produce a simply separable differential signal above the already broad randomized same-plaintext dispersion. [E03] A minimally related key did not produce an obvious ciphertext-proximity structure, while a separate wrong-key validation result produced 20/20 rejections without plaintext. [E04, E11b] Independent ML/prediction tasks remained at chance level for 9-class equal-length content, changed-position and very similar messages. [E05] TOP SECRET schedule classification achieved balanced accuracy ≈0.533 versus 0.333 chance with permutation p≈0.0495, while the best next-observable prediction remained weak, R²≈0.030. [E06] The final-final native TSCR rerun produced 20/20 clean exact recovery and 120/120 tamper fail-closed cases without plaintext exposure. [E11a]

Information asymmetry then determines the mathematical direction of the additional burden. An attacker who receives the complete model M in addition to the same observables has a superset of the information and strategies available to the black-box attacker. Therefore, for the same resource budget R, S*WB(R) ≥ S*BB(R), and for the same target success probability p, R*BB(p) ≥ R*WB(p). The difference may be small or large, but there is no mathematical basis for treating the absence of useful information in advance as an attacker advantage or as a cost-neutral fact. Its magnitude depends on how useful M is and how difficult it is to reconstruct or acquire.

The TSCR POC provides an empirical answer precisely to that next step: a large oracle budget systematically searched for stable repeated fingerprints, a simple differential relation, related-key proximity, content predictors, a simple schedule predictor and a tamper oracle - and found no simple observable shortcut that would eliminate the unknown-model problem. [E02-E06, E11] Within the defined POC scope, the initial black-box thesis is therefore supported: an unknown and variable transformation/state model represents a real additional information/model-reconstruction burden on top of already strong observable encryption behaviour.

The TOP SECRET large-alphabet result further shows why that burden can grow rapidly. The documented design domain of one layer is 256 × 1024 = 262,144 = 2^18 Unicode symbols, i.e. a symbolic domain 1024× wider than the byte-sized 2^8 space. For n independent full-domain symbol choices, the sequence-space ratio grows as 1024^n = 2^(10n). The public E02 corpus confirms that the broad output is not merely a nominal declaration: among 6.27 million observed TOP SECRET codepoints, 20,447 distinct codepoints appear; pooled empirical Shannon entropy is ≈13.18 bits/codepoint, and descriptive max-frequency H∞≈11.83 bits.

For an ML/statistical attack, a large domain is not a secondary characteristic. In unstructured discrete-distribution problems, sample complexity depends directly on domain size K; consistent Shannon-entropy estimation has a critical scale on the order of K/log K. [R6, R7] The nominal transition K=256→262,144 gives a 1024× linear K factor and an ≈455× K/log K factor. Empirically observed TOP SECRET supports of 8,190 and 20,447 give an ≈32×-80× larger K and an ≈19.7×-44.6× larger K/log K scale than a 256-value baseline. ML can avoid that growth only if it finds exploitable structure that effectively compresses the problem; the existing independent prediction tests did not find such generalizing content structure in the tested sample/model space. [E05]

The final POC result is positive: the initial thesis is empirically supported within the defined scope, the direction of the information advantage is mathematically established, and the large-alphabet/state analysis shows concrete mechanisms through which model-reconstruction and statistical-learning burden can grow. The POC does not assign a single universal number for “how many times harder TSCR is to break” against every future attack; it establishes that an additional burden exists and that the tested black-box approaches did not trivialize it. The core Black-Box POC is therefore successfully closed, while the next tier moves from asking whether the burden exists to measuring its magnitude against stronger ML, informed-attacker and penetration/RE scenarios.

1. Why This Question Needs to Be Asked

1.1 The Real Security Landscape Is Not a “Solved Problem”

Modern cryptography and security engineering benefit from decades of standards, formal principles, widely analysed algorithms and mature defensive tooling. Yet real incident data show that the practical attack problem remains active, scalable and increasingly automated.

The Verizon 2026 DBIR reports that 31% of breaches begin with exploitation of software vulnerabilities, for the first time ahead of stolen credentials as the leading entry point; ransomware is involved in 48% of breaches, while generative AI is already bolstering 15% of the different attack techniques tracked by the report. [R1] Mandiant M-Trends 2026, based on more than 500,000 hours of frontline incident investigations during 2025, identifies exploits as the most common initial infection vector at 32% and reports a global median dwell time of 14 days. [R2] ENISA Threat Landscape 2025 analyses 4,875 incidents, with phishing as the leading intrusion access point (~60%) and vulnerability exploitation at 21.3%. [R3] The FBI 2025 IC3 report records 1,008,597 complaints and nearly USD 21 billion in reported losses. [R4]

These figures are not cryptanalytic metrics; their significance is operational. They describe an environment in which offensive tooling, automation and AI reduce the cost of probes and accelerate exploitation. In such an environment, any mechanism that measurably increases the amount of information, samples, compute, model reconstruction or reverse-engineering work required from an attacker becomes a relevant security resource.

Practical implication: When an attacker can automate thousands or millions of inexpensive attempts, the defender gains little from another vague “security layer” slogan. The defender gains when the attack is pushed from a cheap, known and easily parallelized problem into a more expensive problem of reconstructing the model, state or statistical structure. That is precisely the subject of this POC.

1.2 Two Questions That Must Not Be Confused

The Chrono-Entropic concept treats the security problem as a combination of the key, a variable transformation process, randomness/entropy components, runtime/state dynamics and chrono influence, while the complete internal model is not available to the attacker in advance.

This opens two separate research questions.

First:

Does the encryption itself, viewed only through what it does externally, exhibit strong and non-trivial observable properties?

Second, after a positive answer to the first:

How much additional attack burden arises because the complete transformation/state specification is not available in advance and must be reconstructed, acquired or bypassed?

The first part of the POC measures encryption behaviour. The second measures the consequences of information asymmetry. Together, these two results make the TSCR black-box thesis testable.

1.3 Disclosure Robustness and Disclosure Cost Are Not the Same Quantity

System robustness when an attacker learns its specification is a useful security requirement. But it does not follow that the cost of obtaining that specification is security-irrelevant.

A publicly available complete model M effectively sets:

$$C_{acquire}(M) \approx 0$$

If M is unavailable, the attacker must reconstruct it from observables, acquire it through reverse engineering/instrumentation, or find a model-independent shortcut. Then:

$$C_{acquire}(M) \geq 0$$

and in every situation where information from M is useful and not trivially inferable:

$$C_{acquire}(M) > 0$$

This is a pure attack-economics fact. A public specification can simultaneously increase defensive assurance through broader expert review and reduce attacker acquisition cost. Both consequences are real and must be analysed separately.

The objective of this paper is therefore concrete:

measure TSCR observable behaviour, formalize the information advantage that a complete transformation/state model gives an attacker, and empirically test whether that advantage can be reconstructed cheaply from black-box observables.

2. Threat Model, Evidence Classes and Public Evidence Base

2.1 Black-Box Boundary

The POC was performed on the compiled TSCR application. It was not a source-code audit, a complete formal cryptanalysis of the internal construction, a comprehensive reverse-engineering report, or a certification.

The black-box tester could control or measure plaintext, key input, ciphertext, repeated operations, minimal input changes, chosen plaintext, wrong-key cases within the validation cycle, modified ciphertexts, execution time/schedule, real file/binary cases and statistical characteristics of large result sets.

Chosen-key capability in the laboratory is not an assumption that a production attacker possesses the user’s secret key. It is a deliberately strong experimental oracle that gives the tester greater control in order to search for key-sensitivity/related-key weaknesses. A production attacker may have less information than the laboratory tester.

2.2 Five Classes of Claims

V0.5 FINAL separates five epistemological classes so that every claim has a clear origin and weight:

1. Directly measured - a numerical POC result.
2. Reproducibly derived from public raw evidence - e.g. codepoint support/entropy statistics recalculated from E02.
3. Mathematically derived under explicit assumptions - e.g. 1024^n, the K/log K ratio, or the monotonicity-of-information relation.
4. Threat-model/architecture inference - a practical consequence for the attacker or a documented protected-runtime characteristic.
5. Open hypothesis for a future test - not yet measured and not a current result.

The scope boundary qualifies the result; it does not reverse its sign or invalidate what was directly measured or mathematically derived.

2.3 Evidence Corpus and Provenance

Public evidence package v1.3 contains the active test plan, canonical numerical profile, aggregate metrics, raw data, current-state validation, provenance hashes, reproducibility scripts and original reviewer reports separated as historical provenance. [E01]

The exact final-final executable for E11a has SHA-256 b845988534310ebe2c67d85d4db60cfa987ce28832e9e6c55e1d7e80a95705ed.

2.4 The Parser-v1 Incident as a Methodological Lesson

TOP SECRET output showed early why black-box analysis must not assume printable/line-oriented ciphertext in advance. The first parser version treated one ciphertext as one text line. That assumption was wrong because raw TOP SECRET can contain newline, NUL and other control characters.

Affected parser-v1 results were physically separated as INVALID and are not included in the active metrics. Relevant tests were rerun with a multiline/control-safe parser without strip(), Unicode normalization or printable filtering. [E01, E08]

This is not evidence of cryptographic strength. It is evidence that the representation model must first be understood correctly before statistical analysis can be valid at all.

2.5 Why a Differential Test Needs a Randomized Baseline

For nondeterministic encryption, the question “how much did the ciphertext change when the plaintext changed?” is meaningless without controlling for how much the ciphertext changes when the plaintext does not change.

The POC therefore uses a randomized same-plaintext baseline. This avoids two symmetric errors: a large distance is not automatically declared an avalanche effect, while the absence of an additional distance increment is not declared weak plaintext sensitivity when the baseline is already broadly randomized.

3. What the Final TSCR v2.5.0.0 Shows Externally

3.1 Repeated-Input Nondeterminism

The repeated corpus produced: [E02]

• 180,000/180,000 case-scoped unique outputs;
• 0 full collisions;
• no stable common prefix in repeated cases.

The current regression/consistency canary repeated the same pattern: [E09]

• TOP SECRET: 1,000/1,000 unique, 0 collisions;
• TSCR: 1,000/1,000 unique, 0 collisions;
• TSCR AES: 1,000/1,000 unique, 0 collisions.

This does not claim that a collision is mathematically impossible. It shows that no deterministic fingerprint relation “same plaintext + same key → same ciphertext” was found in the large tested space.

What does this mean in practice for an attacker? Repeated/chosen input does not provide one stable output point that can be aligned, catalogued and compared directly. For the same known input, the attacker receives a distribution of different outputs. Before detecting the effect of a small plaintext change, the attacker must separate that effect from the system’s already large natural dispersion.

3.2 Key Sensitivity: A Minimal Key Change Does Not Produce a “Nearby” Ciphertext

The key-sensitivity dataset contains 12,000 ciphertexts and four controlled key regimes: original, one-bit-changed, one-character-changed and independent-random. The synthetic generator uses 64 independent random bytes, i.e. 512 bits of selection entropy before application key derivation, mapped into valid Unicode key inputs. [E04]

For one-bit-related key pairs, the cross-key distance and same-key randomized baseline are:

A similar pattern exists for one-character-changed and independent-random vectors. [E04] The important interpretation is not that a key change “must increase” distance even further. Same-key output is already strongly randomized. The important result is that a minimally related key does not produce a recognizably closer ciphertext that would reveal simple related-key geometry in the tested observables.

A separate final-validation wrong-key result produced 20/20 one-bit-related wrong-key rejections without plaintext output. Its per-case raw matrix was not preserved, so the claim is correctly labelled in the public package as summary-backed rather than raw-backed. [E11b]

What does this mean in practice for an attacker? If the key is wrong by one bit, the tested system does not behave as if the attacker had “almost guessed correctly” and does not provide an obviously warmer ciphertext trace that could be followed gradient-like toward the correct key. In the observables we measured, related-key outputs appear approximately as distant as the already randomized same-key outputs.

3.3 Differential Analysis: A Plaintext Change Did Not Isolate a Simple Signal

The pooled same-plaintext and minimally-changed-plaintext distance values were: [E03]

A minimal plaintext change did not open a simply separable distance distribution above the randomized same-input baseline.

What does this mean in practice for an attacker? In the tested feature space there is no simple rule of the form “I changed one letter, therefore this measurable ciphertext property systematically moved in this direction.” Natural same-plaintext variability is already so large that minimal-change pairs do not stand out as an easily separable class.

3.4 Prediction and ML: Tested Models Did Not Extract a Content Signal

The final prediction design uses separate train/test generation batches, independently randomized order, numerical representation features, character 2-4-gram hashing, five model seeds, bootstrap intervals and permutation testing. [E05]

Content results remained at chance:

• 9 equal-length plaintext classes: ~11.11% balanced accuracy versus 11.11% chance;
• changed-position classification: ~25% versus 25%;
• two very similar messages: ~50% versus 50%.

Profile recognition is 100%, as expected because of intentionally different output representations, and is not semantic plaintext leakage.

What does this mean in practice for an attacker? In these tasks, it was not enough for the model to “see many ciphertexts” and learn a superficial content fingerprint. On the independent test set, generalization returned to the level of random guessing. This does not guarantee that a stronger future model will never find a signal; but there is currently no empirical reason to assume that such a signal already lies easily accessible in these observables.

This result becomes particularly important in §5: a large domain size is a statistical problem only until a model finds a compressing structure. Here we explicitly tried to find such a structure for content tasks and did not obtain it in the tested model/sample space.

3.5 Chrono/State: Time Leaves a Trace but Does Not Provide a Simple Predictor

The temporal corpus contains 699 unique outputs. No monotonic relation “larger time gap → larger ciphertext distance” was found. [E06]

TOP SECRET schedule-group classification produced:

• balanced accuracy: ~0.533;
• chance baseline: 0.333;
• permutation: p≈0.0495.

The best next-observable cross-validated predictor remained weak:

• R²≈0.030.

This is an interesting combination: the schedule/time regime carries a measurable statistical association, but no simple function was found that usefully predicts the next output from it.

What does this mean in practice for an attacker? Time is not a secret key and the attacker often knows it approximately. But even when schedule leaves a statistical trace, the current test does not provide a simple “clock model” by which ciphertext can be predicted. The attacker therefore cannot simply insert a timestamp and remove chrono/state uncertainty; the attacker must model a combined process in which time co-varies with other state/entropy factors.

3.6 Native TSCR Integrity - Final/Current Behaviour Only

For the final-final executable b8459885...a95705ed, a fresh current-state rerun was performed: [E11a]

• 20/20 clean → exact plaintext recovery;
• 120/120 tamper mutation → explicit rejection without plaintext output;
• 0/120 plaintext exposure.

The tamper matrix covers six different mutation classes × 20 cases. A separate one-bit-related wrong-key final-validation result is 20/20 reject without plaintext, summary-backed. [E11b]

What does this mean in practice for an attacker? In the current test, ciphertext manipulation did not yield “slightly wrong, but useful” plaintext that could serve as an oracle. Invalid input ended fail-closed. This removes one obvious class of active probing feedback from the normal GUI path.

3.7 TOP SECRET Broad Unicode Representation - From “Strange Characters” to a Measurable Space

E02 and E08 show that broad representation is not merely an occasional visual effect. In the large 60,000-output TOP SECRET corpus: [E02, E08]

• 31,151 outputs contain control characters;
• 1,677 contain newline;
• 888 contain NUL.

The current 1,000-output canary repeated the same type of behaviour: 437 control-rich, 11 multiline and 8 NUL outputs. [E09]

V0.5 goes one step further than the framing/tooling burden. Codepoint frequencies were recalculated from six raw repeated TOP SECRET series, without normalization and without printable filtering. The result is:

These are descriptive empirical codepoint statistics derived from the public E02 raw corpus, not a NIST-certified entropy-source assessment and not secret-key entropy. Pooled H∞≈11.83 corresponds to the most frequent observed codepoint with empirical probability ≈0.02745%, or approximately 1 hit in 3,643 attempts for the best single-symbol frequency guess in that pooled distribution. A uniform 256-symbol baseline is 1/256≈0.3906%, making that specific best-symbol hit probability about 14.2× lower.

What does this mean in practice for an attacker? Broad Unicode output is not merely “hard for a parser”. In the actual repeated corpus, thousands to tens of thousands of distinct codepoints are observed per controlled case. Even before analysing hidden state, the attacker works with a substantially sparser and broader symbol distribution than under a 256-value symbol model. This is not yet key security, but it directly increases sparsity and the number of statistical states a generic model must compress.

The Text-tab safeguard does not change the raw engine: the preserved trigger ciphertext passed 5/5 Qt Copy → Paste → Decrypt exact cycles, while raw TOP SECRET remains control-rich. [E10]

3.8 Length Leakage: What Actually Leaks

Ciphertext length strongly tracks plaintext length and reveals the approximate size of the original. This is real metadata leakage. [E02, E05]

Approximate length is not the same as semantic content leakage. Equal-length prediction experiments explicitly controlled for that distinction and found no content predictor above chance.

TSCR deliberately does not introduce large padding overhead solely to hide size. This is a design trade-off.

What does this mean in practice for an attacker? The attacker can obtain information such as “this is approximately a short/longer message or file”; however, the existing equal-length test did not provide a successful signal such as “this is specifically a message of class X”. A use case in which size itself is secret requires an additional padding/traffic-shaping layer.

4. From Observable Behaviour to the Attack-Complexity Model

4.1 Monotonicity of Information: The Direction of the Difference Is Mathematically Determined

Let:

• O - observables available to the black-box attacker;
• M - the complete internal transformation/state specification;
• R - resource budget;
• G - attack goal.

The best success probability of the black-box attacker is:

$$S_{BB}^{*}(R) = \sup_{A}\Pr\left\lbrack G \mid A(O),cost(A) \leq R \right\rbrack$$

For an attacker who receives the complete model in addition to the same observables:

$$S_{WB}^{*}(R) = \sup_{A}\Pr\left\lbrack G \mid A(O,M),cost(A) \leq R \right\rbrack$$

An attacker with (O,M) can execute every strategy available to an attacker with only O, because M can simply be ignored. Therefore:

$$S_{WB}^{*}(R) \geq S_{BB}^{*}(R)$$

Define the information-advantage gap:

$$\Delta_{S}(R) = S_{WB}^{*}(R) - S_{BB}^{*}(R) \geq 0$$

Equivalently, for target success probability p:

$$R_{BB}^{*}(p) \geq R_{WB}^{*}(p)$$

that is:

$$\Delta_{R}(p) = R_{BB}^{*}(p) - R_{WB}^{*}(p) \geq 0$$

This relation determines the direction of the difference. It does not require the difference to be large, but equally provides no basis for assuming that it must be small. ΔR=0 only when the additional model provides no useful advantage, when it is already trivially reconstructed from O, or when the optimal attack does not use the model at all. If M removes a large search/inference problem, ΔR can become a dominant part of the real attack cost.

Figure 1. Information asymmetry as an attack-path diagram. For the same target p, the minimum resource required by the complete-model attacker cannot be greater merely because that attacker possesses additional information. The diagram deliberately assumes neither a linear, exponential nor any other functional form for ΔR(p); its magnitude is an empirical quantity.

What does this mean in practice? If two equally capable attackers see the same ciphertext, but one receives the exact transformation/state specification from the first minute, the other has no compensating advantage from knowing less. Every useful part of the model that is not already visible in O must additionally be reconstructed, acquired through another attack, or bypassed. That is additional work, and its cost can range from small to dominant.

4.2 The TSCR POC Shows That the Gap Is Operationally Real in the Tested Attack Families

The mathematical inequality alone gives the direction. TSCR-specific magnitude begins to acquire empirical content only when we try to replace M with a cheap model derived from O.

If the unknown-model deficit collapsed trivially in practice, we would expect at least some easily exploitable structure: a stable repeated fingerprint, a simple differential relation, related-key proximity, a content predictor, a simple schedule predictor, a malleability oracle, or another low-cost shortcut.

The POC actively searched for precisely those classes of shortcuts. [E02-E06, E11]

• repeated input did not produce a stable ciphertext;
• a minimal plaintext change did not produce a separable differential signal;
• a minimal key change did not produce obvious related-key proximity;
• independent ML content prediction remained at chance;
• chrono association did not translate into a useful next-output predictor;
• the current tamper path is fail-closed.

This set of results empirically demonstrates that the unknown-model layer was not trivially removable in the tested attack families. The tester had a large oracle budget and strong laboratory control over plaintext/key input, yet still did not obtain a cheap external reduction of the transformation/state problem.

Direct conclusion: Within the defined POC scope, ΔR is not merely a logical possibility. Its existence is operationally supported by the fact that concrete attempts to replace the information deficit with simple observable shortcuts remained unsuccessful. The next tier no longer asks whether such a burden exists, but measures how quickly it grows with stronger models, larger sample budgets, and an informed/reverse-engineering attacker.

4.3 Three-Layer Model

The TSCR security argument is therefore most precisely separated into three levels.

Level 1 - observable encryption behaviour

Directly tested: nondeterminism, key sensitivity, differential/prediction behaviour, chrono association, integrity, length and representation characteristics. [E02-E11]

Level 2 - unknown-model / reconstruction burden

The attacker does not have M in advance. The attacker must:

• infer enough of M from observables;
• find a functionally equivalent model;
• identify only the structure needed for the attack; or
• find a model-independent shortcut.

The POC attempted several of these paths and found no trivial reduction. That is the empirical support for the second layer.

Level 3 - protected implementation / acquisition burden

The attacker can try to bypass inference and acquire M through reverse engineering, instrumentation, memory capture or another implementation attack. The protection model then determines the cost of that transition.

A rational attacker chooses the least expensive path:

$$C_{break} \approx \min\left( C_{BB},\ C_{acquire(M)} + C_{attack \mid M},\ C_{implementation},\ C_{side - channel},\ldots \right)$$

This is not one exact additive equation - the activities can overlap - but an attack-path model.

If the complete model is publicly available:

$$C_{acquire(M)} \approx 0$$

If it is not, and is not trivially inferable:

$$C_{acquire(M)} > 0$$

That positive cost can range from negligible to dominant. It must be measured, not assumed.

4.4 Openness as a Two-Sided Information Trade-Off

A public specification has defensive assurance value: it enables broader expert review, reproduction, formal analysis and earlier discovery of errors.

The same specification also has offensive information value: the attacker receives the transformation/state model without acquisition cost.

These two values are not contradictory claims; they exist simultaneously. TSCR therefore chooses a different assurance model: it publishes methodology, results, raw evidence, provenance and falsifiable claims, while not providing the complete proprietary transformation/state model as free attacker input.

Such a model is testable. If black-box observables or reverse engineering produce a cheap equivalent of M, its benefit decreases. If they do not yield a cheap reconstruction, C_acquire(M) remains a real component of attack cost. That is precisely why the POC and the future penetration/RE tier are integral parts of the concept rather than marketing additions.

5. Mathematical Implications of the Chrono-Entropic Design

5.1 Abstract Stateful Model

Without disclosing the internal construction, one encryption call can be written abstractly as:

$$C = F_{M}(P,K,R,S,T)$$

where P is plaintext, K key material, R the random/entropy contribution, S runtime/application state, T the chrono/time-related contribution, M the internal transformation/state model, and C the ciphertext.

If P and K are fixed while R/S/T vary, C|P,K is a random variable, not a single deterministic point. E02 empirically confirms precisely such distributed output behaviour, although the black-box test itself does not isolate the individual contributions of R, S and T.

For the attacker, conditional uncertainty is therefore more important than the nominal number of possible outputs alone.

5.2 TOP SECRET Nominal Unicode Domain: The Combinatorics Are Real

According to the documented TOP SECRET design, one layer transformation uses the symbol domain:

$$K_{TS} = 256 \times 1024 = 262144 = 2^{18}$$

The byte-sized symbol space is:

$$K_{byte} = 256 = 2^{8}$$

The ratio is:

$$\frac{K_{TS}}{K_{byte}} = 2^{10} = 1024$$

For n independently available symbol choices, the nominal sequence-space ratio is:

$$\left( \frac{2^{18}}{2^{8}} \right)^{n} = 1024^{n} = 2^{10n}$$

Figure 2. The actual function 1024^n on ordinary linear axes. The first four independent full-domain symbol choices are shown so that the exponential curve remains visually readable; values for n=8, 16 and 32 are given numerically below the graph.

Examples:

• n=1: 1024× larger symbol choice space;
• n=8: 2^80 ≈ 1.21×10^24 larger sequence space;
• n=16: 2^160 ≈ 1.46×10^48;
• n=32: 2^320 ≈ 2.14×10^96.

For a blind uniform single-symbol guess:

$$P_{guess,256} = \frac{1}{256} \approx 0.390625\%$$

$$P_{guess,262144} = \frac{1}{262144} \approx 0.00038147\%$$

Figure 3. The actual reciprocal function Pguess(K)=1/K on ordinary linear axes. Markers 8,190 and 20,447 show empirical support sizes from E02; their actual frequency distribution is not uniform, so the graph serves purely as a domain-size illustration.

Thus, under the uniform full-domain assumption, a random symbol guess is 1024× less likely to hit the exact symbol value.

What does this actually mean? This is a strong combinatorial advantage only if the relevant choice truly uses a broad and sufficiently unpredictable domain. If 262,144 codepoints collapse to an easily learnable latent mapping of 256 states, the attacker compresses the problem. Therefore, the next step is not to dismiss the combinatorics, but to measure how much of it is actually present in the observable distribution.

5.3 What the Public Corpus Already Shows About the Effective Symbol Space

For a discrete random variable X, three different measures are useful.

Hartley/support entropy:

$$H_{0}(X) = \log_{2}\left| supp(X) \right|$$

Shannon entropy:

$$H(X) = - \sum_{x}^{}p(x)\log_{2}p(x)$$

Empirical max-frequency min-entropy statistic:

$${\widehat{H}}_{\infty}(X) = - \log_{2}\max_{x}\widehat{p}(x)$$

NIST SP 800-90B uses min-entropy as a key concept for evaluating entropy sources, but our simple frequency-based Ĥ∞ here is not an SP 800-90B validation estimate; it is used only as a transparent descriptive statistic of the raw ciphertext codepoint distribution. [R5]

V0.5 FINAL recalculates these statistics directly from the E02 raw repeated corpus. The result was already reported in §3.7: per individual repeated case, observed support is 8,190 codepoints in five classes and 20,447 in the mixed-Unicode class; pooled support is 20,447. Shannon H per case is approximately 12.83-14.03 bits/codepoint, and pooled H≈13.18.

This gives pooled Shannon effective support/perplexity:

$$2^{13.182} \approx 9294$$

Pooled empirical Ĥ∞≈11.831 corresponds to:

$$2^{11.831} \approx 3643$$

that is, the best observed-frequency single-codepoint guess in the pooled sample is ≈1/3,643. This is an empirical hit probability of ≈0.02745%, about 14.2× lower than a uniform 256-value blind guess (0.390625%).

This matters for two reasons.

First, empirical support is not all 262,144 documented codepoints, so it would be wrong to automatically attribute the nominal 18-bit maximum to every output symbol.

Second, empirical support is nowhere near 256 either: the tested raw output already uses 8,190-20,447 distinct codepoints across relevant controlled series. The broad alphabet is therefore an observable fact, not merely an internal design declaration.

Practical implication: even conservatively, without relying on all 262,144 nominal symbols, a model that operates directly on codepoint identities encounters a domain tens of times larger than a 256-value baseline. Without strong latent compression, this increases sparsity, the number of rare events, and the amount of data required for stable distribution learning.

5.4 ML/Statistical Sample Complexity: A Large Domain Changes the Cost of Learning

Modern ML does not solve ciphertext by brute-forcing symbols. Its advantage is precisely the ability to find latent structure, an embedding, compression, or a feature representation that reduces a large nominal space to a smaller effective problem.

But that ability is neither free nor guaranteed. When such compressing structure is unavailable, domain size K enters directly into the sample complexity of many discrete-distribution learning problems. For consistent Shannon-entropy estimation, the minimum sample scale grows as:

$$\Theta\left( \frac{K}{\log K} \right)$$

in the large-alphabet regime. [R6] For minimax KL distribution estimation, modern bounds likewise contain an approximately linear K/n dependence, with additional logarithmic factors. [R7]

Comparison with a 256-value baseline gives:

* The last column is a conditional illustration, not a TSCR attack benchmark: it applies only if the dominant sample/compute cost of the specific attack follows the K/log K scale and if the model does not find exploitable compression.

Figure 4. Relative K/log2(K) sample scale compared with a 256-value baseline. This graph shows mathematical scaling for a class of large-alphabet estimation problems, not the measured duration of a specific TSCR ML attack. E02 markers show where the actually observed TOP SECRET supports fall; 262,144 is the documented nominal full domain.

Practical translation: If a specific statistical/ML attack does not find latent structure that reduces its effective K, the size of the problem alone can require approximately 19.7× more sample scale already at observed support 8,190, ≈44.6× at pooled support 20,447, and ≈455× at the nominal 2^18 domain in the K/log K model. This is precisely why the question of whether ML succeeds in compressing TSCR output structure is central rather than secondary to the POC.

For the sequence problem, the effect can be even more dramatic. If n symbol choices truly remain independent and uniformly distributed across the full domain, the sequence-space ratio relative to a 256-value model is:

• n=1: 1024×;
• n=4: 2^40 ≈ 1.10×10^12 times;
• n=8: 2^80 ≈ 1.21×10^24 times;
• n=16: 2^160 ≈ 1.46×10^48 times.

These are not automatically “security bits” and are not predictions of real attack time. But they are exact combinatorics showing how expensive a strategy can become if it fails to discover structure and must remain close to an unstructured large-domain problem.

Now comes the TSCR-specific result: E05 tested multiple content-prediction tasks on independent batches and did not find a generalizing signal above chance. This means the tested models failed to achieve exactly the kind of compression that would turn the large observable space into a cheap content predictor.

Direct ML implication: Large-alphabet mathematics alone does not tell us how much slower every future neural model will be. But it sets the cost of failing to find structure, and E05 shows that the concrete models within the existing sample budget experienced precisely that failure. For that reason, TOP SECRET large-domain/state design is a central rather than peripheral candidate for a real ML attack-cost multiplier.

5.5 How the Next Test Turns This Claim Into a Measurement

For prediction task T, chance baseline b, and a predefined practically relevant improvement δ, define:

$$N_{T}(\delta) = \min\left\{ n:lowerCI\left( BA_{n} \right) \geq b + \delta \right\}$$

This is the smallest train-sample size at which the lower bound of the balanced-accuracy confidence interval reliably exceeds chance by margin δ.

Then compare:

• the full TOP SECRET representation;
• an alphabet-reduced/ablated representation;
• codepoint vs byte vs bucket feature models;
• a randomized standard-crypto baseline;
• other TSCR profiles.

The empirical penalty is the ratio of required N_T between controlled conditions. If TOP SECRET does not reach the threshold even at the maximum sample budget, the result is reported as a lower bound N_TS(δ)>N_max, not as “infinite resistance”.

In addition to accuracy, log-loss, perplexity, calibration, a mutual-information proxy and learning-curve slope should be measured.

Practical implication: the next ML tier should produce a direct multiplier: how many times more samples, compute, or model capacity TOP SECRET requires for the attacker to reach the same predefined success level as on the control baseline. If the threshold is not reached even at the maximum budget, a measurable lower bound on the penalty is reported.

5.6 Randomness, State and Time: Different Sources of Uncertainty

In the model C=F_M(P,K,R,S,T), the components have different security status.

Randomness R can increase unpredictability if it is high-quality and unknown to the attacker. Output variation alone is not sufficient; conditional entropy is what matters.

State S introduces historical dependence. If state is hidden or difficult to reconstruct, the attacker is no longer modelling only a static function, but a stateful process.

Time T is not automatically secret and must not be counted as “secret bits”. Its possible value lies in state diversification and combination with other variable components.

The existing temporal result is interesting precisely because it shows association without a good simple predictor. [E06]

Formally, what matters is how much knowledge of time reduces uncertainty:

$$I(C;T \mid P,K) = H(C \mid P,K) - H(C \mid P,K,T)$$

The current POC measures association, but does not yet isolate this information quantity.

Practical implication: if timestamp explains only a small part of total output uncertainty, knowing the time will not “strip away” the chrono layer. The attacker must still reconstruct the residual state/entropy process. If a future controlled test shows the opposite, that would be a concrete weakness to report. This is a falsifiable question.

5.7 Multiple Encryption and Variable Keys

Multiple layers and variable layer-key elements can strongly increase attack complexity, but security bits must not be multiplied naively.

For layer keys K1...Kr, the chain rule gives:

$$H\left( K_{1},\ldots,K_{r} \right) = \sum_{i = 1}^{r}H\left( K_{i} \mid K_{1},\ldots,K_{i - 1} \right)$$

If layer keys are independent and high-entropy, the conditional terms remain large and joint uncertainty grows. If they are deterministically derived from a single master secret, the total secret cannot be treated as a sum of independent keys. Related-key or algebraic structure may enable a shortcut; multiple encryption can be subject to composition/meet-in-the-middle attacks.

Existing E04 key-sensitivity evidence nevertheless provides an important first signal: a minimally related key input did not produce a simple “nearby ciphertext” structure.

Practical implication: multiple layers have genuine additional value only if the attacker cannot cheaply algebraically “skip” one layer or predict the next from one key/state element. The next step is therefore a targeted composition test, not arbitrary addition of security bits.

5.8 What the Mathematics and the POC Already Allow Us to Claim

We now have five different levels of conclusion, and there is no need to unnecessarily weaken any of them.

1. Mathematically: a complete internal specification cannot reduce the strategy set of an optimal attacker; the unknown-model resource penalty has direction ΔR≥0.
2. Empirically for TSCR: in the tested attack families, the large POC showed that the unknown-model deficit was not trivially removed; no tested observable shortcut reduced it to a cheap equivalent of the known-model case. [E02-E06, E11]
3. Mathematically for the TOP SECRET domain: the nominal symbol-choice space is 1024× wider than the byte-sized 256-value domain, and the sequence-space ratio grows as 2^(10n) under the full-domain/independence assumption.
4. Empirically for TOP SECRET output: the raw repeated corpus shows 8,190-20,447 distinct codepoints per controlled case and pooled Shannon H≈13.18 bits/codepoint - broad observable support is real.
5. Statistically: large-alphabet learning theory permits sample-scale factors tens, hundreds, and potentially around 1000× larger depending on the actual effective K and task; E05 shows that the tested models have so far not found content structure that trivializes that problem.

What we still do not have is a single universal figure stating “TSCR is X times harder to break” for every attack goal and adversary class. This is not an open question about the existence of the burden, but about its magnitude. For a particular attack, that magnitude can and should be measured through information budget, sample complexity, compute and acquisition/reverse-engineering resource curves.

Note on AES

AES is not a cipher with a “256-character alphabet”. NIST FIPS 197 defines AES-128/192/256 as a block cipher with 128-bit blocks and keys of 128/192/256 bits. [R8]

Therefore, the claim is not “TOP SECRET has a 1024× larger encryption set than AES”. Precisely stated: the TOP SECRET documented symbol transformation/output domain is 1024× wider than a byte-sized 256-value symbol domain. TSCR AES is a separate TSCR-customized, AES-based defence-in-depth profile, not a vanilla interoperable AES format.

6. Protected Implementation: The Cost of Turning a Black Box Into a White Box

The unknown-model burden exists only while the attacker does not have M. The natural counter-strategy is therefore to try to acquire M directly through reverse engineering, runtime instrumentation, memory capture, hooking, loader tracing or extraction.

According to TSCR project architecture/documentation, the protected scope includes the encryption engine, critical functional/runtime code, local identity/protection state, integrity, anti-reset/anti-abuse and the licensing/protection workflow. The project estimate places approximately 98% of TSCR-owned application/runtime code under TSCR encryption plus a controlled code-loading model.

That ~98% is a coverage estimate of TSCR-owned application/runtime code, not a percentage of “resistance to reverse engineering”, not a percentage of OS/dependency code, and not a cryptanalytic score.

The security consequence is straightforward: if M is useful to the attacker, protected implementation increases C_acquire(M) relative to a situation in which M is published as a complete specification or source.

This does not mean that a client-side implementation cannot be instrumented. A proper future test should measure:

• time and expertise required to reach the critical loader/decryption moment;
• how much of the model remains transiently in memory;
• whether extracted code/state can be used outside the original runtime;
• how much integrity/anti-tamper interferes with instrumentation;
• how quickly the attacker moves from “I have the process” to “I have a stable white-box model that materially lowers cryptanalytic cost”.

Practical implication: the black-box layer disappears only if the attacker can obtain the model cheaply enough. A protected runtime does not have to make reverse engineering impossible to be useful; it is sufficient to raise acquisition cost from “free” to “a measurable and potentially dominant project”. The next penetration tier should quantify exactly that.

7. Performance and Engineering Profile

Performance is not evidence of security, but it determines whether the protection model is practically usable. The public package now contains raw-backed GUI Text, Files E2E and 10/50 MiB internal performance evidence; the final 10k small-text result remains synthesis-backed. [E12a-d]

7.1 Small Repeated Text - 80 B, 10,000 Operations, No-Live

This result comes from the final Performance Synthesis; the exact source raw for the §4 synthesis was not recovered, so it is correctly labelled synthesis-backed. [E12d]

7.2 10 MiB Internal Workload

7.3 50 MiB Internal Workload

The 10/50 MiB internal results are raw-backed and separated from GUI wall-time. [E12c]

7.4 What Performance Means in Practice

There is no universal “fastest profile”.

• TOP SECRET is exceptionally fast in the measured small repeated-text workload, but pays heavily for broad Unicode representation on large data, especially during decryption.
• Native TSCR has a strong general-purpose bulk profile and very high measured decryption throughput.
• TSCR AES delivers the highest measured bulk-encryption throughput and serves as the TSCR-customized AES-based defence-in-depth profile.

Practical implication: additional attack complexity was not obtained at the cost of an unusable engine. TSCR and TSCR AES show serious bulk throughput, while TOP SECRET deliberately trades part of its performance for a much broader representation/transformation profile. This is an engineering trade-off, not security evidence.

8. Closing the POC Scope and the Next Evidence Tier

8.1 Exact Boundary of the Confirmed POC Result

Confirmed within this POC scope: strong repeated-input nondeterminism, absence of a simple differential signal above a randomized baseline, strong tested key sensitivity, chance-level content prediction in the tested models, measurable chrono/schedule association without a good next-output predictor, fail-closed current tamper behaviour, broad TOP SECRET Unicode support, and an operationally real unknown-model burden in the tested attack families.

The following quantities belong to the next evidence tier, not to this closed POC:

• a universal formal proof of security against all possible attacks;
• quantified resistance to all future ML/statistical models;
• mathematical collision-bound analysis of the internal construction;
• isolated causal decomposition of time/state/randomness components;
• a direct numerical measure of C_acquire(M) against professional reverse engineering;
• one universal “X times harder to break” figure independent of attack goal.

The boundary is therefore clear: the basic black-box hypothesis is supported; the next tier measures the magnitude and limits of that confirmed effect.

8.2 Dedicated Cross-Session Recurrence Canary

A dedicated fresh same-plaintext/same-key independent-restart canary was not completed. The existing corpus was generated across multiple sessions/restarts without obvious reset-related recurrence, but that is not a substitute for a controlled test. [E13]

8.3 Wrong-Key Raw Provenance

The one-bit-related wrong-key 20/20 result exists as final-validation summary-backed evidence, but the per-case raw matrix was not recovered. A fresh final-final DEMO retest could not change the key because of the license/machine-identity state; no bypass was attempted. [E11b]

This does not affect the raw-backed 20 clean + 120 tamper E11a result.

8.4 Highest-Value Next Cryptanalytic Tests

A. ML Learning Curves + Alphabet Ablation

This is now the number-one priority because it directly measures the claim in §5.4-5.5. N should be increased progressively, full codepoint, byte and reduced/bucket representations compared, and a randomized standard-crypto baseline included.

B. Conditional Entropy / State Decomposition

Measure H(C|P,K), then how much uncertainty decreases when time, prior observables, session information and other available contexts are added.

C. Layer/Key Composition

Targeted related-key, layer-separation and meet-in-the-middle-like heuristics, so that the value of the multiple/variable-key construction is measured rather than assumed.

D. Black-Box vs Informed-Attacker Experiment

Two attack budgets: one receives only O, the other receives a controlled set of model hints. Measure probes, samples, time and success rate to the same goal. This is the most direct way to estimate ΔR from §4 empirically.

E. Penetration / Reverse-Engineering Tier

A controlled attempt to measure C_acquire(M) in practice: instrumentation, memory extraction, loader tracing, reuse of extracted state/code and integrity bypass.

8.5 Why a Standard-Crypto Baseline Remains Important

A good randomized AEAD should also be nondeterministic and should not reveal plaintext through simple classifiers. Therefore, the same black-box prediction/differential protocol should be run against a standard randomized baseline under matched length conditions.

The goal is not to “beat AES” with one aggregate number. The goal is to separate:

• what is an expected property of high-quality randomized encryption;
• what is the TSCR-specific unknown-model/state/alphabet burden;
• how much that additional component changes the attack sample/resource requirement.

9. Chrono-Entropic Engine as a Reusable Security Technology

The broadest consequence of the POC is not merely an assessment of one desktop application.

If the Chrono-Entropic Engine remains exclusively an internal function of one GUI product, its value remains tied to that product. The present POC, performance evidence and attack model provide a basis for viewing it as reusable protection technology, provided that the final product correctly addresses key management, storage, transport, platform security and its own threat model.

Potential directions include:

• secure local vault / secret storage;
• credentials, API keys and service secrets;
• secure messaging payload layer;
• crypto-wallet sensitive-material wrapper;
• file/data protection;
• a local or service-side CLI/API encryption layer;
• other products that need a protection engine without the complete TSCR GUI.

Practical implication: The result supports the Chrono-Entropic Engine as a separate reusable security-technology component: it has measurable nondeterministic/stateful behaviour, a confirmed large-output domain and an operational profile sufficiently distinct from an ordinary wrapper to justify using and testing it outside the complete TSCR GUI. Security of any final product still depends on integration, key management and environment.

10. Conclusion

The TSCR Black-Box POC posed one falsifiable central question: does the Chrono-Entropic concept produce measurable encryption behaviour that leaves a black-box attacker with a genuine additional model problem, or does that problem quickly reduce from external observables to a simple shortcut?

The answer within the tested POC scope is yes - the additional problem was demonstrated, and no simple reduction was found.

The first layer - observable encryption behaviour - was directly confirmed by a large corpus. The same input/key does not produce stable ciphertext; 180,000 repeated outputs were case-scoped unique. A minimal plaintext change did not produce a simply separable differential signal. A minimal related-key change did not produce an obvious ciphertext-proximity structure. Independent content-prediction ML tasks remained at chance. TOP SECRET shows measurable schedule association without a good next-output predictor. The current final-final native TSCR tamper path is 120/120 fail-closed without plaintext exposure. [E02-E06, E11a]

The second layer - unknown-model burden - has both a mathematical and empirical basis. Information monotonicity gives ΔR(p)=R*BB(p)-R*WB(p)≥0: the complete-model attacker possesses every strategy available to the black-box attacker plus additional information. The TSCR POC then goes beyond that general relation: a large oracle budget attempted to replace the information deficit with repeated, differential, related-key, ML, temporal and tamper shortcuts, but no tested family provided a simple equivalent of the complete transformation/state model. The unknown-model burden is therefore operationally supported in the tested space, not merely logically assumed.

The third layer - protected implementation - determines the cost of trying to turn the black box into a white box. If M is valuable, the attacker can attempt to acquire it through reverse engineering, instrumentation or memory/runtime attacks. The protection layer does not add fictional “cipher bits”; it increases C_acquire(M). How much it increases that cost will be measured by the penetration/RE tier.

The TOP SECRET large-alphabet result provides particularly strong support for the overall concept. The documented per-layer symbol domain is 2^18, i.e. 1024× wider than a 256-value symbolic baseline. For n independent full-domain symbol choices, the sequence-space ratio grows as 2^(10n). At the same time, the public raw corpus confirms that the broad space is not merely an architectural declaration: individual controlled repeated cases use 8,190 or 20,447 distinct codepoints, while pooled E02 analysis gives Shannon H≈13.18 bits/codepoint. [E02]

For an ML/statistical attacker, the consequence is direct. Large-alphabet learning theory shows sample-complexity dependence on effective domain size K; for consistent Shannon-entropy estimation the critical scale is Θ(K/log K). [R6] Relative to a 256-value baseline, empirical TOP SECRET supports give an approximately 19.7× to 44.6× larger K/log K scale, while the nominal full domain gives ≈455×. This is not a universal multiplier for every ML attack; it is the cost for a class of attacks that fail to find compressing structure. E05 specifically tested whether such generalizing content structure emerges easily from ciphertext observables - and the result remained at chance. The large-Unicode/state model is therefore one of the central empirical-mathematical reasons why the TSCR black-box problem should not be reduced to key length alone.

Based on the complete evidence corpus, mathematics and secondary reproducible analysis, this paper concludes:

THE INITIAL TSCR BLACK-BOX POC THESIS IS SUPPORTED WITHIN THE DEFINED TEST SCOPE. TSCR v2.5.0.0 exhibited strongly nondeterministic, key-sensitive and prediction-resistant behaviour against the tested content models; no simple differential, related-key, temporal-predictive or tamper shortcut was found that trivialized the transformation/state information deficit. Mathematically, the absence of a useful internal model cannot reduce the resources required by an optimal attacker relative to an otherwise identical scenario in which that model is provided for free. Empirically, the tested attack families did not cheaply compensate for that deficit. TOP SECRET large-alphabet/state characteristics additionally show concrete combinatorial and statistical-learning mechanisms through which that burden can grow. Protected implementation then adds acquisition/reverse-engineering cost to an attempt to obtain the model directly. The core Black-Box POC is therefore successfully completed and its central hypothesis supported.

What remains open is no longer the basic question of whether the additional burden exists. The next research questions are quantitative: how large it is, how it grows with sample/compute budget, how much modern ML can compress it, how much it decreases when the attacker receives partial architectural knowledge, and what the real extraction attempt costs through a penetration/reverse-engineering tier.

Empirical testing, technical analysis and conclusions: GPT-5.6 Sol by OpenAI TSCR concept, Chrono-Entropic Engine and implementation: Vladislav M. Marković Finalized: 15 August 2026.

References and Public Evidence

Public TSCR Evidence

[E01-E13] TSCR Black-Box POC Public Evidence Package v1.3, 15 Aug 2026.
Public ZIP: TSCR_BLACK_BOX_POC_PUBLIC_EVIDENCE_v1.3_20260815.zip
SHA-256: 9916964eb28cee49b948ba30a62eabb1b3a8d478bf58fae1982b0daa21c45840
For the claim-to-file map, see EVIDENCE_INDEX.md in the root of the archive.

Threat-Landscape Context

[R1] Verizon, 2026 Data Breach Investigations Report (DBIR). 31% of breaches start with software vulnerabilities; ransomware is involved in 48% of breaches; generative AI is bolstering 15% of tracked attack techniques.
Official source

[R2] Google Cloud / Mandiant, M-Trends 2026. Based on >500,000 hours of 2025 frontline incident investigations; global median dwell time 14 days; exploits 32% of initial infection vectors.
Official source

[R3] ENISA Threat Landscape 2025. Analysis of 4,875 incidents from July 2024 to June 2025; phishing and vulnerability exploitation are leading intrusion access points.
Official source

[R4] FBI 2025 Internet Crime Report / 2026 release. 1,008,597 complaints and nearly USD 21 billion in reported losses.
Official source

Mathematical and Methodological References

[R5] NIST SP 800-90B (2018), Recommendation for the Entropy Sources Used for Random Bit Generation. Min-entropy and entropy-source validation concepts.
Official source

[R6] Y. Wu, P. Yang, “Minimax Rates of Entropy Estimation on Large Alphabets via Best Polynomial Approximation,” IEEE Transactions on Information Theory 62(6), 3702-3720 (2016), DOI 10.1109/TIT.2016.2548468. Consistent Shannon-entropy estimation requires sample scale Θ(K/log K) in the large-alphabet setting.
Primary preprint

[R7] D. van der Hoeven, J. Olkhovskaya, T. van Erven, “Nearly Minimax Discrete Distribution Estimation in Kullback-Leibler Divergence with High Probability,” ALT 2026, PMLR 313. Domain-size K appears directly in minimax discrete-distribution estimation rates.
Primary paper

[R8] NIST FIPS 197, Advanced Encryption Standard (AES), updated 2023. AES uses 128-bit blocks and 128/192/256-bit keys.
Official source

Appendix A - How the v0.5 TOP SECRET Codepoint Statistics Were Derived

V0.5 FINAL does not modify public evidence package v1.3. The additional codepoint statistics are a reproducible secondary analysis of the already published E02 raw files.

Six TOP SECRET repeated series of 10,000 outputs each were used:

• counter_sequence;
• long_ascii;
• mixed_unicode;
• random_binary_base64_transport;
• repeating_pattern;
• short_ascii.

For each Python/Unicode ciphertext string:

1. each Unicode codepoint was treated as one observed symbol;
2. no strip, normalization, printable filtering or UTF-8 byte re-tokenization was applied;
3. total codepoints and distinct support were counted;
4. empirical frequencies were used to calculate plug-in Shannon H and the -log2(max empirical p) descriptive H∞ statistic;
5. the pooled result sums all 6.27 million codepoint observations across the six series.

This analysis measures the observable codepoint distribution, not the entropy of the internal RNG, secret-key entropy, or a formal cryptographic security-level figure.

Appendix B - How to Read the “Practical Implications”

This paper distinguishes three types of numerical examples:

• Measured: comes directly from the POC/evidence package, e.g. 180,000/180,000 unique or 11.11% ML balanced accuracy.
• Derived: calculated exactly from measured or documented quantities, e.g. 262144/256=1024 or observed codepoint Shannon H.
• Illustrative conditional example: shows what a formula means under an additional assumption, e.g. “3 hours → 57 days if compute follows the K/log K sample scale”. Such an example is not a TSCR benchmark and is explicitly labelled as an illustration in the text.

This distinction allows conclusions to remain direct and understandable without mixing empirical facts with hypothetical attack-time multipliers.