{ "vercy": "1.0-draft", "publication": { "status": "research-draft", "adjudicationStatus": "unreviewed", "publishableCanonical": false, "generatedAt": "2026-09-12T10:58:19Z", "providers": [ "Codex" ], "breadth": "recalled by Codex without web access - no source was read", "missingProviders": [], "pass": 2, "cost": { "grok": { "seconds": 22.8, "error": "Reading additional input from stdin...\nOpenAI Codex v0.153.4\n--------\nworkdir: R:\\02_PROJECTS\\02_Meta_Models_Platforms\\Ver.cy\\current\\thing-registry-backlog\nmodel: gpt-6-astra\nprovider: openai\napproval: never\nsandbox: read-only\nreasoning effort: none\nreasoning summaries: none\nsession id: 01a09543-7aad-7883-979d-b8786494857c\n--------\nuser\nDescribe what is already known about one registered thing. Answer as JSON only, no prose around it.\n\nThing: linear cryptanalysis\nSense to describe: (none recorded)\nDomain code: ACT.ACT\nAlso known as: (none)\n\n\nContext for this batch of 1001 things:\n# Batch 044:", "usd": 0.0, "recall": true }, "codex": { "seconds": 76.7, "error": "Reading additional input from stdin...\nOpenAI Codex v0.153.4\n--------\nworkdir: R:\\02_PROJECTS\\02_Meta_Models_Platforms\\Ver.cy\\current\\thing-registry-backlog\nmodel: gpt-6-astra\nprovider: openai\napproval: never\nsandbox: read-only\nreasoning effort: none\nreasoning summaries: none\nsession id: 01a09543-7aa2-7a92-a26b-8207e29f6dc8\n--------\nuser\nYou are drafting a Vercy meta-model for one registered thing. Answer as JSON only, no prose around it.\n\nThing: linear cryptanalysis\nRegistry id: vr.tr.linear-cryptanalysis\nPlane / domain: ACT / ACT.ACT\nRegistry definition: (none recorded)\nNames folded into thi" } }, "enrichment": { "pass": 3, "engine": "claude", "producedAt": "2026-10-06T12:00:00Z", "ingestedAt": "2026-10-06T08:44:31+00:00", "fields": [ "agent_conduct", "ethics", "failure_modes_and_hazards", "owners", "visual_identification" ] }, "gate": { "passed": true, "version": "1.0", "at": "2026-10-07T10:10:27+00:00", "evidence": [ "completeness 1.00", "sense: Wikidata description", "2 live sources", "review by codex: pass" ] } }, "metaModel": { "id": "THING-Q1826463", "registryId": "vr.tr.linear-cryptanalysis", "name": "linear cryptanalysis", "version": "0.1.0-research.1", "entryKind": "thing", "family": "Thing Registry", "domain": [ "ACT.ACT" ], "status": "research-draft" }, "canonicalUrl": "https://ver.cy/models/thing/q1826463/", "model": { "registry_id": "vr.tr.linear-cryptanalysis", "name": "linear cryptanalysis", "purpose": "Enable an AI agent to recognise linear cryptanalysis, assess the evidence and resources supporting a proposed attack, and select justified analysis or validation steps.", "definition": "Linear cryptanalysis is a statistical method for analysing symmetric ciphers, especially block ciphers, that exploits biased affine relations among plaintext, ciphertext and key bits to distinguish cipher behaviour from an ideal random mapping or recover key information.", "scope_statement": "This model owns linear cryptanalysis as an analytical activity under vr.tr.linear-cryptanalysis: constructing and evaluating binary linear approximations of cryptographic transformations, using their statistical behaviour to distinguish transformations or infer key information, and assessing the resulting claims.", "in_scope": [ "Binary masks, parity relations, approximation endpoints and round coverage", "Linear trails, linear hulls and key-dependent correlation estimates", "Single, multiple and multidimensional approximation methods, with explicitly identified extensions", "Plaintext-ciphertext sampling assumptions and statistical distinguishers", "Key-bit inference, partial-key ranking and remaining key-search requirements", "Attack complexity, experimental validation and limits of security conclusions" ], "out_of_scope": [ "Complete specifications and implementation histories of target ciphers", "Differential cryptanalysis except where a hybrid explicitly incorporates a linear stage", "General algebraic equation solving without a statistical linear-approximation mechanism", "Physical leakage acquisition and side-channel instrumentation", "Operational intrusion, credential management and exploitation of deployed systems" ], "distinguishing_features": [ "The proposed mechanism identifies binary parity masks over cryptographic inputs, outputs or intermediate states and explains how their statistical behaviour supports inference.", "A classical biased approximation specifies a parity event whose probability differs from one half; a zero-correlation extension must explicitly identify its different distinguishing mechanism.", "The evidence concerns parity distributions across samples, whereas differential cryptanalysis concerns propagation of differences between related inputs.", "The relation is evaluated statistically rather than assumed to be an exact equation that every encryption satisfies.", "A key-recovery claim identifies how parity statistics reveal key information or rank guesses; a distinguisher alone does not establish full key recovery." ], "characteristics": [ { "name": "Target and approximation interval", "kind": "relation", "unit_or_values": "Cipher specification, parameter set, total rounds, approximation start and end states", "why_it_matters": "Makes the result attributable to an exact transformation and prevents reduced-round evidence being applied to the full cipher." }, { "name": "Method family", "kind": "category", "unit_or_values": "Single approximation; multiple approximations; multidimensional; zero-correlation extension; explicitly described hybrid", "why_it_matters": "Determines which statistical model and boundary conditions must be recorded." }, { "name": "Approximation masks", "kind": "relation", "unit_or_values": "Input, output, intermediate and optional key masks with bit ordering and parity convention", "why_it_matters": "Identifies the actual relation being evaluated." }, { "name": "Signed bias and correlation", "kind": "measurement", "unit_or_values": "For the declared parity-zero event: p in [0,1], bias ε=p−1/2, correlation c=2p−1; dimensionless", "why_it_matters": "Prevents confusion between probability, bias and correlation, and preserves signs needed when combining contributions." }, { "name": "Approximation-set dimension", "kind": "measurement", "unit_or_values": "Binary rank of the mask basis, alongside the number of approximations evaluated", "why_it_matters": "Separates the number of relations from their linear independence and the size of a joint-distribution representation." }, { "name": "Sampling regime", "kind": "category", "unit_or_values": "Known or chosen plaintext; fixed or varying key; sampling with or without replacement; declared input distribution", "why_it_matters": "Controls whether the observed statistics match the attack's assumptions." }, { "name": "Attack resources", "kind": "measurement", "unit_or_values": "Data pairs, bytes of memory, operations in a declared unit, and optional measured runtime", "why_it_matters": "Supports comparison with resource limits and a matching exhaustive-search baseline." }, { "name": "Inference performance", "kind": "measurement", "unit_or_values": "Success probability, false-positive probability, retained key-candidate fraction and confidence intervals", "why_it_matters": "Connects statistical evidence to the claimed distinguishing or recovery outcome." }, { "name": "Evidence maturity", "kind": "state", "unit_or_values": "Proposed; analytically derived; simulated; experimentally reproduced; contradicted", "why_it_matters": "Distinguishes an attack estimate from a demonstrated result." } ], "affordances": [ "Construct or inspect masks for a specified cipher interval and check their parity conventions.", "Compare candidate approximations while preserving trail, hull and key-dependence distinctions.", "Estimate data requirements under explicit sampling and statistical assumptions.", "Evaluate parity statistics on controlled datasets and rank partial-key candidates.", "Compare complete attack costs and success rates with a matching search baseline.", "Identify unsupported extrapolations and choose experiments that resolve them." ], "agent_conduct": { "may": [ "Explain linear cryptanalysis at a conceptual level and its role in cipher design.", "Assess cipher designs the agent's user owns or is authorized to test." ], "must_not": [ "Attack encryption protecting systems or data the agent's user is not authorized to test.", "Help break the confidentiality of other people's communications.", "Claim a cipher is secure based only on resisting this one method." ], "requires_human": [ "Publishing new attacks on ciphers in active use." ] }, "ethics": { "considerations": [ "Cryptanalysis protects people by revealing weak ciphers but can also expose private data.", "Responsible disclosure gives users time to switch to stronger systems." ], "affected_parties": [ "Users of encrypted systems", "Cipher designers" ] }, "owners": { "steward": "Nobody owns the method; researchers answer for its use.", "master_systems": [] }, "visual_identification": [ "Appears in research papers and cipher design documents as linear approximations and bias tables." ], "failure_modes_and_hazards": [ "Weak ciphers left in use expose data.", "Misuse against systems without authorization." ], "what_it_is_for": [ "Linear cryptanalysis is used in cryptographic research to evaluate whether statistical biases weaken a symmetric cipher.", "It supports comparisons of cipher designs and security claims by relating exploitable bias to data requirements and computational effort." ], "facets_not_applicable": { "interfaces": "No specific standard or official classification governs linear cryptanalysis as a general analytical method." } }, "sources": [ { "id": "wikidata", "title": "Wikidata item Q1826463: linear cryptanalysis", "url": "https://www.wikidata.org/wiki/Q1826463", "url_status": "live", "what_it_supports": "identity and sense of the item", "checked_by": "wikidata-api" }, { "id": "wikipedia-en", "title": "Wikipedia: Linear cryptanalysis", "url": "https://en.wikipedia.org/wiki/Linear_cryptanalysis", "url_status": "live", "what_it_supports": "general description of the item", "checked_by": "wikidata-api sitelink" } ], "structure": { "bundles": [ { "id": "attack-identity-and-target", "name": "Attack identity and target", "description": "Record what qualifies the activity as linear cryptanalysis and exactly which cryptographic transformation it addresses.", "rationale": "The method name alone does not specify its mechanism, target or intended outcome.", "layers": [ { "id": "method-boundary", "name": "Method boundary", "description": "Separate classical biased approximations from extensions and neighbouring attack families.", "findings": [ { "id": "linear-inference-mechanism", "name": "Linear inference mechanism", "description": "Identify the parity observable, its expected statistical behaviour and the inference it supports.", "questions": [ { "text": "Which binary linear relation and statistical property make this an instance of linear cryptanalysis?", "kind": "definition", "id": "linear-inference-mechanism-q01" }, { "text": "If described as zero-correlation, differential-linear or another extension, which stage belongs to this model and which belongs to a neighbouring method?", "kind": "boundary", "id": "linear-inference-mechanism-q02" } ] } ] }, { "id": "cipher-coverage", "name": "Cipher coverage", "description": "Bind the analysis to the actual cipher variant and round interval.", "findings": [ { "id": "specified-target", "name": "Specified target", "description": "Record block size, key size, round count, key schedule assumptions and any altered or omitted operations.", "questions": [ { "text": "Which specification and parameter set define the attacked transformation, including whitening and the key schedule?", "kind": "provenance", "id": "specified-target-q01" }, { "text": "Which rounds form the approximation and which additional rounds are handled through key guessing?", "kind": "boundary", "id": "specified-target-q02" } ] } ] } ] }, { "id": "approximation-construction", "name": "Approximation construction", "description": "Represent how local parity relations become a candidate approximation over the target interval.", "rationale": "An unexplained numerical bias cannot establish that the masks, composition or key dependence are correct.", "layers": [ { "id": "local-mask-relations", "name": "Local mask relations", "description": "Identify the component relations and numerical conventions used in construction.", "findings": [ { "id": "mask-and-table-conventions", "name": "Mask and table conventions", "description": "Record mask orientation, bit numbering and whether local table entries represent counts, biases, correlations or another normalisation.", "questions": [ { "text": "What exact parity equation does each mask encode, including any affine constant or key parity?", "kind": "definition", "id": "mask-and-table-conventions-q01" }, { "text": "How were component approximation values computed, and what normalisation and input distribution do they use?", "kind": "measurement", "id": "mask-and-table-conventions-q02" } ] } ] }, { "id": "trail-and-hull-composition", "name": "Trail and hull composition", "description": "Separate an individual sequence of internal masks from the combined endpoint relation.", "findings": [ { "id": "composed-correlation-basis", "name": "Composed correlation basis", "description": "Require the derivation to identify included trails, signs, omitted contributions and assumptions about round keys or statistical independence.", "questions": [ { "text": "Does the reported correlation describe one trail, a partial hull sum or the complete endpoint relation?", "kind": "definition", "id": "composed-correlation-basis-q01" }, { "text": "Which composition assumptions are justified, and how are key-dependent signs and cancellation between trails handled?", "kind": "boundary", "id": "composed-correlation-basis-q02" } ] } ] } ] }, { "id": "sampling-and-statistical-evidence", "name": "Sampling and statistical evidence", "description": "Connect approximation predictions to observations under a declared data-generating process.", "rationale": "Sampling artefacts or an inappropriate statistical model can create apparent evidence for an ineffective attack.", "layers": [ { "id": "data-population", "name": "Data population", "description": "Specify how plaintext-ciphertext pairs are generated, selected and grouped by key.", "findings": [ { "id": "usable-sample-accounting", "name": "Usable sample accounting", "description": "Record sample counts, repeated inputs, input restrictions and whether observations share the key assumed by the analysis.", "questions": [ { "text": "What plaintext distribution, access model and key-reuse conditions does the statistical prediction require?", "kind": "boundary", "id": "usable-sample-accounting-q01" }, { "text": "How many usable pairs remain after filtering, and how do duplicates or sampling without replacement affect the calculation?", "kind": "measurement", "id": "usable-sample-accounting-q02" } ] } ] }, { "id": "test-and-dependence-model", "name": "Test and dependence model", "description": "Identify the test statistic and treatment of relationships between approximation outputs.", "findings": [ { "id": "calibrated-parity-test", "name": "Calibrated parity test", "description": "Record null and alternative distributions, thresholds and approximation dependencies. Multidimensional methods can model joint behaviour without assuming independent approximation outputs. [Hermelin, Cho and Nyberg](https://link.springer.com/article/10.1007/s00145-018-9308-x).", "questions": [ { "text": "Which statistic and threshold achieve the stated false-positive and success probabilities under the declared sampling regime?", "kind": "measurement", "id": "calibrated-parity-test-q01" }, { "text": "How are dependencies among approximations and selection effects from searching many masks incorporated or experimentally checked?", "kind": "measurement", "id": "calibrated-parity-test-q02" } ] } ] } ] }, { "id": "key-inference-and-cost", "name": "Key inference and cost", "description": "Explain what information the statistics recover and what work remains to obtain a verified key.", "rationale": "A strong approximation or favourable ranking can still leave an impractical recovery task.", "layers": [ { "id": "recovery-mechanism", "name": "Recovery mechanism", "description": "Map statistical outcomes to key parities, guessed subkeys and candidate rankings.", "findings": [ { "id": "key-information-yield", "name": "Key information yield", "description": "Separate key-parity inference from partial-key ranking: Matsui's Algorithm 1 and Algorithm 2 exemplify these distinct outcomes. [Hermelin, Cho and Nyberg](https://link.springer.com/article/10.1007/s00145-018-9308-x).", "questions": [ { "text": "Which key parity or subkey bits are inferred, guessed or left unresolved by the statistical stage?", "kind": "definition", "id": "key-information-yield-q01" }, { "text": "How are surviving subkey candidates mapped through the key schedule and verified against additional encryption pairs?", "kind": "action", "id": "key-information-yield-q02" } ] } ] }, { "id": "end-to-end-complexity", "name": "End-to-end complexity", "description": "Account for the complete attack under a stated performance target.", "findings": [ { "id": "comparable-resource-estimate", "name": "Comparable resource estimate", "description": "Include data acquisition, preprocessing, guess evaluation, ranking, memory and residual search with clearly stated cost units.", "questions": [ { "text": "What are the total data, time and memory costs at the claimed success probability, including residual key search?", "kind": "measurement", "id": "comparable-resource-estimate-q01" }, { "text": "Under matching resources and success criteria, does the complete procedure improve on exhaustive search or another stated baseline?", "kind": "measurement", "id": "comparable-resource-estimate-q02" } ] } ] } ] }, { "id": "validation-and-security-interpretation", "name": "Validation and security interpretation", "description": "Establish what has been demonstrated and how far the result supports a security conclusion.", "rationale": "Analytical estimates, selected-key experiments and full-cipher attacks support different conclusions.", "layers": [ { "id": "reproducible-evaluation", "name": "Reproducible evaluation", "description": "Preserve enough derivation and experimental context to independently test the claim.", "findings": [ { "id": "prediction-versus-observation", "name": "Prediction versus observation", "description": "Compare predicted correlations and recovery rates with measurements across explicitly selected keys and datasets.", "questions": [ { "text": "Which paper sections, derivations, code versions and experiment settings support each reported attack result?", "kind": "provenance", "id": "prediction-versus-observation-q01" }, { "text": "Across how many independently sampled keys and trials do observed correlations, candidate ranks and success rates match the prediction?", "kind": "measurement", "id": "prediction-versus-observation-q02" } ] } ] }, { "id": "claim-limits-and-next-actions", "name": "Claim limits and next actions", "description": "Translate the evidence into a bounded conclusion and a useful follow-up decision.", "findings": [ { "id": "supported-security-conclusion", "name": "Supported security conclusion", "description": "State whether the evidence establishes a component property, reduced-round distinguisher, partial recovery or complete attack under specific conditions.", "questions": [ { "text": "Which restrictions on rounds, keys, data access or resources prevent this result from establishing a practical break of the deployed cipher?", "kind": "boundary", "id": "supported-security-conclusion-q01" }, { "text": "Which next experiment would most directly test the assumption currently limiting the attack claim?", "kind": "action", "id": "supported-security-conclusion-q02" } ] } ] } ] }, { "id": "evidence-and-external-alignment", "name": "Evidence and external alignment", "description": "What the world already says about this thing, gathered so the model can be checked against it.", "rationale": "A model that cannot be lined up against existing standards, identifiers and practice cannot be adopted by anyone who already uses them.", "layers": [ { "id": "reported-evidence", "name": "Reported evidence", "description": "Findings from the breadth pass, kept separate from the structural claims.", "findings": [ { "id": "evidence-confidence-notes", "name": "Check these first", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ "This is a recall-based description; no sources were consulted.", "The inverse-square data estimate applies to classical biased-approximation attacks and should not be transferred directly to zero-correlation or multidimensional variants.", "Differential-linear cryptanalysis is included as a related hybrid; classifications may treat it separately." ], "questions": [ { "id": "evidence-confidence-notes-q01", "text": "Which of these check these first hold for the sense of linear cryptanalysis this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-kinds", "name": "Kinds and varieties", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ "Classical single-approximation linear cryptanalysis", "Multiple linear cryptanalysis", "Multidimensional linear cryptanalysis", "Zero-correlation linear cryptanalysis", "Differential-linear cryptanalysis, a hybrid with differential cryptanalysis" ], "questions": [ { "id": "evidence-kinds-q01", "text": "Which of these kinds and varieties hold for the sense of linear cryptanalysis this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-real-world-use", "name": "Real-world use", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ "Evaluating the security margins of proposed block ciphers and reduced-round variants.", "Recovering key information in experimental attacks, historically including attacks on DES.", "Guiding S-box design through bounds on linear correlations.", "Assessing how cipher diffusion limits useful linear trails across successive rounds." ], "questions": [ { "id": "evidence-real-world-use-q01", "text": "Which of these real-world use hold for the sense of linear cryptanalysis this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-measurements", "name": "Typical measurements", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ { "quantity": "Linear approximation bias, epsilon = p - 1/2", "typical_range": "Mathematical range: -1/2 to 1/2; exploitable biases in substantial cipher constructions are generally small in magnitude.", "unit": "dimensionless" }, { "quantity": "Linear correlation, c = 2p - 1", "typical_range": "Mathematical range: -1 to 1.", "unit": "dimensionless" }, { "quantity": "Data complexity of a classical single-approximation attack", "typical_range": "Often scales on the order of 1/epsilon^2; constants depend on the attack, desired success probability and statistical assumptions.", "unit": "known plaintext-ciphertext pairs" }, { "quantity": "Attack success probability", "typical_range": "0 to 1, evaluated for a specified data budget, computational budget and key distribution.", "unit": "dimensionless" } ], "questions": [ { "id": "evidence-measurements-q01", "text": "Which of these typical measurements hold for the sense of linear cryptanalysis this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-failure-modes-and-hazards", "name": "Failure modes and hazards", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ "Combining component biases under unjustified independence assumptions can produce inaccurate attack estimates.", "Treating a single linear trail as the complete approximation ignores the reinforcing or cancelling contributions of other trails in its linear hull.", "A detectable statistical bias does not by itself establish a practical key-recovery attack.", "Required data, time or memory can exceed practical limits even when an attack improves on exhaustive search.", "Reduced-round results can be misrepresented as breaks of the full cipher." ], "questions": [ { "id": "evidence-failure-modes-and-hazards-q01", "text": "Which of these failure modes and hazards hold for the sense of linear cryptanalysis this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-neighbours", "name": "Neighbouring kinds and how to tell them apart", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ { "name": "Differential cryptanalysis", "difference": "Studies how input differences propagate to output differences, whereas linear cryptanalysis studies probabilities of affine bit relations." }, { "name": "Algebraic cryptanalysis", "difference": "Attempts to solve algebraic constraints describing the cipher; linear cryptanalysis uses statistical deviations in affine approximations." }, { "name": "Side-channel analysis", "difference": "Uses implementation leakage such as timing or power consumption; conventional linear cryptanalysis uses mathematical relations in cipher input and output data." }, { "name": "Linear trail", "difference": "A trail specifies intermediate masks through cipher components; linear cryptanalysis is the broader attack methodology that can exploit their aggregate effect." }, { "name": "Linear hull", "difference": "A hull aggregates trails sharing endpoint masks; it is an analytical object used within linear cryptanalysis." } ], "questions": [ { "id": "evidence-neighbours-q01", "text": "Which of these neighbouring kinds and how to tell them apart hold for the sense of linear cryptanalysis this model covers, and on what evidence?", "kind": "provenance" } ] } ] } ] } ] }, "openQuestions": [ "Should zero-correlation linear cryptanalysis be represented as a subtype here or linked to a separately registered method, given its different statistical mechanism?", "Which primary references should anchor the distinctions among classical, multiple, multidimensional and hybrid variants?", "For each modelled attack, how much do full-hull contributions and the actual key schedule change estimates obtained from selected trails?", "Which right-key and wrong-key statistical assumptions remain accurate for the target cipher, sampling regime and number of key hypotheses?", "What evidence threshold should distinguish a reproduced research attack from a practical security compromise when data acquisition and residual key search are included?" ], "statistics": { "bundles": 6, "layers": 11, "findings": 16, "questions": 26 } }