﻿Structural attack study started: 2026-11-02T22:09:10
Machine: Microsoft Windows NT 10.0.26300.0, cores = 12

Structural advantage of the full design (V3) over plain xoshiro128** (V0)
Model cross-check against the published source: rng32.c sha256 164902b92bb55f05; gamma 0x61C88647=True, w-default 0xA3C59AC3=True, t-default 0x7F4A7C15=True
Attacker model: knows the design and consecutive 32-bit outputs, not the key.

=== A self-checks (model == published design) ===
  xoshiro128** [1,2,3,4] -> 00002D00 00000000 005A7080 : OK
  V3 zero key (Fig.2 words) -> 0FFB6755 600B2072 66DB7A7D EBDB4A2E : OK
  published testbench first word -> F74AA527 : OK

=== B plain xoshiro128** (V0): linear state recovery, no key ===
  recovered full 128-bit state from 4 outputs: 2000/2000 , time per recovery = 29.6 us
  (R_t = scram(s1) is a bijection and the state transition is F2-linear, so 4 outputs give 128
   linear equations that pin the state; no secret key is needed.)

=== C full design (V3): recovery needs the 64-bit (w0,t0) first ===
  with the correct (w0,t0) stripped, the same linear solve recovers the state: OK
  cost per (w0,t0) guess (one strip + one linear solve) = 28.9 us
  full 2^64 search, 1 core at this speed: 1.69E+007 years

=== D attack ladder for V3 (best attack found; NOT a security proof) ===
  naive joint guess (w0,t0)          : 2^64
  t0 ~ ~t0 are equivalent (Tent(x)=Tent(~x)) : 2^63
  Tent big-cycle phase (~90.8% of keys lie on a cycle of length 650116965 = 2^29.276):
    guessing t0 becomes guessing a phase on that cycle -> 2^(32+29.276) = 2^61.276
  the Weyl part cannot be reduced: w is a full-period arithmetic progression (gamma odd).

=== E why no cheaper attack was found: output low bits carry no linear info on w0 ===
  bias of (output bit0 == w0 bit b) over 200000 random keys:
    max |bias| = 0.00284 , statistical noise = 0.00112 (ratio 2.54) -> no usable linear leak
  the Weyl stream (carry-propagating addition) and the Tent stream (linear in t0) are XORed with
  the scrambled xoshiro output; no shortcut was found that strips one of them without guessing
  the other, so the 64-bit key is guessed jointly.

=== F keyless linear-complexity distinguisher (inverted scrambler), 600 words, 8 bit-planes ===
  V0 inverted: mean LC = 128.0 , streams with LC<=130 (short recurrence) = 80/80
  V3 inverted: mean LC = 300.1 , streams with LC<=130 = 0/80
  (LC exactly 128 for V0 reveals the order-128 linear recurrence after the public scrambler is
   undone; V3 shows LC ~ N/2, i.e. no detectable linear structure.)

=== G per-layer contribution: one added layer at a time (best attack found) ===
  V1 (+Weyl): with the correct w0 stripped, the linear solve recovers the state: OK
    guesses needed: 2^32 (w0); cost per guess = 28.7 us; full search, 1 core: 34.2 hours
  V2 (+Tent): with the correct t0 stripped, the linear solve recovers the state: OK
    guesses needed: 2^32 -> 2^31 (t0 ~ ~t0) -> 2^29.276 for ~90.8% of keys (big-cycle phase);
    cost per guess = 29.3 us; 2^31 search, 1 core: 17.5 hours
  V3 (both): the two keys must be guessed jointly, so the costs multiply: 2^63 (2^61.3), see C and D.
  keyless LC distinguisher (as in F): V1 mean LC = 300.3 , flagged 0/80 ; V2 mean LC = 300.3 , flagged 0/80

  per-variant summary (best attack found / keyless LC distinguisher):
    V0 xoshiro only : state from 4 words, no guess        / flagged 80/80
    V1 +Weyl        : 2^32 guesses                        / flagged 0/80
    V2 +Tent        : 2^31 guesses (2^29.3 for ~91%)      / flagged 0/80
    V3 full         : 2^63 guesses (2^61.3 for ~91%)      / flagged 0/80

Summary of the defensible improvements of V3 over plain xoshiro128**:
  1. plain output is linearly invertible: full state from 4 words in ~29.6 us; V3 raises the
     cost of the best attack we found to ~2^63 guesses (2^61.3 for ~91% of keys).
  2. the keyless linear-complexity distinguisher that flags plain xoshiro (LC 128) does not flag V3.
  3. each layer alone raises the guessing cost only to about 2^32 (hours on one core); the two
     layers together require a joint guess, so the costs multiply (section G).
  No claim of cryptographic security is made; these are structural, measured properties.

