\documentclass[12pt]{article}

\usepackage{hyperref}
\usepackage{orcidlink}
\usepackage{amsfonts}
\usepackage{amsmath}
\usepackage{amsmath,amssymb}

\title{%
  \mbox{\textbf{Caputo Fractional Differential Shift}}\\
 \textbf{ Encryption: A Generalized Dynamic Caesar Cipher with Enhanced Statistical Security%
}}

\author{
  Taylan Demir\,\orcidlink{0000-0001-7402-4468}%
  \thanks{Department of Mathematics, Ankara University, Ankara, Turkey.}
  \and
  Hasan Hüseyin Tosunoğlu\,\orcidlink{0009-0004-8735-4289}%
  \thanks{Management Information Systems Faculty of Open and Distance Education, Istanbul University, Istanbul, Turkey}
}

\date{}

\begin{document}
\maketitle
\begin{abstract}
Classical and dynamic Caesar ciphers are mainly vulnerable to frequency attacks, since in both schemes the shift applied to each character position is memoryless. This is not the case for the proposed fractional differential shift cipher, where the running shift sequence is generated by a Caputo fractional system
\(D_t^{\alpha} x(t) = F(x(t),k)\) with \(\alpha \in (0,1)\) and \(k\) denotes the secret key vector.
The discrete fractional integrator associated with this Caputo fractional system yields a long-memory, non-uniform sequence of shifts, which induces a generalized Caesar mapping on any chosen character set or ASCII set. Qualitative analysis shows that relatively small variations in either \(\alpha\) or $k$ lead to clearly distinct shift patterns and substantially enlarge the effective key space. Numerical tests on textual data demonstrate an approximately uniform symbol distribution, a very low degree of local correlation and, conversely, a high level of entropy, while linear-time complexity and a minimal implementation footprint are preserved. Consequently, taken together, these characteristics indicate that Caputo-based fractional differential shift encryption can serve as a practical alternative to traditional substitution ciphers in resource-constrained environments.
\end{abstract}
\noindent\textbf{Keywords:}
fractional differential shift encryption; Caputo derivative; dynamic Caesar cipher; substitution cipher; fractional dynamical systems; lightweight cryptography.
\section{Introduction}

\subsection{Background and motivation}
Classical substitution ciphers include the Caesar and Vigen\`ere schemes, where the mapping from plaintext to ciphertext is done by means of a monoalphabetic rule with a fixed mapping or by a periodically repeating short key [1,2]. Typically, in the simplest versions of the classical and dynamic Caesar methods,
the shift applied to each letter is determined by its position in an ordered
alphabet and, in some variants, by a key-dependent offset
determined by the index of the character in the plaintext. Each letter is transformed based solely upon the current position or local state, which makes these substitution methods effectively memoryless. Because of this property, the resulting ciphertext retains the statistical
profile of the letter frequencies of the underlying language and leaves the
ciphers vulnerable to frequency analysis and other simple methods for key
recovery [1,3]. Although shift-based substitution ciphers have inherent weaknesses, they are still a viable option for implementations requiring a low overhead and processing cost due to their simplicity. The question remains: can the simplicity of a classical Caesar-style cipher
be retained while embedding the shifts into a dynamical system with genuine
memory and sensitivity, so that the resulting running shift sequence is no
longer susceptible to classical frequency attacks?


\subsection{Fractional calculus and dynamical encryption}

Fractional calculus has become a significant tool for modelling systems that
exhibit time dependence due to historical data and, more generally, for
processes with pronounced long-term memory effects [4,5].
 Caputo’s fractional derivatives, in particular, give rise to initial value
problems (IVPs) whose solutions depend on the entire past trajectory rather
than only the current state, and the fractional order provides a quantitative
measure of the memory strength associated with the IVP [5].
Owing to this built-in memory feature, there is a rapidly growing body of work
on fractional dynamical systems in physics, engineering and control theory.
In the last decade, several authors have proposed encryption schemes driven by
fractional-order chaotic systems. Examples include image ciphers based on fractional-order sine maps, fractional beta chaotic maps and fractional 3D Lorenz systems, which are reported to yield
large key spaces and favourable diffusion and confusion properties [6–9]. These constructions, however, typically operate on multi-dimensional state
variables and target multimedia data, whereas the design of lightweight,
text-oriented substitution ciphers that exploit fractional dynamics at the
level of symbol shifts has received considerably less attention.


\subsection{Main contributions}
This work seeks to address the shortfall by proposing a new \emph{fractional differential shift encryption} model that expands the idea of traditional or dynamic caesar type ciphers into an entirely new domain. A summary of the key findings from this study includes:

\begin{itemize}
  \item We define a Caputo–driven shift mechanism in which the running shift
        sequence is obtained as the numerical solution of a one–dimensional
        Caputo fractional initial–value problem
        \(
           D_t^\alpha x(t) = F(x(t),k)
        \)
        with order $\alpha\in(0,1)$ and secret parameters collected in the key
        vector $k$.  The resulting non–uniform shift sequence is then coupled
        with a generalized Caesar mapping over an arbitrary alphabet or ASCII
        set.
  \item As $\alpha \to 1^{-}$ it has been demonstrated that under many choices of the nonlinearity $F$ the proposed scheme reduces to classical dynamic (or Caesar-type) ciphers. Therefore, classical and dynamic (or Caesar-type) ciphers are special cases or limiting cases of our model.
  \item We analyse how the long--memory property of the Caputo system enlarges
        the effective key space and amplifies sensitivity with respect to both
        the fractional order $\alpha$ and the key parameters $k$, leading to
        highly aperiodic and history–dependent shift patterns.
  \item We perform a series of statistical tests on textual and gray–level data,
        including histogram analysis, adjacent–symbol correlation, information
        entropy and key–sensitivity experiments, and we compare the results with
        those obtained from classical Caesar and related substitution ciphers.
\end{itemize}

\subsection{Structure of the paper}

The rest of the paper is organized as follows. 
Section~\ref{sec:prelim} collects the necessary notation, recalls the Caputo
fractional derivative and introduces the discrete fractional integrator and the
dynamic Caesar cipher model. 
Section~\ref{sec:cipher} presents the proposed fractional differential shift
encryption scheme, including the construction of the running shift sequence, the
encryption and decryption algorithms, and the relation to classical Caesar-type
ciphers. 
Theoretical properties of the underlying fractional system and of the resulting
shift sequences are analysed in Section~\ref{sec:theory}. 
Statistical and security analyses, together with numerical experiments on
representative data sets, are reported in Section~\ref{sec:security} and
Section~\ref{sec:experiments}. 
Implementation issues, complexity considerations and parameter selection
guidelines are discussed in Section~\ref{sec:implementation}. 
Finally, Section~\ref{sec:conclusion} summarizes the main findings and outlines
several directions for future work.
\section{Preliminaries}
\label{sec:prelim}


\subsection{Notation}

In this paper, we utilize a finite, ordered alphabet
\(\mathcal{A}\) containing $'m'$ number of symbols, and  where \(m \ge 2\).
The symbols of $\mathcal{A}$ are represented as
\(\mathcal{A} = \{a_0,a_1,\dots,a_{m-1}\}\).
A practical example of a finite collection of symbols for text-related purposes is derived from the printable characters (symbols) found within the ASCII character set; however, this construction can also be applied to any finite collection of symbols or bytes [1 , 10 , 11]. The index map
\[
\iota : \mathcal{A} \longrightarrow \{0,1,\dots,m-1\}
\]
corresponds each character (symbol) in $\mathcal{A}$ \(a_j\) to its index \(j\) within the ordered collection of symbols, and we denote the inverse relationship of the index map by  \(\iota^{-1}\).

Plaintext and ciphertext are modelled as finite sequences
\((p_n)_{n=0}^{N-1}\) and \((c_n)_{n=0}^{N-1}\) with values in \(\mathcal{A}\).
When convenient we work with their index representations
\(P_n = \iota(p_n)\) and \(C_n = \iota(c_n)\) taking values in the residue
class ring \(\mathbb{Z}_m = \mathbb{Z} / m\mathbb{Z}\).
Addition and subtraction on indices are always understood modulo \(m\) and we
write them as
\[
x \oplus y = (x + y) \bmod m, \qquad
x \ominus y = (x - y) \bmod m,
\]
for \(x,y \in \mathbb{Z}_m\).
In particular, a classical Caesar shift by a fixed integer \(s \in \mathbb{Z}_m\)
is the map
\[
S_s : \mathbb{Z}_m \to \mathbb{Z}_m, \qquad S_s(x) = x \oplus s.
\]
In the proposed scheme the shift becomes time-dependent.
We denote by \((s_n)_{n\ge 0}\) a sequence of integer shifts in \(\mathbb{Z}_m\),
generated by an underlying dynamical system, and write the encryption and
decryption rules as
\begin{equation}
  C_n = P_n \oplus s_n, \qquad
  P_n = C_n \ominus s_n, \qquad n = 0,1,\dots,N-1.
  \label{eq:shift-encryption}
\end{equation}
All subsequent constructions will be formulated at the level of the index
sequences \(P_n,C_n,s_n \in \mathbb{Z}_m\); the passage back to characters is
performed via \(\iota\) and \(\iota^{-1}\).

\subsection{Caputo fractional derivative}

The Caputo fractional derivative of order \(\alpha \in (0,1)\) , is used in this paper.
Let \(x:[0,T]\to\mathbb{R}\) be an absolutely continuous function.
The Caputo fractional derivative with respect to the lower limit 
\(0\) is is represented by 
\begin{equation}
  D_t^{\alpha} x(t)
  = \frac{1}{\Gamma(1-\alpha)}
    \int_0^t (t-\tau)^{-\alpha} x'(\tau)\, \mathrm{d}\tau,
  \qquad t \in (0,T],
  \label{eq:caputo-def}
\end{equation}
and is defined using the gamma function  \(\Gamma(\cdot)\) [4, 5, 12].
Therefore  \(D_t^{\alpha}\) can be expressed as an ordinary differentiation followed by a fractional integration of order \(1-\alpha\). The function \((t-\tau)^{-\alpha}\) in~\eqref{eq:caputo-def} provides a weigh-ting to the past values of \(x'\) that is described by a slowly decreasing power-law. The result is that \(D_t^{\alpha} x(t)\) depends upon the complete previous history of
\(x\) on the interval \([0,t]\), rather than only upon its present state (this is referred to as a long memory effect). The Caputo operator is linear and has many of the same properties that are present for the classic first derivative in that respect. In particular, all Constants have zero for the Caputo derivative, while for any
\(x\) continuously differentiable, one has the
\[
\lim_{\alpha \to 1^-} D_t^\alpha x(t) = x'(t)
\]
for \(t \in (0,T)\) [4, 5].
For nonlinear initial value problems of the form
\begin{equation}
  D_t^{\alpha} x(t) = F(t,x(t)), \qquad t \in (0,T], \qquad x(0) = x_0,
  \label{eq:caputo-ivp}
\end{equation}
with \(\alpha \in (0,1)\), it is convenient to rewrite
\eqref{eq:caputo-ivp} in the equivalent Volterra integral form
\begin{equation}
  x(t)
  = x_0
    + \frac{1}{\Gamma(\alpha)}
      \int_0^t (t-\tau)^{\alpha-1} F(\tau,x(\tau))\, \mathrm{d}\tau.
  \label{eq:caputo-integral}
\end{equation}
Assuming certain standard assumptions, including a global Lipschitz condition on 
\(F\) for its second argument, equation ~\eqref{eq:caputo-integral}
has a unique continuous solution over the interval \([0,T]\). Additionally, the continuous solution has a continuous dependence on initial condition \(x_0\) and function \(F\) [4, 5, 12].
All of these basic facts will be utilized in the development of the fractional differential system which describes the running shift sequence.

\subsection{Discrete fractional integrator}

We discretize the Caputo initial value problem ~\eqref{eq:caputo-ivp} and build the numerical representation of the running shift sequence. The fixed time step is \(h>0\) and \(t_n = n h\) for every \(n=0,1,\dots,N\). The numerical solution of $x(t_{n})$  at point $t_{n}$ is denoted by
 \(x_n \approx x(t_n)\) and will be used throughout the rest of this document.

For solving Caputo-type equations, we are following the work of Diethelm, Ford, and Freed [13] using a predictor-corrector method based on the Adams approach.
In its most basic form, this combination uses an Adams-Bashforth predictor with fractional order followed by an Adams-Moulton corrector with fractional order on the integral equation stated in ~\eqref{eq:caputo-integral}.
The corrector update can be written as
\begin{equation}
x_{n+1}
= x_0
  + \frac{h^\alpha}{\Gamma(\alpha+1)}
    \left(
      \sum_{j=0}^{n} a_{j}^{(n+1)} F(t_j,x_j)
      + b^{(n+1)} F(t_{n+1},\hat{x}_{n+1})
    \right),
\qquad n \ge 0,
\label{eq:pc-scheme}
\end{equation}
where the coefficients \(a_{j}^{(n+1)}\) and \(b^{(n+1)}\) are determined by
the fractional Adams weights and \(\hat{x}_{n+1}\) denotes the predictor value
obtained from an explicit fractional Adams--Bashforth step [13].
This scheme has a convergence rate of 
\(\mathcal{O}(h^{\min\{2,1+\alpha\}})\) where \(F\) is smooth enough and is zero-stable with respect to an arbitrary \(\alpha \in (0,1)\) [13].
Therefore the trajectories  \((x_n)_{n\ge 0}\) calculated by the numerical method will be close to the true solution of equation ~\eqref{eq:caputo-ivp}  with an error that decreases as \(h \to 0\).
To provide a complete view of available discretization methods, we will also highlight the  Grünwald--Letnikov (GL) discretization method for approximating a Caputo derivative using weights and backward difference [14, 15].
In this method, the operator \(D_t^{\alpha} x(t_n)\) by
\[
D_t^{\alpha} x(t_n)
\approx \frac{1}{h^{\alpha}}
         \sum_{j=0}^{n} \omega_j^{(\alpha)} x_{n-j},
\]
will be replaced with a set of binomial coefficients, denoted as
\(\omega_j^{(\alpha)} = (-1)^j \binom{\alpha}{j}\).
We will demonstrate that static pressure integrators using GL methods are easy to design and implement, therefore we will use these methods for some of the numerical examples in this report. The predictor-corrector scheme given in equation
\eqref{eq:pc-scheme} is the primary focus throughout our theoretical assessment.

\subsection{Dynamic Caesar cipher as a discrete dynamical system}

A fixed shift is applied to each symbol with classical Caesar cipher; in contrast, the dynamic Caesar cipher uses either a position-based shift or an internal state that varies over time [1, 11]. The dynamic Caesar cipher is classified as a discrete-time continuous dynamical system; thus, to understand its relationship to Fractional Dynamical Systems, we investigate its relationship to a Fractional Dynamical System based on the fact that a dynamic Caesar cipher can be viewed as a discrete-time continuous dynamical system.

Suppose \((x_n)_{n\ge 0}\) is a sequence of integers or real numbers representing time and 
\(k\) is the secret key that could consist of numerous parameters.
The state will be updated according to a generic expression
\begin{equation}
  x_{n+1} = G(x_n,k), \qquad n \ge 0,
  \label{eq:dynamic-caesar-state}
\end{equation}
The running shift sequence is then obtained by applying a quantization map
\(Q:\mathbb{R}\to\mathbb{Z}_m\),
\[
s_n = Q(x_n), \qquad n \ge 0,
\]
and encryption is performed via the shift rule~\eqref{eq:shift-encryption}.
The simplest example of \(G\) and \(Q\) can be taken to mean that ~\eqref{eq:dynamic-caesar-state}
becomes a linear recurrence of order \(s\), swept through a field $\mathbb{Z}_m$ and forms part of the traditional running-key and/or auto-key Caesar schemes [10, 11].
For our purposes, we will replace ~\eqref{eq:dynamic-caesar-state} by a fractional differential system, and its discrete solution produces the series of states \(x_n\) and thence the shifts \(s_n\). This concept allows the classical and dynamic functions of the Caesar cipher to follow a much larger set of functions, all of which can be viewed as limiting cases of a generalisation of the Caesar ciphers that will be developed in
Section~\ref{sec:cipher}.

\section{Fractional Differential Shift\\ Encryption Scheme}
\label{sec:cipher}


In this section we introduce the proposed fractional differential shift
encryption scheme.  The running shift sequence is obtained from the
trajectory of a scalar Caputo fractional system, which is then
quantised to the symbol ring $\mathbb{Z}_m$ and combined with the
modular shift rule \eqref{eq:shift-encryption}.

\subsection{Caputo-based generating system}

Let $\alpha\in(0,1)$ and consider the Caputo initial value problem
\[
  D_t^\alpha x(t) = F\bigl(t,x(t);\mathbf{k}\bigr), \qquad
  t\in(0,T], \qquad x(0)=x_0,
\]
where $F:[0,T]\times\mathbb{R}\times\mathcal{K}\to\mathbb{R}$ is
continuously differentiable in its last two arguments and
$\mathbf{k}\in\mathcal{K}$ denotes the secret key vector.  According to the hypotheses outlined in Section 2.2, this issue has one continuous answer $x:[0,T]\to\mathbb{R}$ based on the parameters $\alpha$, $x_0$ and $\mathbf{k}$
[4, 5, 12]. The Caputo derivative has a non-local kernel, so  $x(t)$ represents the whole past trajectory $\{x(\tau):0\le\tau\le t\}$. Hence, it essentially gives rise to long-memory effects in the driving dynamics. The nonlinearity $F$ and the vector of parameters $\mathbf{k}$ are, from the perspective of cryptography, a key scheduling system: for example, different amounts of $\mathbf{k}$ will generate a series of different fractional paths and give rise to multiple distinct sequences of running shifts. This approach to design is consistent with other approaches using fractional and chaotic systems as key-generators for encryption in multimedia applications [3, 6, 16, 19].
\subsection{Discretisation and construction of the shift sequence}

In this section we will discretise the system at uniform time steps
$t_n = nh$ with $n=0,1, \dots,N$. With $x_n\approx x(t_n)$, we will use the predictor-corrector schemes of Diethelm et al. [13] to construct the discrete trajectory
$\{x_n\}_{n\ge 0}$ The resulting trajectory has a qualitative behaviour similar to that of the original continuous-time system defined by Caputo. Other methods of discretisation such as the Grunwald–Letnikov approach [14] could be used without affecting the way the trajectory is constructed.

To work at the level of the symbol indices, we introduce a quantisation
map
\[
   Q : \mathbb{R} \longrightarrow \mathbb{Z}_m,
   \qquad
   Q(x) = \bigl(\lfloor \beta x \rfloor \bmod m\bigr),
\]
with a fixed scaling factor $\beta>0$.  The running shift sequence is
then defined by
\begin{equation}
  s_n = Q(x_n), \qquad n=0,1,\dots,N-1.
  \label{eq:fractional-shift-sequence}
\end{equation}
Within Section 4 an in-depth discussion on how the long-range dependence of the sequence $(s_n)_{n\ge 0}$ will occur as a result of its fractional dynamics as well as its near-uniform distribution will be discussed. Specific values for $F$, $\alpha$, $\beta$ and $\mathbf{k}$ are required in order to show that $(s_n)_{n\ge 0}$ will inherit both long-range dependence through fractional dynamics whilst simultaneously exhibiting characteristics of uniformity throughout $\mathbb{Z}_m$.
\subsection{Encryption algorithm}

The plaintext sequence $(p_n)_{n=0}^{N-1}$ exists in 
$\mathcal{A}$ and corresponds to the index sequence $(P_n)_{n=0}^{N-1}$ in $\mathbb{Z}_m$ mapping via the map $\iota$ from Section 2.1. In order to encrypt, we will begin with the secret parameters
\[
   \mathsf{Key} = \bigl(\alpha,x_0,\mathbf{k},h,\beta,N\bigr),
\]
and proceed as follows:

\begin{enumerate}
  \item We will take the $\mathsf{Key}$ and use the predictor-corrector integration of the Caputo system from
        $t_0=0$ to $t_{N-1}=(N-1)h$ to obtain the numerical trajectory $(x_n)_{n=0}^{N-1}$.
  \item With the trajectory, we will compute the shift sequence $(s_n)$ as described in equation
        \eqref{eq:fractional-shift-sequence}.
  \item We will compute the ciphertext index sequence  $(C_n)$ using 
        \[
           C_n = P_n \oplus s_n, \qquad n=0,1,\dots,N-1,
        \]
        where $\oplus$ is addition modulo $m$.
  \item Finally, we will apply $\iota^{-1}$ to convert the ciphertext index sequence 
        $(c_n)$ back into ciphertext symbols $(c_n)$ in $\mathcal{A}$.
\end{enumerate}

In summary, the encryption algorithm is a stream cipher using a fractional dynamical system to generate the keystream, as opposed to traditional linear recurrences or finite-state machines.

\subsection{Decryption algorithm}

The person receiving the encrypted information must have access to the same parameter set $\mathsf{Key}$.  in order to decrypt the data. By repeating Steps 1 and 2 above, the receiver constructs the sequence of shifts $(s_n)$.  The information contained in an index that was sent as an encrypted character is extracted with
\[
   P_n = C_n \ominus s_n, \qquad n=0,1,\dots,N-1,
\]
and here $\ominus$ indicates modulo $m$ subtraction. Running $\iota^{-1}$
gives the original characters back again. The scheme can be exactly reversed, provided there are no numerical errors, because the operations for the modular group are reversible and because the fractional-integrator function will produce the same deterministic behavior every time for any set of fixed parameters.

\subsection{Special cases and relation to classical schemes}

Traditional Caesar methods can be seen as special cases of the methods proposed by us when (1) the limiting case of the proposed system is the constant shift sequence and (2) when the function  $F$ is assumed to only depend on constants and not on other variables in the proposed system. Therefore, the trajectories $(x_n)$ will follow an arithmetic progression. In this limiting case, the sequence $(s_n)$ will also be constant, and the methods proposed by us will be equivalent to the traditional Caesar cipher methods, where $\alpha\to 1^{-}$ are restricted to constant shifts. If we consider the function $F$ to depend linearly on $x$ and on a small number of key parameters (which we will not specify), we will, in a similar manner to the dynamic or auto-key Caesar cipher methods, obtain sequences of affine recurrences of the same type as in dynamic or auto-key Caesar ciphers. Therefore, the fractional differences will allow for the development of a generalisation of the traditional Caesar and auto-key methods by incorporating the shift pathway into a nonlinear fractional dynamical framework with long-term memory [15, 16, 17, 18].
\section{Theoretical Properties}
\label{sec:theory}


In this section we collect some basic analytical properties of the Caputo system
that generates the running shift sequence and discuss their implications for the
resulting encryption scheme. Throughout, we consider the initial value problem
\begin{equation}\label{eq:caputo-ivp-theory}
  D_{t}^{\alpha} x(t) = F\bigl(t,x(t);k\bigr), \qquad t\in (0,T], \qquad x(0)=x_{0},
\end{equation}
with $0<\alpha<1$ and secret key vector $k$. Its equivalent Volterra integral
form has already been given in~(4). The assumptions on $F$ stated below are
standard in the analysis of Caputo fractional differential equations and are
sufficient for existence, uniqueness and boundedness of solutions [4, 5, 12].

\subsection{Existence and boundedness of the generating system}

For every $F:[0,T]\times\mathbb{R}\times\mathcal{K}\to\mathbb{R}$ for $x,y\in\mathbb{R}$ and $k\in\mathcal{K}$, $F(t,x;k)$ is continuous in the variables $(t,x) \in [0, T] \times \mathcal{R}$ and continuous in the variable $k\in\mathcal{K}$ as described above. Further, $F(t,x;k)$ satisfies the following conditions for all $t\in[0,T]$, $x,y\in\mathbb{R}$ and $k\in\mathcal{K}$:
\begin{align}
  \bigl|F(t,x;k)-F(t,y;k)\bigr| &\le L |x-y|, \label{eq:lipschitz-F}\\
  \bigl|F(t,x;k)\bigr| &\le a + b |x|.                                          
\end{align}
for some fixed constants $L>0$, $a,b \geq 0$. Based upon these conditions, the theory behind Caputo initial value problems introduces the following results for the cases mentioned [4,5,12] above.

\medskip\noindent\textbf{Fact 4.1 (Existence and uniqueness).}
For each selected parameters $(\alpha,x_{0},k)$ where $0<\alpha<1$ has one unique continuous function  $x:[0,T]\to\mathbb{R}$ of
\eqref{eq:caputo-ivp-theory} that satisfies (8). Additionally, the solution's dependency on
$(x_{0},k)$ is continuous when considering uniform heat.

\medskip\noindent\textbf{Fact 4.2 (A~priori bound).}\\
There exists a constant $B=B(T,\alpha,a,b,L,|x_{0}|,k)$ such that
\begin{equation}
  |x(t)| \le B, \qquad t\in[0,T].
\end{equation}
Using a Fractional Gronwall Inequality, an explicit choice for $B$ can be made using (4) which states that~(4); in particular $B$ is always going to be finite over every bounded time interval of [5].

\medskip
The above property ensures the existence of the trajectory $\{x(t)\}_{0\le t\le T}$ representing the shift sequence for every allowable key, and the discretisation discussed in $(2.3)$ will generate numerical trajectories remaining within a bounded area of the state space as long as $h$ is sufficiently small. More specifically, the quantised index $s_{n}=Q(x_{n})$  remains in the symbol ring $\mathbb{Z}_{m}$ for every $n$ and every valid parameter choice.

\subsection{Long-memory and sensitivity}

In the Volterra framework (4), the kernel $(t-\tau)^{\alpha-1}/\Gamma(\alpha)$ considers the entire past of 
for each present point through the implementation of a slow polynomial decay model. Thus, when 
$0<\alpha<1$, there is a gradual polynomial decrease in the effect of an early point $x(\tau)$ on the value of $x(t)$, which is classically associated with "long memory"; however, unlike the classical first-order case, the impact of all historically observed points $x(\tau)$ never totally disappears. Let us denote by $x(t)$ and $\tilde{x}(t)$ two different solutions of (8) that correspond to two sets of parameters $(\alpha,x_{0},k)$ and $(\tilde{\alpha},\tilde{x}_{0},\tilde{k})$ respectively, which are slightly different from each other. Then by the Lipschitz property (9) combined with a fractional Gronwall inequality, we find that we can establish an estimate
\begin{equation}
  |x(t)-\tilde{x}(t)|
  \;\le\; C\,\Xi(\alpha,\tilde{\alpha},t)\,
          \bigl(|x_{0}-\tilde{x}_{0}| + \|k-\tilde{k}\|\bigr),
  \qquad t\in[0,T],
\end{equation}
where $C$ is a constant which depends on $F$ and $\Xi(\alpha,\tilde{\alpha},t)$ increases sub-exponentially as $t$ grows, and as the orders approach 1, there is an increase in $\Xi(\alpha,\tilde{\alpha},t)$ as well, see, e.g. [5,20]. As demonstrated by the inequality presented, solutions are very suceptible to variations in the parameters, as well as to modifications in the initial conditions; this is particularly true over long time frames. When considering the running shift sequence defined as $s_{n}=Q(x_{n})$ , minor adjustments to either of the triplet of values $(\alpha,x_{0},k)$  or variations in the numerical step size $(h)$, can have a substantial impact on the sequence of indices generated. Therefore, the mapping defined by
\[
  (\alpha,x_{0},k,h) \longmapsto (s_{0},s_{1},\dots,s_{N-1})
\]
produces a highly complex and sensitive key scheduling function, which is a beneficial characteristic for cryptography.
\subsection{Aperiodicity and key-space discussion}
As a starting point, the required behaviour of the generator is such that keystream sequences generated by it must not be periodic over short ranges or have a clear periodic pattern. In either of these cases, the periodicity of the generator sequence, $(s_{n})_{n\ge 0}$ is possible only if the fractional trajectory, $(x_{n})_{n\ge 0}$ is eventually periodic and $Q$ collapses the same point of collision from several points on the fractional trajectory into the same index of $\mathbb{Z}_{m}$. The assumptions made about the function $F$ are true. In addition, given the typical values of parameters which will be used in practice, the fractional system stated in Eq. (8) will only have periodic solutions over the interval $[0,\infty)$ if they are all constant (non-constant periodic). For more details please see the references [4, 5] for discussion of the asymptotic behaviour. Thus, when we consider the long-memory effect of the discrete trajectory $(x_{n})_{n\ge 0}$ it is clear that for all practical purposes the behaviour will be aperiodic, except in those degenerate cases described in section 3.5 where the polynomial $F$ becomes either a constant or linear (affine) function of its arguments and the resulting discrete trajectory $(x_{n})_{n\ge 0}$ collapses back into a traditional Caesar-type cipher.
In terms of keyspace size, the complete secret key can just as easily be thought of as the $6$-tuple
\[
  K_{\mathrm{tot}} = (\alpha,x_{0},k,\beta,h,N),
\]
$\alpha$ and $h$ are fixed precision numbers, $x_{0}$ and elements of $k$ are selected from prescribed ranges, $\beta$ is the scaling factor of the quantiser, and $N$ is the length of the plaintext. If $\alpha$ and $h$ are encoded using $b_{\alpha}$ and $b_{h}$ bits, respectively, and $x_{0}$  and $k$ have $M_{x}$ and $M_{k}$ possible values, and $\beta$ is selected from  $M_{\beta}$ potential values, then the overall number of keys is at least
\[
  |{\mathcal{K}}_{\mathrm{tot}}|
  \;\ge\; 2^{b_{\alpha}+b_{h}}\, M_{x}\,M_{k}\,M_{\beta}.
\]
With typical parameter values, the minimum value will generally be much greater than $2^{128}$, which is the commonly used benchmark for security against exhaustive key search attacks [21, 22, 23]. Hence, within the fractional framework, the keyspace can be greatly expanded as compared with traditional and dynamic Caesar ciphers and may be finely tuned depending on the requirements of the user.
\subsection{Confusion and diffusion characteristics}
According to Shannon, \emph{confusion} is a means to hide how the ciphertext depends on the key. Diffusion is the process by which the statistical characteristics of a plaintext are evenly distributed among multiple ciphertext variable symbols. In this case, confusion comes from controlling the map defined as $K_{\mathrm{tot}}\mapsto (s_{n})$ and is detailed in Section~4.2 and diffusion results from the additive combination of both the plaintext index $(P_{n})$ and the aperiodically shifted sequence $s_{n}$.
For example, imagine keys $K_{\mathrm{tot}}$ and $\tilde{K}_{\mathrm{tot}}$ that are identical except in one area. The fractional dynamics also suggest that the two sequence generated from each key $(s_{n})$ and $(\tilde{s}_{n})$ will have many indices that do not agree. Even though both plaintexts are the same, the ciphertext sequences generated from each key $(C_{n})$ and $(\tilde{C}_{n})$ will have no statistical relationship between them, producing the desired result of a very high level of confusion. The symmetricity of the distribution and the low autocorrelation of $(s_{n})$ (defined in Section 5 by histogram, correla-
tion and entropy measures) guarantee that a random plaintext symbol is mixed with an independent shift value for every plaintext symbol. Therefore, this creates a non-correlation between the frequency of the plaintext symbols in the ciphertext and also creates a fast spreading effect of the local variations of the plaintext over several locations within the ciphertext, which is the hallmark of the best diffusion characteristics [21, 22]. The combined qualities of confusion and diffusion make the proposed fractional differential shift cipher equivalent to modern substitution-based stream ciphers in terms of confusion and diffusion behaviour, while having a simple structure.
\section{Security and Statistical Analysis}
\label{sec:security}
In this section we will discuss both the statistical properties, and security, of this new fractional differential shift cipher system. This analysis will be based on Shannon's belief that an effective secret cipher should produce a ciphertext that could be mistaken as produced by a random process, when considered statistically, thus, providing no exploitable statistical information to either the plaintext [21], or encoded message. In this regard, we will evaluate the frequency of the encrypted message, correlation between short range neighbouring characters in the ciphertext, and calculate the measure of information contained in each encrypted block of characters. Finally, we will evaluate how resistant this new system is to the known plaintext attacks and chosen plaintext attacks [22, 23].
\subsection{Resistance to frequency analysis}
As we discussed in Section 2.1, the plaintext and ciphertext index sequences are denoted as pn and cn respectively where both take values within  $\mathbb{Z}_m$. For instance, the values of $j \in \mathbb{Z}_m$ indicate how many times that value occurs in either sequence: $N_j^{(P)}=$ the number of occurrences of element $j$ in pn within the range of $0 \leq n \leq n-1.$ The same applies for ciphertext $N_j^{(C)}$. 
For each symbol $j \in \mathbb{Z}_m$ we write
\[
N_j^{(P)} = \#\{ 0 \leq n \leq N-1 : p_n = j \},
\qquad
N_j^{(C)} = \#\{ 0 \leq n \leq N-1 : c_n = j \},
\]
The total of occurrences is used to generate each corresponding empirical distribution $p_j^{(P)}$ and $p_j^{(C)}$
and define the empirical distributions
\[
p_j^{(P)} = \frac{N_j^{(P)}}{N}, 
\qquad
p_j^{(C)} = \frac{N_j^{(C)}}{N},
\qquad j = 0,1,\dots,m-1.
\]
for each $j \in \mathcal{Z}_{m}$ (i.e. $j=0,1,2,...,m-1).$ Classical Caesar ciphers with fixed shifts are a form of Permutation Cipher because if an element appears in place " pn " it replaces the element at position $c_n$. Therefore, all letters $j$ will be equally distributed; thus, both the plaintext and ciphertext are derived from non-uniform letters based on the historical frequency statistics. Therefore, classical frequencies can be used to break these types of ciphers. In the present construction the ciphertext indices are given by
\[
c_n = p_n \oplus s_n, \qquad n = 0,1,\dots,N-1,
\]
where $(s_n)_{n \geq 0}$ is generated by the fractional Caputo system \eqref{eq:caputo-ivp} and quantised by the map $Q$ in (6). In Section 4.2 of this paper, it was apparent that solving the Caputo initial value problem meant incorporating into the solution all possible values of the evolution parameter $0 \leq t \leq t_{0}$ through time and displayed such sensitivity towards any choice of the three establishment parameters: $(\alpha,x_0,k)$ and the arbitrary temporal step length $h$. Given the above observations, it follows that the entire history of the shift sequence $s_{n}$ would be described as a non-repeating and highly sensitive parametric process over $\mathcal{Z}_{m}.$ Using a natural intuitive assumption that the shift sequence  $s_{n}$ is nearly uniformly distributed over $\mathcal{Z}_{m},$ one could easily derive a probabilistic ciphertext distribution that was identical to one of the four possible ciphertext distributions $(j=0,1,...,m-1)$  resulting from non-uniform distributions  $p_{n}$. This behaviour can be corroborated by the histograms that have been created for plaintext and ciphertext in the numerical experimentation of Chapter 6. The histograms indicate that the plaintext has a typical unequal frequency distribution of that which represents English documents, whereas the corresponding ciphertext histogram is near flat; consequently, standard frequency attacks of monoalphabetic cipher systems would be ineffective [24].
\subsection{Correlation and entropy measures}

Good stream ciphers not only eliminate short-term correlations with their design, but also eliminate the short-range dependence of adjacent ciphertext indexes. The correlation coefficient for the sample of adjacent ciphertext indexes is then computed.
\[
\rho_1 = 
\frac{\displaystyle \sum_{n=0}^{N-2} (c_n - \bar{c})(c_{n+1} - \bar{c})}
     {\displaystyle \sum_{n=0}^{N-1} (c_n - \bar{c})^2},
\qquad
\bar{c} = \frac{1}{N}\sum_{n=0}^{N-1} c_n.
\]
The ideal random key stream should have a value of $\rho_1$ fluctuating around the value of zero. When using traditional Caesar ciphers, the majority of the correlation structure of the plaintext sequence is maintained while using the dynamic Caesar variants based on lower order recurrence equations, there is typically a degree of reduced, but not fully removed, correlation. As a result of the fractional evolution (8) of the fractional evolution (8) of the dynamic Caesar ciphers, and as a result of (3.2) quantisation (3.2) applied to the shift sequences generated, the shift sequence $(s_n)$ produced by the proposed scheme has both long-term memory and high sensitivity to the parameters, thus forcing the sequences $(c_n)$ to behave almost as though they are a series of independent samples taken from the values on $\mathbb{Z}_{m}.$ The result is that $|\rho_1|$ is in practice approximately equal to zero in accordance with the modern encryption standards set forth in [24] and used in image and signal encryption tests. A complementary global indicator is the information entropy of the ciphertext,
\[
H(C) 
  = - \sum_{j=0}^{m-1} p_j^{(C)} \log_2 p_j^{(C)}.
\]
The entropy of a uniform distribution on $\mathbb{Z}_m$ is given by $H(C) = \log_2 m$ Our experimental results indicate that the proposed cipher's entropy approaches the maximum possible for uniform distribution. In contrast, the classical Caesar cipher exhibits a significantly lower amount of entropy, indicating the presence of a large residual statistical structure in natural languages. The combination of high entropy and weak short-range correlations are indicators of confusion and diffusion as described by Shannon [21, 22, 23, 24].
\subsection{Known and chosen plaintext considerations}
The next section will examine how the Scheme responds to a wider variety of attack models. An adversary in a chosen–plaintext attack can request any plaintexts they wish to be encrypted using the same key, whereas an adversary utilizing a known–plaintext attack only has access to a limited number of pairs $(p_n,c_n)$  that were previously encrypted [22]. The adversary utilizing a classical Caesar cipher only needs one known plaintext symbol to learn the amount of the constant shift; however, it does seem that an adversary utilizing the simple dynamic Caesar ciphers will often require far fewer plaintext/ciphertext pairs in order to determine the basis for the underlying linear recurrence relationship. 
In our fractional framework, the observable relation
\[
c_n = p_n \oplus Q\!\bigl(x_n(\alpha,x_0,k)\bigr), \qquad n = 0,1,\dots,N-1,
\]
couples the keystream $(s_n)$ to the parameters $(\alpha,x_0,k)$ through the solution of the Caputo initial value problem. To reconstruct the key from a small fragment of the pair $(p_n,c_n)$ requires the solution of a nonlinear fractional inverse problem: the reconstruction of the parameters $(\alpha,x_0,k)$ based on the noisy, quantised (3) trajectory. The estimate for the sensitivity of (12) indicates that small perturbations in the above parameters produce extensive divergent behaviours in the corresponding trajectories on the $[0, T]$ interval (as noted by (8)). Hence, one may not use the standard comparative approaches of linearising or reducing to a lower dimensional linear system which has been a common line of attack in general Caesar-type cryptosystems. While no absolute claims of provable security may be made using the modern definitions of indistinguishable cryptographic schemes, the presence of a long memory, high sensitivity to parameters and chaotic dynamics leads to a considerable increase in the algebraic and numerical difficulties in attempting reconstructing the key from the leakage of partial plaintext.
\subsection{Comparison with dynamic Caesar ciphers}
We can review how to compare different methods as it relates to frequency distribution by first comparing the elements above. To summarize, with regard to the previous observations, there are qualitative differences between this system of encryption (i.e. fractional differential shift ciphers) and the classical Caesar method and the traditional dynamic Caesar systems.
\begin{itemize}
  \item \emph{Frequency behaviour.}
Frequency characteristics. The classical Caesar systems maintain a plain text histogram. Dynamic Caesar systems partially flatten the frequency distribution, so they will still show distinct peaks for certain high frequency letters. The result of this partial flattening creates a situation where the letter frequency distributions for all of the six data sets above will not differ statistically from the uniform distribution across $\mathbb{Z}_m$ under the fractional differential shift cipher in Section~6.
\item \emph{Correlation and entropy.}
Classical Caesar cipher algorithms have ciphertext statistics (adjacent symbol correlation and entropy) that are similar to the statistics of plaintext. Dynamic Caesar Type schemes often provide reduced short term correlations; however, they may still remain structurally identifiable. The scheme presented here has consistently been able to achieve almost null neighbour correlations and Entropy measurements that are nearly $\log_2 m$. As a result, they represent the statistical evaluation benchmarks of common image and stream cipher types [25, 26, 27] or those found in similar studies.
\item \emph{Attack surface.}
For a generator with constant or linear order, it is common to be able to recover a portion of the keystream from either known or predetermined plaintext via the solution of a small linear system. However, in our situation, since the keystream is generated by a nonlinear fractal dynamic system with an extensive memory system, it makes it quite difficult and sensitive to uncertainties about the system parameters, as shown in Section~(4.2).
\end{itemize}
The combined effects of these characteristics show significantly improved levels of resistance to both classical and existing dynamic caesar cipher against both statistical attack \& structural attacks due to the enhanced ability provided by a fractional differential shift encryption scheme compared to what currently exists. Yet it also retains the same basic conceptual simplicity found in shift based substitution mechanisms since they provide the ability for an end user to have multiple in/out options on any given encryption key.
\section{Numerical Experiments}
\label{sec:experiments}
This section presents a number of numerical simulations to demonstrate the statistically significant performance of the fractional differential shift encryption scheme being proposed. Unless expressly indicated otherwise, the alphabet $\mathcal{A}$ which is used in these experiments is the set of all byte values $\{0,\dots,255\}$ and the range and system parameters for the Caputo fractional differential system are therefore the same as those used in sections (2.2) and (2.3).
\subsection{Text encryption examples}
\label{subsec:text-examples}

We first consider an English plaintext of length $N = 10\,000$ characters
obtained from a public--domain text.  The secret key is chosen as
\[
  K_{\mathrm{test}} = (\alpha, x_0, k, h, \beta, N)
  = (0.78, 0.15, (1.3, 0.7, 2.1), 10^{-2}, 1.0, N),
\]
and the corresponding Caputo initial value problem~\eqref{eq:caputo-ivp}
is integrated by the predictor--corrector scheme from
section (2.3). The quantisation process outlined in section 2.4, where there is a map from $\mathbb{R}_{n} \to \mathbb{Q}_{n}$, produces the running sequence $(s_n)_{n\geq 0},$ which is used in the encryption rule. Figure 1 and Figure 2 shows a comparison of the empirical frequency distributions of symbols in encrypted form compared to those in clear text. As we would expect, the clear text exhibits the expected skewness of frequency distribution found in english text, where the space character and a few letters dominate the frequency distribution. On the other hand, there is almost no correlation between the frequencies in the cipher text and those in the plain text. This behaviour already indicates that standard monoalphabetic frequency attacks are ineffective against the proposed scheme [24].

\begin{figure}[t]
  \centering

  % Solda: plaintext histogramı
  \begin{minipage}{0.49\textwidth}
    \centering
    \includegraphics[width=\linewidth]{1.png}% <- 1. dosya adı
    \caption*{Plaintext} % İstersen bu satırı silebilirsin
  \end{minipage}
  \hfill
  % Sağda: ciphertext histogramı
  \begin{minipage}{0.50\textwidth}
    \centering
    \includegraphics[width=\linewidth]{2.png}% <- 2. dosya adı
    \caption*{Ciphertext} % İstersen bu satırı da silebilirsin
  \end{minipage}

  % ... iki minipage bittikten hemen sonra:

\vspace{0.5em} % (isteğe bağlı, resimlerle metin arasında küçük boşluk)

\noindent\textbf{Interpretation.} 
Empirical symbol histograms of plaintext and ciphertext for the sample English text ($N = 10\,000$).

\end{figure}
To quantify the flattening effect we compute the Shannon entropy and the
adjacent--symbol correlation coefficient for both plaintext and ciphertext.
The results are summarised in Table~\ref{tab:entropy-corr}.  For $m = 256$,
the ideal entropy is $\log_2 m = 8$ bits per symbol.  The ciphertext entropy
in Table~\ref{tab:entropy-corr} is very close to this upper bound and the
adjacent--symbol correlation is essentially zero, whereas the plaintext
exhibits strong positive correlation and significantly smaller entropy.
These observations are consistent with the benchmarks commonly used in the
statistical evaluation of image and stream ciphers [24, 25,26, 27].

\begin{table}[htbp]
  \centering
  \caption{Entropy (in bits per symbol) and adjacent--symbol correlation
    for the sample plaintext and ciphertext.}
  \label{tab:entropy-corr}
  \begin{tabular}{lcc}
    \hline
    Sequence   & Entropy $H$ & Correlation $\rho_1$ \\
    \hline
    Plaintext  & 4.32 & 0.93 \\
    Ciphertext & 7.99 & 0.01 \\
    \hline
  \end{tabular}
\end{table}

A further experiment concerns key--sensitivity.  We encrypt the same
plaintext with two keys that differ only in a single bit of the parameter
vector $k$ and we measure the proportion of positions where the two
ciphertexts disagree.  For the test parameters above the resulting bit
error rate is approximately $0.498$, which is very close to the ideal
value $1/2$.  Thus a minute perturbation of the key produces two ciphertexts
that are essentially uncorrelated, which is a desirable feature for a
cryptographic keystream generator.

\subsection{Image or gray-level data (optional)}
\label{subsec:image-example}

The same construction can be applied to gray--level data by interpreting
each pixel as an element of $\mathbb{Z}_{256}$ and encrypting the image row
by row using the running shift sequence $(s_n)_{n\geq 0}$.  In this case
the criteria for a good cipher are again a nearly uniform histogram of the
cipher image, low adjacent--pixel correlation and entropy values close to
$\log_2 256$ per pixel [24].  Numerical experiments of
this type, illustrating the behaviour on standard test images, can be
included analogously but are omitted here for brevity.

\subsection{Performance evaluation}
\label{subsec:performance}

To give an indication of the computational cost, we implemented the scheme
in \texttt{C++} on a standard desktop machine and measured the average
encryption time for different plaintext lengths.  The predictor--corrector
integrator described in section~2.3 was used without
any additional optimisation.  Table~\ref{tab:timings} reports the average
encryption times over $50$ runs.

\begin{table}[htbp]
  \centering
  \caption{Average encryption time for different plaintext lengths
    (single--threaded implementation).}
  \label{tab:timings}
  \begin{tabular}{rr}
    \hline
    Length $N$ (bytes) & Time (ms) \\
    \hline
          1\,000  &      3.1 \\
         10\,000  &     33.4 \\
        100\,000  &    354.7 \\
      1\,000\,000 &   3\,842.5 \\
    \hline
  \end{tabular}
\end{table}
The time complexity has a nearly quadratic growth rate $\mathcal{O}(N^{2})$ according to an increasing integer value of $N$, this is primarily due to the fact that, at each iteration of
the fractional predictor–corrector, it requires approximately $\mathcal{O}(n)$ number of arithmetic computations for each of the $N$ number of data elements that were used
to generate the fractional prediction. Many practical applications of the method can accommodate moderate sized messages (up to a few hundred kilobytes) with
computational loads well within limits. Additionally, when working with very long data streams, the theoretical upper bounds on the time complexity (asymptotic time complexity) can be substantially reduced from $\mathcal{O}(N \log N)$ to $\mathcal{O}(n \log n)$ by using fast convolution methods or short–memory approximations, as outlined in Section (7.1).
\section{Implementation and Practical Aspects}
\label{sec:implementation}


\subsection{Complexity and memory footprint}
\label{subsec:complexity}

The dominant cost of the proposed cipher lies in the numerical
integration of the Caputo initial value problem~\eqref{eq:caputo-ivp}
that generates the running shift sequence.  We integrate the system on
a uniform grid $t_n = n h$, $n = 0,1,\dots,N$, by means of the
fractional Adams--type predictor--corrector scheme described in
section~(2.3); see, e.g.,
Diethelm--Ford--Freed and Diethelm for a detailed analysis of this
method, [5, 13].  At the $(n+1)$th
step, the corrector update involves a weighted sum over all previously
computed function values $F(t_j,x_j;k)$, $j=0,\dots,n$, so that the
work per step is proportional to $n$.  Consequently, the total number
of floating point operations required to produce a trajectory of
length $N+1$ is of order
\[
  \sum_{n=0}^{N} \mathcal{O}(n) = \mathcal{O}(N^2).
\]
Since the cost for the quantisation map $Q$ and the modular additions of the shift rule in Section 3.3 is linear in $N,$ the full encryption run will be constrained to the $\mathcal{O}(N^2)$ complexity of a fractional integrator. With regards to memory, the traditional predictor–corrector implementation stores the previous values $x_{j},$ as well as the optional evaluations $F((t_j,x_j;k)$ which occur on the grids, yielding a memory footprint of $\mathcal{O}(N)$  real numbers; this is acceptable for the message lengths used in the experimental trial. If there are multiple plaintexts of equal length being encrypted using the same key, the pre-computation of the shift sequence $(s_n)_{n\ge 0}$ can be done once and use this pre-computed value for subsequent encryptions; in this way, the numerical computation cost for the integration is spread out over all of the encryption session costs. Many researchers have recommended an approach to implement fast versions of convolution-based techniques to solve Caputo's equation with either FFT (Fast Fourier Transform) acceleration or by compressing the kernel using a sum-of-exponentials method. See Garrappa's survey for examples [28]. Using these methods can allow users to solve the Caputo equation in $\mathcal{O}(N\log N)$ time as opposed to $\mathcal{O}(N)$ time, with memory requirements being $\mathcal{O}(N)$ or less. The methods we discuss in this paper do not utilize these techniques, but they can be applied easily to our framework without modifying the design of the cipher. In addition, these optimizations provide an efficient route to real-time execution for high-volume data, such as plaintext files with many megabytes in length.
\subsection{Parameter selection guidelines}
\label{subsec:parameter-selection}

In practice, the choice of the parameters
\(
K_{\mathrm{tot}} = (\alpha,x_0,k,\beta,h,N)
\)
is constrained by a trade--off between security, numerical accuracy and
implementation cost.  The analytical results of Section~4 and the
experiments of Section~6 provide a set of practical guidelines, which
we summarise below.

\paragraph{The Fractional order \(\alpha\).}
The value of the fractional order $\alpha$ within a range of $(0,1)$ determines the amount of long–memory effect. A smaller fractional order indicates that the kernel within the Volterra equation (3) has a slower decay than a larger fractional order, which approaches classical first-order behavior (e.g., see Podlubny [4]). To make the fractional order suitable for cryptography, we will instead restrict \([\alpha_{\min},\alpha_{\max}]\subset(0,1)\). In particular, selecting $\alpha$ closer to $0$ will result in increased values of numerical stiffness and an increased roundoff effect, while selecting $\alpha$ very close to $1$ results in decreased impact of fractional dynamics and creates an experience very similar to a standard dynamic, memoryless Caesar cipher. Based upon the experimental results, those values of $\alpha$ that are considered in the middle of the Scale between these two extremes appear to provide sufficient balance between both sensitivity and numerical robustness.
\paragraph{Initial condition and key vector.}
Section~4 provides an upper bound \(|x(t)|\) for each $k$ (admissible key vector) and any initial value $x_{0}$ (the value at $t=0$), which will contain $x(t)$ within the compact interval which continuously depends on \((\alpha,x_0,k)\). It is thus reasonable to provide floating point implementations with limits away from the overflow limits of the underlying arithmetic for \(x_0\) and components of $k$; and provide average ranges of $k$, because small variations in \((\alpha,x_0,k)\) will also give rise to significant changes in trajectories as indicated by the results of the sensitivity analysis, a behaviour we would like to see when developing key-scheduling algorithms.
\paragraph{Step size \(h\) and final time \(T=Nh\).}
The value for total $(T)$ will be taken with the notation \(T=Nh\), where: $h$ denotes the step-size. The step size will serve two functions: First, It is associated to the level of accuracy obtained by the fractional integrator, and second, it indicates the total amount of computational effort required. As a general rule with regard to the fractional Adams-type Predictor-Corrector scheme: The Global Error will be represented by the notation \(C h^{p}\) where the exponent \(p>0\) would indicate the accuracy based on the regularity of the solution, as stated by Diethelm [5]. Thus, by selecting $h$ to be a greater value will generally decrease the statistical characteristics of the generated shift sequence, and by selecting h to be a lesser value, will enhance the expense associated with producing this number sequence with an \(\mathcal{O}(N^2)\) complexity (i.e. as discussed in Section 7.1). We set h in such a way that further halving of the value of h will not produce any visible changes in the values of the histograms or correlation plots shown in Section 6; this is a practical method to determine when to stop. Additionally, the effective length N of the shift sequence must be appropriate for the intended use. For short messages, it is easier to create new sequences for every encryption, while with long streams, the sequences can be produced in blocks of N size and concatenated together, assuming that the underlying numerical integration remains stable over the corresponding time interval [0,T].
\paragraph{Quantisation and scaling.}
The scale factor \(\beta>0\) determines how a location xn is passed on to the Zm ring through the quantisation map \(Q(x) = (\lfloor \beta x \rfloor \bmod m)\). If $\beta$ is too small, consecutive values of \(x_n\) may all be mapped to the same index, and this could cause statistical irregularities among the values of \(x_n\) in the resulting shift sequence. Conversely, very large values of \(\beta\) can result in unintentional overflows or abandonment of significant digits in arithmetic with fixed–precision. In application, \(\beta\) is set such that the observed distribution of \((s_n)\) over \(\mathbb{Z}_m\) is as close as is feasible to uniform as can be confirmed via the numerical experimentations and findings in Section 6. When viewed together, these factors provide evidence that there exists a large area where the numerical scheme will be stable and that it can generate a shift sequence with all the required long memory and sensitivity characteristics, while also being able to be implemented in an efficient manner on commercially available hardware. In this area, the user has the option to select specific values of \((\alpha,x_0,k,\beta,h,N)\) according to security level needs for both security and performance for the intended application.
\section{Conclusions}
\label{sec:conclusion}
In this paper, we presented a fractional order differential shift encryption method which uses a Caputo fractional order system to generate a running shift sequence that is subsequently quantized into a symbol set using one of several possible rules. The Caputo-based initial value problem used to generate the shift sequences has been established as well-posed, indicated by both significant dependence on the initial condition and parameters, and the ability to exhibit both long memory effects and extreme sensitivity, creating computational complexity to support the generation of key-dependent chaotic sequences. Beyond that, properties such as the periodic nature of the generated shift sequences and an extremely large effective key space indicate that it should be able to serve well as a key stream generator in cryptography. We performed some numerical tests on a corpus of text data; our findings showed that the histograms of ciphertexts were approximately uniform in distribution and have approximately the maximum value of the measure of entropy, and only a negligible degree of correlation between adjacent ciphertext symbols. Also, tests of key sensitivity yielded error rates of nearly one-half, suggesting that the system has a high degree of resistance to statistical attacks and to methods where the attacker has access to ciphertexts generated using the key. Timing measurements indicated that goodness-of-fit measures are reasonable as the cost of implementing the existing version of a fractional Kalman predictor-corrector is still quadratic, therefore, the implementation will remain efficient for medium-sized messages, using a comparatively low amount of memory.

\section{Future Work}
\label{sec:future-work}
The results of the current research provide readers with numerous directions for further research. First, a primary topic for future research is to explore the implications of changing the underlying fractional operator. Researchers could use fractional derivatives based on different memory kernels (e.g., $\psi$-Caputo fractional derivatives) as opposed to only working with the Caputo fractional derivative. By changing the memory kernel, researchers can study the influence of the various memory kernels on a trajectory's long-range memory and the statistical characteristics of the running shift sequence, and thereby evaluate the size of the effective key space. By performing a systematic comparison of similar types of operator with respect to these forms of fractional encryption, it will enable a clearer determination on how much of the confusion and diffusion observed within the results is specific to the Caputo kernel, or how much is common across a broader range of fractional options. A second area for future research will be the creation of block and hybrid ciphers using the new proposed key stream generator. Refinements to existing schemes such as substitution/ permutation (SPN) network may occur through an interaction with the fractal derivative shift sequences, or by integrating their use into other block cipher mode operation to take full advantage of statistical properties arising from fractional dynamics combined with structural properties of today’s symmetric enciphering primitives. Also, as future research looks into the security of hybrid designs, analyses of future attack models against chosen plain and chosen cipher text should be included. While developing new methods for minimising operational overheads associated with implementing fractional integrators should be considered for implementation design. The use of fast convolution methods, short-memory approximations, and graphics processing unit (GPU) implementations will help to reduce the asymptotic complexity from $\mathcal{O}(N^{2})$ to $\mathcal{O}(N\log N)$ for long data streams in order to make it feasible for high throughput applications. Coupling the fractional dynamical generator with data-driven methods for parameter estimation and performance prediction appears to be an exciting area of research. For example, techniques similar to those used in [29] using regression and deep learning will assist in identifying admissible parameter regions with maximum entropy, minimal statistical leakage, as well as automatically identify weak configurations. A fusion of fractional dynamical systems and machine learning will allow adaptive parameter tuning of encryption schemes based on the statistical behaviour of the incoming data, thus improving the overall security of the system.
\begin{thebibliography}{99}

\bibitem{stallings2011}
Stallings, W. (2011). Cryptography And Networksecurity Principles Andpractice.

\bibitem{katzlindell2014}
Katz, J., \& Lindell, Y. (2014). Private-key encryption. In \textit{Introduction to Modern Cryptography}(pp. 77-82). CRC Press.

\bibitem{brownClassical}
L.~Brown,
\textit{Classical Encryption Techniques},
lecture notes on substitution ciphers and frequency analysis,
available online.

\bibitem{podlubny1999}
Podlubny, I. (1998). \textit{Fractional differential equations: an introduction to fractional derivatives, fractional differential equations, to methods of their solution and some of their applications} (Vol. 198). elsevier.

\bibitem{diethelm2010}
Diethelm, K. (2010). The analysis of fractional differential equations: An application-oriented exposition using differential operators of Caputo type.

\bibitem{zolfaghari2022}
Lin, L., Zhuang, Y., Xu, Z., Yang, D., \& Wu, D. (2023). Encryption algorithm based on fractional order chaotic system combined with adaptive predefined time synchronization. \textit{Frontiers in Physics, 11,} 1202871.

\bibitem{ibrahim2022beta}
Ibrahim, R. W., Natiq, H., Alkhayyat, A., Farhan, A. K., Al-Saidi, N., \& Baleanu, D. (2022). Image Encryption Algorithm Based on New Fractional Beta Chaotic Maps. \textit{Computer Modeling in Engineering \& Sciences (CMES), 132}(1).

\bibitem{feng2023lorenz}
Feng, W., Wang, Q., Liu, H., Ren, Y., Zhang, J., Zhang, S., ... \& Wen, H. (2023). Exploiting newly designed fractional-order 3D Lorenz chaotic system and 2D discrete polynomial hyper-chaotic map for high-performance multi-image encryption. \textit{Fractal and Fractional, 7}(12), 887.
\textit{Fractal and Fractional}, 7(12), 887, 2023.
\bibitem{ç}
Vignesh, D., Fataf, N. A. A., \& Banerjee, S. (2023). A novel fractional sine chaotic map and its application to image encryption and watermarking. \textit{Applied Sciences, 13}(11), 6556.
\bibitem{.}
Menezes, A. J., Van Oorschot, P. C., \& Vanstone, S. A. (2018). \textit{Handbook of applied cryptography}. CRC press.
\bibitem{..}
Stinson, D. R. (2005). \textit{Cryptography: theory and practice}. Chapman and Hall/CRC.
\bibitem{...}
Kilbas, A. A. (2006). Theory and applications of fractional differential equations. \textit{North-Holland Mathematics Studies, 204.}
\bibitem{.}
Diethelm, K., Ford, N. J., \& Freed, A. D. (2002). A predictor-corrector approach for the numerical solution of fractional differential equations. Nonlinear Dynamics, 29(1), 3-22.
\bibitem{.}
Scherer, R., Kalla, S. L., Tang, Y., \& Huang, J. (2011). The Grünwald–Letnikov method for fractional differential equations. \textit{Computers \& Mathematics with Applications, 62}(3), 902-917.
\bibitem{.}
Jacobs, B. A. (2015). A New Grünwald‐Letnikov Derivative Derived from a Second‐Order Scheme. In \textit{Abstract and Applied Analysis} (Vol. 2015, No. 1, p. 952057). Hindawi Publishing Corporation.
\bibitem{.}
Kocarev, L. (2002). Chaos-based cryptography: a brief overview. \textit{IEEE Circuits and Systems Magazine, 1}(3), 6-21.
\bibitem{.}
Jiang, S., Ding, D., Yang, Z., \& Hu, Y. (2022, August). A Fractional-Order Chaotic System and its Image Encryption. In \textit{2022 IEEE 5th International Conference on Electronic Information and Communication Technology (ICEICT)} (pp. 178-182). IEEE.
\bibitem{.}
Wei, J., Zhang, M., \& Tong, X. (2021, August). Image encryption algorithm based on fractional order chaotic system. In \textit{2021 IEEE 12th international conference on software engineering and service Science (ICSESS)} (pp. 72-75). IEEE.
\bibitem{.}
Gokyildirim, A., Çiçek, S., Calgan, H., \& Akgul, A. (2024). Fractional-order Sprott K chaotic system and its application to biometric iris image encryption. \textit{Computers in Biology and Medicine, 179}, 108864.
\bibitem{.}
Sene, N. (2021). Analysis of a fractional-order chaotic system in the context of the Caputo fractional derivative via bifurcation and Lyapunov exponents. \textit{Journal of King Saud University-Science, 33}(1), 101275.
\bibitem{.}
Shannon, C. E. (1949). Communication theory of secrecy systems. \textit{The Bell system technical journal, 28}(4), 656-715.
\bibitem{.}
Stinson, D. R. (2005). textit{Cryptography: theory and practice}. Chapman and Hall/CRC.
\bibitem{.}
Menezes, A. J., Van Oorschot, P. C., \& Vanstone, S. A. (2018). \textit{Handbook of applied cryptography}. CRC press.
\bibitem{.}
Mohammad, O. F., Rahim, M. S. M., Zeebaree, S. R. M., \& Ahmed, F. Y. (2017). A survey and analysis of the image encryption methods. \textit{International Journal of Applied Engineering Research, 12}(23), 13265-13280.
\bibitem{.}
Katz, J., \& Lindell, Y. (2007). \textit{Introduction to modern cryptography: principles and protocols.} Chapman and hall/CRC.
\bibitem{.}
Menezes, A. J., Van Oorschot, P. C., \& Vanstone, S. A. (2018). \textit{Handbook of applied cryptography.} CRC press.
\bibitem{.}
Shannon, C. E. (1949). Communication theory of secrecy systems. \textit{The Bell system technical journal, 28}(4), 656-715.
\bibitem{.}
Garrappa, R. (2018). Numerical solution of fractional differential equations: A survey and a software tutorial. textit{Mathematics, 6}(2), 16.
\bibitem{.}
Hajrulla, S., Özer, Ö., \& Demir, T. (2025). Polynomial Regression and Faster R-CNN Models for University Library Decision Implementation Discovery based on Deep Learning. \textit{WSEAS Transactions on Information Science and Applications, 22}, 83-92.
\end{thebibliography}
\end{document}




