Security notice. ITB is an experimental symmetric cipher construction without prior peer review, independent cryptanalysis, or formal certification. The construction's security properties have not been verified by independent cryptographers or mathematicians.

PRF-grade hash functions are required. No warranty is provided.

No bespoke cryptography. ITB introduces no cryptographic primitive of its own — no custom S-box, permutation, or round function. It is a construction over existing primitives, much as PGP composes standard ciphers rather than defining one. Such constructions are not the object of algorithm-level cryptographic certification: national regimes (NIST CAVP/FIPS in the US, GOST/FSB in Russia, OSCCA's SM-series in China, IC3S in India, SOG-IS/EUCC and national lists in the EU, ASD's ISM in Australia, CRYPTREC in Japan, KCMVP in South Korea) certify primitives and the modules built on them, not compositional schemes. Eligibility for regulated use is therefore inherited from the primitives ITB is configured with, not conferred by ITB itself.

Companion document to SCIENCE.md. This file is the audit-oriented operational reference — composition modes matrix, cross-scheme comparisons, deployment threat model, design-rationale tables, compliance framing, and the explicit non-closed threats list. The formal construction and proofs live in SCIENCE.md and PROOFS.md; the accessible-explanation narrative lives in ITB.md. Sections cross-referenced below point to the authoritative source for each topic.

Supported versions. Active development tracks main. Security fixes land on main first; older tags receive backports only when the maintainer judges the fix worth backporting (rare given the pre-release status).

Reporting a vulnerability. Private reports preferred via GitHub Security Advisories. Discord channel for coordination: discord.gg/wRYF8shHpd. Email contact is intentionally not published — Discord and Security Advisories cover both informal triage and formal disclosure.

Triage and response. Best-effort triage within 14 days. Pre-release status means no SLA or commercial support is implied. Responses are individually authored, not template-driven.

Coordinated disclosure. Findings against the construction — cryptanalytic attacks, theoretical weaknesses, implementational flaws — are most welcome and prepared for academic publication. A 90-day coordinated disclosure window is the default; faster public disclosure may be appropriate when a fix lands quickly or the finding is already public via parallel discovery. The ITB construction was published to invite scrutiny, not to claim closed-form security — cryptanalytic findings under the author's own attribution are explicitly encouraged.

Out of scope. Hardware-level attacks (DPA/SPA, Spectre, Meltdown, Rowhammer, cache timing, fault injection), supply-chain attacks against dependencies, attacks against the host OS / language runtime / hardware platform itself. See the Disclaimer above.

† Software-level property under the random-container model; no guarantees against hardware-level attacks (see Disclaimer). The information-theoretic barrier under passive observation applies to Part 2 (per-pixel absorption, P(v | h) = 1/2 from Proof 1); Part 1's per-chunk mask permutation is a PRF-conditional layer keyed by the lockSeed (Proof 11), and the two parts always run together as the shipped indivisible barrier composition (see SCIENCE.md § 1.5 Interlocked Barrier).

¶ CCA eliminates noise bits (12.5 %), but CSPRNG fill bytes remain encrypted in data bit positions by dataSeed — indistinguishable from plaintext (Proof 10).

‡‡ MAC + Silent Drop assumes the attacker is unaware of MAC presence. If the attacker knows MAC is inside (e.g., insider knowledge), the encrypted MAC tag serves as a local verification oracle during brute-force — the attacker decrypts with candidate keys, computes MAC(payload), and checks against the embedded tag without requiring recipient response. Search cost remains P ×ばつ 2^(2·keyBits) (same as Core ITB — no CCA, noiseSeed not leaked, both seeds must be searched jointly), but the attacker can now verify candidates. Without insider knowledge: no verification → plausible deniability. Grover: √P ×ばつ 2^keyBits.

For the underlying PRF requirements, 8-seed isolation proof, and multi-factor KPA argument, see SCIENCE.md § 1.1 ChainHash, § 2.3 8-Seed Isolation, § 2.6 Multi-Factor Full KPA Resistance. For cross-cipher key-size and primitive-requirement comparisons and the AEAD comparison matrix, see SCIENCE.md § 4 Comparison with Existing Ciphers. For the byte-splitting property analysis, see SCIENCE.md § 2.10 Byte-Splitting Property.

‡ Deprecated construction (TLS 1.0 / 1.1, RFC 8996). Included for historical context only.

For the CCA leak upper bound proof and ITB's noise-position-only bound, see SCIENCE.md § 2.8 CCA Leak Upper Bound and Proof 6.

The always-on Interlocked Barrier (SCIENCE.md § 1.5) is a per-chunk 48-bit PRF-keyed permutation drawn from a ≈ 2^70.20 mask space. It applies uniformly across every column in the table below; the barrier's contribution to the KPA / Crib KPA / CPA columns is architectural and PRF-conditional, and stacks on top of the pixel-level obstacles listed per cell.

† IT barrier is a software-level property under the random-container model; no guarantees against hardware-level attacks (see Disclaimer).

* Per-bit XOR hides XOR masks under passive observation; with an invertible primitive, naive pixel-level inversion would attempt seed recovery, but the always-on Interlocked Barrier's Part 1 permutation forecloses the SAT anchor at instance-formulation (see REDTEAM.md § FNV-1a lo-lane SAT).

** MAC + Reveal: CCA reveals noisePos but not startPixel (startPixel determined by independent startSeed + nonce, not transmitted). startPixel enumerated as [0, P). Total: P ×ばつ 2^keyBits classical, √P ×ばつ 2^(keyBits/2) Grover. At 1024-bit keys under the unified MinPixels floor (P = 400): classical ~2^1033, Grover ~2^516. With invertible primitive under KPA: the always-on Interlocked Barrier's per-chunk mask permutation (Part 1, keyed by lockSeed independent of noiseSeed) forecloses the SAT anchor even under the maximum-peek attacker regime — Bitwuzla returns UNSAT on the naive-crib anchor with FNV-1a on every seed role (see REDTEAM.md § FNV-1a lo-lane SAT). Full multi-factor obstacle enumeration in SCIENCE.md § 2.6.

††† Core ITB and MAC + Silent Drop (no oracle): attacker must jointly search noiseSeed and dataSeed — without dataSeed, noiseSeed output is indistinguishable from random, so independent attack on noiseSeed is impossible. Joint search space: 2^(2·keyBits). startSeed contributes only P (startPixel candidates, enumerated as [0, P)), not 2^keyBits. Total: P ×ばつ 2^(2·keyBits). Grover: √P ×ばつ 2^keyBits. At 1024-bit keys under the unified MinPixels floor (P = 400): classical ~2^2057, Grover ~2^1028.

§§ CCA removes noise bits (12.5 % of container), but CSPRNG fill bytes encrypted by dataSeed persist in data bit positions, indistinguishable from plaintext. The information-theoretic barrier is reduced, not fully eliminated (Proof 10).

Nonce reuse is local. The shipped wire carries two independent nonces (main_nonce and interlock_nonce) drawn per encrypt from crypto/rand and enforced pairwise-distinct at the API, so caller-side reuse is not reachable through the shipped surface. Under a lab-forced dual-slot / main-only / interlock-only collision, plaintext recovery is null under every attacker-realistic probe at the tested sample sizes (see REDTEAM.md § Nonce reuse): the barrier's per-chunk PRF-keyed 48-bit mask permutation removes the demask anchor even under the maximum-leverage dual-slot collision (modifier †† below). Seeds remain secret (PRF non-invertibility blocks ChainHash inversion), so future messages with fresh nonces are unaffected — no key rotation required. A single nonce collision provides too few observations for Simon, BHT, or quantum structural algebraic attacks. Unlike AES-GCM where nonce reuse leaks the GHASH key H and enables forgery until key rotation (global catastrophe affecting all subsequent messages), ITB nonce collision is strictly local — ITB is nonce-misuse-resistant under the PRF assumption. For the usage-precondition framing and the demasking disclaimer, see ITB.md § 9 Nonce Reuse.

†† Interlocked Barrier modifier. The always-on Interlocked Barrier removes the demask entry point on the colliding messages: the per-chunk PRF-keyed 48-bit mask triple is applied before COBS, so the two-time-pad XOR yields lane-compressed bits l0(P1) ‖ l1(P1) ‖ l2(P1) ⊕ l0(P2) ‖ l1(P2) ‖ l2(P2) interpretable only with lockSeed and PRF-opaque under the PRF assumption. Empirically, plaintext recovery is null under every attacker-realistic dual-slot / main-only / interlock-only collision probe at the tested sample sizes (see REDTEAM.md § Nonce reuse). See SCIENCE.md § 1.5 and § 2.15 for the full barrier construction.

§ CCA reveals noise bit positions, but does not eliminate all ambiguity: CSPRNG fill bytes in data positions remain encrypted by dataSeed, indistinguishable from plaintext (Proof 10).

Every entry point applies the CCA-resistant MinPixels floor uniformly, so the auth-side envelope covers Core ITB, MAC + Silent Drop, and MAC + Reveal — one row per metric, no plain-vs-auth split.

The Landauer row bounds the cost of blind enumeration of the noise-barrier space; it does not bound structural attacks that do not enumerate.

Under CCA (MAC + Reveal) the noise positions are revealed but CSPRNG fill in data positions persists as residual ambiguity (Proof 10); the noise-barrier headline is stated at the unified MinPixels floor. For the noise-barrier bound derivation, see Proof 5; for the per-chunk mask-space derivation, see Proof 11.

8/1 is Pareto-optimal among the analyzed noise-density configurations. The Barrier column for 8/1 is stated at the unified MinPixels = 400 floor from §4; the other rows carry each format's own data_bits ×ばつ MinPixels(format) for the illustrative comparison. All noise-barrier exponents place blind enumeration above the Landauer bound; that scopes to enumeration cost, not to structural attack resistance.

Implemented: Inside (full capacity) — every shipped MAC Authenticated Low-Level entry point (EncryptAuth3x{128,256,512}Cfg) and every triple.Pipeline profile that enables MAC. Other placements are theoretical alternatives, not implemented. For the composition analysis, see SCIENCE.md § 2.13 MAC-Inside-Encrypt Composition.

For detailed per-CVE analysis of 20+ hardware attacks (Spectre variants, Downfall, Hertzbleed, MDS, Zenbleed, Rowhammer), see HWTHREATS.md.

The optional C pixel processing backend (CGO_ENABLED=1, GCC -O3 -mavx2) was verified for side-channel equivalence with the Pure Go backend:

The analysis applies equally to ARM64 NEON auto-vectorization: veor, vand, vorr, vshl, vshr are constant-time on ARM. ARM sdiv (for % totalPixels) is variable-time but operates on public data only. ARM has no frequency throttling from NEON (unlike Intel AVX-512).

Both backends produce identical ciphertext. Switching between CGO_ENABLED=0 (Pure Go pixel kernel; Go-assembly hash ASM stays engaged) and CGO_ENABLED=1 (C + SIMD pixel kernel) does not change the security model on any platform.

Every shipped registry primitive is a PRF-grade construction that satisfies the requirements catalogued in SCIENCE.md § 1.1 ChainHash and § 2.6 Multi-Factor Full KPA Resistance. Tests and benchmarks cover every registry entry across the 128 / 256 / 512-bit widths shipped by the ChainHash surface; the concrete registry list is authoritative in hashes/registry.go. For per-primitive technical notes (Areion-SoEM proofs, BLAKE / ChaCha20 kernels, AES-CMAC construction, SipHash keying), see the hashes/CONSTRUCTIONS.md reference.

For key-size and primitive-requirement comparisons vs AES / ChaCha20 / Threefish, see SCIENCE.md § 4 Comparison with Existing Ciphers. For the effective key-size table by hash width (128 / 256 / 512), see SCIENCE.md § 6 Implementation and ITB.md § 4 8-Seed Isolation.

Framed as «outside the barrier's threat model» where that is the honest description, and as «conditional» where the barrier's closure depends on a precondition. None of these is a claim that the barrier is weak — they are the boundary of what the barrier addresses. The full cryptographer verdict enumerating these classes appears in the pre-flight review; the summary sentence from that verdict is preserved here verbatim:

Closure of the KPA / CPA families is conditional on a secure PRF and fresh nonces; total inversion or a reused nonce is outside what the barrier closes.

• Total or systematic PRF inversion. The barrier is explicitly PRF-conditional. Total inversion of the configured primitive lets the attacker resolve the per-chunk masks, the startPixels, and the seed components algorithmically, collapsing every architectural obstacle. Systematic partial PRF inversion is raised in cost but not eliminated. Outside the barrier's power to close.
• Nonce reuse. Closure of the CPA / KPA families is conditional on fresh per-message nonces on both header slots — the main nonce that feeds the per-pixel and per-snake derivations and the independent interlock nonce that feeds the barrier's per-chunk mask draws. Under joint collision of both, the barrier's per-chunk masks repeat; the shipped API generates each of the two nonces internally per call, which prevents caller-side reuse, but that is an API-discipline property, not a construction-level guarantee. Simultaneous collision on both slots requires a CSPRNG hardware fault. Empirically the lab-forced dual-slot collision recovers zero plaintext bytes at the tested sample sizes (see REDTEAM.md § Nonce reuse) — the structural closure argument is conditional; the empirical outcome is null.
• Upstream key-management / related-seed supply. The 8-seed API draws independent CSPRNG components and rejects both pointer and byte-level Components collisions, so related-seed differentials do not arise through the shipped surface. A defective upstream KDF that supplies correlated seeds is outside the construction's control. Threat-model boundary, not a barrier property.
• Physical side channels (timing, power, EM, cache, speculative execution). Out of scope by construction — leakage is a property of the execution environment, not the algorithm. The barrier's own kernels are written to a constant-time discipline (mask-merge only, no secret-dependent branches or memory accesses; the deterministic reduction avoids rejection sampling precisely to stay branch-free), but a deployment-level side-channel evaluation is per-CPU, per-compiler, and orthogonal to the algorithm-level claims. See HWTHREATS.md for the per-instruction inventory.
• Key-material compromise. If the seeds or the derived state leak through any channel, confidentiality is lost by definition. The barrier assumes secret seeds.
• Implementation defects in the shipped Go code. The architectural argument assumes the code correctly implements the construction. Bugs in the unrank kernels, the reduction, the interleave, or the seed plumbing would be defects the architecture cannot self-correct. The test suite demands byte-level asm ↔ Go parity, directed reduction-boundary vectors at the exact gcd / preimage-cut points, and mask disjointness / popcount assertions rather than roundtrip tests alone.
• Fault injection. Active perturbation of the running computation is a hardware-execution threat outside the algorithm's model.
• CCA via a deployment decryption oracle. Core ITB and MAC + Silent Drop expose no oracle; MAC + Reveal is an optional deployment mode whose CCA behaviour is per-deployment and bounded by Proof 6 (noise position, 3 bits per pixel). Whether an oracle exists at all is a protocol choice, not a barrier property.
• Quantum key recovery. The seed-space search under Grover is a hypothetical upper-bound argument, not something the barrier addresses directly; the oracle-degradation framing applies (under Silent Drop there is no verification predicate for Grover to run against). Post-key quantum recovery is outside the barrier's threat model. For the full quantum resistance analysis, see SCIENCE.md § 3.3 Quantum Resistance.
• Undiscovered cryptanalysis. No finite argument, architectural or empirical, establishes resistance to techniques not yet known. The construction has had no external cryptanalysis or formal certification. For the scope and maturity disclaimer, see SCIENCE.md § 7 Scope and Maturity Disclaimer.