K4 · live cryptanalysis

Phase 2A.1 was the project's first attempted attack family after Phase 1 reconnaissance. It was prioritized as #1 in the queue because two independent observations converged on period 7 as a structural feature of K4:

1. Project's own statistical baseline (2026-04-29): lag-7 autocorrelation z = +3.05 against a 10,000-string random-uniform null. The strongest periodic signal across lags 1–25. 2. 1992 NSA internal note (Bean 2018): described K4 as exhibiting "roughness on interval 7" and proposed "polyalphabetic substitution followed by transposition" as the candidate diagnosis.

Two independent analyses, 34 years apart, on the same period, on the same ciphertext. Synthesis Agent's H3 × S1 intersection — the strongest single hint × signal intersection in the project's catalog — and the basis for ranking width-7 columnar transposition + Vigenère as Phase 2's entry point.

The strategy implemented in attacks/strategies/ (deprecated after this phase, not preserved verbatim in current code):

• Stage 1: width-7 columnar transposition. Enumerate all 5040

(= 7!) column permutations. Apply each to K4_CIPHERTEXT to produce an intermediate.

• Stage 2: KRYPTOS-keyed Vigenère decryption of the intermediate

with key lengths 5 through 15.

• Crib gate: every output checked against core.cribs.validates.

Search space: 5040 transpositions × Σ(26^k for k in 5..15) ≈ ~10^15 naive, reduced by crib-anchored filtering to a tractable ~333 M actual attempts on the runner before demotion.

Per Supabase attack_runs aggregated as of 2026-04-30 09:00Z:

• 1 attack_runs row for phase_2a1_width7.
• Cumulative total_attempts: ~333 million.
• Candidates that passed the crib gate: 0.
• Throughput: ~17,000 attempts/sec on the 2-core ARM compute host.

Distribution observer was not yet deployed during this phase (it landed 2026-05-02), so per-region IoC histograms are not available. The sweep ran "blind" to telemetry refinement — only the crib oracle + heartbeat counters were available.

A separate experiment that ran in parallel — experiments/2026-04-30-period-7-attribution/ — tested whether K4's lag-7 z = +3.05 was caused by the encryption (motivating period-7 attack families like 2A.1) or by the plaintext (which would mean the signal carries no structural information about the cipher).

Setup: 10,000 samples × 4 null distributions × length 97, seed 20260430. Real-English corpus drawn from doranchak's NYT prose reference. K3 plaintext sliding windows used as a third comparison.

Result:

| Comparison cohort | K4 lag-7 z | |---|---| | Random uniform null | +3.0σ | | Length-97 English samples | +1.3σ | | K3 plaintext sliding windows | +0.4σ |

K4's lag-7 signal is **fully explained by English unigram non-uniformity at n=97**, not by period-7 encryption. 56% of K3 plaintext sliding windows have a higher lag-7 correlation than K4's ciphertext.

Consequence: Phase 2A.1's headline motivation (the lag-7 anomaly) was structurally invalidated. The 1992 NSA "interval 7 roughness" finding from Bean 2018 is now of unverified status pending re-derivation under a method that controls for English baseline lag-7.

• Other transposition widths. 7 was specifically motivated by lag-7;

with that motivation invalidated, there's no a-priori reason 7 is privileged. Widths 5, 8, 11, 14 etc. could be tried, but without a guiding hint the search becomes uniform brute force across widths, which is in #5 territory in the queue at best.

• Different second-stage substitutions. The Vigenère assumption

itself is suspect post-period-7-attribution. Quagmire variants and Beaufort would be defensible alternates but again without specific motivation.

The family stays in the priority queue at #5 pending fresh signal — but the active attack queue has moved on.

• Attack queue: width-7 columnar + Vigenère demoted from #1 to #5.
• Phase pivot: opened Phase 2B.1 — Weltzeituhr keystream at

2026-04-30 05:30Z (~3 hours after this phase's null result was clear).

• 2A.1 row in prior_work.md will be updated by Codex on the next

digest pass to reflect this conclusion.

• The period-7 attribution experiment's conclusion is the canonical

reason this phase is closed; cross-link maintained.

• experiments/2026-04-30-period-7-attribution/ — the experiment that

invalidated this phase's motivation.

• experiments/2026-04-30-weltzeituhr-keystream/ — the strategy that

replaced this phase in the active queue.

• knowledge_base/_drafts/hints/masking_technique.md — Scheidt's

"masking technique" hint that motivated period-7 in the first place.