Key Recovery from Embedded Symmetric-Cipher Key Schedules via Sequential Peeling on Lagrangian Submanifolds

Abstract

: We show that a symmetric-cipher key schedule embedded onto a Lagrangian submanifold leaks its key in closed form. In the Lagrangian Balanced Encryption (LBE) construction, each schedule byte sets the kick strength of one iterate of the Chirikov standard map, and the difficulty of identifying a Lagrangian from limited observations is taken to protect the key. Our central result overturns that premise: the tangent-map trace of the embedding is an exact affine function of each key byte once the earlier bytes are fixed. This single algebraic fact turns byte-by-byte recovery from a heuristic into a proof. Identifiability follows in closed form, the recovery estimator is a linear least-squares solve with an analytic error law, and the apparent “multiplicative entanglement” that seems to bind the bytes together is revealed as nothing more than an artefact of observing the system at full depth. Given a depth-stratified tangent-map oracle on an admissible query set, sequential peeling recovers the embedded 120-byte prefix of the Advanced Encryption Standard with a 256-bit key (AES-256) schedule and hence the full 32-byte master key—with zero known key bytes on every trial, and does so identically for Serpent-256, ChaCha20, PRESENT-128, SPECK-128/256 and a SHAKE-driven control: recovery is a property of the embedding, and any cipher embedded this way inherits it. The method is fast (one linear solve per byte), robust (100% up to 10 − 4 relative observation noise, matching the analytic law), independently validated against an extended-precision oracle, and reproduced by a chosen-plaintext variant that uses only momentum observations, while every full-depth zero-knowledge optimiser we tried fails below 5%. The one prerequisite is that the embedding expose its depth-stratified geometry—a conventionally deployed cipher does not, and is unaffected.