An introduction to the protocol and its security model — nibble-bit key derivation, a self-ratcheting secret state, and layered confidentiality claims that each say exactly what they rest on.
QuStream is a key-material lifecycle and link-security mechanism. A distributor broadcasts high-entropy, QRNG-origin blocks — Q-blocks — as public material. Endpoints that share a secret state derive a fresh message key from each block and refresh that state locally, message by message, without distributing bulk key files. Beyond single blocks, the same mechanism runs over a continuous high-rate broadcast served by an operational mesh of QRNG nodes — the basis of the everlasting mode described below.
This document answers three questions in order: how the key derivation works, why the result is secure, and exactly what is — and is not — being claimed. One distinction underpins everything that follows: the Q-block is public substrate; the secret is the path through it. QuStream's security rests entirely on the secrecy of that path, never on the secrecy of the block.
Three objects matter. The Q-block (Qt) is a public, integrity-protected field of QRNG-origin bits, broadcast each epoch and treated as a two-dimensional grid. The PDK (path-derivation key) — the secret state — is a secret sequence of nibbles held by both endpoints; it encodes a walk through the Q-block: a start position, a direction sequence, and a schedule of (j,k) nibble pairs. The MEK is the message-encryption key — the bits that walk extracts.
The PDK is read as nibble pairs (j,k). For each pair the walk advances j bits, then extracts k bits, repeating until 256 bits have been collected: that sequence is the MEKt. The walk then continues from where it stopped to gather a further 256 bits, which become PDK1 — the refreshed state. The route is not fixed: it may run horizontally, vertically, diagonally, or in dog-legs, so the shape of the walk is itself part of the secret. Two separate, non-overlapping stretches of the same walk therefore produce the message key and the next state from one public block.
j bits (the line crossing plain cells) and takes k (the coloured cells) at each nibble pair, threading horizontally, vertically and diagonally to collect 256 bits of MEK (teal), then continuing into the next 256 bits as PDK1 (slate).After each epoch, regenerate promotes PDK1 to the current PDK0, and the next Q-block drives a fresh walk. Because the update runs one-way through the extraction, an endpoint compromised at one epoch cannot reconstruct earlier states — this gives forward secrecy. Crucially, refreshing the state from a public block adds no new secret entropy; the regenerate step reshuffles the existing secret rather than enlarging it. Fresh secret entropy enters the chain only through initial provisioning or a periodic key-encapsulation step — the distinction that underlies the protocol's confidentiality modes, below.
Each message is authenticated under a single-use key. A universal hash of the message is computed under a secret hash key, and the result is masked with a fresh one-time key drawn from the same extraction. Because the mask is used exactly once, an attacker who has not seen it cannot produce a valid tag for any altered message — even with unlimited computing power. This is information-theoretic authentication, and like the confidentiality claim it is bounded: it holds for as long as fresh one-time key material is allocated to each tag.
QuStream can also run as a perpetual broadcast. Two nodes share only an initial time and an initial PDK, while a high-rate QRNG stream runs between them continuously, day and night, segmented by embedded time-signal markers. At each marker the current PDK walks the new segment to pull three outputs — a message key, an authentication key, and the PDK for the next segment — exactly as in the block mode, but over an unbounded stream rather than a finite reservoir. The chain never runs out: a fresh key is produced every period whether or not it is used, and a minimum and maximum refresh interval may be fixed as part of the shared initial secret. Because the two nodes stay aligned by time and PDK alone, no per-message negotiation is required.
The continuous-stream mode separates two roles. Nodes are the entropy fabric: each is a QRNG source that broadcasts and relays a stream; they generate randomness but derive no keys. Users are the consumers: two users who share an initial time and PDK, reading the same stream, walk it identically and arrive at the same message key, authentication key, and next PDK. This fabric is operational — a mesh of independent QRNG sources at roughly 1.5 Gbit/s each, every stream relayed several times for resilience, aggregating to about a terabit per second of genuine, un-stored entropy. The relays add reach and availability, not secret entropy; the security figure is the unique aggregate rate, not the node count.
A user need not receive the whole stream at all times. Because it knows the time and the PDK, it knows which stream and which segment to read and roughly where its walk will land, so it can tap just that material on cue — from any relay — take its key, and discard the rest, holding a working buffer of about one segment and storing nothing. The adversary, knowing none of this, must retain the broadcast continuously and indefinitely, because a segment once passed cannot be fetched back. That asymmetry — a momentary read for the user against permanent retention for the adversary — is what the bounded-storage guarantee rests on.
Two profiles bracket the choices. A well-connected peer may full-ingest the entire aggregate and select locally; because it takes everything, its reception reveals nothing about what it uses, and the adversary is forced to store the whole fabric. A lighter endpoint may instead weave its keys across a secret subset of streams, receiving only those: cheaper to consume, and — provided the choice of subset stays hidden — still forcing the adversary to store the whole aggregate to threaten arbitrary users. The breadth of the subset is a dial: more streams raise the volume an adversary must capture; fewer lower the cost of participation.
One point of delivery matters. The reception-hiding property belongs to broadcast delivery — RF, satellite (which carries IP payloads), free-space optical, or managed multicast — where a receiver listens without announcing what it takes. Over routed internet unicast, packets are addressed to each user, so an on-path observer can see which streams a user pulls; there, hidden selective reception is not available, and a user either ingests the whole aggregate or accepts that its consumed subset is visible to such an observer. The everlasting guarantee against a global harvester does not depend on this: a harvester who did not store a user's streams can never recover them, on any medium.
The attacker may hold the entire Q-block; it is public. The only secret is the walk — its start (alignment), its direction sequence, and its (j,k) schedule, all encoded in the PDK. Given the public block, the secrecy of the extracted key is therefore bounded by the entropy of the walk, not by the size of the block. Adding diagonals and dog-legs enlarges the space of possible walks and raises the work factor against an attacker, but it cannot manufacture secret entropy beyond what the PDK encodes; entropy that has been transmitted in the clear cannot contribute to secrecy.
When each payload bit is masked with a secret, previously unused key bit — the key stream at least as long as the message, independent of the plaintext, and never reused — the ciphertext discloses no information about the plaintext. This is Shannon-perfect secrecy: for any candidate plaintext an equally plausible key stream is consistent with the observed ciphertext, and the guarantee depends on no computational assumption. The claim is explicitly bounded. A Q-block carries a finite secret budget, and that budget equals the unused secret key material consumed — one secret bit per protected bit.
The continuous-stream mode draws its secrecy from a different source again: the adversary's inability to record the stream. If the broadcast is faster than an adversary can store, the bits the secret walk selects are, with high probability, bits the adversary never kept — so the derived keys carry real secret entropy even though the stream is public. This is the bounded-storage model: it gives information-theoretic security against an adversary of unlimited computing power, conditional on a bound on the adversary's storage rather than on any computational hardness. The guarantee is everlasting — once a segment has passed, its bits are gone, so a harvest-now-decrypt-later adversary cannot reconstruct past keys even with future quantum hardware and unlimited storage — and, unlike the public-block ratchet, each segment injects fresh secret entropy, so the key supply refreshes indefinitely rather than being capped by the initial secret. The strength of the claim is explicit and tunable: it scales with the volume of stream an adversary cannot store, set against the adversary's real storage. Higher aggregate rate, shorter refresh windows, or many independent parallel streams widen that margin (relaying the same stream to more nodes adds reach, not entropy); against a storage-rich adversary the mode degrades gracefully to the computational tier. A privacy-amplification step distils the un-stored entropy into uniform keys.
One residual avenue deserves its own statement. An observer watching a user does not learn the walk — it stays in the PDK — nor the segment from the ciphertext, which is opaque; the only things that can leak are an in-band identifier naming the stream, and a reception pattern that reveals which stream the user pulls. Both are closeable. Stream and segment are derived from the shared secret and a synchronised clock, so packets carry no selector to leak; and on a broadcast medium reception is passive, with nothing on the wire to observe. Where reception is necessarily visible — routed unicast — constant-rate, content-independent reception, decoupled from transmission timing, hides which segments are used at the cost of revealing the set received. Should a user's subset leak to an on-path observer who also stores those streams, that user does not break: it falls back to the secret-walk and one-time-pad tiers, still post-quantum and forward-secure, and every past segment the observer did not store remains everlastingly safe.
The reception leak of §3.4 is a local attack: it needs an observer positioned to see, and attribute, the streams a particular user pulls. That vantage is scarcer than it first appears, because in many common deployments many users already sit behind a single shared address by default. Behind enterprise NAT, carrier-grade NAT on mobile networks — where thousands of subscribers present the same public address — or public Wi-Fi, an observer out on the wider internet sees only traffic to a shared address, not to an individual, and so cannot tie a given stream-subset to a given user. The shared address supplies an anonymity set at no cost, and the more co-located users draw overlapping subsets, the harder attribution becomes.
This is a real but bounded mitigation, and it is worth being precise about its limits. Address-sharing hides a user from observers beyond the sharing point, not from observers at or within it: the enterprise that runs the NAT, the carrier that operates the mobile core, and the access point — or anyone sniffing the local link — still see per-user reception, and those operators are often the very parties with the storage or the legal reach to mount the attack. It is also an anonymity argument rather than a cryptographic one: timing and volume patterns can re-link a flow to a device unless reception is held at a constant, content-independent rate. So shared addressing narrows the attack to adversaries sitting at or below the aggregation point, and constant-rate reception closes most of what remains — and neither is needed for the headline guarantee, which holds against a global harvester regardless, with a defeated reception channel costing a user only a demotion to the secret-walk and one-time-pad tiers, never past traffic.
Beyond the information-theoretic budget, the regenerate ratchet and successive Q-blocks provide a forward-secure key-refresh whose security reduces to standard, published primitives: the path generation under a pseudorandom assumption, and an authenticated-encryption layer over the derived key. This tier is post-quantum and resistant to harvest-now-decrypt-later capture. It carries sustained, bulk traffic; the information-theoretic tier is reserved for traffic whose assurance warrants spending fresh secret material.
Against an adversary who does not observe the block, four quantities are unknown: the block, the path, the alignment, and the epoch state. Against an adversary who holds the public block — the conservative assumption — the block term contributes nothing, and secrecy rests on the path, the alignment, and the epoch state. QuStream counts only what is genuinely secret to the attacker it faces; nothing public is allowed into the budget.
QuStream makes three separate, individually defensible confidentiality claims rather than one broad assertion. Each rests on its own foundation, and none reaches past it.
| Property | One-Time-Pad ITS | Bounded-Storage ITS | Computational |
|---|---|---|---|
| Foundation | Shannon perfect secrecy | Bounded-storage model | Standard primitives |
| Assumption | None | Adversary storage < stream | PRF / AEAD / ML-KEM |
| Compute resistance | Unconditional | Unconditional | Post-quantum |
| Harvest-now, decrypt-later | Immune | Immune — bits vanish | Resistant |
| Operative bound | Provisioned secret, used once | Un-stored stream vs storage | Secret × primitive strength |
| Key supply | Finite reservoir | Indefinite, self-refreshing | Indefinite rotation |
| Forward secrecy | Inherent | Everlasting | One-way ratchet |
| Infrastructure | Preloaded key fill | Shared un-storable broadcast | Q-block epochs |
| Best-fit traffic | Highest-assurance, bounded | Sustained, storage-bound foe | Bulk / general |
Claims of different strength — unconditional, storage-bounded, and computational — stand on different foundations, and treating them as one weakens all three. QuStream therefore states each separately: an unconditional one-time-pad claim where it spends provisioned secret material; an everlasting bounded-storage claim where the broadcast outpaces the adversary's ability to record it; and a computational claim for sustained bulk traffic. Each is tied to a named foundation, and none borrows assurance from another.
QuStream supports information-theoretic confidentiality in two regimes — unconditionally, from one-time-pad material consumed once; and everlastingly, from a broadcast an adversary cannot fully store — together with information-theoretic authentication where key material is allocated for it. Beyond these it provides post-quantum computational confidentiality and authentication. The information-theoretic claims apply to the payload-encryption path; epoch integrity, replay protection, traffic-flow confidentiality, and endpoint-compromise recovery are separate, stated controls.
QuStream derives keys by walking a secret path through quantum-random material — a finite preloaded reservoir, a perpetual public broadcast, or successive public blocks — refreshing its own state as it goes and authenticating every message under single-use material. It offers unconditional Shannon-grade confidentiality from provisioned key material, everlasting confidentiality from a broadcast no adversary can fully store, post-quantum computational assurance for the rest, and per-message authentication throughout — each claim scoped, bounded, and resting only on what its foundation delivers.