VRIL-KEM v1.2-rc1: Schauberger's Centripetal Vortex as a Key Derivation Function

Classical key exchange is broken by a sufficiently large quantum computer. Shor's algorithm dismantles both RSA and elliptic-curve Diffie-Hellman in polynomial time. The standard response, codified by NIST's post-quantum standardization process and finalized in FIPS 203, is to replace the broken exchange with a lattice-based Key Encapsulation Mechanism whose security reduces to the hardness of Module Learning With Errors — a problem for which no efficient quantum algorithm is known.

VRIL-KEM does this, and adds three constructions on top.

What Ships in v1.2-rc1

The v1.2-rc1 release is a C99 library with four build backends, a NIST-compatible API, and pre-built static libraries for Linux x64, Linux ARM64, and macOS. Three parameter sets are available:

• VRIL-KEM-1024-3 (n=1024, k=4) — approximately 192-bit post-quantum security, targeting NIST Level 3. Public key 7,200 bytes, ciphertext 6,304 bytes.
• VRIL-KEM-2048-5 (n=2048, k=5) — approximately 256-bit post-quantum security, NIST Level 5. Public key 17,952 bytes, ciphertext 15,392 bytes.
• VRIL-KEM-4096-7 (n=4096, k=7) — approximately 384-bit post-quantum security, NIST Level 5+. Public key 50,208 bytes, ciphertext 42,016 bytes. The default parameter set.

All three share the same ring algebra: R_q = Z_q[X]/(X^N + 1), q = 12,289 (an NTT-friendly prime), the same arithmetic primitives, and the same API surface. Selecting a parameter set is a compile-time flag, not a protocol change. Hybrid suites pairing each variant with X25519 for defense-in-depth are available as Go source under VRIL-HYBRID-1, -2, and -3.

The four build backends are: a portable reference implementation (ref/), an AVX2-accelerated variant (avx2/, approximately 6–7× faster on Linux x64), a constant-time masked backend for side-channel-sensitive environments (ct/, ISW 2-share), and a memory-optimized streaming variant (mem/, under 32 KB stack, for IoT and embedded targets).

The Three Novel Constructions

The security foundation is standard M-LWE with the Fujisaki-Okamoto transform providing IND-CCA2 security in the random oracle model. On top of this, VRIL-KEM introduces three constructions not present in any existing standardized post-quantum KEM:

HI-Gaussian Sampler. The error distribution is a seven-layer Fibonacci-weighted Gaussian (η₁=3). Each layer applies a different Fibonacci-sequence weight before the samples are combined, producing a composite distribution that is statistically indistinguishable from a standard discrete Gaussian in the security proof but whose internal structure resists Kannan-embedding and BKZ lattice reduction attacks more aggressively than a single-distribution sampler. The resistance comes from the mixing structure: an attacker who partially reduces the lattice against one layer's distribution finds the other six layers unaffected.

Outer Harmonic Commitment (OHC). After successful decapsulation, the recipient computes an additional integrity token over the decapsulated shared secret and the original ciphertext components. This token is published as part of the response. The commitment prevents ciphertext component-substitution attacks under adaptive chosen-ciphertext attack — a class of attack where an adversary replaces individual components of a valid ciphertext to probe the decapsulation oracle. The OHC binding ensures that any substitution is detectable before the shared secret is used.

Centripetal Vortex KDF (CVKDF). The key derivation step between the raw MLWE output and the final shared secret uses a spiral compression function rather than a linear one. This is the construction whose design draws most directly from physics, and it is worth describing in some detail.

Schauberger's Spiral and the CVKDF

Viktor Schauberger, the Austrian naturalist and forester, spent decades studying the movement of water in mountain streams. His central engineering observation — formalised in several patents and in the manuscript notes later compiled by Callum Coats as The Water Wizard — was that the most efficient natural motion is centripetal rather than centrifugal: energy concentrates inward along a spiral path, not outward along a radial one. Water in a healthy stream moves in a characteristic inward-spiraling vortex that is self-cooling, self-purifying, and self-sustaining. Disturb the spiral — straighten the stream, increase the temperature, reverse the rotation — and the water loses its structural integrity.

The cryptographic translation is this: most key derivation functions are structurally linear. They take a key material input and produce an output by applying a one-way function in a single pass — HKDF is the canonical example. VRIL-KEM's CVKDF instead applies a seven-layer cascade in which each layer takes the output of the previous layer, applies a domain-separated one-way compression, and feeds the result inward to the next. The “inward” direction is not spatial but structural: each layer reduces the effective entropy surface available to an attacker who has partially compromised the derivation. By layer seven, the shared secret has been through seven independent one-way compressions, each with its own domain separator, each drawing on the Fibonacci-weighted structure of the HI-Gaussian sampler.

The security claim is that inverting the CVKDF output requires inverting all seven layers simultaneously, for which the estimated probability is 2^-128. This is not a proof; it is a security argument backed by the structure of the cascade. Formal EasyCrypt proofs of the full CVKDF chain are planned for v2.0.

The Schauberger analogy earns its keep not as decoration but as a design discipline. A linear KDF is a straight pipe: efficient, but with no structural redundancy against partial inversion. The centripetal cascade is a spiral: each revolution reinforces the one before it. The key material spirals inward through seven compressions and arrives at the shared secret more protected for having traveled that path.

Honest Status

v1.2-rc1 is a release candidate. The README states its limitations plainly, and they are worth repeating:

• No formal EasyCrypt security proofs have been completed yet. The IND-CCA2 argument is mechanically sound via the Fujisaki-Okamoto structure, but the full CVKDF chain has not been formally verified. Proofs are planned for v2.0.
• Constant-time behavior is compiler-dependent on some targets. For side-channel-sensitive deployments, use the ct/ backend explicitly.
• Key and ciphertext sizes are large relative to ML-KEM (FIPS 203). VRIL-KEM-4096-7 carries a 50 KB public key and a 42 KB ciphertext. This is the cost of the higher security margin; evaluate whether your protocol's bandwidth budget can accommodate it. For bandwidth-constrained protocols, VRIL-KEM-1024-3 has a competitive size profile against ML-KEM-768.
• The library has not been independently peer-reviewed. It is not recommended for production use without independent audit.

These are not caveats buried in fine print. They are the first things the README says under its “Honest Disclosures” section. The team's position is that a cryptographic library that does not state its limitations clearly is a library that cannot be trusted — and the limitations above are the honest status of a research prototype in its first public release.

Integration

The API surface is NIST PQC competition-compatible. Any library or protocol using the standard triple — crypto_kem_keypair, crypto_kem_enc, crypto_kem_dec — can be adapted to use VRIL-KEM with no protocol changes. The shared secret is 32 bytes in all parameter sets, directly suitable as input to a symmetric cipher or HKDF expansion.

The Go hybrid package (vril-mesh/pkg/hybrid) exposes a higher-level Context API for VRIL-KEM + X25519 combined key exchange, producing a single 32-byte shared secret that is secure against an adversary who breaks either primitive in isolation.

The source, release artifacts, pre-built libraries, and NIST KAT response files are at github.com/VRIL-LABS/vril-kem. Security reports go through GitHub Security Advisories before public disclosure.

What Comes Next

The immediate roadmap includes formal EasyCrypt verification of the CVKDF chain (targeting v2.0), independent security review, and the VRIL-MESH integration — a cross-platform network client that uses VRIL-KEM as its key exchange primitive at every connection layer. The hybrid Go package in the current release is the early form of that integration; the full VRIL-MESH client is in active research.

The CVKDF cascade, which first appeared as the key derivation layer in VRIL-KEM, is also the entropy-pipeline primitive in VRIL-ZIP. The same seven-layer Fibonacci-weighted structure that hardens the KEM's shared secret governs the compression pipeline in the entropy engine. The design coherence is deliberate: one cascade, two applications, a single body of formal verification work to cover both.