Laplace Cipher Lab is security-sensitive experimental cryptography. It is not a supported encryption product and currently makes no security claim.

No version is supported for protecting real data. Security fixes apply to the current main branch and the active research milestone. Historical drafts are retained for reproducibility and may remain deliberately vulnerable.

Do not place exploitable implementation details, secret material, or an unannounced full-round break in a public issue. Use GitHub private vulnerability reporting when enabled, or contact the repository owner privately.

Include, where applicable:

• suite identifier, commit, and round count;
• attack and oracle model;
• chosen-input, related-key, and related-tweak assumptions;
• data, time, and memory complexity;
• success probability and comparison with a generic attack;
• reproduction code, vectors, traces, or solver model;
• affected implementations and platforms.

Reduced-round analysis and non-exploitable research observations may use the public cryptanalysis template.

• Rust 1.97.1 is pinned and checked against the current stable release before tags.
• Every package is publish = false; this lab never publishes to crates.io.
• Third-party crate, registry, and git dependencies are prohibited.
• Portable core crates are no_std, allocation-free, and safe Rust.
• Non-generated Rust files are limited to 500 lines.
• Floating point and secret-indexed tables are prohibited in cryptographic code.
• GitHub CodeQL default setup is expected; no advanced CodeQL workflow is used.
• Every release requires an exact-commit pentest, remediation, clean retest, release notes, CI, and signed immutable tag.
• Every behavior has automated and adversarial tests, while platform and security claims additionally require independent and real-environment evidence under the testing policy.

scripts/checks.sh
cargo deny check
cargo audit

The version-specific release gate also runs scripts/check_latest_tools.sh and the exact-commit release-readiness validation.

Maintainers will acknowledge valid reports, coordinate a remediation window, and preserve cryptanalytic credit unless the reporter requests anonymity. A negative result about the design is a project result and must not be hidden to protect the project's reputation.