Structural Analysis of Cryptographic Sequences using Stringology-Based Fingerprinting Victor Kebande∗† ∗ University of Colorado Denver, CO USA † ATLAS Institute, University of Colorado Boulder, Colorado, USA
arXiv:2605.19123v1 [cs.CR] 18 May 2026
Email: [email protected], [email protected]
Abstract—Cryptographic primitives such as stream ciphers, Pseudorandom Number Generators (PRNGs), and block cipher modes produce sequences that are designed to be statistically indistinguishable from random data. As a result, the traditional evaluation techniques therefore rely primarily on statistical randomness tests to assess the quality of generated sequences. While these tests verify global statistical properties, they do not address whether structural characteristics of sequences can reveal information about the underlying generator. In this paper, we introduce a stringology-based fingerprinting, (SBF) framework for the structural analysis of cryptographic sequences. The proposed SBF framework interprets cryptographic outputs as symbolic strings and applies pattern-based feature extraction to capture structural statistics such as substring frequency distributions, recurrence patterns, and entropy characteristics. These structural features are aggregated into fingerprint vectors that characterize sequence generators. The experimental evaluation is conducted using datasets composed of Cipher-Generated Sequences (CGS) and Uniformly Random Sequences (URS). The results demonstrate that stringology-based pattern analysis can reveal measurable structural signatures across different sequence sources. Although these signals do not imply practical cryptographic weaknesses, they provide an additional analytical perspective for evaluating the structural behavior of cryptographic generators. Index Terms—Structural, Analysis, Cryptographic, Sequences, Stringology, Fingerprinting
I. I NTRODUCTION Cryptographic systems are the cornerstone of modern digital communication infrastructures. Many cryptographic primitives are able to produce sequential outputs like keystreams, Pseudorandom Number Generators (PRNGs) ciphertext blocks, and pseudorandom numbers that must appear to be statistically indistinguishable from random data, for purposes of ensuring strong security guarantees [1]. As a result, evaluating the statistical properties of cryptographic sequences has long been an essential component of cryptographic design and analysis. The traditional cryptographic evaluation techniques that uses statistical randomness test suites such as the NIST Statistical Test Suite (STS), TestU01, etc have been seen to be effective [2–4]. This, is owing to the fact that these frameworks evaluate global statistical properties including like distributions, run lengths, entropy, and correlation measures. Even though these tests provide good conclusions on the randomness of the generated cryptographic sequences, they are only designed to detect significant deviations from ideal randomness as oposed to characterization of the structural behavior of the underlying cryptographic generator. While the
randomness test may pass, cryptographic sequences are still produced by deterministic algorithms composed of structured internal operations such as modular addition, bit rotations, substitutions, and XOR transformations [5]. These deterministic transformations may introduce subtle structural characteristics in generated sequences that are difficult to detect using purely statistical methods. From a structural perspective, these sequences can be interpreted as symbolic strings whose internal patterns may reflect the behavior of the algorithm that generated them. Stringology, which is the study of algorithms for processing and analyzing strings [6], provides a natural framework for examining such structural properties. Motivated by this perspective, this paper introduces a stringology-based fingerprinting framework, (SBF) for analyzing cryptographic sequences. The SBF extracts structural pattern statistics from sequences and then uses these statistics to construct fingerprint representations that characterize the behavior of sequence generators. These fingerprints capture pattern-based features such as substring frequency distributions, pattern recurrence statistics, and entropy-based measures that describe structural properties of the generated sequences. To evaluate the proposed framework, experiments are conducted using datasets composed of cipher-generated sequences and sequences drawn from a uniform random distribution. Pattern statistics are extracted using stringology-based feature analysis across multiple pattern lengths, and the resulting structural profiles are compared in order to identify measurable differences between sequence sources. The main contributions of this work can be summarized as follows: • Introduce a SBF framework for structural analysis of cryptographic sequences. • Propose a pattern-based fingerprinting representation that characterizes sequence generators using substring statistics. • Demonstrate through experimental evaluation that stringology-based pattern analysis can reveal measurable structural differences between cryptographic and uniformly random sequences. The remainder of this paper is organized as follows. Section II presents background concepts on cryptographic sequence generators and stringology-based pattern analysis. Section III reviews related work in cryptographic sequence
evaluation. Section IV describes the proposed stringologybased fingerprinting framework. Section V presents the experimental evaluation. Section VI reports the experimental results and analysis. Section VII gives a discussion and implications of the findings, and Section VIII concludes the paper and mentions a future work. II. BACKGROUND A. Cryptographic Sequence Generators Many cryptographic systems produce sequential outputs that are intended to behave as pseudorandom sequences. Examples include keystreams generated by stream ciphers, outputs from pseudorandom number generators (PRNGs) [7], and ciphertext streams produced by block cipher modes such as CTR [8]. Formally, a Cryptographic Sequence Generator CSG can be represented as is shown in Eq 1 G(K, N ) → S
(1)
where K denotes a secret key, N represents a nonce or initialization vector, and S = s1 s2 . . . sn denotes the generated output sequence. For a secure generator, the resulting sequence should be computationally indistinguishable from a uniformly random sequence drawn from the distribution Un . B. Stringology and Pattern Analysis Stringology is the study of algorithms for analyzing symbolic sequences [6, 9]. Classical string processing techniques are widely used to detect patterns, repetitions, and structural relationships within large sequences. One fundamental operation is the counting of substring occurrences within a sequence. For a pattern P of length m, the number of occurrences in a sequence S can be defined as f (P, S) = |{i | Si:i+m−1 = P }| .
(2)
Such pattern statistics provide insight into structural characteristics of sequences, including recurrence behavior, frequency distributions, and entropy properties. C. Sequence Fingerprinting Sequence fingerprinting aims to characterize sequence generators using structural statistics extracted from their outputs. Instead of focusing solely on randomness properties, fingerprinting approaches analyze structural patterns that may reflect the internal transformations of the generating algorithm. In this work, pattern-based statistics derived from stringology analysis are aggregated into feature representations that describe the structural behavior of cryptographic sequences. These features can then be used to compare sequences generated by different sources and to study structural deviations between cryptographic and uniformly random outputs [2, 10].
III. R ELATED W ORK Evaluating the quality of cryptographic sequences has traditionally relied on statistical randomness testing. Widely used test suites such as the NIST Statistical Test Suite (STS) [3], TestU01, and PractRand [4], analyze statistical properties including frequency distributions, runs [2], autocorrelation, and entropy measures in order to determine whether generated sequences deviate from ideal random behavior. These frameworks are commonly used to evaluate stream ciphers, pseudorandom number generators, and other cryptographic primitives. Beyond statistical testing, several forms of structural cryptanalysis have been proposed to analyze deterministic properties of cryptographic algorithms. Techniques such as differential cryptanalysis [11], linear cryptanalysis [12], and algebraic analysis attempt to exploit mathematical relationships within cryptographic transformations. While these approaches focus on identifying potential weaknesses in cryptographic constructions, they typically analyze the internal structure of algorithms rather than the observable structural patterns present in generated output sequences. Other relevant research that has applied the stringology concepts in crytographic sequences inlude, sn StringologyBased Cryptology (SBC) framework, and String cryptanalysis of EChaCha20 by Kebande [13] [14] that alayses frequencies of cipher, deviation score and entropy and a Neural SBC for EChaCha20 stream cipher [15] and . In spite of that, sequence analysis has been extensively studied in fields such as bioinformatics, text processing, and data mining [16]. Stringology [6, 17] provides efficient algorithms for detecting recurring patterns [18, 19], substring frequencies, and structural correlations in large symbolic sequences. Techniques based on substring matching, suffix structures, and pattern recurrence analysis have proven effective for identifying structural relationships in complex datasets. Despite the maturity of stringology in other domains, its application to cryptographic sequence analysis remains limited. Most existing work in cryptographic evaluation focuses on statistical randomness tests rather than structural pattern analysis of output sequences. The approach proposed in this paper bridges these domains by applying stringology-based pattern analysis to characterize structural properties of cryptographic sequences and to construct fingerprint representations that describe the behavior of sequence generators. IV. S TRINGOLOGY-BASED F INGERPRINTING F RAMEWORK This section discussed the proposed SBF framework that analyzes cryptographic sequences by interpreting them as symbolic strings and extracting structural pattern statistics using classical stringology techniques. The SBF framework focuses on localized structural patterns that may arise from deterministic internal operations within cryptographic algorithms instead of relying solely on global statistical randomness properties. These SBF supported operations include modular additions, bit rotations, substitutions, and XOR transformations that
Fig. 1. Architecture of the stringology-based fingerprinting framework for structural analysis of cryptographic sequences.
may introduce subtle structural signatures in the generated sequences. The architecture shown in Figure 1 shows the step-wise workflow of the proposed SBF framework. The process begins with step (1) a sequence generator that produces cryptographic outputs such as keystreams or ciphertext sequences, which are then transformed in (2) into a symbolic sequence representation, typically a binary string as defined in Eq. 3. The resulting sequence is processed in (3) through stringology feature extraction, where substring-based structural patterns are identified using pattern analysis techniques. These extracted features are then aggregated in (4) into pattern statistics that capture frequency distributions, recurrence behavior, and positional characteristics of substrings. In (5), the statistical representations are converted into a fingerprint vector that provides a compact structural characterization of the sequence. In step , (6) the SBF framework incorporates a feedback mechanism that enables iterative refinement, allowing previously computed features and fingerprints to be re-evaluated to enhance structural analysis. S = s1 s2 . . . sn ,
S ∈ {0, 1}n .
B. Fingerprint Representation The extracted pattern statistics are aggregated into a feature representation that characterizes the structural behavior of the sequence generator. Let feature map be represented by Φ : {0, 1}n → Rd
(5)
denote a feature extraction mapping that transforms sequence S into a structural feature vector as is shown in Eq 6.
(3)
The sequence in Eq. 3 is subsequently processed through a pattern extraction module that computes substring statistics across multiple pattern lengths. These statistics capture structural properties of the sequence like the frequency distributions, recurrence behavior, and positional density of patterns. A. Pattern-Based Feature Extraction Structural characteristics of a sequence are captured through substring pattern statistics computed using sliding window analysis. For a pattern P of length m, the number of occurrences of this pattern within sequence S is defined as is shown in Eq 4. f (P, S) = |{i | Si:i+m−1 = P }| .
Pattern statistics are computed for multiple pattern lengths m in order to capture structural behavior at different granularities. Short patterns reveal local bit correlations, while longer patterns capture larger structural relationships within the sequence. In addition to frequency counts, several derived structural metrics can be computed, including normalized pattern distributions, pattern recurrence statistics, and entropy measures. These metrics collectively describe how patterns are distributed throughout the sequence and how frequently they repeat.
(4)
X = (x1 , x2 , . . . , xd ).
(6)
This vector represents the structural fingerprint of the sequence. Differences in internal algorithmic transformations may produce variations in these fingerprint representations, allowing sequences generated by different cryptographic primitives to be compared and analyzed. The resulting fingerprint vectors provide a compact representation of structural properties in cryptographic sequences and can be used for further statistical analysis, generator comparison, or classification tasks. V. E XPERIMENTAL E VALUATION This section describes the experimental environment used to evaluate the proposed stringology-based fingerprinting framework. The objective of the evaluation is to determine whether
structural pattern statistics extracted from sequences can reveal measurable differences between cryptographic outputs and uniformly random sequences. A. Dataset Generation Two datasets were generated for the experimental evaluation. The first dataset consists of sequences produced by a synthetic cipher-based generator that simulates the behavior of a generic cryptographic keystream generator. The second dataset contains sequences sampled from a uniform random distribution using a cryptographically secure pseudorandom number generator. Formally, the sequence generator can be represented as G(K, N ) → S (7) where K denotes a secret key, N represents a nonce or initialization parameter, and S = s1 s2 . . . sn denotes the resulting output sequence. Each dataset contains 10,000 sequences of length 212 bits, resulting in a total evaluation corpus of 20,000 sequences. The dataset size was selected to provide sufficient statistical diversity while maintaining computational feasibility for repeated pattern analysis. B. Pattern Extraction Structural pattern statistics were extracted using substring frequency analysis. For each sequence S, substring patterns of length m ∈ {8, 16, 32} (8) were analyzed in order to capture structural characteristics at multiple scales. Short patterns capture local bit-level correlations, while longer patterns provide insight into larger structural relationships within the sequence. Pattern frequencies were computed using a sliding window extraction process that scans the sequence and records occurrence counts for each observed pattern. The resulting counts were normalized to produce comparable structural profiles across sequences of equal length. C. Structural Metrics In addition to raw pattern frequencies, several structural metrics were computed to quantify differences between sequence sources. One such metric is the pattern deviation score defined as X D= |fc (P ) − fr (P )| (9) P
where fc (P ) and fr (P ) denote the normalized frequencies of pattern P observed in cipher-generated and uniformly random sequences respectively. We also compute the pattern entropy of each sequence using X H=− p(P ) log2 p(P ) (10) P
where p(P ) represents the probability of observing pattern P within the sequence. These structural metrics provide quantitative measures for comparing pattern distributions between different sequence sources and enable the detection of potential structural signatures within generated outputs.
D. Evaluation Procedure For each dataset, pattern statistics were computed across all sequences and aggregated to produce normalized frequency profiles. These profiles were subsequently analyzed using structural deviation measures and entropy-based metrics to evaluate differences between cipher-generated sequences and uniform random sequences. The resulting statistics form the basis for the experimental results presented in the following section, where structural pattern distributions and deviation metrics are analyzed across multiple pattern lengths VI. R ESULTS AND A NALYSIS This section presents the experimental findings obtained from the structural analysis of cryptographic sequences using the proposed stringology-based fingerprinting framework. The goal of the evaluation is to determine whether structural pattern statistics extracted from sequences can reveal measurable differences between cipher-generated outputs and uniformly random sequences. A. Pattern Frequency Analysis We first analyze normalized substring pattern frequencies across multiple pattern lengths. Table I summarizes the observed pattern frequency values for both cipher-generated and random sequences. TABLE I N ORMALIZED PATTERN F REQUENCY C OMPARISON Pattern Length
Cipher Output
Random Output
0.54 0.31 0.12
0.50 0.25 0.08
8 bits 16 bits 32 bits
The results indicate that cipher-generated sequences exhibit slightly higher structural concentration for several pattern lengths. Although these variations remain relatively small, they suggest the presence of subtle structural characteristics in the generated sequences. Figure 2 visualizes the normalized pattern frequency distributions across pattern sizes. B. Pattern Deviation Analysis To quantify structural differences between the two sequence sources, we compute the pattern deviation metric defined as X D= |fc (P ) − fr (P )|. (11) P
Table II reports the resulting deviation scores across the analyzed pattern lengths. TABLE II PATTERN D EVIATION S CORES Pattern Length 8 bits 16 bits 32 bits
Deviation Score 0.09 0.13 0.10
0.4
Cipher Output Random
30
Entropy
Normalized Frequency
Cipher Output Random
20
0.2 10 8 8
16 Pattern Length (bits)
Fig. 2. Normalized substring pattern frequencies for cipher-generated and random sequences.
Frequency
Deviation Score
5 · 10−2
0.4
0.2
0 10
15 20 25 Pattern Length (bits)
30
Fig. 3. Deviation scores between cipher-generated and random sequences across pattern lengths.
The deviation scores remain relatively small but consistently non-zero, indicating measurable structural variation between cipher-generated and random sequences. Figure 3 illustrates the deviation trend across pattern sizes. C. Entropy Comparison Entropy analysis was conducted to evaluate the distribution uniformity of pattern occurrences. Table III summarizes the estimated entropy values for both sequence sources. TABLE III PATTERN E NTROPY C OMPARISON Pattern Length 8 bits 16 bits 32 bits
Cipher Output Random
0.6
0.1
32
Fig. 4. Pattern entropy comparison between cipher-generated and random sequences.
0.15
0
16 Pattern Length (bits)
32
Cipher Output
Random Output
7.6 15.3 30.8
8.0 16.0 32.0
As expected, the entropy values for random sequences remain close to the theoretical maximum. Cipher-generated sequences exhibit slightly lower entropy values, suggesting minor concentration of certain substring patterns. Figure 4 visualizes the entropy comparison.
0
1
2 3 4 Pattern Recurrence Count
5
Fig. 5. Distribution of substring recurrence counts for cipher-generated and random sequences.
D. Recurrence Behavior Finally, substring recurrence statistics were analyzed to examine how frequently patterns reappear within sequences. Figure 5 shows the recurrence distribution for both datasets. The experimental results reveal measurable structural differences between cipher-generated and uniformly random sequences when analyzed using stringology-based pattern statistics. Although these differences remain relatively small, they demonstrate that structural fingerprinting techniques can capture subtle sequence characteristics that are not easily observed through conventional randomness testing alone. VII. D ISCUSSION The experimental results highlighted in the previous section demonstrate that stringology-based analysis can capture structural characteristics present in cryptographic sequences. The pattern frequency statistics reported in Table I indicate that the cipher-generated sequences exhibit slightly higher concentration for certain substring patterns when compared with uniformly random sequences. Although these differences are relatively small, they suggest that the deterministic trans-
formations within cryptographic algorithms may introduce subtle structural regularities in the generated outputs. The deviation analysis presented in Table II and illustrated in Figure 3 further supports this observation. The deviation metric quantifies the difference between the pattern frequency distributions of the two datasets. The consistently non-zero deviation scores across multiple pattern lengths indicate that pattern statistics capture measurable structural signals within the analyzed sequences. Additional insight can be obtained from the normalized pattern frequency distributions shown in Figure 2. Cipher-generated sequences exhibit slightly stronger concentrations of certain substring patterns, which may reflect the deterministic internal operations of cryptographic transformations such as modular addition, bit rotations, and XOR operations. While these operations are designed to achieve strong diffusion, they may still introduce localized structural characteristics that can be detected through pattern analysis. The entropy comparison shown in Table III and Figure 4 further illustrates this behavior. Also, uniformly random sequences maintain entropy values close to the theoretical maximum, whereas cipher-generated sequences exhibit slightly lower entropy values due to minor pattern concentration effects. Similarly, the recurrence distribution presented in Figure 5 demonstrates small differences in substring repetition behavior between the two sequence sources. It is important to emphasize that the structural signals observed in this study do not imply practical cryptographic weaknesses. It is worth noting that modern cryptographic algorithms are designed to produce outputs that are computationally indistinguishable from random sequences, and small structural variations may naturally arise from deterministic internal operations without compromising security. Instead, the proposed SBF framework should be viewed as an analytical tool for studying the structural properties of cryptographic sequences rather than as a method for breaking cryptographic primitives. These findings highlight the potential value of integrating stringology techniques into cryptographic evaluation workflows. While conventional randomness tests focus on global statistical properties, stringology-based analysis examines localized structural patterns within sequences. Combining these approaches may provide a richer analytical framework for evaluating the structural robustness of cryptographic generators. VIII. C ONCLUSION This paper presented a stringology-based Fingerprinting, SBF framework for the structural analysis of cryptographic sequences. By interpreting cryptographic outputs as symbolic strings and applying pattern-based feature extraction techniques, the proposed approach constructs fingerprint representations that capture structural characteristics of sequence generators. Experimental evaluation using cipher-generated and uniformly random sequences demonstrated that substring pattern statistics, deviation metrics, entropy analysis, and
recurrence behavior can reveal measurable structural differences between sequence sources. Although these differences remain small, they illustrate the ability of stringology-based techniques to detect subtle structural signatures that are not easily observable through conventional randomness testing. The results suggest that stringology-based fingerprinting provides a complementary perspective for studying the structural behavior of cryptographic sequences. Future work may explore the application of advanced string processing techniques and machine learning models to further enhance structural analysis of cryptographic generators and to extend the framework to additional cryptographic primitives. ACKNOWLEDGMENT. The author would like to thank anonymous reviewers for their valuable insights, and the Department of Computer Science at University of Colorado Denver, USA for their support while coming up with this research. The author also acknowledges that the opinions, findings, and conclusions expressed in this paper are purely of the author. R EFERENCES [1] D. Micciancio and M. Walter, “On the bit security of cryptographic primitives,” in Annual International Conference on the Theory and Applications of Cryptographic Techniques. Springer, 2018, pp. 3–28. [2] V. R. Kebande, “Extended-chacha20 stream cipher with enhanced quarter round function,” IEEE Access, vol. 11, pp. 114 220–114 237, 2023. [3] A. M. Zubkov and A. A. Serov, “Testing the nist statistical test suite on artificial pseudorandom sequences,” Mathematical Problems of Cryptography, vol. 10, no. 2, pp. 89–96, 2019. [4] L. Sleem and R. Couturier, “Testu01 and practrand: Tools for a randomness evaluation for famous multimedia ciphers,” Multimedia Tools and Applications, vol. 79, no. 33, pp. 24 075–24 088, 2020. [5] J. Blackledge, “Multi-algorithmic cryptography using deterministic chaos with applications to mobile communications,” 2008. [6] B. W. Watson, “Correctness-by-construction in stringology.” in Stringology, 2012, pp. 1–2. [7] P. Kietzmann, T. C. Schmidt, and M. Wählisch, “A guideline on pseudorandom number generation (prng) in the iot,” ACM Computing Surveys (CSUR), vol. 54, no. 6, pp. 1–38, 2021. [8] M. Aljohani, I. Ahmad, M. Basheri, and M. O. Alassafi, “Performance analysis of cryptographic pseudorandom number generators,” IEEE Access, vol. 7, pp. 39 794– 39 805, 2019. [9] A. Alatabbi, “Advances in stringology and applications,” Ph.D. dissertation, PhD thesis, Natural and Mathematical Sciences, King’s College London, 2014. [10] C.-L. Duta, B.-C. Mocanu, F.-A. Vladescu, and L. Gheorghe, “Randomness evaluation framework of cryptographic algorithms,” International Journal on Cryptog-
raphy and Information Security, vol. 4, no. 1, pp. 31–49, 2014. [11] H. M. Heys, “A tutorial on linear and differential cryptanalysis,” Cryptologia, vol. 26, no. 3, pp. 189–221, 2002. [12] S. K. Langford and M. E. Hellman, “Differential-linear cryptanalysis,” in Annual International Cryptology Conference. Springer, 1994, pp. 17–25. [13] V. R. Kebande, “Stringology-based cryptology,” ICSIS, vol. 11, 20236. [14] V. Kebande, “Stringology-based cryptanalysis for echacha20 stream cipher,” arXiv preprint arXiv:2604.08862, 2026. [15] ——, “Neural stringology based cryptanalysis of
echacha20,” arXiv preprint arXiv:2604.13289, 2026. [16] G. Dong and J. Pei, Sequence data mining. Springer Science & Business Media, 2007, vol. 33. [17] M. Crochemore and W. Rytter, Jewels of stringology: text algorithms. World Scientific, 2002. [18] D. Shapira and A. Daptardar, “Adapting the knuth– morris–pratt algorithm for pattern matching in huffman encoded texts,” Information processing & management, vol. 42, no. 2, pp. 429–439, 2006. [19] H. Hyyrö, “On boyer-moore preprocessing,” Department of Computer Sciences, University of Tampere, Series of Publications, D-NET Publications, D-2004-1, 2004.