Adjusted NPCR and UACI Reference Values for STL Files under IEEE-754 Validity Constraints

1. Introduction

The Number of Pixel Change Rate (NPCR) and the Unified Average Changed Intensity (UACI) are the two canonical statistics for measuring the sensitivity of a cipher to plaintext and key perturbations. The hypothesis-testing framework of Wu, Noonan, and Agaian [1] compares them against reference values derived under the ideally encrypted image model, in which the ciphertext bytes are mutually independent and uniformly distributed on $\{0,\dots ,255\}$. This framework has been transferred unchanged to 3D-model encryption.

A binary STL ciphertext violates the uniform-byte model by construction. Its triangle records consist almost entirely of IEEE-754 single-precision floats, and a valid file must encode only finite values in these fields. Hence not all bit patterns are admissible, and the uniform distribution over such files has non-uniform, position-dependent byte marginals.

Existing studies on 3D-model encryption typically evaluate NPCR and UACI over the vertex coordinates, each quantized to L bits, resulting in an alphabet of $2^L$ possible values. The model is then assessed as a regular image against the reference constants for this alphabet [2,3,4,5,6]. The usual choice is $L=8$, reducing each coordinate to an integer in $\{0,\dots ,255\}$.

A finer alternative is to compute the statistics directly from the raw bytes of the STL file, as our byte-level scheme [7] already does. This test is more demanding: if the ciphertext coordinates are restricted to a narrow range — such as $[0,256)$ — the floating-point exponents remain nearly constant, causing the byte-level NPCR and UACI to fall well below the expected reference values. To attain those values, the cipher must randomize the entire binary encoding, so that the ciphertext is distributed uniformly over valid STL files — that is, it follows the valid-STL (VSTL) distribution, formalized in Section 2. Accordingly, this paper answers the natural question: what are the exact reference values of NPCR and UACI under the VSTL distribution?

We prove that both adjusted references lie strictly below their uniform-byte counterparts. The NPCR reference becomes ${\mu }_{\mathcal{N}}^{\mathrm{VSTL}}\approx 99.609190456\%$ instead of $99.609375\%$, a shift of only $0.000184544$ percentage points. The UACI reference becomes ${\mu }_{\mathcal{U}}^{\mathrm{VSTL}}\approx 33.455728563\%$ instead of $33.463541667\%$, a shift of $0.007813104$ percentage points — large enough to affect hypothesis testing for sufficiently large STL files. We also derive the exact variances of both statistics, from which the corresponding critical values follow.

The remainder of the paper is organized as follows. Section 2 fixes notation and defines the VSTL distribution. Section 3 derives its byte-level marginal and joint laws. Section 4 and Section 5 derive the adjusted NPCR and UACI references together with their variances. Section 6 reports the numerical results and their practical impact, and Section 7 concludes.

2. Preliminaries and Notation

2.1. STL layout

An STL model admits two encodings of the same triangulated surface: a human-readable ASCII form and a compact binary form that dominates practical use [8,9]. We assume these two representations to be semantically equivalent, as ASCII content can be parsed and translated into binary.

A binary STL file consists of T triangles, each one represented as a record of 50 bytes containing a normal vector $n\in {\mathbb{R}}^3$ (3 floats), three vertices $v_1,v_2,v_3\in {\mathbb{R}}^3$ (9 floats), and a 16-bit attribute byte count.

This paper considers the encryption of the triangle records only; file metadata (the header and triangle-count bytes of the binary form, or the solid name of the ASCII form) is outside its scope.

Each float is an IEEE-754 single-precision 32-bit number [10] $(s,e_0\dots e_7,m_0\dots m_{22})$ that we will decompose into four bytes $B_0$, $B_1$, $B_2$, and $B_3$, indexed from most- to least-significant:

• $B_0=s\parallel e_{0\dots 6}$, sign / high-exponent byte;
• $B_1=e_7\parallel m_{0\dots 6}$, low-exponent / high-mantissa byte;
• $B_2=m_{7\dots 14}$, mantissa mid byte;
• $B_3=m_{15\dots 22}$, mantissa low byte.

A triangle therefore contains 12 occurrences each of $B_0$, $B_1$, $B_2$, and $B_3$ plus two attribute bytes, for fifty bytes total; an STL file with T triangles thus carries $50T$ data bytes.

2.2. Validity Constraint

For our purposes, a valid float is any IEEE-754 finite single-precision 32-bit number, i.e. any encoding whose exponent field is not 0xFF. We do not exclude subnormals or signed zeros as both are well defined [11] and produced by real-world modelers. Excluding NaN and $\pm \infty$ is essential because neither value admits a consistent geometric interpretation — the fundamental properties of a triangle containing such coordinates (e.g. side lengths, perimeter, area) are undefined. Moreover, these values complicate STL serialization and deserialization. In binary form, they cause divergent behavior across reader implementations, ranging from the outright rejection of the entire file, through the flagging of triangles as degenerate, to the silent substitution with a finite value. In ASCII form, the grammar provides no portable textual representation for them at all.

Let $\mathcal{F}\subset {\{0,1\}}^{32}$ be the set of valid float encodings. Then

$$\left|\mathcal{F}\right|=2^{32}-2^{24}=4278190080.$$

(1)

2.3. The Valid-STL (VSTL) Reference Distribution

Let C be an STL ciphertext of T triangles, viewed as a vector of $N=50T$ bytes $C_1,\dots ,C_N$. To analyze NPCR and UACI precisely under the reference distribution of valid STL files, we consider an ideal cipher with the following two assumptions:

(A1)

The encryption transformation is a bijection on the set of valid STL files [12]: every plaintext is a valid STL file, and so is its ciphertext. For a random key, its differential properties are strong enough that the ciphertext distribution closely approximates the uniform distribution over this space [13,14,15].

(A2)

Bytes drawn from different floats are mutually independent. The only coupling is internal to a single float: its leading pair $(B_0,B_1)$ is dependent, because these two bytes form the exponent which is directly affected by the aforementioned validity constraint; the trailing bytes $B_2$ and $B_3$ are free uniform bytes, independent of each other and of $(B_0,B_1)$.

Assumption (A1) is the STL analogue of the ideally encrypted image of [1], and (A2) follows from the expectation that a strong cipher renders its output indistinguishable from random data, so distinct floats and triangles carry no detectable dependence.

We call the distribution specified by (A1) and (A2) the valid-STL (VSTL) distribution: the uniform distribution over all valid STL files. It imposes no structure on the ciphertext beyond what the validity constraint forces.

At the block level, one float is a four-byte random vector $F=(B_0,B_1,B_2,B_3)$ that is uniform on the set of finite IEEE-754 32-bit encodings; a triangle is then the product of 12 independent copies of F and one independent uniform 16-bit attribute word. The per-position byte marginal $C_k\sim {\mathrm{VSTL}}_k$ depends only on $kmod50$ and falls into one of three classes:

• Class U (unconstrained, 26 positions per triangle): $B_2,B_3$ of every float, plus the two attribute bytes;
• Class B1 (low-exponent / high-mantissa, 12 positions per triangle): $B_1$ of every float;
• Class B0 (sign / high-exponent, 12 positions per triangle): $B_0$ of every float.

The three classes above completely determine the one-byte marginals, which suffice for any quantity built from one-position expectations — in particular, the NPCR and UACI reference means. However, the joint law of the constrained exponent pair $(B_0,B_1)$ contributes additionally to the exact finite-sample laws and variances.

3. Byte-Level Marginals and Joint Laws

3.1. Class U (Unconstrained Bytes)

For any byte that encodes either an unconstrained mantissa slice ($B_2$ or $B_3$ of a float) or one half of the attribute word, all 256 possible byte values are consistent with the validity constraint. Hence

$$P_U\left(v\right)={\displaystyle \frac{1}{256}},v\in \{0,\dots ,255\}.$$

(2)

3.2. Class B1 ($B_1=e_7\parallel m_{0\dots 6}$)

Fix a byte value v at position $B_1$. To compute its probability, we count how many valid 32-bit floats have $B_1=v$. Bytes $B_2$ and $B_3$ are completely free and contribute the same factor to every v, so they cancel out and can be ignored. The only remaining degree of freedom is the byte $B_0$, which has 256 possible patterns; the question reduces to: how many of those 256 patterns are admissible given that $B_1=v$?

The validity constraint $e\ne \mathtt{0}\mathtt{xFF}$ is equivalent to $\neg (e_{0\dots 6}=\mathtt{0}\mathtt{x}\mathtt{7}\mathtt{F}\wedge e_7=1)$ — i.e. the forbidden pattern requires both the low exponent bit and all of the high exponent bits to be set.

• If $v<128$, then $e_7=0$ and the forbidden pattern cannot occur regardless of $B_0$. Therefore, the $B_0$ byte is unconstrained and all $\mathbf{256}$ patterns are admissible.
• If $v\ge 128$, then $e_7=1$. The forbidden pattern can now occur, and it does so for exactly two $B_0$ bytes: $\mathtt{0}\mathtt{x}\mathtt{7}\mathtt{F}$ and $\mathtt{0}\mathtt{xFF}$. These values are ruled out, leaving $256-2=\mathbf{254}$ admissible patterns.

The total number of admissible $(B_0,B_1)$ patterns is $2^{16}-2^8=65280$ (equivalently $128·256+128·254$, since low-half values of v contribute 256 admissible patterns each, compared to 254 for high-half values). Therefore

$$P_{B_1}\left(v\right)=\left\{\begin{array}{cc}{\displaystyle \frac{256}{65280}}={\displaystyle \frac{1}{255}},\hfill & v\in \{0,\dots ,127\},\hfill \\ {\displaystyle \frac{254}{65280}}={\displaystyle \frac{127}{32640}},\hfill & v\in \{128,\dots ,255\}.\hfill \end{array}\right.$$

(3)

3.3. Class B0 ($B_0=s\parallel e_{0\dots 6}$)

Similarly to the B1 case, we fix v at position $B_0$ and ask how many of the 256 possible $B_1$ patterns are admissible.

• If $v\notin \{127,255\}$, then $e_{0\dots 6}\ne \mathtt{0}\mathtt{x}\mathtt{7}\mathtt{F}$ and the forbidden pattern cannot occur regardless of $B_1$. Therefore, the $B_1$ byte is unconstrained and all $\mathbf{256}$ patterns are admissible.
• If $v\in \{127,255\}$, then $e_{0\dots 6}=\mathtt{0}\mathtt{x}\mathtt{7}\mathtt{F}$. The forbidden pattern can now occur whenever $e_7=1$, which rules out half of the $B_1$ byte space, leaving $256/2=\mathbf{128}$ admissible patterns.

Hence

$$P_{B_0}\left(v\right)=\left\{\begin{array}{cc}{\displaystyle \frac{128}{65280}}={\displaystyle \frac{1}{510}},\hfill & v\in \{127,255\},\hfill \\ {\displaystyle \frac{256}{65280}}={\displaystyle \frac{1}{255}},\hfill & v\notin \{127,255\}.\hfill \end{array}\right.$$

(4)

3.4. Per-Float Joint Law

Let $\mathcal{V}=\{0,\dots ,255\}$ denote the byte alphabet, so that ${\mathcal{V}}^k$ is the set of all k-byte sequences. The admissible $(B_0,B_1)$ pairs then form the subset

$$\mathcal{X}=\{(v_0,v_1)\in {\mathcal{V}}^2:v_0\notin \{127,255\}\vee v_1<128\}.$$

(5)

Because the VSTL model is uniform on valid float encodings, $(B_0,B_1)$ is uniform on $\mathcal{X}$, whose cardinality is $\left|\mathcal{X}\right|=65280$. Therefore

$$P_{B_{0,1}}(v_0,v_1)=\left\{\begin{array}{cc}{\displaystyle \frac{1}{65280}},\hfill & (v_0,v_1)\in \mathcal{X},\hfill \\ 0,\hfill & (v_0,v_1)\notin \mathcal{X}.\hfill \end{array}\right.$$

(6)

The unconstrained bytes $B_2$ and $B_3$ are independent and uniformly distributed on $\mathcal{V}$, and independent of $(B_0,B_1)$. Hence the exact four-byte law of one float factorizes as

$$\begin{array}{c}{P}_F(v_0,v_1,v_2,v_3)=P_{B_{0,1}}(v_0,v_1)P_U\left(v_2\right)P_U\left(v_3\right)\\ P_F(v_0,v_1,v_2,v_3)=\left\{\begin{array}{cc}{\displaystyle \frac{1}{\left|\mathcal{F}\right|}}={\displaystyle \frac{1}{4278190080}},\hfill & (v_0,v_1)\in \mathcal{X},\hfill \\ 0,\hfill & (v_0,v_1)\notin \mathcal{X}.\hfill \end{array}\right.\end{array}$$

(7)

In other words, $F=(B_0,B_1,B_2,B_3)$ is uniform on the set of finite 32-bit float encodings. Its one-byte marginals are (4), (3), and (2). However, $B_0$ and $B_1$ are not independent, because $P_{B_{0,1}}(v_0,v_1)\ne P_{B_0}\left(v_0\right)P_{B_1}\left(v_1\right)$. For example:

$$\begin{array}{c}{P}_{B_{0,1}}(127,128)=0,\\ P_{B_0}\left(127\right)P_{B_1}\left(128\right)={\displaystyle \frac{127}{16646400}}>0.\end{array}$$

(8)

This is the only within-float dependence introduced by the finiteness constraint, and it is numerically weak — only 256 of the 65536 raw byte pairs are excluded. Nevertheless, $P_{B_0}$ and $P_{B_1}$ must be viewed as marginals of the joint law (6) rather than as independent sampling rules: factoring them through independence preserves the per-position expectations but corrupts every block-level statistic, including the finite-sample laws and variances of NPCR and UACI.

3.5. Macroscopic Departure from Uniformity

Let $Q_v$ denote the number of bytes equal to value v in a single 50-byte triangle. Because $Q_v$ is a sum of 50 position indicators, linearity of expectation reduces $E\left[Q_v\right]$ to a sum of one-byte marginal probabilities. Each position contributes its own marginal probability; the joint law $P_{B_{0,1}}$ that couples $B_0$ and $B_1$ within a float plays no role in this calculation. Aggregating the marginals across the three byte classes within the record gives

$$E\left[Q_v\right]=26P_U\left(v\right)+12P_{B_0}\left(v\right)+12P_{B_1}\left(v\right).$$

(9)

The expected frequencies deviate from the uniform target most strongly at $v\in \{127,255\}$. Table 1 reports the exact $E\left[Q_v\right]-50/256$ results across the four partitions of the byte alphabet.

4. NPCR Reference Under the VSTL Distribution

Let $C^1$ and $C^2$ be two ciphertexts drawn independently from the VSTL distribution. For each byte position $k\in \{1,\dots ,N\}$, define the disagreement indicator

$$D_k=\left\{\begin{array}{cc}1,\hfill & \mathrm{if}{C}_k^1\ne C_k^2,\hfill \\ 0,\hfill & \mathrm{if}{C}_k^1=C_k^2,\hfill \end{array}\right.$$

(10)

i.e. $D_k$ is a 0/1 random variable that records whether the two ciphertexts differ at position k. The NPCR statistic is then the fraction of positions at which they differ, expressed as a percentage:

$$\mathcal{N}(C^1,C^2)={\displaystyle \frac{1}{N}}{\displaystyle \sum _{k=1}^N}{D}_k·100\%.$$

(11)

The indicator $D_k$ is a Bernoulli random variable with success probability $q_k$ fixed by the byte distribution probability $P_k$ at position k:

$$q_k=Pr[C_k^1\ne C_k^2]=1-{\displaystyle \sum _{v=0}^{255}}{P}_k^2\left(v\right).$$

(12)

4.1. Per-Class Collision Probability

Class U.

$$\begin{array}{c}{\displaystyle \sum _{v=0}^{255}}{P}_U^2\left(v\right)=256{\left({\displaystyle \frac{1}{256}}\right)}^2\\ {\displaystyle \sum _{v=0}^{255}}{P}_U^2\left(v\right)={\displaystyle \frac{1}{256}}=0.00390625\end{array}$$

(13)

$$q_U={\displaystyle \frac{255}{256}}=0.99609375.$$

(14)

Class B1.

$$\begin{array}{c}{\displaystyle \sum _{v=0}^{255}}{P}_{B_1}^2\left(v\right)=128{\left({\displaystyle \frac{1}{255}}\right)}^2+128{\left({\displaystyle \frac{127}{32640}}\right)}^2\\ {\displaystyle \sum _{v=0}^{255}}{P}_{B_1}^2\left(v\right)={\displaystyle \frac{32513}{8323200}}\approx 0.00390631\end{array}$$

(15)

$$q_{B_1}={\displaystyle \frac{8290687}{8323200}}\approx 0.99609369.$$

(16)

Class B0.

$$\begin{array}{c}{\displaystyle \sum _{v=0}^{255}}{P}_{B_0}^2\left(v\right)=254{\left({\displaystyle \frac{1}{255}}\right)}^2+2{\left({\displaystyle \frac{1}{510}}\right)}^2\\ {\displaystyle \sum _{v=0}^{255}}{P}_{B_0}^2\left(v\right)={\displaystyle \frac{509}{130050}}\approx 0.00391388\end{array}$$

(17)

$$q_{B_0}={\displaystyle \frac{129541}{130050}}\approx 0.99608612.$$

(18)

That $q_{B_0}<q_{B_1}<q_U$ is a direct consequence of the Cauchy–Schwarz inequality ([16] §3.6, Thm. 9): the collision sum ${\sum }_{v=0}^{255}{P}_k^2\left(v\right)$ is minimized by the uniform distribution, so $q_k$ decreases as the marginal becomes less uniform.

4.2. Per-Triangle and Per-File NPCR Expectation

Let S denote the total number of disagreeing byte positions between $C^1$ and $C^2$, so that

$$S={\displaystyle \sum _{k=1}^N}{D}_k,\mathcal{N}={\displaystyle \frac{S}{N}}·100\%.$$

(19)

Write $S_U$ for the contribution of the $26T$ unconstrained byte positions. Then $S_U\sim \mathrm{Binomial}(26T,q_U)$.

For the j-th float, let $D_{0,j}$ and $D_{1,j}$ denote the disagreement indicators of its $B_0$ and $B_1$ bytes, and define the paired contribution

$$Y_j=D_{0,j}+D_{1,j}.$$

(20)

The $Y_j$ are independent across floats and independent of $S_U$. The block decomposition thus isolates the only dependent two-byte pair inside each float — the constrained $(B_0,B_1)$ — and collapses it into a single ternary variable $Y_j$, leaving the remaining bytes as independent unconstrained positions. Therefore

$$S=S_U+{\displaystyle \sum _{j=1}^{12T}}{Y}_j.$$

(21)

Using the joint PMF (6), the exact law of $Y_j$ is easiest to read as follows: $Pr[Y_j=0]$ is the probability that both constrained bytes are equal (no differences whatsoever), $Pr[Y_j=1]$ is the probability that exactly one of them is different, and $Pr[Y_j=2]$ is the probability that both are different.

$$\begin{array}{c}Pr[Y_j=0]=\sum _{(v_0,v_1)\in \mathcal{X}}{P}_{B_{0,1}}^2(v_0,v_1)\\ Pr[Y_j=0]={\displaystyle \frac{1}{65280}}\approx 0.000015319\end{array}$$

(22)

$$\begin{array}{c}Pr[Y_j=2]=1-{\displaystyle \sum _{v=0}^{255}}{P}_{B_0}^2\left(v\right)-{\displaystyle \sum _{v=0}^{255}}{P}_{B_1}^2\left(v\right)+Pr[Y_j=0]\\ Pr[Y_j=2]={\displaystyle \frac{16516477}{16646400}}\approx 0.992195129\end{array}$$

(23)

$$\begin{array}{c}Pr[Y_j=1]=1-Pr[Y_j=0]-Pr[Y_j=2]\\ Pr[Y_j=1]={\displaystyle \frac{32417}{4161600}}\approx 0.007789552.\end{array}$$

(24)

Linearity of expectation applied to $Y_j=D_{0,j}+D_{1,j}$ reduces the exponent-byte-pair expectation to the two marginal disagreement probabilities derived above:

$$\begin{array}{c}E\left[Y_j\right]={\displaystyle \sum _{i=0}^2}iPr[Y_j=i]\\ E\left[Y_j\right]=Pr[Y_j=1]+2Pr[Y_j=2]\\ E\left[Y_j\right]=\left(1-{\displaystyle \sum _{v=0}^{255}}{P}_{B_0}^2\left(v\right)\right)+\left(1-{\displaystyle \sum _{v=0}^{255}}{P}_{B_1}^2\left(v\right)\right)\\ E\left[Y_j\right]=q_{B_0}+q_{B_1}.\end{array}$$

(25)

That is, the within-float dependence between $B_0$ and $B_1$ changes the exact law of S but not its mean.

After substituting the per-class disagreement probabilities in (21), we obtain the total expected disagreement count over a T-triangle file:

$$\begin{array}{c}E\left[S\right]=E\left[S_U\right]+12TE\left[Y_j\right]\\ E\left[S\right]=26T{q}_U+12T(q_{B_0}+q_{B_1})\\ E\left[S\right]={\displaystyle \frac{138177869}{2774400}}·T\approx 49.804595228·T.\end{array}$$

(26)

Rescaling by the total byte count $N=50T$ produces the NPCR mean, which is an intensive property of the VSTL distribution, independent of file size:

$$\begin{array}{c}{\mu }_{\mathcal{N}}^{\mathrm{VSTL}}={\displaystyle \frac{E\left[S\right]}{N}}100\%\\ \begin{array}{|c|}\hline {\mu }_{\mathcal{N}}^{\mathrm{VSTL}}={\displaystyle \frac{138177869}{1387200}}\%\approx 99.609190456\%\\ \hline\end{array}.\end{array}$$

(27)

Compared with the classical reference ${\mu }_{\mathcal{N}}^{\mathrm{uniform}}=99.609375\%$, the VSTL distribution lowers the NPCR expectation by $\Delta {\mu }_{\mathcal{N}}\approx 0.000184544$ percentage points.

4.3. Deviation from Uniformity

To measure how far $Y_j$ departs from uniformity, we compare it against the idealized counterpart $Y^{\prime }\sim \mathrm{Binomial}(2,q_U)$ that would arise if the two exponent bytes were independent and uniform:

$$Pr[Y^{\prime }=k]=\left({\displaystyle \genfrac{}{}{0pt}{}{2}{k}}\right){\left(q_U\right)}^k{\left(1-q_U\right)}^{2-k},k\in \{0,1,2\}.$$

(28)

Table 2 lists both laws side by side, together with their pointwise difference.

4.4. Variance and Hypothesis Test

The variance derivation reuses the same block decomposition (21). We compute the exponent-byte-pair variance directly from the ternary law of $Y_j$:

$$\begin{array}{c}\mathrm{Var}\left(Y_j\right)=E\left[Y_j^2\right]-{\left(E\left[Y_j\right]\right)}^2\\ \mathrm{Var}\left(Y_j\right)={\displaystyle \sum _{i=0}^2}{i}^{2}Pr[Y_j=i]-{\left({\displaystyle \sum _{i=0}^2}iPr[Y_j=i]\right)}^2\\ \mathrm{Var}\left(Y_j\right)={\displaystyle \frac{539634602879}{69275658240000}}\approx 0.007789671.\end{array}$$

(29)

The same variance admits an alternative decomposition that explicitly represents the $(B_0,B_1)$ dependence as a covariance term:

$$\mathrm{Var}\left(Y_j\right)=\mathrm{Var}\left(D_{0,j}\right)+\mathrm{Var}\left(D_{1,j}\right)+2\mathrm{Cov}(D_{0,j},D_{1,j}).$$

(30)

Within a single float, the validity constraint couples the $B_0$ and $B_1$ bytes, so joint disagreement happens slightly more often than the independence baseline predicts:

$$\begin{array}{c}\mathrm{Cov}(D_{0,j},D_{1,j})=E\left[D_{0,j}{D}_{1,j}\right]-E\left[D_{0,j}\right]E\left[D_{1,j}\right]\\ \mathrm{Cov}(D_{0,j},D_{1,j})=Pr[Y_j=2]-q_{B_0}{q}_{B_1}\\ \mathrm{Cov}(D_{0,j},D_{1,j})={\displaystyle \frac{16129}{541216080000}}\approx 0.0000000298.\end{array}$$

(31)

The covariance induces a numerically negligible positive correction, though we retain it for exactness.

The mutual independence of $S_U$ and $Y_j$ lets $\mathrm{Var}\left(S\right)$ split into the unconstrained-block variance $\mathrm{Var}\left(S_U\right)$ and the sum of $12T$ identical exponent-byte-pair variances $\mathrm{Var}\left(Y_j\right)$:

$$\begin{array}{c}\mathrm{Var}\left(S\right)=\mathrm{Var}\left(S_U\right)+12T\mathrm{Var}\left(Y_j\right)\\ \mathrm{Var}\left(S\right)=26T{q}_U(1-q_U)+12T\mathrm{Var}\left(Y_j\right)\\ \mathrm{Var}\left(S\right)={\displaystyle \frac{8989293763657}{46183772160000}}·T\approx 0.194641826·T.\end{array}$$

(32)

Rescaling by the total byte count $N=50T$ produces the variance of NPCR expressed in squared percentage points:

$$\begin{array}{c}{\left[{\sigma }_{\mathcal{N}}^{\mathrm{VSTL}}\right]}^2={\left({\displaystyle \frac{100\%}{N}}\right)}^2\mathrm{Var}\left(S\right)\\ {\left[{\sigma }_{\mathcal{N}}^{\mathrm{VSTL}}\right]}^2={\displaystyle \frac{8989293763657}{11545943040000·T}}{[\%]}^2\\ {\left[{\sigma }_{\mathcal{N}}^{\mathrm{VSTL}}\right]}^2\approx {\displaystyle \frac{0.778567306}{T}}{[\%]}^2.\end{array}$$

(33)

The NPCR variance is inversely proportional to T and therefore vanishes as the file grows.

For a one-sided $\alpha$-level test of $H_0:\mathcal{N}(C^1,C^2)={\mu }_{\mathcal{N}}^{\mathrm{VSTL}}$ against $H_1:\mathcal{N}(C^1,C^2)<{\mu }_{\mathcal{N}}^{\mathrm{VSTL}}$, following the convention of [1], we use the approximation

$${\mathcal{N}}_{\alpha }^{*}\approx {\mu }_{\mathcal{N}}^{\mathrm{VSTL}}-{\Phi }^{-1}\left(\alpha \right){\sigma }_{\mathcal{N}}^{\mathrm{VSTL}},$$

(34)

where ${\Phi }^{-1}\left(\alpha \right)$ denotes the upper-tail quantile of the standard normal.

5. UACI Reference Under the VSTL Distribution

Let $C^1$ and $C^2$ be two ciphertexts drawn independently from the VSTL distribution. For each byte position $k\in \{1,\dots ,N\}$, define the absolute byte difference

$$A_k=|C_k^1-C_k^2|\in \{0,\dots ,255\}$$

(35)

i.e. $A_k$ records the intensity gap between the two ciphertexts at position k. The UACI statistic is then the mean absolute difference, normalized by the maximum gap and expressed as a percentage:

$$\mathcal{U}(C^1,C^2)={\displaystyle \frac{1}{255·N}}{\displaystyle \sum _{k=1}^N}{A}_k·100\%.$$

(36)

For any fixed byte position k, the marginal difference $A_k$ has expectation

$${\delta }_k={\displaystyle \sum _{v_0=0}^{255}}{\displaystyle \sum _{v_1=0}^{255}}{P}_k\left(v_0\right)P_k\left(v_1\right)|v_0-v_1|,$$

(37)

where $P_k$ is the per-position byte distribution at index k.

5.1. Per-Class Expected Absolute Difference

The class sums below reduce to pairwise absolute-distance sums, and two elementary identities suffice.

First, for a block of consecutive bytes R we write $\Lambda \left(R\right)$ for the sum of absolute differences over all ordered pairs drawn from R. Each gap $d\in \{1,\dots ,n-1\}$ is realized by exactly $2(n-d)$ ordered pairs, so

$$\begin{array}{c}\Lambda \left(R\right)=\sum _{x,y\in R}|x-y|,R={\displaystyle \bigcup _{i=0}^{n-1}}\{a+i\},n\in \mathbb{N}\\ \Lambda \left(R\right)=2{\displaystyle \sum _{d=1}^{n-1}}d(n-d)=2\left(n{\displaystyle \sum _{d=1}^{n-1}}d-{\displaystyle \sum _{d=1}^{n-1}}{d}^2\right)\\ \Lambda \left(R\right)={\displaystyle \frac{n(n^2-1)}{3}},\end{array}$$

(38)

which depends only on the block length n and not on the starting value a ([17] §1.2.3).

Second, let $R_m$ and $R_M$ be two sets of bytes such that $\forall x\in R_m,\forall y\in R_M,x<y$. Then $|x-y|=y-x$ for all such pairs; counting both orderings requires doubling the single-direction sum:

$$\begin{array}{c}\Lambda (R_m,R_M)=2\sum _{x\in R_m}\sum _{y\in R_M}|x-y|,max{R}_m<min{R}_M\\ \Lambda (R_m,R_M)=2\sum _{x\in R_m}\sum _{y\in R_M}(y-x)\\ \Lambda (R_m,R_M)=2\left(\left|R_m\right|\sum _{y\in R_M}y-\left|R_M\right|\sum _{x\in R_m}x\right).\end{array}$$

(39)

Class U. Every byte value is equiprobable, so (37) reduces to the uniform closed form [1]:

$$\begin{array}{c}{\delta }_U=P_U^2\Lambda \left(\mathcal{V}\right)={\displaystyle \frac{21845}{256}}=85.33203125.\end{array}$$

(40)

Class B1. Let ${\mathcal{V}}_{lo}=\{0,\dots ,127\}$ and ${\mathcal{V}}_{hi}=\{128,\dots ,255\}$ denote the lower and upper halves of the byte alphabet, respectively, such that ${\mathcal{V}}_{lo}\cup {\mathcal{V}}_{hi}=\mathcal{V}$ and ${\mathcal{V}}_{\mathrm{lo}}\cap {\mathcal{V}}_{\mathrm{hi}}=\varnothing$. The marginal $P_{B_1}$ is constant on each half: $\forall v\in {\mathcal{V}}_{\mathrm{lo}},P_{B_1}\left(v\right)=P_{lo{B}_1}=1/255$ and $\forall v\in {\mathcal{V}}_{\mathrm{hi}},P_{B_1}\left(v\right)=P_{hi{B}_1}=127/32640$. The difference expectation splits into three groups of byte pairs — both bytes in the lower half, both bytes in the upper half, and one byte drawn from each half (each group counted in both orderings):

$$\begin{array}{c}{\delta }_{B_1}=P_{lo{B}_1}^2\Lambda \left({\mathcal{V}}_{lo}\right)+P_{hi{B}_1}^2\Lambda \left({\mathcal{V}}_{hi}\right)+P_{lo{B}_1}{P}_{hi{B}_1}\Lambda ({\mathcal{V}}_{lo},{\mathcal{V}}_{hi})\\ {\delta }_{B_1}={\displaystyle \frac{236743367}{2774400}}\approx 85.331375072.\end{array}$$

(41)

Class B0. The marginal $P_{B_0}$ keeps a single value across most bytes: $\forall v\in \mathcal{V}\setminus \{127,255\},P_{B_0}\left(v\right)=P_{B_0^{*}}=1/255$; but for the two minority bytes — 127 and 255 — drops to $P_{B_0}\left(127\right)=P_{B_0}\left(255\right)=1/510$. Removing these two bytes from the respective halves leaves the majority sets ${\mathcal{V}}_{lo}^{*}={\mathcal{V}}_{lo}\setminus \left\{127\right\}=\{0,\dots ,126\}$ and ${\mathcal{V}}_{hi}^{*}={\mathcal{V}}_{hi}\setminus \left\{255\right\}=\{128,\dots ,254\}$. The difference expectation splits into four groups of byte pairs over the blocks ${\mathcal{V}}_{lo}^{*}$, ${\mathcal{V}}_{hi}^{*}$, $\left\{127\right\}$, and $\left\{255\right\}$ — both bytes among the majority groups, one majority byte paired with each of the minority bytes, and the two minority bytes paired together (each group counted in both orderings):

$$\begin{array}{c}\begin{array}{cc}\hfill {\delta }_{B_0}=& P_{B_0^{*}}^2\left[\Lambda \left({\mathcal{V}}_{lo}^{*}\right)+\Lambda \left({\mathcal{V}}_{hi}^{*}\right)+\Lambda ({\mathcal{V}}_{lo}^{*},{\mathcal{V}}_{hi}^{*})\right]\hfill \\ \hfill +& P_{B_0^{*}}{P}_{B_0}\left(127\right)\left[\Lambda ({\mathcal{V}}_{lo}^{*},\left\{127\right\})+\Lambda (\left\{127\right\},{\mathcal{V}}_{hi}^{*})\right]\hfill \\ \hfill +& P_{B_0^{*}}{P}_{B_0}\left(255\right)\Lambda ({\mathcal{V}}_{lo}^{*}\cup {\mathcal{V}}_{hi}^{*},\left\{255\right\})\hfill \\ \hfill +& P_{B_0}\left(127\right)P_{B_0}\left(255\right)\Lambda (\left\{127\right\},\left\{255\right\})\hfill \end{array}\\ {\delta }_{B_0}={\displaystyle \frac{65216}{765}}\approx 85.249673203.\end{array}$$

(42)

The ordering ${\delta }_{B_0}<{\delta }_{B_1}<{\delta }_U$ mirrors $q_{B_0}<q_{B_1}<q_U$ from Section 4. Because the absolute-difference sum depends only on how probability mass is spread across the gaps between values, what matters is where each class shifts that weight: class $B_0$ thins out the extreme value 255, removing the widest gaps and pushing ${\delta }_{B_0}$ lowest, whereas class $B_1$ carries slightly unequal mass on the two halves ($P_{lo{B}_1}>P_{hi{B}_1}$), leaving ${\delta }_{B_1}$ just under ${\delta }_U$.

5.2. Per-Triangle and Per-File UACI Expectation

Let W denote the total absolute byte difference between $C^1$ and $C^2$, so that

$$W={\displaystyle \sum _{k=1}^N}{A}_k,\mathcal{U}={\displaystyle \frac{W}{255·N}}·100\%.$$

(43)

Write $W_U$ for the contribution of the $26T$ unconstrained byte positions.

For the j-th float, let $A_{0,j}$ and $A_{1,j}$ denote the absolute byte differences of its $B_0$ and $B_1$ bytes, and define the paired contribution

$$Z_j=A_{0,j}+A_{1,j}\in \{0,\dots ,510\}.$$

(44)

The $Z_j$ are independent across floats and independent of $W_U$. As in the NPCR case, the block decomposition isolates the only dependent two-byte pair inside each float — the constrained $(B_0,B_1)$ — and collapses it into a single variable $Z_j$. Therefore

$$W=W_U+{\displaystyle \sum _{j=1}^{12T}}{Z}_j.$$

(45)

The exact law of $Z_j$ is the self-convolution of $P_{B_{0,1}}$ over the admissible exponent byte draws whose absolute differences sum to $\lambda$:

$$Pr[Z_j=\lambda ]=\sum _{\begin{array}{c}(x_0,x_1),(y_0,y_1)\in \mathcal{X}\\ |x_0-y_0|+|x_1-y_1|=\lambda \end{array}}{P}_{B_{0,1}}(x_0,x_1)P_{B_{0,1}}(y_0,y_1).$$

(46)

Linearity of expectation applied to $Z_j=A_{0,j}+A_{1,j}$ reduces the exponent-byte-pair expectation as follows:

$$\begin{array}{c}E\left[Z_j\right]={\displaystyle \sum _{i=0}^{510}}iPr[Z_j=i]\\ E\left[Z_j\right]=\sum _{\begin{array}{c}(x_0,x_1)\in \mathcal{X}\\ (y_0,y_1)\in \mathcal{X}\end{array}}{P}_{B_{0,1}}(x_0,x_1)P_{B_{0,1}}(y_0,y_1)(|x_0-y_0|+|x_1-y_1|)\\ \begin{array}{cc}\hfill E\left[Z_j\right]=& \sum _{x_0,y_0}\left(\sum _{x_1}{P}_{B_{0,1}}(x_0,x_1)\right)\left(\sum _{y_1}{P}_{B_{0,1}}(y_0,y_1)\right)|x_0-y_0|\hfill \\ \hfill +& \sum _{x_1,y_1}\left(\sum _{x_0}{P}_{B_{0,1}}(x_0,x_1)\right)\left(\sum _{y_0}{P}_{B_{0,1}}(y_0,y_1)\right)|x_1-y_1|\hfill \end{array}\\ \begin{array}{cc}\hfill E\left[Z_j\right]=& \sum _{x_0,y_0}{P}_{B_0}\left(x_0\right)P_{B_0}\left(y_0\right)|x_0-y_0|\hfill \\ \hfill +& \sum _{x_1,y_1}{P}_{B_1}\left(x_1\right)P_{B_1}\left(y_1\right)|x_1-y_1|\hfill \end{array}\\ E\left[Z_j\right]={\delta }_{B_0}+{\delta }_{B_1}.\end{array}$$

(47)

That is, the within-float dependence between $B_0$ and $B_1$ changes the exact law of W but not its mean.

After substituting the per-class expected absolute differences in (45), we obtain the total expected absolute difference over a T-triangle file:

$$\begin{array}{c}E\left[W\right]=E\left[W_U\right]+12TE\left[Z_j\right]\\ E\left[W\right]=26T{\delta }_U+12T({\delta }_{B_0}+{\delta }_{B_1})\\ E\left[W\right]={\displaystyle \frac{11834495599}{2774400}}·T\approx 4265.605391796·T.\end{array}$$

(48)

Rescaling by $255·N=255·50T$ produces the UACI mean, which is an intensive property of the VSTL distribution, independent of file size:

$$\begin{array}{c}{\mu }_{\mathcal{U}}^{\mathrm{VSTL}}={\displaystyle \frac{E\left[W\right]}{255·N}}100\%\\ \begin{array}{|c|}\hline {\mu }_{\mathcal{U}}^{\mathrm{VSTL}}={\displaystyle \frac{11834495599}{353736000}}\%\approx 33.455728563\%\\ \hline\end{array}.\end{array}$$

(49)

Compared with the classical reference ${\mu }_{\mathcal{U}}^{\mathrm{uniform}}\approx 33.463541667\%$, the VSTL distribution lowers the UACI expectation by $\Delta {\mu }_{\mathcal{U}}\approx 0.007813104$ percentage points.

5.3. Deviation from Uniformity

We compare $Z_j$ against the idealized counterpart $Z^{\prime }$ that would arise if the two exponent bytes were independent and uniform:

$$Pr[Z^{\prime }=\lambda ]={\displaystyle \frac{1}{{256}^4}}\sum _{d_0+d_1=\lambda }g\left(d_0\right)g\left(d_1\right),$$

(50)

where the number of ordered byte pairs with absolute difference d is

$$\begin{array}{c}g\left(d\right)=\left|\{(x,y)\in {\mathcal{V}}^2:|x-y|=d\}\right|\\ g\left(d\right)=\left\{\begin{array}{cc}256,\hfill & d=0,\hfill \\ 2(256-d),\hfill & 1\le d\le 255.\hfill \end{array}\right.\end{array}$$

(51)

Figure 1 plots both laws and their pointwise difference.

5.4. Variance and Acceptance Interval

The variance derivation reuses the same block decomposition (45). The mutual independence of $W_U$ and $Z_j$ lets $\mathrm{Var}\left(W\right)$ split into the unconstrained-block variance $\mathrm{Var}\left(W_U\right)$ and the sum of $12T$ identical exponent-byte-pair variances $\mathrm{Var}\left(Z_j\right)$:

$$\mathrm{Var}\left(W\right)=\mathrm{Var}\left(W_U\right)+12T\mathrm{Var}\left(Z_j\right),$$

(52)

where, mirroring the NPCR covariance decomposition,

$$\mathrm{Var}\left(Z_j\right)=\mathrm{Var}\left(A_{0,j}\right)+\mathrm{Var}\left(A_{1,j}\right)+2\mathrm{Cov}(A_{0,j},A_{1,j}).$$

(53)

In addition to (38), let ${\Lambda }_2\left(R\right)$ denote the sum of squared absolute differences over all ordered pairs drawn from a block of consecutive bytes R. Each gap $d\in \{1,\dots ,n-1\}$ now contributes $d^2$ to each of its $2(n-d)$ ordered pairs. Therefore

$$\begin{array}{c}{\Lambda }_2\left(R\right)=\sum _{x,y\in R}{(x-y)}^2,R={\displaystyle \bigcup _{i=0}^{n-1}}\{a+i\},n\in \mathbb{N}\\ {\Lambda }_2\left(R\right)=2{\displaystyle \sum _{d=1}^{n-1}}{d}^2(n-d)=2\left(n{\displaystyle \sum _{d=1}^{n-1}}{d}^2-{\displaystyle \sum _{d=1}^{n-1}}{d}^3\right)\\ {\Lambda }_2\left(R\right)={\displaystyle \frac{n^2(n^2-1)}{6}},\end{array}$$

(54)

which likewise depends only on the block length n and not on the starting value a.

In addition to (39), let ${\Lambda }_2(R_1,R_2)$ denote the sum of squared differences over ordered pairs spanning two byte sets $R_1$ and $R_2$, such that $R_1\cap R_2=\varnothing$. Since squaring removes any dependence on the sign of $x-y$, no ordering between $R_1$ and $R_2$ is required; only disjointness is needed, so that the factor of 2 counts each cross pair in both orderings exactly once:

$$\begin{array}{c}{\Lambda }_2(R_1,R_2)=2\sum _{x\in R_1}\sum _{y\in R_2}{(x-y)}^2,R_1\cap R_2=\varnothing \\ {\Lambda }_2(R_1,R_2)=2\sum _{x\in R_1}\sum _{y\in R_2}\left(x^2-2xy+y^2\right)\\ {\Lambda }_2(R_1,R_2)=2\left(\left|R_1\right|\sum _{y\in R_2}{y}^2-2\sum _{x\in R_1}\sum _{y\in R_2}xy+\left|R_2\right|\sum _{x\in R_1}{x}^2\right).\end{array}$$

(55)

Each of the $26T$ unconstrained positions contributes the absolute-difference variance of two uniform bytes [1]

$$\begin{array}{c}\mathrm{Var}\left(W_U\right)=E\left[W_U^2\right]-{\left(E\left[W_U\right]\right)}^2\\ \mathrm{Var}\left(W_U\right)=26T\left(P_U^2{\Lambda }_2\left(\mathcal{V}\right)-{\delta }_U^2\right)\\ \mathrm{Var}\left(W_U\right)={\displaystyle \frac{3101968155·T}{32768}}\approx 94664.555511475·T,\end{array}$$

(56)

and direct evaluation of the absolute-difference variances of the two exponent bytes using the squared-difference identities (54) and (55) gives

$$\begin{array}{c}\mathrm{Var}\left(A_{1,j}\right)=E\left[A_{1,j}^2\right]-{\left(E\left[A_{1,j}\right]\right)}^2\\ \begin{array}{cc}\hfill \mathrm{Var}\left(A_{1,j}\right)=& P_{lo{B}_1}^2{\Lambda }_2\left({\mathcal{V}}_{lo}\right)+P_{hi{B}_1}^2{\Lambda }_2\left({\mathcal{V}}_{hi}\right)\hfill \\ \hfill +& P_{lo{B}_1}{P}_{hi{B}_1}{\Lambda }_2({\mathcal{V}}_{lo},{\mathcal{V}}_{hi})-{\delta }_{B_1}^2\hfill \end{array}\\ \mathrm{Var}\left(A_{1,j}\right)={\displaystyle \frac{3113924114224279}{855255040000}}\approx 3640.930445992\end{array}$$

(57)

$$\begin{array}{c}\mathrm{Var}\left(A_{0,j}\right)=E\left[A_{0,j}^2\right]-{\left(E\left[A_{0,j}\right]\right)}^2\\ \begin{array}{cc}\hfill \mathrm{Var}\left(A_{0,j}\right)=& P_{B_0^{*}}^2\left[{\Lambda }_2\left({\mathcal{V}}_{lo}^{*}\right)+{\Lambda }_2\left({\mathcal{V}}_{hi}^{*}\right)+{\Lambda }_2({\mathcal{V}}_{lo}^{*},{\mathcal{V}}_{hi}^{*})\right]\hfill \\ \hfill +& P_{B_0^{*}}{P}_{B_0}\left(127\right){\Lambda }_2({\mathcal{V}}_{lo}^{*}\cup {\mathcal{V}}_{hi}^{*},\left\{127\right\})\hfill \\ \hfill +& P_{B_0^{*}}{P}_{B_0}\left(255\right){\Lambda }_2({\mathcal{V}}_{lo}^{*}\cup {\mathcal{V}}_{hi}^{*},\left\{255\right\})\hfill \\ \hfill +& P_{B_0}\left(127\right)P_{B_0}\left(255\right){\Lambda }_2(\left\{127\right\},\left\{255\right\})-{\delta }_{B_0}^2\hfill \end{array}\\ \mathrm{Var}\left(A_{0,j}\right)={\displaystyle \frac{2126679296}{585225}}\approx 3633.951550258\end{array}$$

(58)

The covariance term requires the expected product $E\left[A_{0,j}{A}_{1,j}\right]$. To keep it compact, we abbreviate the pairwise distance sums it needs as four $\Lambda$-factors, where in each subscript the first symbol refers to $B_0$ and the second to $B_1$, with ∘ denoting an unconstrained byte and • a constrained one:

$$\begin{array}{c}{\Lambda }_{\circ \circ }={\left[\Lambda \left(\mathcal{V}\right)\right]}^2,\\ {\Lambda }_{•\circ }={\displaystyle \frac{\Lambda ({\mathcal{V}}_{lo}^{*},\left\{127\right\})+\Lambda (\left\{127\right\},{\mathcal{V}}_{hi})+\Lambda ({\mathcal{V}}_{lo}\cup {\mathcal{V}}_{hi}^{*},\left\{255\right\})}{2}},\\ {\Lambda }_{\circ •}={\displaystyle \frac{\Lambda ({\mathcal{V}}_{lo},{\mathcal{V}}_{hi})}{2}}+\Lambda \left({\mathcal{V}}_{hi}\right),\\ {\Lambda }_{••}=\Lambda (\left\{127\right\},\left\{255\right\})\Lambda \left({\mathcal{V}}_{hi}\right).\end{array}$$

(59)

By applying inclusion–exclusion to remove the inadmissible exponent pairs from the full-alphabet sum and factoring out $P_{B_{0,1}^{*}}$, where $\forall (v_0,v_1)\in \mathcal{X},P_{B_{0,1}}(v_0,v_1)=P_{B_{0,1}^{*}}=1/65280$, the expected product evaluates to

$$\begin{array}{c}E\left[A_{0,j}{A}_{1,j}\right]=\sum _{\begin{array}{c}(x_0,x_1)\in \mathcal{X}\\ (y_0,y_1)\in \mathcal{X}\end{array}}{P}_{B_{0,1}}(x_0,x_1)P_{B_{0,1}}(y_0,y_1)|x_0-y_0||x_1-y_1|\\ E\left[A_{0,j}{A}_{1,j}\right]=P_{B_{0,1}^{*}}^2\sum _{\begin{array}{c}(x_0,x_1)\in \mathcal{X}\\ (y_0,y_1)\in \mathcal{X}\end{array}}|x_0-y_0||x_1-y_1|\\ E\left[A_{0,j}{A}_{1,j}\right]=P_{B_{0,1}^{*}}^2\left({\Lambda }_{\circ \circ }-2{\Lambda }_{•\circ }{\Lambda }_{\circ •}+{\Lambda }_{••}\right)\\ E\left[A_{0,j}{A}_{1,j}\right]={\displaystyle \frac{473023438}{65025}}\approx 7274.485782391,\end{array}$$

(60)

which yields the exact covariance

$$\begin{array}{c}\mathrm{Cov}(A_{0,j},A_{1,j})=E\left[A_{0,j}{A}_{1,j}\right]-E\left[A_{0,j}\right]E\left[A_{1,j}\right]\\ \mathrm{Cov}(A_{0,j},A_{1,j})=E\left[A_{0,j}{A}_{1,j}\right]-{\delta }_{B_0}{\delta }_{B_1}\\ \mathrm{Cov}(A_{0,j},A_{1,j})={\displaystyle \frac{462407}{33162750}}\approx 0.013943566.\end{array}$$

(61)

The covariance induces a numerically negligible positive correction, though we retain it for exactness.

Rescaling by ${(255·N)}^2$ produces the variance of UACI expressed in squared percentage points:

$$\begin{array}{c}{\left[{\sigma }_{\mathcal{U}}^{\mathrm{VSTL}}\right]}^2={\left({\displaystyle \frac{100\%}{255·N}}\right)}^2\mathrm{Var}\left(W\right)\\ {\left[{\sigma }_{\mathcal{U}}^{\mathrm{VSTL}}\right]}^2={\displaystyle \frac{8403759629833955137}{750774946176000000·T}}{[\%]}^2\\ {\left[{\sigma }_{\mathcal{U}}^{\mathrm{VSTL}}\right]}^2\approx {\displaystyle \frac{11.193447081}{T}}{[\%]}^2.\end{array}$$

(62)

The UACI variance is inversely proportional to T and therefore vanishes as the file grows.

For a two-sided $\alpha$-level test of $H_0:\mathcal{U}(C^1,C^2)={\mu }_{\mathcal{U}}^{\mathrm{VSTL}}$, following the convention of [1], we use the normal approximation

$$\begin{array}{cc}\hfill {\mathcal{U}}_{\alpha }^{*-}& \approx {\mu }_{\mathcal{U}}^{\mathrm{VSTL}}-{\Phi }^{-1}(\alpha /2){\sigma }_{\mathcal{U}}^{\mathrm{VSTL}},\hfill \\ \hfill {\mathcal{U}}_{\alpha }^{*+}& \approx {\mu }_{\mathcal{U}}^{\mathrm{VSTL}}+{\Phi }^{-1}(\alpha /2){\sigma }_{\mathcal{U}}^{\mathrm{VSTL}},\hfill \end{array}$$

(63)

where ${\Phi }^{-1}(·)$ denotes the upper-tail quantile of the standard normal.

6. Numerical Results

Table 3 reports the reference values of both statistics under the uniform-byte and VSTL distributions. Since the variance is inversely proportional to T, it is represented as the size-independent coefficient $T{\sigma }^2$.

Table 4 and Table 5 give the resulting critical values for both distributions: the NPCR one-sided lower bound ${\mathcal{N}}_{\alpha }^{*}$ from (34) and the UACI two-sided bounds ${\mathcal{U}}_{\alpha }^{*-}$, ${\mathcal{U}}_{\alpha }^{*+}$ from (63), computed with the exact VSTL mean and variance.

6.1. Practical Significance

A corrected reference affects an applied test only when the mean shift $\Delta \mu$ is comparable to the standard deviation of the statistic, which sets the width of the acceptance region that the conventional test draws from the uniform-byte reference values. Solving $\Delta \mu =z\sigma$ for T gives the exact file sizes at which the corrections start to matter. At $z=1$ the shift equals the standard deviation, and at the 95% quantile ($z={\Phi }^{-1}\left(0.05\right)\approx 1.644853627$ for the one-sided NPCR hypothesis, and $z={\Phi }^{-1}\left(0.025\right)\approx 1.959963985$ for the two-sided UACI hypothesis) the VSTL reference mean falls outside the acceptance region, so the conventional test rejects an ideal cipher. For NPCR, $\Delta {\mu }_{\mathcal{N}}$ reaches one standard deviation at $T\ge 22850120$ and exceeds the 95% acceptance threshold at $T\ge 61821992$. For UACI, $\Delta {\mu }_{\mathcal{U}}$ reaches one standard deviation already at $T\ge 183450$ and exceeds the 95% acceptance half-width threshold at $T\ge 704714$.

Since the VSTL references are exact at every file size, we recommend validating STL ciphers against ${\mu }_{\mathcal{N}}^{\mathrm{VSTL}}$ and ${\mu }_{\mathcal{U}}^{\mathrm{VSTL}}$, with tolerances derived from the associated variances rather than from hard-coded constants.

7. Conclusions

This paper derived the exact NPCR and UACI reference values under the VSTL distribution: ${\mu }_{\mathcal{N}}^{\mathrm{VSTL}}\approx 99.609190456\%$ and ${\mu }_{\mathcal{U}}^{\mathrm{VSTL}}\approx 33.455728563\%$, both strictly lower than their textbook uniform-byte counterparts. Both shifts originate from the IEEE-754 validity constraints and the UACI correction is practically more relevant.

We also obtained the exact finite-sample laws of both statistics. Because the exponent bytes of each float are weakly dependent, each statistic is the convolution of a sum over the unconstrained bytes and a sum over the constrained bytes. This refinement contributes only a numerically negligible positive covariance correction to each variance, but it makes the probabilistic statement of the null model exact.

We encourage future work on STL ciphers to validate against the format-specific VSTL reference values.