{"id":"6f3daa5a-0f5b-4a0c-a0d8-8961f9fbbd0f","arxiv_id":"1909.01587","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"The paper introduces Topcode-matrices as 3 by q encodings of labeled graphs, builds matrix groups and number-string passwords from them, and claims this provides network security without proving any security property.","lead":"This paper defines a family of three-row matrices, called Topcode-matrices, that encode the edges and labels of graphs and can also encode Chinese characters, and it proposes using these matrices to generate text passwords and an overall network security mechanism. A generalist might read it to see a proposal connecting graph labeling, matrix groups, and network encryption, but the security claims are not proved.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Security rests on an undefined 'splitting-hardness' premise; under the natural verifier a one-column private key forges the scheme, and Theorem 5's graphicability condition is a tautology.","rationale":"The Reader correctly identifies the unproved hardness of recovering constituent Topsnut-gpws as the weakest assumption. I agree that no reduction, adversary model, or lower bound is given. However, I see a sharper issue: the security game itself is not defined. Under the only verifier the text suggests, a single-column submatrix is a valid private key, making forgery trivial and the exact-recovery hardness premise irrelevant. If a stricter verifier is intended, the paper does not say so. The Reader also notes Theorem 5 is false; I agree and specify that it is vacuous because the displayed equality holds identically for every Topcode-matrix. These issues do not change the Reader's REJECT verdict, but they sharpen the reason: the central security claim is not merely unproven, it is under-specified and, on the natural reading, trivially forgeable.","tokens_in":52305,"tokens_out":12039,"duration_ms":141101,"concrete_test":"Implement the acceptance rule inferable from Section V.B.1 (union of public and private Topcode-matrices equals the stored Tcode) and test the single-column private key (7,1,18)^T against public matrix A of Eq. (1). If the rule accepts, the exact-splitting hardness premise is irrelevant; if it rejects, the authors must specify the missing predicate and provide a reduction or lower bound showing that exact recovery is hard.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central security claim ('our Topsnut-gpws are certainly computational security', Section II.C after Fig. 11) rests entirely on the premise that recovering the constituent Topsnut-gpws G1..G4 from a large union Topcode-matrix is computationally infeasible. That premise is load-bearing and unsupported. No cryptographic game is defined: Section V.B.1 presents public key Gpub and private key Gpri with Tcode = Tcode(Gpub) ⨄ Tcode(Gpri), but never states the verifier's acceptance predicate. Under the natural reading, acceptance is just that the presented private matrix completes the union to the stored Tcode; then any single column, e.g. (7,1,18)^T from Eq. (1), is a valid private key and forgery is O(1), so the hardness of exact splitting is irrelevant. If the intended predicate instead requires recovering one of the original graphs, Fig. 1 already shows six non-isomorphic graphs for the same 9-column matrix A, so the public data do not determine a unique private key, and no reduction or lower-bound proof is supplied for exact recovery. Moreover, the only formal graphicability criterion, Theorem 5, is vacuous: because X and Y each contain q entries, 2q = Σ_{x∈X*} α(x) + Σ_{y∈Y*} α(y) is an identity, not a condition. It cannot filter valid submatrices or define a hard instance class. The conclusion's assertion that large matrices 'force attackers to give up' is therefore not a derived security statement.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper introduces Topcode-matrices, which are 3×q arrays (X,E,Y) interpreted as vertex-edge-vertex encodings of 'Topsnut-gpws,' and it catalogues a large number of restricted families obtained by imposing graph-labelling conditions such as graceful, odd-graceful, edge-magic, and harmonious labelings. The paper defines operations on Topcode-matrices (dual, column/XY exchanging, union-addition, splitting), constructs 'every-zero' matrix groups and number-string groups using modular arithmetic in equations (19)-(20), and proposes text-based passwords and an 'overall security mechanism' for networks in which a large Topcode-matrix union serves as a public authentication and its constituent Topsnut-gpws serve as private keys. The paper also discusses Hanzi-matrices, adjacent ve-value matrices, graph equations, and a list of open questions.","tokens_in":52698,"tokens_out":8302,"duration_ms":85368,"significance":"If the claims were established, the one-to-many correspondence between a Topcode-matrix and non-isomorphic graphs (Fig. 1) could be an interesting source of graphical-password constructions, and the proposed catalog would systematize many graph-labelling notions into a matrix formalism. The paper is also explicit about its open questions, which is a useful feature. However, the load-bearing security statement is not proven, the main graphicability criterion is vacuous, and the group constructions are definitional rather than substantive; the paper contains no formal security model, no reduction, and no computational experiments. The useful parts are the explicit examples and the translation of known graph-labelling conditions into matrix conditions; those do not by themselves establish network security, and the paper provides no machine-checked proofs or reproducibility artifacts.","major_comments":[{"comment":"Theorem 5 states that a Topcode-matrix is graphicable if and only if 2q = Σ_{x∈X*}α(x) + Σ_{y∈Y*}α(y). Since X and Y each contain q entries, the right-hand side is identically 2q, so the condition is an identity and cannot discriminate graphicable from non-graphicable matrices. The subsequent citation of the Erdős–Gallai theorem (Theorem 6) is not applied to the degree sequence derived from the appearance counts in Tcode; the degree-sum equation is only necessary, and the Erdős–Gallai inequalities are the missing load-bearing part. As written, Theorem 5 is false as a characterization and invalidates any argument that relies on it to certify that a Topcode-matrix has a graph realization.","section":"Section II.A.3, Theorem 5"},{"comment":"The central security claim that Topsnut-gpws are 'certainly computational security' rests on the assertion that splitting a large union Topcode-matrix into its original constituent Topsnut-gpws is computationally difficult. No adversary model, verifier predicate, reduction to a known hard problem, or lower bound is given. Under the natural reading of Section V.B.1, where Tcode = Tcode(Gpub) ⨄ Tcode(Gpri) is the authentication, a presented 'private' matrix is accepted if it completes the stored union; then any single column, such as (7,1,18)^T from the matrix in Eq. (1), is a valid private key and forgery is trivial. If, alternatively, acceptance requires recovering one of the original graphs exactly, Fig. 1 already exhibits six non-isomorphic graphs with the same Topcode-matrix, so the public data do not determine a unique private key. The conclusion that large matrices 'force attackers to give up' is therefore an unsupported assertion rather than a derived security statement.","section":"Section II.C and Section V.B.1"},{"comment":"The additive v-operation defines x_{λ,r} = (x_{i,r}+x_{j,r}-x_{k,r}) mod M and λ = i+j-k mod M, so F_m is simply an indexed copy of the cyclic group Z_M acting coordinate-wise on each row. Closure, associativity, the identity (the selected T_k), and inverses hold by construction; the same remark applies to the subtractive operation in Eqs. (25)-(26). Thus the 'every-zero' groups are a notational repackaging of finite cyclic groups, and the paper does not prove any new property of these groups or any connection between the group structure and the hardness of the proposed authentication. This makes the group-theoretic part descriptive rather than a result that can support the security mechanism.","section":"Section II.D, Eqs. (19)-(20)"},{"comment":"The proof of claim (1) of Theorem 11 asserts that in a set-ordered odd-graceful Topcode-matrix 'each x^1_i must be even, and each y^1_i must be odd.' The definition only requires max X < min Y and odd edge labels, and examples with odd-valued X and even-valued Y satisfying both conditions exist (for instance two edges with labels 1 and 3 on X={1,3}, Y={4,4}). Consequently the halving transformation used to recover a set-ordered graceful Topcode-matrix is not well-defined in general, so the claimed equivalence is not established as written.","section":"Section V.A, proof of Theorem 11"}],"minor_comments":[{"comment":"There are numerous typos, including 's ce' in the abstract, 'grapgicable' in Lemma 9, 'T[opcode-matrix' in Section II.C, 'Tosnut-gpw' in Section IV.B, and 'Refereing' in Remark 4; these should be corrected.","section":"Throughout"},{"comment":"Several structural theorems are stated without proof or with only a sketch, including Theorem 1, Theorem 2, Theorem 4, and Theorem 8; the authors should either provide complete proofs or clearly label these statements as conjectures.","section":"Theorems 1, 2, 4, and 8"},{"comment":"Several figures (e.g., Figs. 2, 19, and 27) are difficult to read or are not explicitly numbered in the text, which makes the examples harder to verify.","section":"Figures"}],"recommendation":"reject","confidential_remarks":"The paper is best described as a catalogue of definitions and examples with informal security claims. The central security argument depends on an undefined splitting-hardness assumption, the graphicability criterion in Theorem 5 is vacuous, and Theorem 11 has a concrete proof error. These issues go beyond presentation and would require a substantial rewrite, including a formal cryptographic model and a correct characterization of graphicability, before the manuscript could be considered. The connection to graph neural networks is also only superficial."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here is my read. The paper's Topcode-matrix is a 3-by-q edge-incidence representation of a labelled graph, and much of what it presents as new—graceful, odd-graceful, edge-magic Topcode-matrices—is a repackaging of standard graph labelings from Gallian's survey. The genuinely useful part is the emphasis on generating text-based passwords from matrices and the worked examples showing how column/row operations and unions of matrices produce password strings. That is a reasonable design direction for the Topsnut-gpw line of work, and the paper has a lot of concrete examples.\n\nThe soft spots are serious. The central security assertion, that splitting a large union matrix into its constituent graphs is hard and therefore 'certainly computational security,' is never defined or proved. No adversary model, no reduction, no lower bound. Under the natural reading of the proposed public/private-key split, acceptance is just that the private matrix completes the stored union; then any single column from the public matrix is a valid private key and forgery is trivial. If the intended predicate is to recover the original constituent graphs, the paper's own Fig. 1 shows six non-isomorphic graphs for the same matrix, so the public data do not determine a unique private key. The conclusion's claim that large matrices force attackers to give up is not a derived statement.\n\nThe formal mathematics is also shaky. Theorem 5 claims a Topcode-matrix is graphicable iff 2q equals the sum of appearance counts, but because X and Y each have q entries, that condition is an identity. It is not a characterization and cannot filter valid matrices. The Erdős–Gallai theorem is quoted but never applied. The 'every-zero groups' defined by the modular v-operation are indexed copies of cyclic groups; group axioms hold by construction, so they add little. Many other theorems are sketches or assertions. The citation pattern is mostly to the authors' own prior work, which is not damning by itself, but here it means the paper is largely self-referential.\n\nWho gets value from this? Someone working specifically on Topsnut-gpw construction and looking for matrix-based password generation might mine the examples and definitions. As a security paper, it should not be accepted. The load-bearing claim is unsupported, and at least one theorem is false as stated. I would not send it to peer review; I would desk-reject with an invitation to resubmit a version that defines a security game and proves a real characterization.","headline":"A matrix encoding of graph labelings with a catalog of examples, but the security claim is undefined and the main graphicability theorem is vacuous; desk-reject.","tokens_in":53232,"tokens_out":2753,"would_cite":false,"duration_ms":30405,"reading_group":"no","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["05C78","05C50","94A60"],"pacs":[],"model":"deepseek-v4-flash","headline":"A single $3\\times q$ Topcode-matrix can encode several distinct labelled graphs at once, letting one public matrix authenticate multiple private graph-based passwords.","keywords":["Topcode-matrix","Topsnut-gpw","graphical password","text-based password","graph labelling","matrix group","network security","Hanzi-matrix"],"falsifier":"Take a public union matrix built from two or more known Topcode-matrices and run a recovery attack: if the constituent columns can be separated by matching degree multiplicities, by solving $e_i=|x_i-y_i|$, or by exploiting the edge-label set, then the claimed one-vs-more security is refuted for that construction.","tokens_in":52109,"feed_emoji":"🔐","tokens_out":6300,"duration_ms":58167,"temperature":0.7,"pith_summary":"Topological graphic passwords are usually pictures, but this paper recasts them as three-row matrices called Topcode-matrices: each column records one edge of a labelled graph as two vertex labels and one edge label. The paper argues that because many non-isomorphic labelled graphs share the same Topcode-matrix, one matrix can be a public key while several distinct graph passwords act as private keys. It then defines operations, including column exchange, row exchange, union addition, and additive or subtractive group laws, that turn collections of these matrices into algebraic groups, and it shows how the same matrices generate ordinary text-based passwords. If the security premise holds, the approach gives a way to protect networks with passwords that are simultaneously graphical, textual, and algebraic.","feed_headline":"One matrix, many private graph passwords","feed_subtitle":"It lets one public array authenticate several distinct labelled graphs and turn them into text passwords.","key_machinery":"The load-bearing object is the Topcode-matrix, a $3\\times q$ array whose $i$-th column $(x_i, e_i, y_i)^T$ records one edge of a labelled graph: $x_i$ and $y_i$ are labels at the two ends and $e_i$ is the edge label derived from them by an evaluation rule. Its power is that many graphs can share the same matrix, because a matrix records labels but not the graph's topological arrangement; the same columns can be reassembled into different non-isomorphic Topsnut-gpws. The paper's operations run on this object: column-exchanging and $XY$-exchanging produce new matrices from the same graph, union-addition $\\biguplus$ fuses several matrices into one, and additive or subtractive v-operations make every-zero groups in which any chosen matrix acts as the zero element. These operations carry the security argument, because the public object is a union matrix while the private objects are the constituent matrices and graphs.","core_discovery":"The paper's central claim is that a Topcode-matrix can stand for many different labelled graphs at once, and that this one-to-many property is a security feature rather than an ambiguity. A Topcode-matrix is evaluated when an edge label $e_i$ is determined by its two end labels $x_i,y_i$ through a rule such as $e_i=|x_i-y_i|$ or a modular sum, and different graph-labelling conditions (graceful, odd-graceful, edge-magic total, harmonious, and others) become recognisable matrix families. The paper shows that a connected non-tree Topcode-matrix corresponds to at least two Topsnut-gpws, so a single matrix can be published while several non-isomorphic graphs remain usable as private keys. By the union-addition operation, several such matrices merge into one larger matrix, and the paper asserts that splitting that union back into its constituents is hard enough to call the scheme certainly computational security. It then builds every-zero Topcode-matrix groups, graph groups, and number-string groups, and proposes an overall network security mechanism in which each vertex's neighbours must supply group-encrypted permits.","pith_inferences":["My inference: the certainly computational security assertion in Section II.C is only as strong as the splitting problem, and a cheap first check would be to test union matrices against degree-sequence and edge-label recovery algorithms.","My inference: because Theorem 11 identifies matrix families that are equivalent for trees, one could test whether authentication can be made invariant under those transformations, letting a verifier check a canonical matrix class instead of exact private keys.","My inference: the same every-zero group construction could be applied to higher-dimensional arrays or to matrices whose elements are themselves networks, giving hierarchical encryption layers beyond the $3\\times q$ case.","My inference: if the fold-line reading rules are made canonical, the generated text strings could be benchmarked against dictionary and entropy attacks to see whether the pictorial structure actually survives in the string form."],"forward_implications":["One published Topcode-matrix can authenticate several private Topsnut-gpws, so a user or community can rotate private keys without changing the public matrix.","A Topcode-matrix can be read out as a number string by the fold-line rules, so graph-based passwords can be stored and transmitted in ordinary text-password fields.","Every-zero Topcode-matrix groups and number-string groups give algebraic operations for encrypting different parts of a dynamic network at different time steps, with any group element usable as zero.","Equivalence results such as Theorem 11 mean a tree's graceful matrix can be converted into odd-graceful, edge-magic-total, or 6C forms, so the same underlying graph can be presented by many matrix shapes.","Hanzi-matrices extend the same framework to Chinese-character codes, so a Chinese sentence can serve as a public key and another as a private key via a linear system."],"supporting_citations":[{"why":"Supplies the standard graph-theory facts (Laplacian and adjacency matrices, Erdős–Gallai criterion, tree characterisations) that the paper builds on.","marker":"[6]"},{"why":"Provides the survey of graph labelings whose graceful, odd-graceful, edge-magic, and harmonious conditions define the Topcode-matrix families.","marker":"[7]"},{"why":"Introduces Topsnut-gpws, the graphical-password model that Topcode-matrices formalise.","marker":"[11]"},{"why":"Adds the key-model and lock-model viewpoint behind using graph labelings as authentication.","marker":"[12]"},{"why":"Gives the earlier Topsnut-matrix and text-based-password construction from which the matrix-to-string rules are taken.","marker":"[16]"},{"why":"Supplies Hanzi-GB2312-80 codes and Hanzi-graphs used for Hanzi-matrices and Hanzi linear equations.","marker":"[17]"},{"why":"Provides splitting graceful and pan-graceful colourings that underlie splitting Topcode-matrices and the union-security example.","marker":"[18]"},{"why":"Defines vertex-split, edge-split, and coincident operations used to decompose and recombine Topsnut-gpws.","marker":"[20]"}],"fun_headline_variants":["One matrix unlocks many private graph passwords","Topcode-matrix: one public array, many secret graphs","A single matrix, countless secure graph keys","How one matrix hides many network passwords","Matrix-based trick for overall network security"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole scheme rests on the unproved claim that decomposing a large union Topcode-matrix into its original labelled graphs is computationally infeasible; if that decomposition becomes easy, the public-key and private-key design collapses.","fun_headline_variants_meta":{"raw":{"variants":["One matrix unlocks many private graph passwords","Topcode-matrix: one public array, many secret graphs","A single matrix, countless secure graph keys","How one matrix hides many network passwords","Matrix-based trick for overall network security"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000185,"raw_usage":{"total_tokens":1387,"prompt_tokens":1074,"completion_tokens":313,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":690,"completion_tokens_details":{"reasoning_tokens":246}},"tokens_in":690,"tokens_out":313,"duration_ms":3319,"temperature":1.0,"reasoning_tokens":246,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T05:14:01.998733+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a public union matrix built from two or more known Topcode-matrices and run a recovery attack: if the constituent columns can be separated by matching degree multiplicities, by solving $e_i=|x_i-y_i|$, or by exploiting the edge-label set, then the claimed one-vs-more security is refuted for that construction.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the survey of graph labelings whose graceful, odd-graceful, edge-magic, and harmonious conditions define the Topcode-matrix families."},{"cited_title":"Exploring New Cryptographical Con- struction Of Complex Network Data","cited_arxiv_id":null,"evidence_quote":"Introduces Topsnut-gpws, the graphical-password model that Topcode-matrices formalise."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Adds the key-model and lock-model viewpoint behind using graph labelings as authentication."},{"cited_title":"Text-based Passwords Generated From Topological Graphic Pass- words","cited_arxiv_id":null,"evidence_quote":"Gives the earlier Topsnut-matrix and text-based-password construction from which the matrix-to-string rules are taken."},{"cited_title":"Using Chinese Characters To Generate Text-Based Passwords For Information Security","cited_arxiv_id":"1907.05406","evidence_quote":"Supplies Hanzi-GB2312-80 codes and Hanzi-graphs used for Hanzi-matrices and Hanzi linear equations."},{"cited_title":"Splitting Graceful And Pan-graceful Codes Towards Information Security","cited_arxiv_id":null,"evidence_quote":"Provides splitting graceful and pan-graceful colourings that underlie splitting Topcode-matrices and the union-security example."}],"review_version":1}