A physically-anchored, bidirectionally-bounded time-locked encryption scheme can be constructed by combining two mechanisms: (1) cryptographic keys derived from the phase-coherent timing residuals of a minimum three-pulsar array at a target epoch T_target, preventing pre-epoch decryption since the required physical observables do not exist until T_target; and (2) an ephemeral session key transmitted exclusively during the T_target ± window and never stored, preventing post-epoch decryption since archived pulsar timing data recovers only the outer key while the session key is permanently destroyed. Together these designate the universe as the root of trust for the forward TTL and irreversible key erasure for the backward TTL — producing a message that is physically undecryptable both before and after its intended window, without relying on any trusted third party or mathematical hardness assumptions vulnerable to quantum attack.

A bidirectionally time-locked encryption system can be constructed such that: (1) a ciphertext encrypted using cryptographic keys derived from phase-coherent timing residuals of ≥3 millisecond pulsars at epoch T_target is computationally and physically impossible to decrypt before T_target (because the required pulsar timing observables do not yet exist), and (2) the same ciphertext is permanently undecryptable after T_target + Δ (where Δ ≤ 72 hours) because an ephemeral session key transmitted exclusively within the [T_target, T_target + Δ] window is irreversibly destroyed and never stored. The system requires no trusted third party, no mathematical hardness assumptions vulnerable to Shor's algorithm, and achieves forward security through physical causality and backward security through provable key erasure. Falsifiable prediction: given archived pulsar timing data from any epoch before T_target, no adversary with unbounded classical or quantum computational resources can recover the plaintext; given archived pulsar timing data from any epoch after T_target + Δ, no adversary can recover the plaintext without the destroyed session key.

PHASE 1 — Pulsar Timing Residual Characterization (Days 1–60): Use existing NANOGrav/PPTA/EPTA archival data to characterize the statistical unpredictability of timing residuals for candidate MSP arrays. Quantify the minimum prediction error achievable with state-of-the-art models.

PHASE 2 — Key Derivation Function Design and Testing (Days 30–90): Design a KDF that maps a vector of ≥3 simultaneous pulsar timing residuals (each measured to 10 ns precision) to a 256-bit cryptographic key. Test collision resistance, sensitivity to input perturbation, and quantum resistance using simulated residual vectors drawn from empirical distributions.

PHASE 3 — Simulated End-to-End Protocol Test (Days 60–120): Using historical pulsar data, designate a past epoch T_target (e.g., MJD 59000) as the "target." Attempt to derive the correct key using only data available before T_target. Separately, derive the key using data at T_target. Measure success/failure rates across 100 trial epochs.

PHASE 4 — Hardware Erasure Validation (Days 90–150): Implement session key storage in volatile RAM on commodity hardware (Raspberry Pi 5, x86 server). Execute controlled erasure. Attempt forensic recovery using cold-boot attack methodology. Measure residual key recovery probability.

PHASE 5 — Live Telescope Demonstration (Days 120–240): Coordinate with one radio telescope facility (e.g., Parkes, Effelsberg, or Green Bank) to perform a live, prospective test: encrypt a test message using predicted T_target pulsar keys, transmit session key during Δ window, verify decryption succeeds only within window.

# Pulsar Time-Locked Encryption (PTLE) — Architecture Sketch
# Language: Python 3.11+ with ctypes for secure memory operations

import hashlib, hmac, secrets, ctypes, time
from dataclasses import dataclass
from typing import Optional

# ── Data Structures ──────────────────────────────────────────────────────────

@dataclass
class PulsarObservation:
    pulsar_id: str          # e.g., "J0437-4715"
    epoch_mjd: float        # Modified Julian Date of observation
    timing_residual_ns: float  # Residual in nanoseconds (TDB frame)
    measurement_error_ns: float  # 1-sigma uncertainty

@dataclass
class PTLECiphertext:
    ciphertext: bytes        # AES-256-GCM encrypted payload
    nonce: bytes             # 12-byte GCM nonce
    tag: bytes               # 16-byte GCM authentication tag
    target_epoch_mjd: float  # T_target
    window_hours: float      # Δ in hours
    pulsar_array: list[str]  # Pulsar IDs used for key derivation
    kyber_encapsulation: bytes  # Encapsulated K_session (post-quantum)
    metadata_hash: bytes     # SHA3-256 of all non-secret fields

# ── Key Derivation ────────────────────────────────────────────────────────────

def pt_kdf(observations: list[PulsarObservation], 
           target_epoch_mjd: float) -> bytes:
    """
    Pulsar Timing Key Derivation Function (PT-KDF)
    Maps timing residual vector to 256-bit cryptographic key.
    Security: requires physical observables at target_epoch_mjd.
    """
    # Step 1: Validate minimum array size
    assert len(observations) >= 3, "Minimum 3 pulsars required"
    
    # Step 2: Sort by pulsar_id for deterministic ordering
    obs_sorted = sorted(observations, key=lambda o: o.pulsar_id)
    
    # Step 3: Quantize residuals to 1 ns bins (reduces noise sensitivity
    #         while maintaining cryptographic distinctiveness)
    quantized = []
    for obs in obs_sorted:
        q_residual = round(obs.timing_residual_ns)  # 1 ns quantization
        quantized.append(f"{obs.pulsar_id}:{q_residual}ns".encode())
    
    # Step 4: Construct IKM (Input Keying Material) for HKDF
    ikm = b"|".join(quantized)
    
    # Step 5: HKDF-SHA3-256 with domain separation
    salt = f"PTLE-v1|epoch:{target_epoch_mjd:.6f}".encode()
    info = b"pulsar-timing-key-derivation|bidirectional-ttl"
    
    # HKDF Extract
    prk = hmac.new(salt, ikm, hashlib.sha3_256).digest()
    
    # HKDF Expand
    t = b""
    okm = b""
    for i in range(1, 3):  # 2 blocks = 64 bytes, use first 32
        t = hmac.new(prk, t + info + bytes([i]), hashlib.sha3_256).digest()
        okm += t
    
    k_pulsar = okm[:32]  # 256-bit key
    
    # Step 6: Verify avalanche property (development/test mode only)
    # assert _verify_avalanche(obs_sorted, k_pulsar)
    
    return k_pulsar

# ── Encryption (Pre-T_target, by Sender) ─────────────────────────────────────

def ptle_encrypt(plaintext: bytes,
                 target_epoch_mjd: float,
                 window_hours: float,
                 pulsar_array: list[str],
                 recipient_kyber_public_key: bytes) -> PTLECiphertext:
    """
    Encrypt message. K_pulsar is a PLACEHOLDER at encryption time —
    the sender uses the PREDICTED residuals (which will be wrong).
    The actual K_pulsar is derived by the recipient at T_target.
    
    Protocol: C = AES-256-GCM(K_session XOR K_pulsar_actual, M)
    K_session is encapsulated via Kyber and transmitted at T_target.
    K_pulsar_actual is derived from live observations at T_target.
    """
    # Generate ephemeral session key (never stored to disk)
    k_session = secrets.token_bytes(32)
    
    # Placeholder: K_pulsar will be XOR'd at decryption time
    # Sender does NOT know K_pulsar_actual (it doesn't exist yet)
    # Encryption key = K_session (K_pulsar applied at decrypt)
    
    from cryptography.hazmat.primitives.ciphers.aead import AESGCM
    nonce = secrets.token_bytes(12)
    aesgcm = AESGCM(k_session)  # K_pulsar XOR applied at decrypt
    
    # Bind metadata to ciphertext
    aad = f"epoch:{target_epoch_mjd}|window:{window_hours}|pulsars:{','.join(sorted(pulsar_array))}".encode()
    ct_with_tag = aesgcm.encrypt(nonce, plaintext, aad)
    ciphertext = ct_with_tag[:-16]
    tag = ct_with_tag[-16:]
    
    # Encapsulate K_session using CRYSTALS-Kyber-1024
    # (using pqcrypto library or liboqs binding)
    kyber_encapsulation = kyber_encapsulate(k_session, recipient_kyber_public_key)
    
    # Secure erase K_session from memory immediately
    _secure_erase(k_session)
    
    metadata_hash = hashlib.sha3_256(aad).digest()
    
    return PTLECiphertext(
        ciphertext=ciphertext, nonce=nonce, tag=tag,
        target_epoch_mjd=target_epoch_mjd, window_hours=window_hours,
        pulsar_array=pulsar_array, kyber_encapsulation=kyber_encapsulation,
        metadata_hash=metadata_hash
    )

# ── Session Key Transmission (AT T_target, by Sender's Agent) ─────────────────

def transmit_session_key_at_epoch(kyber_encapsulation: bytes,
                                   target_epoch_mjd: float,
                                   window_hours: float,
                                   current_mjd: float) -> bool:
    """
    Transmit encapsulated K_session ONLY within [T_target, T_target + Δ].
    After window expires, encapsulation is securely erased.
    """
    window_end_mjd = target_epoch_mjd + (window_hours / 24.0)
    
    if current_mjd < target_epoch_mjd:
        raise ValueError("FORWARD_BLOCK: T_target not yet reached")
    
    if current_mjd > window_end_mjd:
        _secure_erase(kyber_encapsulation)
        raise ValueError("BACKWARD_BLOCK: Window expired, key destroyed")
    
    # Transmit via authenticated quantum-resistant channel
    return _transmit_kyber_capsule(kyber_encapsulation)

# ── Decryption (AT T_target, by Recipient) ────────────────────────────────────

def ptle_decrypt(ct: PTLECiphertext,
                 observations: list[PulsarObservation],
                 kyber_private_key: bytes,
                 received_kyber_capsule: bytes) -> Optional[bytes]:
    """
    Decrypt requires BOTH:
    1. K_pulsar derived from live pulsar observations at T_target
    2. K_session recovered from Kyber capsule (only available during Δ)
    """
    # Step 1: Derive K_pulsar from live observations
    k_pulsar = pt_kdf(observations, ct.target_epoch_mjd)
    
    # Step 2: Recover K_session from Kyber encapsulation
    k_session = kyber_decapsulate(received_kyber_capsule, kyber_private_key)
    
    # Step 3: Reconstruct decryption key
    k_decrypt = bytes(a ^ b for a, b in zip(k_session, k_pulsar))
    
    # Step 4: Decrypt
    from cryptography.hazmat.primitives.ciphers.aead import AESGCM
    aesgcm = AESGCM(k_decrypt)
    aad = f"epoch:{ct.target_epoch_mjd}|window:{ct.window_hours}|pulsars:{','.join(sorted(ct.pulsar_array))}".encode()
    
    try:
        plaintext = aesgcm.decrypt(ct.nonce, ct.ciphertext + ct.tag, aad)
    except Exception:
        plaintext = None
    finally:
        _secure_erase(k_session)
        _secure_erase(k_pulsar)
        _secure_erase(k_decrypt)
    
    return plaintext

# ── Secure Memory Erasure ─────────────────────────────────────────────────────

def _secure_erase(key_bytes: bytes) -> None:
    """
    Overwrite key material in memory using ctypes to bypass
    Python garbage collector and prevent compiler optimization elision.
    """
    if isinstance(key_bytes, bytes):
        # Get mutable buffer
        buf = (ctypes.c_char * len(key_bytes)).from_buffer_copy(key_bytes)
        # Triple-overwrite: zeros, ones, zeros (DoD 5220.22-M lite)
        ctypes.memset(buf, 0x00, len(key_bytes))
        ctypes.memset(buf, 0xFF, len(key_bytes))
        ctypes.memset(buf, 0x00, len(key_bytes))
        # Force cache flush (x86 CLFLUSH via inline assembly if available)
        # _clflush(buf)  # platform-specific

# ── Validation Test Harness ───────────────────────────────────────────────────

def run_retrosp