Communicatio Secreta is designed to make common OTP failures visible and harder to commit. Its guarantees still depend on pad handling, endpoint integrity, release integrity and disciplined operation.
Decimal one-time-pad encryption hides the encoded plaintext when the pad is uniformly random, secret and never reused.
A 128-bit authentication tag derived from separate one-use pad material protects the complete message envelope.
The authenticated envelope binds its version, direction, public pad identifier, sequence number, length and ciphertext.
An append-only, flushed and exclusively locked ledger rejects a pad already consumed by the current Windows account.
Version 3 .nspt containers use Argon2id and AES-256-GCM with authenticated header parameters.
The release script builds both architectures, runs the security suites, requires Authenticode signing and emits SHA-256 checksums.
It cannot detect a pad copy used on another machine.
It cannot survive deliberate deletion or rollback of the local ledger without hardware-backed state.
It cannot secure an endpoint already controlled by malware or an attacker.
It cannot erase clipboard history, screenshots, crash dumps, SSD snapshots, cloud-synchronised copies or backups.
It cannot turn a weak .nspt passphrase into a strong one.
It does not provide public named identity, deniable messaging, group membership or forward-secure online sessions.
It has not yet received an independent cryptographic or implementation audit.
Use a distinct pad for every message and direction.
Provision pads over an authenticated, confidential channel.
Compare the full pad ID with the intended peer.
Keep pad files off backup, cloud-sync and shared folders.
Use a strong .nspt passphrase—preferably six or more random words.
Install only signed releases in an ACL-protected directory and verify the published SHA-256 checksum.
Communicatio Secreta should be described as an authenticated OTP security prototype, not independently validated production cryptography. Do not use it for high-value or life-safety communication until the complete protocol, implementation, build chain and operational procedures have been independently reviewed.