Security Analysis of Hierarchical Chaotic Channel Derivation and Device-Bound Transaction Authentication

We study two constructions built from coupled chaotic oscillators through structural attacks, conditional security analysis and reproducible measurements. First, a hierarchical derivation produces channel identities rather than cryptographic keys. Its published index mixing (version 1) uses a public invertible mask on a shared parent block: three observed children reveal every sibling in a measured 94 s at coupling weights up to 109, and a parity relation is fixed per parent. SHA-256 index mixing (version 2) removes this attack; 135 Bonferroni-corrected pairwise tests give zero rejections, but general sibling unpredictability remains unproved. Second, a counter- based, device-bound transaction protocol applies the engine to a KDF output derived for each transaction context that determines twelve coupling weights. We derive a classical conditional forgery bound involving KDF pseudorandomness, hash collision resistance and the output min- entropy of this public post-processing. A Q30 collision experiment on a 42-bit output projection estimates collision entropy but does not certify the required min-entropy or a concrete forgery- security level. An independently keyed HMAC-SHA-256 XOR combiner supplies authentication under its stated assumptions; security from the engine arm after HMAC failure remains open. A deterministic correctness battery passes every assertion on Float64 and Q30, with Q30 tags bit- identical across arm64 and x86-64 under Rosetta 2. Burn-in sensitivity, field binding and first- order weight leakage are evaluated with stated detection limits. A hash-based stack is faster in every measured wallet role with fewer primitives. The study documents why statistical pass rates and key-space size alone do not establish security or a deployment advantage.