Biological Complexity and Cryptographic Secrecy: Reproducible Key Recovery and a Structured Evidence Audit of Bio-Derived Key Schemes

Bio-derived key schemes build cryptographic keys from biological material: protein structures, DNA and RNA sequences, amino-acid chains, proteinoid assemblies. This paper audits the class against a protocol drafted prospectively, refined during a pre-specified pilot, and frozen before the main screening and extraction, and tests its central claim empirically. No audited study reported a defensible attacker-conditioned min-entropy for its complete secret; the key-space figures instead measured an output or encoding-table size, a descriptor length, or a parameter-range product. A structured evidence audit of twelve studies finds that the biological material rarely holds the secret, that the evidence concerns the randomness of outputs rather than the secrecy of keys, and that no study provided a publicly linked runnable implementation. On three schemes (the two whose secret is a selection from a public set and one encoding scheme) we recover keys from the first two and bound the entropy of the third. The executed recoveries covered a 647-protein candidate set (work factor about 9.3 search-space bits) and a single-reference DNA position search (about 12 bits); a broader eight-reference analysis gives a projected search space upper bound of at most about 39 bits once a 16-bit auxiliary key is included, and was not exhaustively executed. Reported key spaces range up to millions of bits, and for the encoding scheme the input entropy is left unestablished. These results apply to schemes whose secret is public, a selection from public data, or an encoding; they do not extend to a scheme built on a genuinely private biological sample, a noisy physical measurement, or a properly constructed fuzzy extractor. We contribute a taxonomy of biological sources by role, three security observations, the audit and the recovery and accounting experiments, and a design checklist. Biological complexity does not by itself imply cryptographic secrecy.