Adjusted NPCR and UACI Reference Values for STL Files Under IEEE-754 Validity Constraints

The Number of Pixel Change Rate (NPCR) and the Unified Average Changed Intensity (UACI) are the two canonical statistics for measuring a cipher’s sensitivity to plaintext and key perturbations. Their hypothesis tests compare the measured scores against reference values derived under the ideally encrypted image model, in which every ciphertext byte is an independent uniform draw from {0,…,255}. The resulting constants—99.609375% for NPCR and 33.463541667% for UACI—have been adopted unchanged for 3D-model encryption, yet no prior work has verified that the model holds for the formats involved. We show that this assumption fails for STL files, whose triangle records consist almost entirely of IEEE-754 single-precision floats: structural validity forbids non-finite values, so the uniform law over valid files has non-uniform, position-dependent byte marginals. We formalize this law as the valid-STL (VSTL) distribution and derive in closed form the exact NPCR and UACI reference means, their finite-sample variances, and the resulting critical values. Both references lie strictly below their uniform-byte counterparts—at 99.609190456% for NPCR and 33.455728563% for UACI—implying that tests based on the conventional constants become increasingly prone to falsely rejecting ideal ciphers as file size grows; this effect is observable for UACI at practical file sizes, whereas for NPCR it arises at larger scales. We therefore recommend validating STL ciphers against the format-specific references derived in this paper.