3

This is from Dan Boneh's book

Theorem 2.1. Let X = (E, D) be a Shannon cipher defined over (K, M, C). The following are equivalent:

(i) X is perfectly secure.

(ii) For every $c \in C$, there exists $N_c$ (possibly depending on c) such that for all $m \in M$, we have

$|\{k \in K : E(k, m) = c\}| = N_c$

(iii) If the random variable k is uniformly distributed over K, then each of the random variables E(k, m), for $m \in M$, has the same distribution.

Proof:

For every $c \in C$, there exists a number $P_c$ (depending on c) such that for all $m \in M$, we have Pr[E(k, m) = c] = $P_c$. Here, k is a random variable uniformly distributed over K. Note that $P_c = N_c/|K|, where N_c$ is as in the original statement of (ii)

(Partially copied, not the full thing)

Point (ii) is not clear to me. What exactly is $N_c$? If is the number of ciphertexts possible for each plaintext, then it's always equal to 0 or 1 for perfect secrecy, right. Or can it be something else?

user93353
  • 2,191
  • 3
  • 23
  • 43

1 Answers1

3

What exactly is $N_c$?

It is a number that may depend on a given ciphertext and states how many keys exist for every message that produce this ciphertext. The statement here is that every ciphertext can be produced from every message with an equal number of keys, i.e. if you draw keys uniformly at random all messages had the same probability of being the source.

For perfectly secret schemes with $|K|=|M|$ this will always be either 1 or 0. It could be 0 e.g. if the ciphertext is longer than anything in the message space for a OTP.

SEJPM
  • 45,967
  • 7
  • 99
  • 205
  • Is there a case where it could be something other than 0 or 1 for non-perfect schemes? If yes,can you give an example? – user93353 Oct 29 '20 at 10:58
  • @user93353 You could take a scheme which yields 0 or 1 (for select ciphertexts, not all because then it would be perfectly secret) and modify it to add a redundant bit to the key which is simple ignored but doubles the 1 to 2. – SEJPM Oct 29 '20 at 11:07
  • Since this is in the definition of a perfectly secure scheme, wouldn't it make more sense to include that in the text book - that Nc will always be 0 or 1. That they haven't said so seems very odd to me. Makes me wonder if it can be something other than 0 or 1 for perfect schemes also – user93353 Nov 02 '20 at 06:44
  • @user93353 you can easily construct perfectly secret schemes where this constant can take arbitrary values, eg using the one time pad and redundant bits. – SEJPM Nov 02 '20 at 08:05
  • During decryption how will the other end know which & how many bits are redundant in the ciphertext? – user93353 Nov 02 '20 at 08:07
  • 1
    @user93353 One can e.g. modify the OTP to lead with 10 unused keybits and agree that there will always be 10 of them at the start and they're simply ignored on decryption. This gives you either 0 or $2^{10}$ (instead of 1) as the Nc. – SEJPM Nov 02 '20 at 11:25