Leo Reyzin. Notes for BU CAS CS 538.

1 Information-Theoretic Encryption: Perfect Secrecy and

the One-Time Pad
Consider the following scenario: Alice is sending Bob off on an important mission. Prior to Bob’s leaving,
Alice gives him secret instructions on how to communicate back to her secretly so that no eavesdropper Eve
can intercept their communication.
The first question to ask is what part of the instructions should we consider secret. To be on the safe
side, we must assume that Eve knows as much as possible, and still ensure secrecy under such an assumption.
As far back as 1883, Kerckhoffs [Ker83] suggested that all one can hope to keep secret in a cryptosystem
is a key. The algorithms and designs should be assumed to be publicly known. His insight is true to this
day, as multiple recent examples demonstrate: publicly known security technologies receive more scrutiny,
and hence it is more likely that any problems will be uncovered at early stages. Deploying a secret system
and waiting for it to be broken is generally a poor strategy. In this class we will always assume that the
adversary knows the entire design of the system.
It is imperative to ask what constitutes a secure system—in other words, what is our goal? Note that,
unlike an attack on a system, security cannot be demonstrated by example. Hence, popular perception often
holds that “human ingenuity cannot concoct a cipher which human ingenuity cannot resolve” (this quote is
from Edgar Allan Poe, who, in addition to being a writer, was an amateur cryptographer [Poe65]). We will
not be satisfied with this design-then-break approach to security. Rather, we will define what constitutes a
secure system and then prove that a particular construction is secure, thus guaranteeing security.
The first formal definition of encryption was given by Shannon in his 1949 paper [Sha49].

Definition 1 (encryption scheme a.k.a. cryptosystem). Let M and K be finite sets, and Enc, Dec be
two algorithms (Enc may be randomized). We say that (M, K, Enc, Dec) is an encryption scheme if for all
m ∈ M and k ∈ K, m = Deck (Enck (m)) (if Enc is randomized, this equation should hold with probability
1 over the random choices made by Enc).

Note that this definition says nothing about security, it’s purely functional. We now address security
separately.
Shannon in [Sha49] defined the notion of perfect security as follows. Suppose that there is some a priori
probability distribution DM on the space of possible messages M (for instance, if the space of messages
consists of possible military commands, then some commands are more likely than others). In particular, if
the adversary has a guess g for what message is sent, and then Bob picks a message to send, the probability
of correctness of the adversary’s guess is Prm∈DM [m = g]. Now imagine that the adversary first sees a
ciphertext c of message chosen by Bob. That defines an a posteriori probability distribution on what the
message can be, given that its encryption is c. Now, if the adversary has a guess g for what the message is,
the probability of the guess being correct, conditioned on c, is Prm∈Dm ,k∈K [m = g|Enck (m) = c]. What the
definition says is that the a priori and the a posteriori probabilities are equal.

Definition 2 (perfect secrecy). An encryption scheme (M, K, Enc, Dec) satisfies perfect security with respect
to a distribution DM on M , if for every message g ∈ M and for every ciphertext c,

Pr [m = g|Enck (m) = c] = Pr [m = g] .
m∈Dm ,k∈K m∈Dm

(In the above, and from now on, k is chosen uniformly from the space of all keys.) An encryption scheme
satisfies perfect security if for ever DM it satisfies perfect security with respect to DM .

We can also consider another notion of security: no matter what message you encrypt, the probability of
getting a particular ciphertext is the same. (Intuitively, therefore, the adversary knows nothing about the
message from seeing the ciphertext). We will call this definition “Shannon secrecy.”
Leo Reyzin. Notes for BU CAS CS 538. 2

Definition 3 (Shannon secrecy). An encryption scheme (M, K, Enc, Dec) satisfies Shannon secrecy if for
every two messages m1 , m2 ∈ M and for every ciphertext c,

Pr [Enck (m1 ) = c] = Pr [Enck (m2 ) = c] .

k∈K k∈K

Note that both of these definitions consider only the issue of encrypting a single message once. They do
not say what happens if we encrypt two or more messages with the same key, for example.
In [Sha49], Shannon proves that the two definitions are equivalent, which is a good sign: if we have
two definitions that both seem intuitively right, then the fact that they are equivalent gives some level of
assurance that that our formalizations were correct. (In particular, because these definitions are equivalent,
and because Shannon, being modest, never gave the second one a name, you may see the terms “Shannon
secrecy” and “perfect secrecy” used interchangeably for the two definitions. In these notes, we use the term
“perfect” for the same definition as what Shannon called “perfect” in his paper.)

Theorem 1. A cryptosystem (M, K, Enc, Dec) satisfies Shannon secrecy if and only if it satisfies perfect
secrecy.

Proof. First, the “only if” direction. Let DM be a distribution on M , let g ∈ M , and let c be a ciphertext.
Pr [Enck (m)=c∧m=g]
Then Prm,k [m = g|Enck (m) = c] = m,k Prm,k [Enck (m)=c] (by definition of conditional probability). Note that
Prm,k [Enck (m) = c ∧ m = g] = Prm,k [Enck (g) = c ∧ m = g] (we just substituted m for g in the encryption,
which we can do, because the condition requires m = g). Now, note that the events Enck (g) = c and m = g
are independent (because g is fixed, so in the first event the outcome depends entirely on the choice of k,
and in the second event the outcome depends entirely on the choice of m). Hence, we get Prm,k [Enck (g) =
c ∧ m = g] = Prk [Enck (g) = c] Prm [m = g]. Finally, note that by Shannon secrecy, the probability that an
encryption of g is c is the same as that the encryption of a random message is c: Prm,k [Enck (m) = c] =
P P P
m∈DM Pr[m] Prk [Enck (m) = c] = m∈Dm Pr[m] Prk [Enck (g) = c] = Prk [Enck (g) = c] m∈Dm Pr[m] =
Pr [Enc (m)=c] Pr [m=g]
m
Prk [Enck (g) = c]. Putting it all together, we get Prm,k [m = g|Enck (m) = c] = m,kPrm,kk[Enck (m)=c] =
Prm [m = g], which is perfect secrecy.
Now the “if” direction. Fix any two messages m1 , m2 and ciphertext c. Pick any distribution DM that
has non-zero probabilities for m1 and m2 . Then, just like before (except using m1 for g), we get Prm,k [m =
m1 |Enck (m) = c] = Prk [Enc k (m1 )=c] Prm [m=m1 ]
Prm,k [Enck (m)=c] , and we know that it’s equal, by perfect secrecy, to Prm [m =
Prk [Enck (m1 )=c]
m1 ]. Canceling Prm [m = m1 ] (it’s non-zero because that’s how we chose DM ), we get Prm,k [Enck (m)=c] = 1.
Prk [Enck (m2 )=c]
Same for m2 : = 1. Because the fractions are equal for m1 and m2 and the denominators are
Prm,k [Enck (m)=c]
the same, the numerators must be equal as well: Prk [Enck (m1 ) = c] = Prk [Enck (m2 ) = c].

Consider now the following scheme that satisfies Shannon secrecy for M = {0, 1}: the key space is
the space of the two permutations of {0, 1}, and encryption is defined as Enck (m) = k ⊕ m. The proof
that it satisfies Shannon secrecy is quite simple, because there are only two messages and two ciphertexts:
Prk [Enck (0) = 0] = Prk [Enck (1) = 0] = Prk [Enck (0) = 1] = Prk [Enck (1) = 1] = 1/2.
We now generalize this scheme for longer messages by repeating the scheme for one-bit messages. The
result is known as the one-time-pad, or the Vernam cipher (patented by Vernam in 1919 [Ver19] and published
in 1926 [Ver26], for use with punch-tape in telegraph transmission). For any integer n, let M = K = {0, 1}n ,
and let Enck (m) = m ⊕ k. Let Deck (c) = c ⊕ k. It’s easy to see that for any fixed m ∈ M and c ∈ {0, 1}n ,
Prk∈K [Enck (m) = c] = P rk∈K [k = m ⊕ c] = 2−n . Hence, for any m1 ∈ M, m2 ∈ M, c, Prk [Enck (m1 ) = c] =
Prk [Enck (m2 ) = c].
This is a very computationally efficient scheme: exclusive-or is a simple operation, and multiple bits can
be encrypted independently in parallel. Its main drawback is that it requires a very long key, which can be
Leo Reyzin. Notes for BU CAS CS 538. 3

used only once. Next time we need to encrypt a message, we need to select a new random key (otherwise,
the adversary could, for example, compute the exclusive-or of the two messages encrypted).
Shannon showed that, unfortunately, it’s the best one can do. The following theorem is known as the
Shannon bound.

Theorem 2. If (M, K, Enc, Dec) satisfies perfect secrecy, then |K| ≥ |M |.

Proof. Let c be a possible ciphertext—i.e., fix some message m1 ∈ M , and let c be such that Pr[Enck1 (m1 ) =
c] > 0. Suppose there is some m2 ∈ M such that for all k ∈ K, Deck (c) 6= m2 . Then, by definition
of encryption scheme m2 would never get encrypted to c (because otherwise you couldn’t decrypt it). So
Pr[Enck1 (m2 ) = c] = 0, so Pr[Enck1 (m1 ) = c] 6= Pr[Enck1 (m2 ) = c], which violates perfect secrecy. In other
words, c must be decryptable to all plaintexts in M . Hence, for each m2 ∈ M , there exists k ∈ K such that
Deck (c) = m2 . So there must be at least as many k ∈ K as m2 ∈ M , so |K| ≥ |M |.

This pretty much ends our discussion of information-theoretic cryptography: we have an efficient encryp-
tion scheme, and a proof that you can’t do better. We will have to limit adversary’s computational power
if we want anything more efficient.

References
[Ker83] Auguste Kerckhoffs. La cryptographie militaire. Journal des Sciences Militaires, 9th Series:5–
38 and 161–191, January-February 1883. Available at http://www.petitcolas.net/fabien/
kerckhoffs/.

[Poe65] Edgar Allan Poe. A few words on secret writing. In James A. Harrison, editor, The Complete Works
of Edgar Allan Poe, volume XIV, pages 114–149. AMS Press, NY, 1965. Originally in Graham’s
Magazine, July 1841.

[Sha49] Claude E. Shannon. Communication theory of secrecy systems. Bell System Technical Jour-
nal, 28(4):656–715, October 1949. Available at http://www.cs.ucla.edu/~jkong/research/
security/shannon.html and http://www3.edgenet.net/dcowley/docs.html.

[Ver19] Gilbert S. Vernam. U.S.Patent 1,310,719. Secret signaling system, 22 July 1919.

[Ver26] Gilbert S. Vernam. Cipher printing telegraph systems for secret wire and radio telegraphic commu-
nications. Journal of the American Institute of Electrical Engineers, 45:109–115, 1926.