Question

1.1 Let S = {01, 10, 11}. Note that S is a set of 2-bit strings with string 00 missing. Consider the following three One-Time Pad (OTP) variants. For each of these OTP variants state whether the resulting cipher is perfectly secure or not, and prove your answer. In other words, if your answer is “yes”, prove that the cipher passes Shannon’s perfect secrecy criterion, and if your answer is “no” then show that the cipher fails this criterion. In each case below the encryption and decryption procedures are as in OTP, i.e. encryption outputs a bitwise xor of the key and the message and decryption outputs a bitwise xor of the key and the ciphertext.

(a) Let M = S and K = {0, 1}^2. In other words, the message and the key are both 2-bit strings, but not every 2-bit string is a valid message.

(b) Let M = {0, 1}^2 and K = S

(c) Let M = K = S.

1.2 Are the sizes (i.e. cardinalities) of the key space and the message space in the above three cases correlated with whether or not the cipher is secure? Explain how and why.

Answer 1

Solution 1.1a: This follows the perfect secrecy of the OTP Perfect secrecy of the One Time Password (OTP) on 2 bit strings states that for each mo, m,,c E 10,1)2 we have Prk-(0.1)[E(k, mo)cPrk(o.E(k,m,)-c] Since S c {0,132, it follows that the similar property can hold for each mo, mi E S and cE (0,1)2 Another better answer is to see that encryption performs independently on each 2 bit strings message block, and state that security directly for a single block only Another better answer is to see that encryption performs independently on each 2 bit strings message block, and state that security directly for a single block only The direct argument will just state that for each m and c there is a unique key k in K = {0,1}2 such that E()- c namely k mc, and hence the probability that Prk(o.1EO-c] is a constant and equal to 1/KI 1/4, therefore the perfect secrecy follows . . . . · Solution 1.1b: As IMl-4> IK]-2, we know that this encryption can't be perfectly secure one To argue it is enough for finding a violation, take the simplest case There is many examples of a (mo,m,,c) triple which can form a counter example, yet one such tuple is mo- 01, m-11 andc01,for which we have Prk (o.1 E(k, mo)-c- 1/3, because the key k-ol E K can map mo c, however Prk-(0.1)[E(k, mi) 0, because no key k E K can map mi-c . . Solution 1.1c: . Here we have, |MI K S, thus this can be a perfectly secure one * Still, it isn't and we can see it by employing the simplest form again and find out some counter example tuple (mo, m1, c). There're many such tuples and we can find them by exploring the table of possible cipher texts for every message in the message space Kev k 10110 Message m Ciphertext c 01 10 10110 01 00 000 11 . We can see for instance that c01 can only be obtained by encrpyting m-01 or 11, however not for encrypting m= 10 Hence taking c-01, mo is equal to either 11 or 01 and m1-10, we have that Prk-(0,1)2 [E(k, mo)-c] # 0 while Prk-(0.1E(k,m)-c0 Therefore, the perfect secrecy can be achieved. . Solution 1.2: Here is the correlatioin o In case (1.1a) we had a perfect secrecy and |Ml < |K o In case (1.1b) we didn't have a perfect secrecy and IMI > K o In case (1.1c) we didn't have a perfect secrecy and |M K This concurs with the fact that the perfect sacrecy states that |K] 2 MI and it illustrates that the implication doesn't hold in the other direction. That is, the condition Kl 2 IMI is necessary still not sufficient for the perfect secrecy