3

The definition of perfect security is just that: $Pr(M =m | C=c) = Pr(M=m)$. We can prove that one time pad is perfectly secure for any distribution on a message space $M$, and it happens to be that the keyspace $K$ has a uniform distribution. Does that have to be true?

For example, let's say $M= \{0 \}$, $K=\{ 0,1 \}$ where $0$ is chosen with probability $p$ and $1$ chosen with probability $1-p$. Then we could have $c = m \oplus k$, and $c=0$ with probability $p$ and $c=1$ with probability $1-p$. Is this perfectly secure if $p \neq \frac12$?

eternalmothra
  • 395
  • 1
  • 10
  • 2
    A scheme with only one possible plaintext is obviously perfectly secure: a ciphertext does not give an attacker any additional information about the plaintext because the attacker already knows what the plaintext is anyway. – fkraiem Sep 20 '18 at 18:31
  • It's meant to be obviously perfectly secure because $Pr(M=m) =1$, but I was wondering if it didn't count as an example because the keyspace is not uniformly distributed. – eternalmothra Sep 20 '18 at 18:43

2 Answers2

3

The answer to your question in the title is No.

For example, let's modify a little the one-bit OTP considered in your question description (with a one-bit message space $M=\{0,1\}$). Instead of using a one-bit key $K=\{0,1\}$, we can use a two-bit key $K=\{00,01,10,11\}$ and discard its last bit when doing the xor. It's easy to see that perfect secrecy holds as long as the first bit satisfies uniform distribution, while the 2-bit key distribution is rather arbitrary.

Therefore, for perfect secrecy, the key distribution does not have to be uniform. Actually, this statement should be true for any kind of security. Security-wise, what really matters is the key entropy rather than the exact key distribution. We see uniform key distribution assumed almost everywhere because it is convenient to use (a weird key distribution could cause problems, e.g., for usability) and it gives us maximum key entropy.

Note that though seemingly contradictory, kelalaka's answer is also true; but it considers only the classical use of OTP where the keyspace matches the message space.

Shan Chen
  • 2,715
  • 1
  • 12
  • 17
1

Let give an example with a bad distribution on the keys with a message space with 2 elements.

$\Pr[m=0] = p$ and $\Pr[m=1] = 1-p$ and

$\Pr[k=0] = q$ and $\Pr[k=1] = 1-q$

  • $\Pr[m=0 , k=0] = pq$ with $c = 0$

  • $\Pr[m=0 , k=1] = p(1-q)$ with $c= 1$

  • $\Pr[m=1 , k=0] = (1-p)q$ with $c= 1$

  • $\Pr[m=1 , k=1] = (1-p)(1-q)$ with $c= 0$

Let have a bias on the keys with $q < 1/2$ and take $p=1/2$ for simplicity:

  • when $c=0$ then $$\Pr[m=1,k=1] = \frac{(1-p)(1-q)}{(pq)+(1-p)(1-q)} = \frac{\frac{1}{2}(1-q)}{\frac{1}{2}q+\frac{1}{2}(1-q)} = \frac{(1-q)}{q+(1-q)} > \frac{1}{2}$$

This is actually linear on $q$ with $q$ is $x$-axis;

enter image description here

Therefore the ciphertext will leak information about $m=1$ whereas in perfect secrecy this probability must be $\frac{1}{2}$.

kelalaka
  • 48,443
  • 11
  • 116
  • 196
  • "The message was $1$"? That is not possible since $M = {0}$. – fkraiem Sep 20 '18 at 18:29
  • $M={0}$ was an example, right? – kelalaka Sep 20 '18 at 18:31
  • Oh, right. Your answer is still not satisfactory, though: you show one scheme which has non-uniform keys and is not perfectly scret, but that does not prove that it is not possible to have non-uniform keys and perfect secrecy. – fkraiem Sep 20 '18 at 18:36
  • Simple fix: replace all occurences of "0.3" with $p$ and all occurences of "0.7" with $1-p$ (if you want to go fancy use $p$ for the plaintext distribution and $q$ for the key distribution). – SEJPM Sep 20 '18 at 18:41
  • @SEJPM tried. Just wonder, can we easily see the result with $p$ and $q$, analytically? – kelalaka Sep 20 '18 at 19:09
  • 1
    @kelalaka a few things with the edit: $\Pr_{m=1,k=1}$ must be smaller than 1/2 because the nominator is larger than the denominator and you can use a bulleted-list to improve the formatting on the listing of the probabilities. Additionally it needs to be shown that the probability of a given plaintext ($m=0$) underlying a given ciphertext doesn't match $p$ (=$\Pr[M=0]$). As for the $p$-$q$ split it should be possible even though I'm too tired right now to figure it out in detail. – SEJPM Sep 20 '18 at 19:25
  • @SEJPM I've finally turned back and fixed it :) – kelalaka Oct 30 '20 at 17:47