Guesswork and Variation Distance as Measures of Cipher Security

Abstract

Abstract. Absolute lower limits to the cost of cryptanalytic attacks are quantified, via a theory of guesswork. Conditional guesswork naturally expresses limits to known and chosen plaintext attacks. New inequalities are derived between various forms of guesswork and variation distance. The machinery thus offers a new technique for establishing the security of a cipher: When the work-factor of the optimal known or chosen plaintext attack against a cipher is bounded below by a prohibitively large number, then no practical attack against the cipher can succeed.As an example, we apply the technique to iterated cryptosystems, as the Markov property which results from an independent subkey assumption makes them particularly amenable to analysis.

The Interplay between Error, Total Variation, Alpha-Entropy and Guessing: Fano and Pinsker Direct and Reverse Inequalities

“…The optimal strategy that minimizes the average number of questions is to guess the values of X in order of decreasing probabilities: first, the value with maximum probability p (1) , then the second maximum p (2) , and so on. The corresponding minimum average number of guesses is the guessing entropy [3] (also known as "guesswork" [4]):…”

“…A notable property is that the optimal upper bound does not depend on the value of K. The upper bound is mentioned by Pliam in [4] as an upper bound of ∆(p, u). The methodology of this paper, based on Schur concavity, greatly simplifies the derivation.…”

“…Fano and Pinsker inequalities find many applications in many areas of science; we only mention a few. They have been applied in character recognition [33], feature selection [7], Bayesian statistical experiments [17], statistical data processing [13], quantization [41], hypothesis testing [36], entropy estimation [38], channel coding [42], sequential decoding [11] and list decoding [36,43], lossless compression [37,43,44] and guessing [37,44], knowledge representation [12], cipher security measures [4], hash functions [8], randomness extractors [40], information flow [18], statistical decision making [20] and side-channel analysis [14,27,45]. Some of the various inequalities used for these applications are not optimal (or not proven optimal) for various reasons (simplicity of the expressions, approximations, etc.).…”

What Is Randomness? The Interplay between Alpha Entropies, Total Variation and Guessing

“…It is of primary importance to assess the "randomness" of a certain random variable X, which represents some identifier, cryptographic key, signature or any type of intended secret. Applications include pseudo-random bit generators [1], general cipher security [2], randomness extractors [3] and hash functions ( [4], Chapter 8), physically unclonable functions [5], true random number generators [6], to list but a few. In all of these examples, X takes finitely many values x ∈ {x 1 , x 2 , .…”

Measuring the Usability and Security of Permuted Passwords on Mobile Platforms

“…If we graph the cumulative distribution of password guessing probabilities, we have what John Pliam called the "work function": the relationship between the number of guesses the attacker makes and his probability of success [14]. How can we use our knowledge of these probability distributions (e.g.…”