aarjaneiro/planetmath huggingface dataset:
conditional entropy

conditional entropy

Definition (Discrete)

Let

(

Ω

,

ℱ

,

μ

)

be a

discrete

probability space

, and let

X

and

Y

be

discrete random variables

on

Ω

.

The

conditional entropy

H

[

X

|

Y

]

, read as “the conditional entropy of

X

given

Y

,” is defined as

H

[

X

|

Y

]

=

-

∑

x

∈

X

∑

y

∈

Y

μ

(

X

=

x

,

Y

=

y

)

log

μ

(

X

=

x

|

Y

=

y

)

(1)

where

μ

(

X

|

Y

)

denotes the

conditional probability

.

μ

(

Y

=

y

)

is nonzero in the
discrete case

Discussion

The results for discrete conditional entropy will be assumed to hold for the

continuous

case unless we indicate otherwise.

With

H

⁢

[

X

,

Y

]

the

joint entropy

and

f

a

function

, we have the following results:

H

[

X

|

Y

]

+

H

[

Y

]

=

H

⁢

[

X

,

Y

]

(2)

H

[

X

|

Y

]

≤

H

⁢

[

X

]

(conditioning reduces entropy)

(3)

H

[

X

|

Y

]

≤

H

⁢

[

X

]

+

H

⁢

[

Y

]

(equality iff

⁢

X

,

Y

⁢

independent)

(4)

H

[

X

|

Y

]

≤

H

[

X

|

f

(

Y

)

]

(5)

H

[

X

|

Y

]

=

0

⇔

X

=

f

(

Y

)

(special case

H

[

X

|

X

]

=

0

)

(6)

The conditional entropy

H

[

X

|

Y

]

may be interpreted as the uncertainty in

X

given knowledge of

Y

. (Try reading the above equalities and

inequalities

with this

interpretation

in mind.)

Title

conditional entropy

Canonical name

ConditionalEntropy

Date of creation

2013-03-22 12:25:16

Last modified on

2013-03-22 12:25:16

Owner

PrimeFan (13766)

Last modified by

PrimeFan (13766)

Numerical id

9

Author

PrimeFan (13766)

Entry type

Definition

Classification

msc 94A17

Related topic

Entropy

Related topic

RelativeEntropy

Related topic

ConditionalProbability

Related topic

DifferentialEntropy

Related topic

ShannonsTheoremEntropy

Generated on Sat Feb 10 13:41:37 2018 by

LaTeXML
derivation of Hartley function

derivation of Hartley function

We want to show that the

Hartley function

log

2

⁡

(

n

)

is the only

function

mapping

natural numbers

to real numbers that

1.

H

⁢

(

m

⁢

n

)

=

H

⁢

(

m

)

+

H

⁢

(

n

)

(),

2.

H

⁢

(

m

)

≤

H

⁢

(

m

+

1

)

(monotonicity), and

3.

H

⁢

(

2

)

=

1

(normalization).

Let

f

be a function on

positive integers

that

satisfies

the above three

properties

. Using the

additive

property, it is easy to see that the value of

f

⁢

(

1

)

must be zero. So we want to show that

f

⁢

(

n

)

=

log

2

⁡

(

n

)

for all

integers

n

≥

2

.

From the additive property, we can show that for any integer

n

and

k

,

f

⁢

(

n

k

)

=

k

⁢

f

⁢

(

n

)

.

(1)

Let

a

>

2

be an integer. Let

t

be any positive integer. There is a unique
integer

s

determined by

a

s

≤

2

t

<

a

s

+

1

.

Therefore,

s

⁢

log

2

⁡

a

≤

t

<

(

s

+

1

)

⁢

log

2

⁡

a

and

s

t

≤

1

log

2

⁡

a

<

s

+

1

t

.

On the other hand, by monotonicity,

f

⁢

(

a

s

)

≤

f

⁢

(

2

t

)

≤

f

⁢

(

a

s

+

1

)

.

Using Equation (1) and

f

⁢

(

2

)

=

1

, we get

s

⁢

f

⁢

(

a

)

≤

t

≤

(

s

+

1

)

⁢

f

⁢

(

a

)

,

and

s

t

≤

1

f

⁢

(

a

)

≤

s

+

1

t

.

Hence,

|

1

f

⁢

(

a

)

-

1

log

2

⁡

(

a

)

|

≤

1

t

.

Since

t

can be arbitrarily large, the

difference

on the left
hand of the above inequality must be zero,

f

⁢

(

a

)

=

log

2

⁡

(

a

)

.

Title

derivation of Hartley function

Canonical

name

DerivationOfHartleyFunction

Date of creation

2013-03-22 14:32:15

Last modified on

2013-03-22 14:32:15

Owner

Mathprof (13753)

Last modified by

Mathprof (13753)

Numerical id

11

Author

Mathprof (13753)

Entry type

Derivation

Classification

msc 94A17

Generated on Sat Feb 10 13:41:39 2018 by

LaTeXML
derivation of mutual information

derivation of mutual information

The

maximum likelihood

estimater for

mutual information

is identical (except for a

scale factor

) to the generalized log-likelihood ratio for multinomials and closely related to Pearson’s

χ

2

test. This implies that the

distribution

of observed values of mutual information computed using

maximum likelihood estimates

for

probabilities

is

χ

2

distributed except for that scaling factor.

In particular if we sample each of

X

and

Y

and combine the samples to form

N

tuples sampled from

X

×

Y

. Now define

T

⁢

(

x

,

y

)

to be the total number of times the tuple

(

x

,

y

)

was observed. Further define

T

⁢

(

x

,

*

)

to be the number of times that a tuple starting with

x

was observed and

T

⁢

(

*

,

y

)

to be the number of times that a tuple ending with

y

was observed. Clearly,

T

⁢

(

*

,

*

)

is just

N

, the number of tuples in the sample. From the

definition

, the generalized log-likelihood ratio test of independence for

X

and

Y

(based on the sample of tuples) is

-

2

⁢

l

⁢

o

⁢

g

⁢

λ

=

2

⁢

∑

x

⁢

y

T

⁢

(

x

,

y

)

⁢

log

⁡

π

x

|

y

μ

x

where

π

x

|

y

=

T

⁢

(

x

,

y

)

/

∑

x

T

⁢

(

x

,

y

)

and

μ

x

=

T

⁢

(

x

,

*

)

/

T

⁢

(

*

,

*

)

This allows the log-likelihood ratio to be expressed in terms of row and column sums,

-

2

⁢

l

⁢

o

⁢

g

⁢

λ

=

2

⁢

∑

x

⁢

y

T

⁢

(

x

,

y

)

⁢

log

⁡

T

⁢

(

x

,

y

)

⁢

T

⁢

(

*

,

*

)

T

⁢

(

x

,

*

)

⁢

T

⁢

(

*

,

y

)

This reduces to the following

expression

in terms of maximum likelihood estimates of cell, row and column probabilities,

-

2

⁢

l

⁢

o

⁢

g

⁢

λ

=

2

⁢

∑

x

⁢

y

T

⁢

(

x

,

y

)

⁢

log

⁡

π

x

⁢

y

μ

*

y

⁢

μ

x

⁣

*

This can be rearranged into

-

2

⁢

l

⁢

o

⁢

g

⁢

λ

=

2

⁢

N

⁢

[

∑

x

⁢

y

π

x

⁢

y

⁢

log

⁡

π

x

⁢

y

⁢

∑

x

μ

x

⁣

*

⁢

log

⁡

μ

x

⁣

*

⁢

∑

y

μ

*

y

⁢

log

⁡

μ

*

y

]

=

2

⁢

N

⁢

I

^

⁢

(

X

;

Y

)

where the hat indicates a maximum likelihood estimation of

I

⁢

(

X

;

Y

)

.

This also gives the asymptotic distribution of

I

^

⁢

(

X

;

Y

)

as

2

⁢

N

times a

χ

2

deviate.

Title

derivation of mutual information

Canonical

name

DerivationOfMutualInformation

Date of creation

2013-03-22 15:13:38

Last modified on

2013-03-22 15:13:38

Owner

tdunning (9331)

Last modified by

tdunning (9331)

Numerical id

5

Author

tdunning (9331)

Entry type

Derivation

Classification

msc 94A17

Generated on Sat Feb 10 13:41:42 2018 by

LaTeXML
Gaussian distribution maximizes entropy for given covariance

Gaussian distribution maximizes entropy for given covariance

Theorem 1

Let

f

:

R

n

→

R

be a

continuous

probability
density function

. Let

X

1

,

…

,

X

n

be

random variables

with

density

f

and with

covariance matrix

K

,

K

i

⁢

j

=

cov

⁢

(

X

i

,

X

j

)

. Let

ϕ

be the

distribution

of the
multidimensional

Gaussian

(

http://planetmath.org/JointNormalDistribution

) with mean

0

and covariance matrix

K

. Then the

Gaussian distribution

maximizes the

differential entropy

for a given covariance matrix

K

. That is,

h

⁢

(

ϕ

)

≥

h

⁢

(

f

)

.

Title

Gaussian distribution maximizes entropy for given covariance

Canonical name

GaussianDistributionMaximizesEntropyForGivenCovariance

Date of creation

2013-03-22 12:19:26

Last modified on

2013-03-22 12:19:26

Owner

Mathprof (13753)

Last modified by

Mathprof (13753)

Numerical id

10

Author

Mathprof (13753)

Entry type

Theorem

Classification

msc 94A17

Generated on Sat Feb 10 13:41:43 2018 by

LaTeXML
Hartley function

Hartley function

Definition

The

Hartley function

is a of uncertainty, introduced by Hartley in 1928. If we pick a sample from a

finite set

A

uniformly at random, the revealed after we know the is given by the Hartley function

H

⁢

(

A

)

:=

log

b

⁡

(

|

A

|

)

.

If the base of the

logarithm

is 2, then the uncertainty is
measured in bits. If it is the

natural logarithm

, then the is nats. It is also known as the Hartley entropy.

Remark:

The Hartley function is a special case of Shannon’s

entropy

. Each

element

in the sample space

A

is associated with probability

p

=

1

/

|

A

|

. For an element

ω

∈

A

, the Hartley of the event

{

ω

}

is

-

log

⁡

(

p

)

=

log

⁡

(

|

A

|

)

, which is

constant

over

ω

∈

A

. The average over the whole sample space is thus also equal to

log

⁡

(

|

A

|

)

.

Characterization

The Hartley function only depends on the number of elements in a
set, and hence can be viewed as a

function

on

natural numbers

.
Rényi showed that the Hartley function in base 2 is the only
function

mapping

natural numbers to real numbers that

1.

H

⁢

(

m

⁢

n

)

=

H

⁢

(

m

)

+

H

⁢

(

n

)

(),

2.

H

⁢

(

m

)

≤

H

⁢

(

m

+

1

)

(monotonicity), and

3.

H

⁢

(

2

)

=

1

(normalization).

Condition 1 says that the uncertainty of the

Cartesian product

of
two finite sets

A

and

B

is the sum of uncertainties of

A

and

B

. Condition 2 says that a larger set has larger uncertainty.

Title

Hartley function

Canonical name

HartleyFunction

Date of creation

2013-03-22 14:31:41

Last modified on

2013-03-22 14:31:41

Owner

kshum (5987)

Last modified by

kshum (5987)

Numerical id

15

Author

kshum (5987)

Entry type

Definition

Classification

msc 94A17

Related topic

ShannonsTheoremEntropy

Related topic

EntropyOfAPartition

Defines

Hartley entropy

Defines

Hartley information

Generated on Sat Feb 10 13:41:45 2018 by

LaTeXML
mutual information

mutual information

Let

(

Ω

,

ℱ

,

μ

)

be a discrete

probability space

, and let

X

and

Y

be

discrete random variables

on

Ω

.

The

mutual information

I

⁢

[

X

;

Y

]

, read as “the mutual information of

X

and

Y

,” is defined as

I

⁢

[

X

;

Y

]

=

∑

x

∈

Ω

∑

y

∈

Ω

μ

(

X

=

x

,

Y

=

y

)

log

μ

(

X

=

x

,

Y

=

y

)

μ

(

X

=

x

)

μ

(

Y

=

y

)

=

D

(

μ

(

x

,

y

)

|

|

μ

(

x

)

μ

(

y

)

)

.

where

D

denotes the

relative entropy

.

Mutual information, or just information, is measured in bits if the logarithm is to the base 2, and in “nats” when using the natural logarithm.

Discussion

The most

obvious

characteristic

of mutual information is that it depends on both

X

and

Y

. There is no information in a vacuum—information is always

about

something. In this case,

I

⁢

[

X

;

Y

]

is the information in

X

about

Y

. As its name suggests, mutual information is

symmetric

,

I

⁢

[

X

;

Y

]

=

I

⁢

[

Y

;

X

]

, so any information

X

carries about

Y

,

Y

also carries about

X

.

The

definition

in terms of relative entropy gives a useful

interpretation

of

I

⁢

[

X

;

Y

]

as a kind of “

distance

” between the

joint distribution

μ

⁢

(

x

,

y

)

and the

product distribution

μ

⁢

(

x

)

⁢

μ

⁢

(

y

)

. Recall, however, that relative entropy is not a true distance, so this is just a conceptual tool. However, it does capture another intuitive notion of information. Remember that for

X

,

Y

independent

,

μ

⁢

(

x

,

y

)

=

μ

⁢

(

x

)

⁢

μ

⁢

(

y

)

. Thus the relative entropy “distance” goes to zero, and we have

I

⁢

[

X

;

Y

]

=

0

as one would expect for independent

random variables

.

A number of useful

expressions

, most apparent from the definition, relate mutual information to the

entropy

H

:

0

≤

I

⁢

[

X

;

Y

]

≤

H

⁢

[

X

]

(1)

I

⁢

[

X

;

Y

]

=

H

[

X

]

-

H

[

X

|

Y

]

(2)

I

⁢

[

X

;

Y

]

=

H

⁢

[

X

]

+

H

⁢

[

Y

]

-

H

⁢

[

X

,

Y

]

(3)

I

⁢

[

X

;

X

]

=

H

⁢

[

X

]

(4)

Recall that the entropy

H

⁢

[

X

]

quantifies our uncertainty about

X

. The last line justifies the description of entropy as “self-information.”

Historical Notes

Mutual information, or simply information, was introduced by Shannon in his landmark 1948 paper “A Mathematical Theory of Communication.”

Title

mutual information

Canonical

name

MutualInformation

Date of creation

2013-03-22 12:37:35

Last modified on

2013-03-22 12:37:35

Owner

drummond (72)

Last modified by

drummond (72)

Numerical id

4

Author

drummond (72)

Entry type

Definition

Classification

msc 94A17

Synonym

information

Related topic

RelativeEntropy

Related topic

Entropy

Related topic

ShannonsTheoremEntropy

Related topic

DynamicStream

Defines

information

Defines

mutual information

Generated on Sat Feb 10 13:41:47 2018 by

LaTeXML
proof of Gaussian maximizes entropy for given covariance

proof of Gaussian maximizes entropy for given covariance

Let

f

,

K

,

ϕ

be as in the parent (

http://planetmath.org/GaussianMaximizesEntropyForGivenCovariance

) entry.

The proof uses the nonnegativity of

relative entropy

D

(

f

|

|

ϕ

)

, and an interesting property of

quadratic forms

. If

A

is a quadratic form and

p

,

q

are probability distributions each with mean

𝟎

and

covariance matrix

𝐊

, we have

∫

p

⁢

x

i

⁢

x

j

⁢

𝑑

x

i

⁢

𝑑

x

j

=

K

i

⁢

j

=

∫

q

⁢

x

i

⁢

x

j

⁢

𝑑

x

i

⁢

𝑑

x

j

(1)

and thus

∫

A

⁢

p

=

∫

A

⁢

q

(2)

Now note that since

ϕ

⁢

(

𝐱

)

=

(

(

2

⁢

π

)

n

⁢

|

𝐊

|

)

-

1

2

⁢

exp

⁡

(

-

1

2

⁢

𝐱

T

⁢

𝐊

-

1

⁢

𝐱

)

,

(3)

we see that

log

⁡

ϕ

is a quadratic form plus a constant.

0

≤

D

(

f

|

|

ϕ

)

=

∫

f

⁢

log

⁡

f

ϕ

=

∫

f

⁢

log

⁡

f

-

∫

f

⁢

log

⁡

ϕ

=

-

h

⁢

(

f

)

-

∫

f

⁢

log

⁡

ϕ

=

-

h

⁢

(

f

)

-

∫

ϕ

⁢

log

⁡

ϕ

by the quadratic form property above

=

-

h

⁢

(

f

)

+

h

⁢

(

ϕ

)

and thus

h

⁢

(

ϕ

)

≥

h

⁢

(

f

)

.

Title

proof of Gaussian maximizes entropy for given covariance

Canonical name

ProofOfGaussianMaximizesEntropyForGivenCovariance

Date of creation

2013-03-22 12:19:35

Last modified on

2013-03-22 12:19:35

Owner

Mathprof (13753)

Last modified by

Mathprof (13753)

Numerical id

10

Author

Mathprof (13753)

Entry type

Proof

Classification

msc 94A17

Related topic

QuadraticForm

Related topic

RelativeEntropy

Related topic

MultidimensionalGaussianIntegral

Generated on Sat Feb 10 13:41:49 2018 by

LaTeXML
sampling theorem

sampling theorem

Sampling Theorem

The greyvalues of digitized one- or two-dimensional signals are typically generated by an analogue-to-digital converter (ADC), by

sampling

a continuous signal at fixed intervals (e.g. in time), and quantizing (digitizing) the samples. The sampling (or point sampling) theorem states that a band-limited analogue signal

x

a

⁢

(

t

)

, i.e. a signal in a finite frequency band (e.g. between 0 and BHz), can be completely reconstructed from its samples

x

⁢

(

n

)

=

x

⁢

(

n

⁢

T

)

, if the sampling frequency is greater than

2

⁢

B

(the Nyquist rate); expressed in the , this that the sampling interval

T

is at most

1

2

⁢

B

seconds. Undersampling can produce serious errors (

aliasing

) by introducing artifacts of low frequencies, both in one-dimensional signals and in digital .

References

•

Originally from the Data Analysis Briefbook (

http://rkb.home.cern.ch/rkb/titleA.html

http://rkb.home.cern.ch/rkb/titleA.html)

Title

sampling theorem

Canonical name

SamplingTheorem

Date of creation

2013-03-22 12:04:25

Last modified on

2013-03-22 12:04:25

Owner

akrowne (2)

Last modified by

akrowne (2)

Numerical id

8

Author

akrowne (2)

Entry type

Theorem

Classification

msc 94A20

Synonym

Nyquist’s theorem

Generated on Sat Feb 10 13:42:01 2018 by

LaTeXML
weight enumerator

weight enumerator

Let

A

be an

alphabet

and

C

a finite subset of

A

*

.
Then the

complete weight enumerator

of

C

, denoted by

cwe

C

, is the

polynomial

in

|

A

|

indeterminates

X

a

labeled by
the letters of

a

∈

A

with

integer

coefficients defined by

cwe

C

⁡

(

(

X

a

)

a

∈

A

)

:=

∑

c

∈

C

∏

a

∈

A

X

a

wt

a

⁡

(

c

)

,

where

wt

a

⁡

(

c

)

is the

a

-weight of the string

c

.

If

A

is an abelian group, one defines the

Hamming weight
enumerator

of

C

, denoted by

we

C

, as a polynomial in only two
indeterminates

X

and

Y

:

we

C

⁡

(

X

,

Y

)

:=

cwe

C

⁡

(

(

X

a

)

a

∈

A

)

|

X

0

=

X

X

a

=

Y

⁢

if

⁢

a

≠

0

,

that is one distinguishes only between zero and the non-zero letters
of the strings in

C

.

If

C

is a code of block length

n

, then both

cwe

C

and

we

C

are

http://planetmath.org/node/6577

homogeneous of degree

n

. Therefore, one can set

Y

=

1

in

we

C

in this case without losing

information

. The resulting polynomial can
be uniquely rewritten in the form

we

C

⁡

(

X

,

1

)

=

∑

i

=

0

n

A

i

⁢

X

n

-

i

,

the

sequence

A

0

,

…

⁢

A

n

defining the

Hamming weight
distribution

. Analogously, one can define more general weight
distributions by setting all but one indeterminate in

cwe

C

⁡

(

(

X

a

)

a

∈

A

)

equal to one.

Examples

•

Let

C

be the ternary (that is

A

=

𝔽

3

=

{

0

,

1

,

2

}

)

linear
code

of block length

4

the vectors

(

1

,

1

,

1

,

1

)

,

(

1

,

1

,

0

,

0

)

and

(

1

,

0

,

1

,

0

)

. Then

cwe

C

⁡

(

X

0

,

X

1

,

X

2

)

=

X

0

4

+

4

⁢

X

0

2

⁢

X

1

2

+

4

⁢

X

0

2

⁢

X

1

⁢

X

2

+

4

⁢

X

0

2

⁢

X

2

2

+

4

⁢

X

0

⁢

X

1

2

⁢

X

2

+

4

⁢

X

0

⁢

X

1

⁢

X

2

2

+

X

1

4

+

4

⁢

X

1

2

⁢

X

2

2

+

X

2

4

and

we

C

⁡

(

X

,

Y

)

=

X

4

+

12

⁢

X

2

⁢

Y

2

+

8

⁢

X

⁢

Y

3

+

6

⁢

Y

4

and the Hamming weight distribution is

1

,

0

,

12

,

8

,

6

.

•

The Hamming weight enumerator of the full binary code of length

n

,

𝔽

2

n

, is simply given by

we

𝔽

2

n

⁡

(

X

,

Y

)

=

(

X

+

Y

)

n

, and the Hamming weight
distribution is the

n

-th of Pascal’s triangle.

Title

weight enumerator

Canonical name

WeightEnumerator

Date of creation

2013-03-22 15:13:23

Last modified on

2013-03-22 15:13:23

Owner

GrafZahl (9234)

Last modified by

GrafZahl (9234)

Numerical id

4

Author

GrafZahl (9234)

Entry type

Definition

Classification

msc 94A55

Classification

msc 94B05

Synonym

Hamming weight enumerator

Related topic

KleeneStar

Related topic

LinearCode

Defines

complete weight enumerator

Defines

weight distribution

Defines

Hamming weight distribution

Generated on Sat Feb 10 13:42:03 2018 by

LaTeXML
weight (strings)

weight (strings)

Let

A

be an

alphabet

,

a

∈

A

a letter from

A

and

c

∈

A

*

a
string over

a

. Then the

a

-

weight

of

c

, denoted by

wt

a

⁡

(

c

)

, is the number of times

a

occurs in

c

.

If

A

is an

abelian group

, the

Hamming weight

wt

⁡

(

c

)

of

c

(no ),
often simply referred to as “weight”, is the number of nonzero letters in

c

.

Examples

•

Let

A

=

{

x

,

y

,

z

}

. In the string

c

:=

y

⁢

x

⁢

x

⁢

z

⁢

y

⁢

y

⁢

z

⁢

x

⁢

y

⁢

z

⁢

z

⁢

y

⁢

x

,

y

occurs

5

times, so the

y

-weight

wt

y

⁡

(

c

)

=

5

.

•

Let

A

=

ℤ

3

=

{

0

,

1

,

2

}

(an abelian group) and

c

:=

002001200

. Then

wt

0

⁡

(

c

)

=

6

,

wt

1

⁡

(

c

)

=

1

,

wt

2

⁡

(

c

)

=

2

and

wt

⁡

(

c

)

=

wt

1

⁡

(

c

)

+

wt

2

⁡

(

c

)

=

3

.

Title

weight (strings)

Canonical name

Weightstrings

Date of creation

2013-03-22 15:13:17

Last modified on

2013-03-22 15:13:17

Owner

GrafZahl (9234)

Last modified by

GrafZahl (9234)

Numerical id

6

Author

GrafZahl (9234)

Entry type

Definition

Classification

msc 94A55

Synonym

weight

Related topic

KleeneStar

Defines

Hamming weight

Generated on Sat Feb 10 13:42:05 2018 by

LaTeXML
Diffie-Hellman key exchange

Diffie-Hellman key exchange

The

Diffie-Hellman key exchange

is a cryptographic protocol for

symmetric

key exchange. There are various implementations of this protocol. The following interchange between Alice and Bob demonstrates the Elliptic Curve Diffie-Hellman key exchange.

•

1) Alice and Bob publicly agree on an

elliptic curve

E

over a large

finite field

F

and a point

P

on that curve.

•

2) Alice and Bob each privately choose large random

integers

, denoted

a

and

b

.

•

3) Using elliptic curve point-addition, Alice computes

a

⁢

P

on

E

and sends it to Bob. Bob computes

b

⁢

P

on

E

and sends it to Alice.

•

4) Both Alice and Bob can now compute the point

a

⁢

b

⁢

P

, Alice by multipliying the received value of

b

⁢

P

by her secret number

a

, and Bob vice-versa.

•

5) Alice and Bob agree that the

x

coordinate

of this point will be their shared secret value.

An evil interloper Eve observing the communications will be able to intercept only the objects

E

,

P

,

a

⁢

P

, and

b

⁢

P

. She can succeed in determining the final secret value by gaining knowledge of either of the values

a

or

b

. Thus, the security of the exchange depends on the hardness of that problem, known as the

elliptic curve discrete logarithm problem

. For large

a

and

b

, it is a computationally “difficult” problem.

As a side note, some care has to be taken to choose an appropriate curve

E

.

Singular

curves and ones with “bad” numbers of points on it (over the given field) have simplified solutions to the

discrete log

problem.

Title

Diffie-Hellman key exchange

Canonical name

DiffieHellmanKeyExchange

Date of creation

2013-03-22 13:45:58

Last modified on

2013-03-22 13:45:58

Owner

mathcam (2727)

Last modified by

mathcam (2727)

Numerical id

6

Author

mathcam (2727)

Entry type

Algorithm

Classification

msc 94A60

Related topic

EllipticCurveDiscreteLogarithmProblem

Related topic

ArithmeticOfEllipticCurves

Generated on Sat Feb 10 13:42:21 2018 by

LaTeXML
elliptic curve discrete logarithm problem

elliptic curve discrete logarithm problem

The

elliptic curve discrete logarithm problem

is the cornerstone of much of present-day

elliptic curve cryptography

. It relies on the natural group law on a

non-singular

elliptic curve

which allows one to add points on the curve together. Given an elliptic curve

E

over a

finite field

F

, a point on that curve,

P

, and another point you know to be an

integer

multiple

of that point,

Q

, the “problem” is to find the integer

n

such that

n

⁢

P

=

Q

.

The problem is computationally difficult unless the curve has a “bad” number of points over the given field, where the term “bad” encompasses various collections of numbers of points which make the elliptic curve discrete logarithm problem breakable. For example, if the number of points on

E

over

F

is the same as the number of elements of

F

, then the curve is vulnerable to attack. It is because of these issues that point-counting on elliptic curves is such a hot topic in elliptic curve cryptography.

For an introduction to point-counting, reference Schoof’s algorithm.

Title

elliptic curve discrete logarithm problem

Canonical name

EllipticCurveDiscreteLogarithmProblem

Date of creation

2013-03-22 13:46:01

Last modified on

2013-03-22 13:46:01

Owner

mathcam (2727)

Last modified by

mathcam (2727)

Numerical id

7

Author

mathcam (2727)

Entry type

Definition

Classification

msc 94A60

Synonym

elliptic curve discrete log problem

Related topic

DiffieHellmanKeyExchange

Related topic

ArithmeticOfEllipticCurves

Generated on Sat Feb 10 13:42:26 2018 by

LaTeXML