# The Odyssey of Entropy: Cryptography
## 3 Entropy and Encryption
### Analysis and Evaluation
#### 3.2.1 Entropy as a Security Measure  
Some researchers used entropy as an independent measure, and others considered it in relation with other security measures. Some effort was spent on the formal assessment of the role of entropy in the evaluation of a cryptosystem [133]. Moreover, some research reports focused on developing methods for measuring the entropy of a cryptosystem [134]. In the following, we review the related research works. * **As an Independent Measure:** Entropy is a widely used security measure. Among the research works that have used entropy as an independent measure for evaluating cryptographic schemes, one may refer to the following. A multichannel system was introduced by [PERSON] et al. [135] for the purpose of structuring and transmitting entropy-manipulated encrypted signals. [PERSON] [136] argued that entropy makes a cryptographic pseudo-random number generator indistinguishable from a truly random number generator. He studied different ways of creating and increasing entropy. A method was introduced by [PERSON] et al. [97] to measure the entropy of small blocks in an encrypted image. The average of the entropy over the blocks of an image was suggested as an efficient measure for evaluating the security of an image encryption scheme. * **Relation with Other Cryptographic Measures:** In the following, we study the research works that have established connections between entropy and other security measures, such as unicity distance, malleability, guesswork, confusion, diffusion and indistinguishability. * **Unicity Distance:** The unicity distance of a cryptosystem is defined as the minimum number of ciphertext bits needed for an adversary with unlimited computational power to recover the key. The connection between entropy and unicity distance has been of interest to some researchers. For example, an entropy analysis presented by [PERSON] [137] highlighted the unicity distance as an upper bound on the probability of the key being guessed by an eavesdropper. * **Malleability:** Consider a cryptosystem \(\mathcal{C}\) and a function \(f\). Let us assume that \(\mathcal{C}\) encrypts a plaintext \(p\) to a ciphertext \(c\), and encrypts \(f(p)\) to \(C^{\prime}\). If there is a transform \(g\) that guarantees \(g(c)=c^{\prime}\), then \(\mathcal{C}\) is called a malleable cryptosystem with respect to the function \(f\). The notion of non-malleable extractors was introduced by [PERSON] and [PERSON] [138] (inspired by the notion of malleability) for the purpose of symmetric-key cryptography from low-entropy keys. Later on, a widely believed conjecture on the distribution of prime numbers in arithmetic progressions was used by [PERSON] et al. [139] along with an estimate for character sums in order to build some new non-malleable extractors. Moreover, entropy analysis was used by [PERSON] et al. [140] to present an unconditional construction for non-malleable extractors with short seeds. Recently, some researchers worked on entropy lower bounds for non-malleable extractors [141]. * **Guesswork:** There is a clear relation between entropy and guesswork. While entropy can be interpreted as the average number of guesses required by an optimal binary search attack to break a cryptosystem, guesswork is defined as the average number of guesses required in an optimal linear search attack scenario [142]. It was shown by [PERSON] and [PERSON] [143] that if appropriately scaled, when the key is long enough, the expectation of the logarithm of the guesswork approaches the Shannon entropy of the key selection process. A similar research work studied the relation between guesswork and Renyi entropy [144]. [PERSON] [145] demonstrated that there cannot be any general inequality between Shannon entropy and the logarithm of the minimum search space size necessary to guarantee a certain level of guesswork. Another research reported by [PERSON] and [PERSON] [146] showed that entropy and guesswork cannot be interchangeably used in normal conditions.