# The Odyssey of Entropy: Cryptography
## 3 Entropy and Encryption
### Modeling, Design and Implementation
#### 3.1.1 Security Models Related to Entropy  
In the following, we discuss security models that can be analyzed using entropy, and we review some related research. * **Entropic Security:** Entropic security is a relaxed version of semantic security. In _semantic security_, only negligible information about the plaintext can be extractable (in any feasible way) from the ciphertext. More specifically, suppose that a probabilistic polynomial time algorithm (PPTA) knows the ciphertext \(c\) generated from a message \(m\) (regardless of the related distribution) and the length of \(m\). The algorithm should still be unable to extract any partial information regarding \(m\) with a probability that is non-negligibly larger than all other PPTAs that know only the length of \(m\) (and not \(c\)). In _entropic security_, the cryptosystem needs to guarantee that the entropy of the message space is high from the point of view of the adversary [34]. A few research reports have worked on entropic security for high-entropy plaintexts [35]. Moreover, this model was used in honey encryption [36]. In honey encryption, decrypting the ciphertext using an incorrect key (guessed by the adversary) leads to a meaningful, but incorrect plaintext, which fools the adversary. * **Unconditional Security:** A cryptosystem is said to have _unconditional security_ (also called _information-theoretic security_) if the system is secure against adversaries with unlimited computational power, resources, memory space, and time. Information-theoretic methods and techniques have been utilized in studying unconditionally secure cryptosystems [37]. Some researchers have focused on this security model. For example, [PERSON] and [PERSON] [38] investigated the possibility of asymmetric unconditional security, which corresponds to asymmetric-key cryptography in the computational security model. * **Provable Security:** Some researchers have used entropy in provable security. For example, [PERSON] et al. [39] argued that the assumption of uniform key distribution, which is made in traditional provable security, is far from reality. They modeled realistic key distributions by entropy sources. As another example, it was shown by [PERSON] [40] that the explicit authenticated key agreement protocol presented by [PERSON] [41] is vulnerable to impersonation attack due to the low entropy of the keys. * **Perfect Secrecy:** Perfect secrecy (defined by [PERSON]) guarantees that \(H(P|C)=H(P)\), where \(P\) is the set of possible values for the plaintext and \(C\) denotes the set of possible values for the ciphertext. Put alternatively, a cryptosystem is perfectly secure if the adversary is unable to make any guesses about the plaintext, even in the case of full access to the channel (and, consequently, to the ciphertext). Several research works have focused on perfect secrecy. [PERSON] [42] argued that message quality degradation is inevitable for a perfectly secure cryptosystem that encrypts an analog message using a digital key with a finite size. He designed a perfectly secure analog signal encryption scheme that keeps the bandwidth of the encrypted signal from growing above that of the original analog signal without altering the key size or increasing the quality degradation incurred on the decrypted signal. The notion of \"finite-state encryptability\" for an individual plaintext sequence was introduced by [PERSON] [43] as the minimum asymptotic key rate required to guarantee perfect secrecy for that sequence. He demonstrated that the finite-state encryptability is equal to the finite-state compressibility (defined by [PERSON] and [PERSON] [44]) for every individual sequence. Perfect secrecy in radio signal encryption using DFT (discrete Fourier transform) wasstudied by [PERSON] et al. [45]. They proved perfect secrecy to be asymptotically achievable for any baseband signaling method, provided that the signal block length approaches infinity.