# The Odyssey of Entropy: Cryptography
## 2 Entropy Measures and Related Concepts
### Entropy Measures  
In addition to Shannon entropy, some other measures for entropy have been introduced by different researchers. For example, for a random variable \(X\) with events \(x_{i}=i\) (\(i\in\{1,2,\ldots,n\}\)) of probability \(P_{X}(x_{i})\), Renyi entropy \(H_{\alpha}^{(R)}\) of order \(\alpha\in\mathbb{R}^{+}\setminus\{1\}\) is defined as [4],  
\[H_{\alpha}^{(R)}(X)=\frac{1}{1-\alpha}\log_{2}\sum_{i=1}^{n}(P_{X}(x_{i}))^{ \alpha}. \tag{4}\]  
It is well known that \(\lim_{\alpha\to 1}H_{\alpha}^{(R)}(X)=H(X)\), where \(H(X)\) is the Shannon entropy given by Equation (3). Moreover, \(H_{0}^{(R)}(X)=H^{(H)}(X)\), where \(H^{(H)}(X)\) is the Hartley entropy (sometimes called max entropy) defined as  
\[H^{(H)}(X)=\max_{\alpha}H_{\alpha}^{(R)}(X)\log_{2}n=\log_{2}|X|. \tag{5}\]  
_Collision entropy_, defined below, is used by many researchers in cryptography,  
\[H^{(\mathcal{C})}(X)=H_{2}^{(R)}(X)=-\log_{2}\sum_{i=1}^{n}(P_{X}(x_{i}))^{2}. \tag{6}\]  
The security of cryptosystems is measured by the expectation of certain function, which is called _perfect expectation_ (in the ideal model, where perfect randomness is available) or _weak expectation_ (in the real model, where perfect randomness is not available). [PERSON] and [PERSON] [15] used Renyi entropy to derive some results and inequalities, which show that weak expectation is not much worse than perfect expectation. For a cryptosystem \(\mathcal{C}\), let resource \(\mathcal{R}\) be a tuple containing the values of all efficiency measures, such as running time, circuit size, the number of oracle queries, etc. For a secret key \(k\in\{0,1\}^{m}\), let \(f(k)\) be the advantage of adversary \(\mathcal{A}\) conditioned on \(k\). In addition, let \(U_{m}\) be the uniform distribution over \(\{0,1\}^{m}\). Then \(\mathcal{C}\) is \((\mathcal{R},\varepsilon)\)-secure if for any adversary \(\mathcal{A}\) with resource \(\mathcal{R}\), the expectation of \(f(U_{m})\) (called _perfect expectation_) is upper bounded by \(\varepsilon\)[16]. When the key is sampled from some non-uniform distribution \(W\), the resulting security is the expectation of \(f(W)\) (called _weak expectation,Weak-Expect-Conf001_). The result of [PERSON] and [PERSON] [15] was motivated by the fact that while cryptographic schemes ideally assume highly random secret keys, true random number generation is so costly and sometimes not feasible in the real world, which causes weak expectation to be substituted for the ideal perfect expectation. As another example, Renyi entropy was used by [PERSON] [17] in order to analyze the success parameters of guess attacks. The relation between the results of evaluating a cryptosystem using Shannon entropy and collision entropy was studied by [PERSON] [18], and the worst possible collision entropy for random variables with a given Shannon entropy was calculated. Another well-known entropy measure is _min entropy_, \(H^{(M)}\), which is calculated as  
\[H^{(M)}(X)=\min_{\alpha}H_{\alpha}^{(R)}(X)=\lim_{\alpha\to\infty}H_{\alpha}^{ (R)}(X)=-\log_{2}\biggl{(}\max_{i}P_{X}(x_{i})\biggr{)}. \tag{7}\]  
Min entropy has been used in studies related to cryptographic primitives, such as hash functions [19; 20], in developing cryptographic hardware such as PUFs (physically unclonable functions) [21], and in authentication [22; 23] and secret sharing [24]. For a probability distribution \(P=\{p_{1},p_{2},\ldots,p_{n}\}\) and \(R\in\mathbb{R}^{+}\setminus\{1\}\), \(R\)_-norm entropy_\(H_{\alpha}^{(R)}(P)\) is defined as [25],\[H_{n}^{(R)}(P)=\frac{R}{1-R}\left(1-\left(\sum_{i=1}^{n}(p_{i})^{R}\right)^{\frac{1 }{R}}\right). \tag{8}\]  
\(R\)-norm entropy is used in fuzzy probability spaces and related areas [26]. [PERSON] and [PERSON] [27] considered Shannon entropy as a special case of \(R\)-norm entropy when parameter \(R\) in Equation (8) approaches unity. They defined conditional \(R\)-norm entropy as well as \(R\)-norm mutual information, and used the defined concepts to generalize the notion of random cipher introduced by [PERSON].