Entropic security

Entropic security is a security definition used in the field of <a href="/facts/Cryptography/e94PEVau">cryptography</a>. Modern <a href="/facts/Encryption/16q29Fdv">encryption</a> schemes are generally required to protect communications even when the attacker has substantial information about the messages being encrypted. For example, even if an attacker knows that an intercepted <a href="/facts/Ciphertext/luNTs4sY">ciphertext</a> encrypts either the message "Attack" or the message "Retreat", a <a href="/facts/Semantically_secure/PlW18aEh">semantically secure</a> encryption scheme will prevent the attacker from learning which of the two messages is encrypted. However, definitions such as <a href="/facts/Semantic_security/PlW18aEh">semantic security</a> are too strong to achieve with certain specialized encryption schemes. Entropic security is a weaker definition that can be used in the special case where an attacker has very little information about the messages being encrypted.
It is well known that certain types of encryption algorithm cannot satisfy definitions such as <a href="/facts/Semantic_security/PlW18aEh">semantic security</a>: for example, <a href="/facts/Deterministic_encryption/UDDXRtQ2">deterministic encryption</a> algorithms can never be semantically secure. Entropic security definitions relax these definitions to cases where the message space has substantial entropy (from an <a href="/facts/Adversary_(cryptography)/X211CFfE">adversary's</a> point of view). Under this definition it is possible to prove security of deterministic encryption.
Note that in practice entropically-secure encryption algorithms are only "secure" provided that the message distribution possesses high entropy from any reasonable adversary's perspective. This is an unrealistic assumption for a general encryption scheme, since one cannot assume that all likely users will encrypt high-entropy messages. For these schemes, stronger definitions (such as semantic security or <a href="/facts/IND-CCA2/2oumAzNt">indistinguishability under adaptive chosen ciphertext attack</a>) are appropriate. However, there are special cases in which it is reasonable to require high entropy messages. For example, encryption schemes that encrypt only secret key material (e.g., <a href="/facts/Key_encapsulation/uDR3scKh">key encapsulation</a> or <a href="/facts/Key_Wrap/kpbaS476">Key Wrap</a> schemes) can be considered under an entropic security definition. A practical application of this result is the use of <a href="/facts/Deterministic_encryption/UDDXRtQ2">deterministic encryption</a> algorithms for secure encryption of secret key material.
Russell and Wang formalized a definition of entropic security for encryption. Their definition resembles the <a href="/facts/Semantic_security/PlW18aEh">semantic security</a> definition when message spaces have highly-entropic distribution. In one formalization, the definition implies that an adversary given the ciphertext will be unable to compute any predicate on the ciphertext with (substantially) greater probability than an adversary who does not possess the ciphertext. Dodis and Smith later proposed alternate definitions and showed equivalence.

<ul><li><a href="http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.6.9932">A. Russell and Y. Wang. How to fool an unbounded adversary with a short key.</a> Appeared at Advances in Cryptology – Eurocrypt 2002.</li>
<li><a href="http://eprint.iacr.org/2004/219">Y. Dodis and A. Smith. Entropic Security and the encryption of high-entropy messages.</a> Appeared at the Theory of Cryptography Conference (TCC) 2005.</li></ul>

Entropic security open-in-new

Entropic security