660 BELL SYSTEM TECHNICAL JOURNAL 



of the key never increases with increasing N . This equivocation is a theo- 

 retical secrecy index — theoretical in that it allows the enemy unlimited time 

 to analyse the cryptogram. 



The function H{X) for a certain idealized type of cipher called the random 

 cipher is determined. With certain modifications this function can be applied 

 to many cases of practical interest. This gives a way of calculating approxi- 

 mately how much intercepted material is required to obtain a solution to a 

 secrecy system. It appears from this analysis that with ordinary languages 

 and the usual types of ciphers (not codes) this "unicity distance" is approxi- 

 mately H{K)/D. Here H{K) is a number measuring the "size" of the key 

 space. If all keys are a priori equally likely H{K) is the logarithm of the 

 number of possible keys. D is the redundancy of the language and measures 

 the amount of "statistical constraint" imposed by the language. In simple 

 substitution with random key H{K) is logio 261 or about 20 and D (in decimal 

 digits per letter) is about .7 for English. Thus unicity occurs at about 30 

 letters. 



It is possible to construct secrecy systems with a finite key for certain 

 "languages" in which the equivocation does not approach zero as i\' ^ oo. 

 In this case, no matter how much material is intercepted, the enemy still 

 does not obtain a unique solution to the cipher but is left with many alter- 

 natives, all of reasonable probability. Such systems we call ideal systems. 

 It is possible in any language to approximate such behavior — i.e., to make 

 the approach to zero of H{y) recede out to arbitrarily large T. Hov»'ever, 

 such systems have a number of drawbacks, such as complexity and sensi- 

 tivity to errors in transmission of the cryptogram. 



The third part of the paper is concerned with "practical secrecy." Two 

 systems with the same key size may both be uniquely solvable when X 

 letters have been intercepted, but differ greatly in the amount of labor 

 required to effect this solution. An analysis of the basic weaknesses of sec- 

 recy systems is made. This leads to methods for constructing systems which 

 will require a large amount of work to solve. Finally, a certain incompat- 

 ibility among the various desirable qualities of secrecy systems is discussed. 



PART I 

 MATHEMATICAL STRUCTURE OF SECRECY SYSTEMS 



2. Secrecy Systems 



As a first step in the mathematical analysis of cryptography, it is neces- 

 sary to idealize the situation suitably, and to define in a mathematically 

 acceptable way what we shall mean by a secrecy system. A "schematic" 

 diagram of a general secrecy system is shown in Fig. 1. At the transmitting 



