076 BELL SYSTEM TECHNICAL JOURNAL 



(4) Each message in d can be enciphered into each cryptogram 

 in d by exactly k/(pi different keys. Similarly for decipherment. 

 The importance of the concept of a pure cipher (and the reason for the 

 name) lies in the fact that in a pure ciplier all keys are essentially the same. 

 Whatever key is used for a particular message, the a posteriori probabilities 

 of all messages are identical. To see this, note that two different keys ap- 

 plied to the same message lead to two cryptograms in the same residue class, 



/ k 



say d . The two cryptograms therefore could each be deciphered by — 



(Pi 



keys into each message in Ci and into no other possible messages. All keys 

 being equally likely the a posteriori probabilities of various messages are 

 thus 



. . ^ p{m)Pm{e) ^ p(m)Pm(e) ^ Pirn 



^^ ^ P(E) ZmP{M)P^{E) P{Q) 



where M is in d , E is in d and the sum is over all messages in d . If E 

 and M are not in corresponding residue classes, Pe{M) — 0. Similarly it 

 can be shown that the a posteriori probabilities of the different keys are 

 the same in value but these values are associated with different keys when 

 a different key is used. The same set of values of Pe{K) have undergone a 

 permutation among the keys. Thus we have the result 

 Theorem 4: In a pure system the a posteriori probabilities of various messages 

 Pe{M) are independent of the key that is chosen. The a posteriori 

 probabilities of the keys Pe{K) are the same in value but undergo 

 a permutation with a different key choice. 

 Roughly we may say that any key choice leads to the same cryptanalytic 

 problem in a pure cipher. Since the different keys all result in crj^ptograms 

 in the same residue class this means that all cryptograms in the same residue 

 class are cryptanalytically equivalent — they lead to the same a posteriori 

 probabilities of messages and, apart from a permutation, the same prob- 

 abilities of keys. 



As an example of this, simple substitution with all keys equally likely is 

 a pure cipher. The residue class corresponding to a given cr}'ptogram E is 

 the set of all cryptograms that may be obtained from E by operations 

 TjTk E. In this case TjT~k is itself a substitution and hence any substitution 

 on E gives another member of the same residue class. Thus, if the crypto- 

 gram is 



then 



E=XCPPGCFQ, 



Ei = RDHHGDS N 

 E2 = ABCCDBEF 



