686 BELL SYSTEM TECHNICAL JOURNAL 



in which E, M and K are the cryptogram, message and key and 

 P{E, K) is the probability of key K and cryptogram E 

 Pe{K) is the a posteriori probabiUty of key K if cryptogram E is 



intercepted 

 P{E, M) and Pe{M) are the similar probabilities for message instead 

 of key. 

 The summation in He{K) is over all possible cryptograms of a certain length 

 (say iV letters) and over all keys. For He{M) the summation is over all 

 messages and cryptograms of length .V. Thus He{K) and He{M) are both 

 functions of .Y, the number of intercepted letters. This will sometimes be 

 indicated explicitly by writing He{K, N) and He{M, N). Note that these 

 are "total" equivocations; i.e., we do not divide by N to obtain the equiv- 

 ocation rate which was used m MTC. 



The same general arguments used to justify the equivocation as a measure 

 of uncertainty in communication theory apply here as well. We note that 

 zero equivocation requires that one message (or key) have unit prob- 

 ability, all others zero, corresponding to complete knowledge. Considered 

 as a function of N, the gradual decrease of equivocation corresponds to 

 increasing knowledge of the original key or message. The two equivocation 

 curves, plotted as functions of N, will be called the equivocation charac- 

 teristics of the secrecy system in question. 



The values of He{K, N) and He{M, X) for the Caesar type cryptogram 

 considered above have been calculated and are given in the last row of 

 Table I. He(K, X) and He(M, X) are equal in this case and are given in 

 decimal digits (i.e. the logarithmic base 10 is used in the calculation). It 

 should be noted that the equivocation here is for a particular cr>'ptogram, 

 the summation being only over M (or K), not over E. In general the sum- 

 mation would be over all possible intercepted cr>'ptograms of length .V 

 and would give the average uncertainty. The computational difficulties 

 are prohibitive for this general calculation. 



12. Properties of Equivocation 

 Equivocation may be shown to have a number of interesting properties, 

 most of which fit into our intuitive picture of how such a quantity should 

 behave. We will first show that the equivocation of key or of a fixed part 

 of a message decreases when more enciphered material is intercepted. 

 Theorem 7: The equivocation of key He(K, X) is a non-increasing function 

 of X. The equivocation of the first A letters of the message is a 

 non-increasing function of the number N which have been inter- 

 cepted. If X letters have been intercepted, the equivocation of the 

 first X letters of message is less than or equal to that of the key. 

 These may be written: 



