706 BELL SYSTEM TECHNICAL JOURNAL 



minimize the number of trials) only 88 trials would be required. Whereas 

 complete trial and error requires trials to the order of the number of keys, 

 this subdividing trial and error requires only trials to the order of the key 

 size in bits. 



This remains true even when the different keys have different probabilities. 

 The proper procedure, then, to minimize the expected number of trials is 

 to divide the key space into subsets of equiprobability. When the proper 

 subset is determined, this is again subdivided into equiprobabiUty subsets. 

 If this process can be continued the number of trials expected when each 

 division is into two subsets will be 



; H{K) 



If each test has S possible results and each of these corresponds to the 

 key being in one of S equiprobability subsets, then 



H{K) 



h = 



log S 



trials will be expected. The intuitive signiticance of these results should be 

 noted. In the two-compartment test with equiprobability, each test yields 

 one bit of information as to the key. If the subsets have very different prob- 

 abilities, as in testing a single key in complete trial and error, only a small 

 amount of information is obtained from the test. Thus with 26! equiprobable 

 keys, a test of one yields only 



r26! - 1 , 26! - 1 , 1 , 1 1 

 - L"^6!- ^"^ ^l6r- + 2-6! ^^^ 2-6"!] 



or about 10^25 \^[^^ ^f information. Dividing into S equiprobability subsets 

 maximizes the information obtained from each trial at log S, and the ex- 

 pected number of trials is the total information to be obtained, that is 

 H(K), divided by this amount. 



The question here is similar to various coin weighing problems that have 

 been circulated recently. A typical example is the following: It is known that 

 one coin in 27 is counterfeit, and slightly lighter than the rest. A chemist's 

 balance is available and the counterfeit coin is to be isolated by a series of 

 weighings. WTiat is the least number of weighings required to do this? The 

 correct answer is 3, obtained by first dividing the coins into three groups of 

 9 each. Two of these are compared on the balance. The three possible results 

 determine the set of 9 containing the counterfeit. This set is then divided 

 into 3 subsets of 3 each and the process continued. The set of coins corre- 

 sponds to the set of keys, the counterfeit coin to the correct key, and the 

 weighing procedure to a trial or test. The original uncertainty is log2 27 



