714 BELL SYSTEM TECHNICAL JOURNAL 



27. Incompatibility of the Criteria for Good Systems 



'J'he five criteria for good secrecy systems given in section 5 appear to 

 have a certain incompatibility when appHed to a natural language with its 

 complicated statistical structure. With artificial languages having a simple 

 statistical structure it is possible to satisfy all requirements simultaneously, 

 by means of the ideal type ciphers. In natural languages a compromise must 

 be made and the valuations balanced against one another with a view 

 toward the particular application. 



If any one of the five criteria is dropped, the other four can be satisfied 

 fairly well, as the following examples show: 



1. If we omit the first requirement (amount of secrecy) any simple cipher 

 such as simple substitution will do. In the extreme case of omitting 

 this condition completely, no cipher at all is required and one sends 

 the clear! 



2. If the size of the key is not limited the Vernam system can be used. 



3. If complexity of operation is not limited, various extremely compli- 

 cated types of enciphering process can be used. 



4. If we omit the propagation of error condition, systems of the type 

 TFS would be very good, although somewhat complicated. 



5. If we allow large expansion of message, various systems are easily 

 devised where the "correct" message is mixed with many "incorrect" 

 ones (misinformation). The key determines which of these is correct. 



A very rough argument for the incompatibility of the five conditions may 

 be given as follows: From condition 5, secrecy systems essentially as studied 

 in this paper must be used; i.e., no great use of nulls, etc. Perfect and ideal 

 systems are excluded by condition 2 and by 3 and 4, respectively. The high 

 secrecy required by 1 must then come from a high work characteristic, not 

 from a high equivocation characteristic. If the key is small, the system 

 simple, and the errors do not propagate, probable word methods will gen- 

 erally solve the system fairly easily, since we then have a fairly simple sys- 

 tem of equations for the key. 



This reasoning is too vague to be conclusive, but the general idea seems 

 quite reasonable. Perhaps if the various criteria could be given quantitative 

 significance, some sort of an exchange equation could be found involving 

 them and giving the best physically compatible sets of values. The two most 

 difficult to measure numerically are the complexity of operations, and the 

 complexity of statistical structure of the language. 



APPENDIX 



Proof of Theorem 3 



Select any message Mi and group together all cryptograms that can be 

 obtained from Mi by any enciphering operation T, . Let this class of crypto- 



