Cryptographic leakage function ($\ell$)

A cryptographic leakage function specifies which observation of secret state is disclosed in a model. A deterministic version writes $L=\ell (X)$, where $X$ is a secret random variable. It is a description of an observer's information, not an encryption algorithm. An ideal cryptographic functionality can explicitly send permitted disclosures to its cryptographic simulator; Canetti's secure-communication example permits disclosure of message length.^[ref]

For an observed value $l$ of positive probability, possible secrets lie in its preimage under $\ell$. Their posterior probabilities areEqual likelihood within that set requires a uniform prior there; it is not a consequence of the word leakage.

An original example takes $X$ uniform on all eight-bit strings and lets $\ell (X)$ be its Hamming weight. The disclosure has only nine possible values, but its consequences vary. If $L=4$, there are $\left(\genfrac{}{}{0ex}{}{8}{4}\right)=70$ equally likely secrets and the best exact guess succeeds with probability $1/70$. If $L=0$, the secret is certainly the all-zero string. A rare disclosure can therefore determine the complete secret even though the observation is encoded in only four bits.

Averaging optimal exact-guess success over all disclosed weights givescompared with $1/256$ before observation. This Hamming-weight leakage of a uniform bit string distinguishes an average guessing probability from the worst conditional outcome.

Specify repeated observations and any correlated side information too. Two individually limited disclosures can jointly identify a secret. A randomized or noisy observation is described by a conditional channel rather than only a deterministic function. Stating an allowed cryptographic leakage function makes a security claim precise; it does not establish that the disclosure is harmless for every application.

Let $X$ be uniformly distributed over the $2^n$ bit strings of length $n$, and disclose only its Hamming weight $W$, the number of one-bits. This is a deterministic cryptographic leakage function. Its consequences depend on the observed weight, even though $W$ has only $n+1$ possible values. A permitted disclosure belongs in the security model; the existence of that model does not establish that the disclosure is harmless.^[ref]

There are $\left(\genfrac{}{}{0ex}{}{n}{w}\right)$ strings of weight $w$. Hence $W$ has a binomial distribution, and conditional probability givesfor each compatible string $x$. The optimal complete-string guess therefore succeeds with probability $1/\left(\genfrac{}{}{0ex}{}{n}{w}\right)$ after that observation. For $n=4$, observing $w=2$ leaves six equally likely strings; observing $w=0$ identifies 0000 exactly.

Averaging over disclosed weights yieldscompared with $2^{-n}$ before disclosure. For four bits this changes $1/16$ to $5/16$. The worst conditional outcome has success probability one. An average guarantee and a guarantee for every observation are consequently different claims.

The information entropy calculation answers another question. Since $W$ is determined by $X$, the mutual information satisfies $I(X;W)=H(W)$ andFor $n=4$, $H(W)\approx 2.03064$ bits and $H(X\mid W)\approx 1.96936$ bits. These entropy values are not obtained by taking the logarithm of the average guessing probability. All calculations here assume the uniform prior and no additional correlated observation.