= Cryptographic leakage function
{title2=$\ell$}
A \b[cryptographic leakage function] specifies which observation of secret state is disclosed in a model. A deterministic version writes $L=\ell(X)$, where $X$ is a secret <random variable>. It is a description of an observer's information, not an <encryption> algorithm. An <ideal cryptographic functionality> can explicitly send permitted disclosures to its <cryptographic simulator>; Canetti's secure-communication example permits disclosure of message length.<Universally Composable Security: A Tutorial by Ran Canetti>[PDFp25, permitted leakage in an ideal functionality; PDFp33, secure point-to-point service leaking message length]{ref}
For an observed value $l$ of positive probability, possible secrets lie in its <preimage> under $\ell$. Their posterior probabilities are
$$
\Pr(X=x\mid L=l)=\frac{\Pr(X=x)\,\mathbf1_{\{\ell(x)=l\}}}{\Pr(L=l)}.
$$
Equal likelihood within that set requires a uniform prior there; it is not a consequence of the word leakage.
An original example takes $X$ uniform on all eight-bit strings and lets $\ell(X)$ be its <Hamming weight>. The disclosure has only nine possible values, but its consequences vary. If $L=4$, there are $\binom84=70$ equally likely secrets and the best exact guess succeeds with probability $1/70$. If $L=0$, the secret is certainly the all-zero string. A rare disclosure can therefore determine the complete secret even though the observation is encoded in only four bits.
Averaging optimal exact-guess success over all disclosed weights gives
$$
\sum_{j=0}^{8}\frac{\binom8j}{256}\frac1{\binom8j}
=\frac9{256},
$$
compared with $1/256$ before observation. This <Hamming-weight leakage of a uniform bit string> distinguishes an average guessing probability from the worst conditional outcome.
Specify repeated observations and any correlated side information too. Two individually limited disclosures can jointly identify a secret. A randomized or noisy observation is described by a conditional channel rather than only a deterministic function. Stating an allowed <cryptographic leakage> function makes a security claim precise; it does not establish that the disclosure is harmless for every application.
Back to article page
