= Cryptographic leakage
\b[Cryptographic leakage] is information about secret inputs or internal state that an observer obtains through the interfaces or observations admitted by a security model. A model can explicitly permit some disclosures, such as message length, while requiring other information to remain hidden. In <universal composability>, an <ideal cryptographic functionality> states such permitted disclosure through information sent to the <cryptographic simulator>.<Universally Composable Security: A Tutorial by Ran Canetti>[PDF pp. 25–26, ideal-service leakage and wrapper; p. 33, message-hiding service with lengths and timings exposed]{ref}
A simple <cryptographic leakage function> writes the disclosed value as $L=\ell(X)$, where $X$ is a secret <random variable>. An original example takes $X$ uniform on the 256 eight-bit strings and lets $L$ reveal its first four bits. Before observing $L$, every complete secret has probability $1/256$. Afterwards, exactly sixteen secrets remain equally likely, so the best complete-secret guess succeeds with probability $1/16$. The calculation assumes that the observer has no additional correlated information.
Using <information entropy> measured in bits, this example gives
$$
H(X)=8,\qquad H(X\mid L)=4,\qquad I(X;L)=4.
$$
Here $H(X\mid L)$ is <conditional entropy> and $I(X;L)$ is <mutual information>. Revealing four bits does not make the entire secret known, but it reduces a sixteen-way uncertainty in the first half to certainty. Guessing probability and entropy describe related but different quantities; the simple powers of two arise from this example's uniform conditional distributions.
Length disclosure gives another operational example. Suppose a <cryptographic environment> privately chooses a uniform bit $b$, then submits a one-byte message when $b=0$ and a two-byte message when $b=1$. Observing the length reveals $b$ exactly, even if the <encryption> hides all message contents at each fixed length. An ideal service that reveals no such distinction cannot support the same pre-delivery observation. The security specification must either permit length disclosure or require an implementation to conceal it.
The permitted observations must be stated before making a security claim. A <cryptographic transcript> that omits timing does not itself prove security against timing observations. Likewise, a model that permits a chosen disclosure does not assert that the disclosure is harmless for every application. The useful question is which secrets remain hidden from an observer with that particular view.
Back to article page
