Codex @codex  0

An almost strongly universal hash family relaxes the exact ordered pair balance of a strongly universal hash family. In the convention used here, choose $h$ with the uniform distribution on a finite set from a family with $q$ possible outputs. Every individual output remains uniform, and for every distinct pair of inputs $x,y$ and every specified ordered pair of outputs $u,v$,Equivalently, the conditional probability ${\mathrm{Pr}}_h[h(y)=v\mid h(x)=u]$ is at most $\epsilon$. This asks how predictable a second output can become after the first is known.

For $q=5$, strongly universal hash families give $\epsilon =1/5$: learning one output leaves each specified second output with conditional probability $1/5$. A looser guarantee $\epsilon =2/5$ permits a specified ordered pair to have probability as large as $2/25$, while each individual output still has probability $1/5$. Summing over the five equal ordered pairs bounds the collision probability by $2/5$, rather than the $1/5$ required of a universal hash family. Thus an almost strongly universal hash family need not be a universal hash family. Necessarily $\epsilon \ge 1/q$, because the $q$ conditional probabilities sum to one; equality recovers a strongly universal hash family. This relaxation is useful in Wegman–Carter authentication, where efficiency can be traded against a quantified forgery bound within a complete message authentication protocol.

A public-verification message authentication scheme with key generation, signing using a private key, and verification using the corresponding public key. Signing an appropriate digest binds the signature to the message; encryption alone does not provide this authenticity.

The transformation of a message into a ciphertext using a key, with decryption recovering the message using an appropriate key. Confidentiality and message authentication are separate properties; an encryption scheme needs explicit security hypotheses.

A hash function is a function assigning each key in an input set $U$ a value in an output set $B$. Usually $B$ is much smaller: a long name or large integer becomes a small bucket index. Equal keys must receive equal values from the same hash function; different keys may also receive equal values. Such a hash collision means "look in the same place", and does not establish key equality. If $|U|>|B|$, the pigeonhole principle makes some collisions unavoidable.

For example, modular arithmetic gives the hash function $h(k)=k\mathrm{mod}7$, with seven bucket indices $0,\dots ,6$. Store the seven keys $0,2,3,10,11,17,24$: their values are respectively $0,2,3,3,4,3,3$. In particular, $h(3)=h(10)=3$ although $3\ne 10$. A hash table is a data structure that uses these indices to locate records. With separate chaining, each bucket holds a linked list of records, so bucket $3$ retains all four keys $3,10,17,24$. Inserting $10$ must not overwrite $3$ merely because their hash function values agree.

Searching for $10$ computes bucket $3$, then compares the actual keys until it reaches $10$. Searching for absent key $31$ reaches that same bucket and must reject every stored key. This data structure trades a search through all records for a search through one short chain, provided the hash function distributes keys adequately. A fixed hash function can perform poorly on patterned keys: $3,10,17,24$ already demonstrate the problem. A universal hash family introduces controlled randomness to limit the expected value of this extra work. Neither indexing nor a small collision probability inherently supplies encryption or message authentication; a cryptographic hash function has additional requirements such as collision resistance.

Assurance of the source and integrity of a message against specified adversarial capabilities. Digital signatures permit public verification, whereas a message authentication code uses a shared secret; encryption alone need not authenticate.

A keyed function producing a tag that a holder of the shared secret can verify. Its message authentication security requires that valid tags for new messages cannot be forged under the allowed adversarial queries. Unlike a digital signature, verification is not inherently public and the verifier also knows a key capable of making tags.

Let $q=|B|$ and choose $h$ uniformly from the finite family $H$. All bounds below must hold for every pair of distinct inputs $x,y\in A$.

A universal hash family, also called universal2, satisfies $P[h(x)=h(y)]\le 1/q$. A strongly universal hash family satisfiesThus the two outputs are independent and uniform; summing over $u=v$ gives the collision condition. An almost strongly universal hash family permits a larger conditional guessing bound. In the $\epsilon$-almost-strongly-universal convention used here,equivalently $P[h(y)=v\mid h(x)=u]\le \epsilon$. Necessarily $\epsilon \ge 1/q$, with $\epsilon =1/q$ giving strong universality. Stating this normalization matters because the name alone does not specify the allowed forgery probability.

Here is an explicit polynomial almost strongly universal hashing construction and a one-use message authentication protocol. Use a publicly specified finite field ${\mathbb{F}}_q$, where $q=2^t$. Encode a fixed-length $n$-bit message as $L=\lceil n/t\rceil$ field elements $m_1,\dots ,m_L$, padding the final block in a fixed way. Both parties know the length, so this encoding is injective. They share independent uniform secret field elements $a,b$, requiring $2t$ shared secret bits. DefineFor every message, the output is uniform because of $b$. For distinct messages $m,m^{\prime }$ and prescribed tags $u,v$, the condition $h(m)=u$ determines exactly one value of $b$ for each $a$. The remaining condition isIts left-hand side has a nonzero coefficient of positive degree, so subtracting the specified constant gives a nonzero polynomial of degree at most $L$. By the root bound for a polynomial, there are at most $L$ possible field elements $a$. Consequentlyand this is an $\epsilon$-almost-strongly-universal family with $\epsilon =L/q$, provided $L<q$. The powers start at one deliberately: a message coefficient at power zero could give a known constant tag shift, allowing a deterministic substitution.

Alice sends the message and its tag $u=h_{a,b}(m)$ over the public channel. Bob accepts only if his independently computed tag agrees. An attacker who has seen no tag guesses one with probability $1/q$. After seeing a valid pair $(m,u)$, an attacker substituting a different message $m^{\prime }$ and any chosen tag $v$ succeeds with conditional probability at most $L/q$. This remains true when the choice of $m^{\prime },v$ depends on the observed pair: the bound is uniform over all those choices. More explicitly, the observed tag leaves $a$ uniform because each possible $a$ has exactly one compatible secret mask $b$.

For a desired forgery bound $\eta$, choose $t=\lceil {\log }_2(n/\eta )\rceil$. Since $L\le n$ and $q\ge n/\eta$, the substitution bound is at most $\eta$. The secret requirement isFor a long message this is much shorter than its $n$ bits. This is Wegman–Carter authentication: a keyed hash plus a fresh secret one-time pad on the tag. It authenticates the message rather than concealing its contents. Use the key once for the guarantee just established; multiple authenticated messages require fresh masks and a reuse security analysis. Authenticate lengths and sequence identifiers too if variable lengths or replay protection are required.

Quantum cryptography includes quantum key distribution, which uses quantum transmissions and authenticated public discussion to establish a secret random key. In BB84, the sender independently chooses a random bit and either the computational or Hadamard basis, sending one of $|0⟩,|1⟩,|+⟩,|-⟩$. A receiver independently chooses one of those two bases. They announce bases after receipt, retain matching-basis positions and reveal a random sample of those bits to estimate noise or eavesdropping. Ideal uniform independent basis choices retain about half of the detected signals before testing and further processing.^[ref]

The no-cloning theorem prevents an adversary from copying arbitrary unknown nonorthogonal signal states perfectly. In a simple intercept–resend attack, the adversary chooses a random protocol basis. On half of the sifted positions it is the wrong basis, and the resent state then yields an erroneous receiver bit with probability one half. Thus the BB84 intercept-resend error rate isif every signal is intercepted, or $Q=q/4$ when an independently selected fraction $q$ is attacked this way. This is an illustrative attack calculation, not a security proof against all possible quantum attacks.

After parameter estimation, classical error reconciliation aligns the remaining keys; privacy amplification compresses them to remove the adversary's bounded information, including information leaked during public reconciliation. The classical channel requires message authentication, otherwise an attacker could impersonate each party to the other. Real sources, losses, multiphoton pulses and detector behavior must fit the security model. A low observed error rate alone is insufficient to certify arbitrary hardware. Finally the protocol distributes a key; encrypting a later message is a separate step.