Past exam of the mathematics course of the University of Cambridge / 2020 / ii / Paper 4 / 3I / a

A cipher has perfect secrecy when the conditional probability of every plaintext given a ciphertext equals its prior probability: $\mathrm{Pr}(M=m\mid C=c)=\mathrm{Pr}(M=m)$ whenever $\mathrm{Pr}(C=c)>0$. Equivalently, the plaintext and ciphertext are independent random variables.

Fix a ciphertext $c$ that can occur. Perfect secrecy requires every possible plaintext $m$ to remain possible after observing $c$. For a deterministic decryption rule, two different plaintexts producing $c$ require two different keys, so the key space has cardinality at least that of the message space.

In a one-time pad, the message and key belong to the same finite additive group, the key is uniform and independent of the message, and encryption is $C=M+K$. For every $m,c$ there is exactly one key $k=c-m$, soindependent of $m$. Bayes theorem then gives $\mathrm{Pr}(M=m\mid C=c)=\mathrm{Pr}(M=m)$, proving perfect secrecy.