Shannon 1949 · Perfect secrecy

Perfect secrecy (Shannon)

Perfect secrecy is not “hard to break.” It is “nothing to break toward”, the observation does not shift beliefs about the secret.

Jump to formal section

~8 min overview · ~6 min formalContinue: Uniform channel

Shannon’s gold standard

Claude Shannon gave cryptography a rigorous definition of absolute confidentiality in 1949. A system has perfect secrecy when seeing the ciphertext leaves your belief about the message unchanged. An unbounded adversary, infinite time, storage, and compute, still learns nothing, because there is no puzzle to solve. This is security that does not rely on computers being too slow: information-theoretic emptiness, not a hardness clock.

Perfect secrecy: I(M;C)=0 with prior equal to posterior; bridge to I(X;O|C)=0 for authorization — Perfect secrecy · posterior = prior
Start from Shannon perfect secrecy: ciphertext reveals nothing because the posterior equals the prior (I(M;C)=0). The bridge panel carries that emptiness idea into authorization transcripts (I(X;O|C)=0). Takeaway: posterior equals prior is the claim anchor before Channel Zero claims.

Every plausible message stays equally plausible after you see the ciphertext. There is no mathematical “error signal” that points at the true plaintext. Formal equivalences, mutual information zero, entropy unchanged, live in the advanced band below (notation).

OTP workshop (intuition)

The cleanest existence proof is the one-time pad (OTP): mix the message with a truly random key of equal length using exclusive-or. Every possible plaintext of that length remains equally plausible under some key. Brute force does not yield a decryption error, it yields every coherent word, with no mathematical way to pick the right one.

The logistics problem is brutal: the key must be as long as the message, truly random, never reused, and distributed safely. That is why the public internet bargained into computational ciphers with short keys, not because Shannon was wrong, but because pad shipping does not scale to every smartphone.

Computational security versus perfect secrecy

Confusing the two tiers is expensive. AES with a large key is still a computational bargain: a bounded adversary is assumed too slow. Perfect secrecy does not care about the attacker’s computer, because confidentiality rests on emptiness.

Computational security versus Shannon perfect secrecy
Dimension	Computational	Perfect secrecy
Adversary power	Bounded (time, energy, silicon)	Unbounded still learns nothing
Metric	Hardness / feasible attack cost	Posterior = prior; empty mutual information
Lifespan	Expires when algorithms or machines catch up	Fails only when model assumptions fail

From messages to authorization transcripts

Message secrecy asks whether ciphertext updates beliefs about the plaintext. Authorization under Channel Zero asks a related but different job: given the public challenge, does the observable transcript reveal anything about the hidden state? The design goal is observer perfect secrecy on the public ceremony channel.

That is recovering the spirit of Shannon for access proofs: the archive of public events should not shift beliefs about the secret under the axioms. Flat public symbols are load-bearing structure for that claim, see A flat, unreadable channel. Metaphor and framing: When the channel reveals nothing.

Formal mathematics and notation

Formal equivalences

For every pair of messages, the ciphertext distribution is the same, or equivalently zero mutual information between message and ciphertext. In entropy language, uncertainty after seeing the ciphertext equals uncertainty before. OTP existence uses exclusive-or with a one-time key of equal length. Authorization under Channel Zero maps the same emptiness idea onto the ceremony channel (notation).

Shannon perfect secrecy

I(M;C)=0

Read as: The ciphertext carries zero mutual information about the message.

Arguments

$M$: : message or protected value before observation
$C$: : ciphertext in the Shannon secrecy equation

Operators

$I$: : mutual information
$= 0$: : posterior belief does not change after observing ciphertext

Significance: Seeing the ciphertext does not change beliefs about the message: posterior equals prior.

Computational contrast: Hardness-clock ciphers assume a bounded adversary is too slow; this equation holds even against unbounded compute when the model assumptions hold.

References:Perfect secrecy

Entropy form of perfect secrecy

H(M\mid C)=H(M)

Read as: Uncertainty about the message after seeing ciphertext equals the uncertainty before seeing it.

Arguments

$M$: : message whose uncertainty is preserved
$C$: : ciphertext observation

Operators

$H$: : entropy or uncertainty measured in bits
$\mid$: : conditional uncertainty after the observation
$=$: : the observation leaves uncertainty unchanged

Significance: Uncertainty about the message is unchanged by observing the ciphertext.

Computational contrast: Computational security can leave residual uncertainty that shrinks with better algorithms; perfect secrecy keeps H(M∣C)=H(M) by construction.

References:Perfect secrecy

One-time pad mixer

C=M\oplus K

Read as: Ciphertext is the message mixed with a one-time key of equal length via exclusive-or.

Arguments

$C$: : ciphertext (Shannon notation on this page; not the Channel Zero challenge)
$M$: : message or plaintext being protected
$K$: : uniform one-time key of equal length, never reused

Operators

$\oplus$: : bitwise exclusive-or mixer
$=$: : ciphertext is exactly the XOR of message and key

Significance: It is the clean existence proof that perfect secrecy is achievable when key logistics hold.

Computational contrast: Short-key computational ciphers replace this pad logistics cost with a hardness bet; OTP pays in key material, not in attack-cost assumptions.

References:Perfect secrecy One-time pad

Authorization empty channel

I(X;O\mid C)=0

Read as: Given challenge C, observable transcript O reveals no mutual information about hidden state X.

Arguments

$X$: : hidden state: private map, secret choice, key material, or local ceremony state
$O$: : observable public transcript or archive
$C$: : public challenge or context conditioning the observation

Operators

$I$: : mutual information between hidden state and observation
$\mid$: : conditioning on the public challenge
$= 0$: : zero effective leakage under the stated model

Significance: The same Shannon emptiness spirit applied to authorization transcripts: the public ceremony should not leak secret-relevant information given the challenge.

Computational contrast: This is not a claim that recovering a stolen token is expensive; it is a claim that the observable archive carries no mutual information about the hidden state.

References:Channel Zero Information-theoretic authorization

Given the public challenge, the observable transcript carries zero Shannon mutual information about the secret.ValidatedAxiom P3 / perfect-secrecy pillar: structural absence of secret-relevant information in O, not merely computational hardness.Holds under the reference architecture