Unicity distance · Anti-unicity

Why more data doesn't help

Enough ordinary ciphertext plus language redundancy collapses a cipher to one key. Authorization transcripts aim at the opposite: more recordings that still leave the secret ambiguous.

Jump to formal section

~7 min overview · ~6 min formalContinue: Axioms

Unicity in classical crypto

Shannon asked how much encrypted text an eavesdropper must collect before a cipher collapses to a unique solution. That threshold is unicity distance u. For a Caesar cipher, a few English words often suffice. Structure in the language acts as a filter until only one key remains.

Unicity versus anti-unicity: classical hypothesis collapse versus lasting ambiguity on authorization transcripts — More recordings ≠ unique secret
Read the classical panel first: more ciphertext collapses hypotheses toward one key. Then read the Channel Zero panel: more ceremony recordings leave a wide cloud of still-plausible secrets. Takeaway: anti-unicity means more surface data does not uniquely identify the hidden map.

Intuition: u ≈ H(K)/D, where H(K) is key entropy and D is per-symbol redundancy. Large redundancy means small unicity distance: more ciphertext helps the attacker. A one-time pad sits at the other extreme: u diverges because every plaintext of that length stays equally plausible (notation).

Unicity is an information-theoretic threshold, not a hardness clock. Computational security asks “how long until a machine finds the key?” Unicity asks “how much observation until ambiguity collapses?”, even for an unbounded adversary.

Mapping to authorization

Treat the policy / secret (and the private map φ) as the “key,” and observable ceremony events O as the “ciphertext.” Low unicity distance means a little observation solves the system. High (or infinite) unicity means the archive does not uniquely determine the secret.

That is the authorization reading of Shannon: not “encrypt HTTP bodies with an OTP,” but keep the public transcript from collapsing ambiguity about hidden state. Related perfect secrecy on the channel is $I(X;O\mid C)=0$ ; see Perfect secrecy (Shannon).

Why more ceremonies don’t uniquely determine φ

Under uniformity, session independence, and empty effective mutual information, more channel recordings need not shrink uncertainty about φ. That regime is anti-unicity for observers: the hypothesis cloud stays wide as ceremony count grows. Ambiguity is deliberate; see structured ambiguity at Ambiguity by design.

Surface bits still accumulate in the ledger notebook; effective bits stay empty when the model holds. See also: Recording without learning · What observers can measure.

What would restore unicity (failure modes)

Anti-unicity is model-scoped, not “infinite data never helps in all physical side channels.” Classical collapse returns when redundancy reappears on the public path:

Reused entropy or nonce reuse across sessions
Skewed zones / non-uniform public symbols
Leaked private map φ
Correlated sessions that let archives accumulate structure

Claims: Claims. Axiom tables: Axioms, theorems, and bounds.

Relation to quantum search bounds

Even Grover-style search needs a target structure: something to amplify. Empty effective information changes the story: there is no ciphertext residue that uniquely marks the secret under the model. Soft deepen: Quantum myths vs real bounds · Computational & quantum intractability (papers).

Back to Math hub.

Formal mathematics and notation

Classic unicity vs anti-unicity

Shannon unicity distance $u$ is the ciphertext length at which a cipher typically collapses to one key under language redundancy. Channel Zero authorization aims at anti-unicity: stacking independent sessions does not uniquely determine φ when $I(X;O\mid C)=0$ and public marginals stay flat.

Classical unicity distance

u \approx \frac{H(K)}{D}

Read as: Classical unicity distance is roughly key entropy divided by redundancy.

Arguments

$u$: : unicity distance
$K$: : keyspace whose entropy is consumed by redundant observations
$D$: : redundancy per observed symbol

Operators

$H$: : entropy of the keyspace
$\approx$: : classical approximation
$/$: : redundancy consumes ambiguity

Significance: This is the ordinary redundancy story: enough ciphertext can consume key ambiguity until only one key remains plausible.

Computational contrast: A hardness-clock system may still leak redundant archives; anti-unicity asks whether authorization transcripts collapse the hidden state at all.

References:Unicity distance

Anti-unicity target

H(X\mid O_{1:n},C_{1:n})\not\to 0

Read as: Even after many observed transcripts and challenges, uncertainty about hidden state X does not collapse to zero.

Arguments

$X$: : hidden state whose ambiguity should remain after an archive
$O_{1:n}$: : archive of observable transcripts across sessions
$C_{1:n}$: : archive of public challenges across sessions

Operators

$H$: : conditional entropy left after the archive
$\not\to 0$: : uncertainty does not converge to a unique secret

Significance: This states the anti-unicity goal for repeated authorization transcripts.

Computational contrast: Classical unicity waits for archives to identify a key; Channel Zero targets archives that remain non-identifying under the model.

References:Unicity distance

Worked contrast: English ciphertext often reaches unicity within tens of characters; uniform independent authorization transcripts keep many secret hypotheses alive (notation). Scope: Claims. Papers: Research papers.