# Using data compression and randomization to build an unconditionally secure
short key cipher

Boris Ryabko  Federal Research Center for Information and Computational
Technologies of SB RAS
Novosibirsk state university
Novosibirsk, Russian Federation
Email<EMAIL_ADDRESS>

###### Abstract

We consider the problem of constructing an unconditionally secure cipher for
the case when the key length is less than the length of the encrypted message.
(Unconditional security means that a computationally unbounded adversary
cannot obtain information about the encrypted message without the key.) In
this article, we propose data compression and randomization techniques
combined with entropically-secure encryption. The resulting cipher can be used
for encryption in such a way that the key length does not depend on the
entropy or the length of the encrypted message; instead, it is determined by
the required security level.

keywords: information theory, cryptography, perfect security, entropic
security, entropically-secure symmetric encryption scheme,
indistinguishability, data compression, randomization, Shannon code.

##  I Introduction

The concept of unconditional secrecy was presented in the seminal article by
C. Shannon, where he also showed that a one-time pad (or Vernam cipher) is
unconditionally secure [1]. In particular, unconditional secrecy means that a
computationally unbounded adversary cannot obtain any information about an
encrypted message without a key. It is clear that this property is highly
desirable, but if the one-time pad is used to encrypt a message, the length of
the key used must be at least the length of the message (or, more precisely,
its Shannon entropy). This requirement is too strict for many applications,
and there are many approaches for creating secure ciphers with short or low
entropy keys, see [2, 3, 5, 4, 6, 7, 8, 9]. One such approach was suggested by
C. Shannon in [1], who described ideal cipher systems where a computationally
unbounded adversary ”does not obtain a unique solution to the cipher but is
left with many alternatives, all of reasonable probability”. He built a theory
of ideal ciphers and described some of them for the case when the probability
distribution of encrypted messages is known. Later, ideal systems were
proposed for the case of unknown statistics, see [6].

A very interesting and promising new way of building secure systems with short
keys is the so-called entropic security, proposed by Russell and Wang [2] and
developed by Dodis and Smith [3]. This cipher uses the entropy of the original
message in such a way that the key length should be roughly the difference
between the message length and its min-entropy (the exact definition will be
given below). Unlike the ideal cipher and some others, this cipher is
guaranteed to hide the values of any function of the original message, and not
just some of its symbols. (Note that the use of the entropy message to improve
the strength of the cipher was also used in [6, 9].)

The notion of an entropy-secure symmetric encryption scheme is extremely
important for cryptography because, as Dodis and Smith [3] said, ”Russell and
Wang showed how one can construct entropically-secure symmetric encryption
schemes with keys much shorter than the length of the input, thus
circumventing Shannon’s famous lower bound on key length”.

Another way to construct a short key cipher is the so-called honey cipher,
proposed by Jewels and Ristenpart [7] and developed by Joseph, Ristenpart and
Tang [8]. In some ways, the honey cipher is like the ideal cipher: a
computationally unlimited adversary has many possible highly probable
decryptions. Li, Tang and Zhang [10] developed and combined the ideas of the
honey cipher and the entropy ciphers to create a new class of easily
implementable short key codes. In a sense, the idea of preprocessing an
original message in order to increase its entropy is being developed and
widely used in their methods.

Data compression and randomization are two methods of preprocessing the
original message that have been used for centuries in cryptography [1, 11].
Moreover, homophonic coding can be used to compress and randomize together
[11, 12]. The goal of both transformations is to make the probability
distribution of the original messages closer to the uniform one (see an
overview in [13]). Interestingly, both transformations have been successfully
applied to some cryptographic problems: they were used to extract randomness
[14, 15, 16] and to build an ideal steganographic system [17].

In this article, we combine entropically-secure encryption with the suggested
compression and data randomization techniques. Using compression and
randomization, the original message is transformed in such a way that the
difference between its length and its min-entropy is constant. This make it
possible to apply an entropically-secure cipher so that the key length is
independent of the entropy or the length of the message (but depends on the
required security level).

##  II Definitions and preliminaries

We consider the problem of symmetric encryption, when there are two parties
Alice and Bob and Alice wants to securely transmit a message $M$ to Bob, where
$M\in\\{0,1\\}^{n}$, $n\geq 1$, obeys a certain probability distribution $p$
defined on the set $\\{0,1\\}^{n}$. Alice and Bob have a shared secret key
$K=K_{1}...K_{k}$, which can be much shorter than the length of $M$, that is
$k\ll n$. Alice encrypts $M$ with $K$ and possibly some random bits, and
obtains the word $cipher(M,K)$. Then she sends it to Bob, who decrypts the
received message and obtains $M$. In addition, there is a computationally
unlimited adversary Eve who does not know $M$ and $K$, but knows the
probability distribution $p$ and wants to find some information about $M$
based on the encrypted message.

Russell and Wang [2] suggested a definition of the entropic security which was
generalised by Dodis and Smith [3] as follows: A probabilistic map $Y$ is said
to hide all functions on $\\{0,1\\}^{n}$ with leakage $\epsilon$ if, for every
adversary $A$, there exists some adversary $\hat{A}$ (who does not know
$Y(M)$) such that for all functions $f$,

$|\,Pr\\{A(Y(M))\,=f(M)\\}\,-Pr\\{\hat{A}(\,)\,=f(M)\\}\,|\,\leq\,\epsilon.$
(1)

(note that $\hat{A}$ does not know $Y(M)$ and, in fact, she guesses the
meaning of the function $f(M)$.) In what follows the probabilistic map $Y$
will be $cipher(M,K)$ and $f$ is a map $f:\\{0,1\\}^{n}\to\\{0,1\\}^{*}$.

###### Definition 1

The map $Y()$ is called $(t,\epsilon$)-entropically secure if $Y()$ hides all
functions on $\\{0,1\\}^{n}$, whenever the min-entropy of the probability
distribution $p$ is at least $t$, where min-entropy $h_{min}(p)$ is as
follows:

$h_{min}(p)=-\log\,\,\max_{a\in A}\,p(a)\,.$ (2)

(Here and below $\log=\log_{2}\,\,$.)

Note, that in a sense the definition 1 is a generalisation of the Shannon
notation of the perfect security. Namely, if we take $\epsilon=0$ and $Y$
$=cipher(M,K)$ and $f(x)=x$, we obtain that for any $M$

$|Pr\\{{A}(cipher(M,K))=M\\}-Pr\\{\hat{A}(\,\,)=M\\}\,|\,=\,0$

(So, $A$ and $\hat{A}$ obtained the same result, but $A$ estimates the
probability based on $cipher(M,K)$, whereas $\hat{A}$ does it without
knowledge of $cipher(M,K)$). So, the entropic security (1) can be considered
as a generalisation of the Shannon’s perfect secrecy.

The following theorem of Dodis and Smith [3] is a generalisation of the
results of Russell and Wang [2].

###### Theorem 1

([3]) Let there be an alphabet $\\{0,1\\}^{n},n>0,$ with a probability
distribution $p$. Then there exists an efficient
$(h_{min},\epsilon)$-entropically secure cipher with the $k$-bit key where

$k=n-h_{min}(p)+2log(1/\epsilon)+2.$ (3)

Another important notion is that of indistinguishability:

###### Definition 2

( Dodis and Smith [3].) A randomized map $Y()$ is
$(t,\epsilon)$-indistinguishable if there is a random variable $G$ such that
for every distribution on messages $\bf{M}$ over $\\{0,1\\}^{n}$ with min-
entropy at least $t$, we have

$SD(Y(M),G)\leq\epsilon,$

where for two distributions $A,B$

$SD(A,B)=\frac{1}{2}\sum_{M\in\bf{M}}|Pr\\{A=M\\}-Pr\\{B=M\\}|\,.$

Dodis and Smith [3] showed that entropic security and indistinguishability are
deeply connected:

###### Theorem 2

( [3] .) Let $Y$ be a randomized map with inputs of length $n$. Then

1\. $(t,\epsilon)$-entropic security for predicates implies
$(t-1,4\epsilon)$-indistinguishability.

2\. $(t-2,\epsilon)$-indistinguishability implies $(t,\epsilon/8)$ -entropic
security for all functions when $t\geq 2\log(1/\epsilon)+1$.

So, both notions are equal up to small changes in the parameters.

##  III The suggested method

We can see from Dodis and Smith Theorem 1 that the choice of the length of the
key $k$ depends significantly on the min-entropy of the probability
distribution; specifically, $k\geq n-h_{min}+2\log(1/\epsilon)+2$, where $n$
is the length of a ciphered message.

In this paper we suggest the following two-step cipher: first, transfer
(encode) the messages $M$ in such a way that difference between $n$ and
$h_{min}$ is a small constant, and then apply an entropically secure cipher
with $k=2\log(1/\epsilon)+O(1)$. The first transformation will be based on
methods of source coding (or data compression) and randomisation. Both
algorithms are described in two following short sections.

###  III-A Lossless codes

####  III-A1 Shannon code and its generalisations

Let there be an alphabet $A=\\{a_{1},...,a_{L}\\}$ with probability
distribution $p(a)$ and let $p(a_{1})\geq p(a_{2})\geq...\geq p(a_{L})>0$.
Define $Q_{1}=0,Q_{t}=\sum_{i=0}^{t-1}p(a_{i})$, $t=2,...,L$ and let
$\hat{Q_{i}}$ be a presentation of $Q_{i}$ in binary system as an infinite
$\\{0,1\\}$ word with finite number of ones and without the initial $0$. (That
is, $1/2=100000...,1/3=010101....$.) The codeword $\hat{\lambda}(a_{i})$ for
symbol $a_{i}$ is chosen to be the first $\lceil\log(1/p(a_{i})\rceil$ binary
digits in $\hat{Q_{i}}$, $i=1,...,L$. It is clear that,

$|\hat{\lambda}(a_{i})|=\lceil\log(1/p(a_{i}))\rceil\,.$ (4)

For example, let $A=\\{a_{1},a_{2},a_{3}\\}$ and
$p(a_{1})=13/16,p(a_{2})=1/8,p(a_{3})=1/16$. Then, $\hat{\lambda}(a_{1})=0,$
$\hat{\lambda}(a_{2})=110,$ $\hat{\lambda}(a_{3})=1111$. Clearly, these
codewords can be made shorter as follows: $\lambda(a_{1})=0,$
$\lambda(a_{2})=10,$ $\lambda(a_{3})=11.$ This procedure for removing extra
digits can be described using binary trees. It is known that the Shannon code
can be represented as a binary tree, the branches of which correspond to
codewords. In this tree, the left child is marked with 0, and the right child
is 1. If some node has one child, it is removed, and the corresponding digit
from the corresponding codeword is also removed. The obtained code we denote
as $\lambda_{Sh}$ and derive from (4) the following:

$|\lambda_{Sh}(a_{i})|\leq\lceil\log(1/p(a_{i}))\rceil\,\leq\log(1/p(a_{i}))+1.$
(5)

Also, it is known that the set of codewords
$\lambda(a_{1}),...,\lambda(a_{L})$ is prefix-free. (Recall that, by
definition, a set of words $U$ is prefix-free if for any $u,v\in U$ neither
$u$ is a prefix of $v$ nor $v$ is a prefix of $u$.)

Note that, for any sequence $x_{1}x_{2}....x_{n},n\geq 1,$ from the alphabet
$A$ and a prefix-free code $\lambda$ the encoded sequence
$\lambda(x_{1})\lambda(x_{2})...\lambda(x_{n})$ can be decoded to
$x_{1}x_{2}....x_{n}$ without errors. Such a code $\lambda$ is called lossless
code. Hence, any prefix-free code is a lossless one.

Note the the “initial” code $\hat{\lambda}(a_{i})$ has the same properties as
a modified $\lambda$, that is, it is the prefix-free and (5) is valid. (That
is why we do not describe the transformation of $\hat{\lambda}$ to $\lambda$
in detail and do not estimate its complexity.)

####  III-A2 Trimmed codes

Let $\lambda$ be a lossless code for letters from $A$. Consider the following
probability distribution
$p(a_{1})=1/2,p(a_{2})=1/4,...,p(a_{L-1})=p(a_{L})=2^{-(L-1)}$. From the
description of the Shannon code we can see that
$|\lambda_{Sh}(a_{L}))|={L-1}$.

In the following applications, the complexity of the cipher will largely
depend on the lengths of the codewords. Thus, it will be convenient to use
codes for which the length of the code of any letter does not exceed
$\lceil\log L\rceil+1$ for any probability distribution (instead of $L-1$ as
in the previous example). It is also worth noting that it will be shown later
that one extra bit of the length of the codeword can add at most 1 extra bit
of the length of the encryption key.

We call such codes as trimmed and define one of them as follows: if $\lambda$
is a code then

$\lambda^{tr}(a_{i})=\begin{cases}0\,\lambda(a_{i})&\quad\text{if
}|\lambda(a_{i})|\leq\lceil\log L\rceil\\\ 1\,bin_{\lceil\log
L\rceil}(i)&\quad\text{if }|\lambda(a_{i})|>\lceil\log L\rceil\,,\end{cases}$
(6)

where $bin_{\lceil\log L\rceil}(i)$ is a binary presentation of $i$ whose
length is $\lceil\log L\rceil$. (For example, $bin_{3}(3)=011$). We see that
the maximal codeword length is not greater than $\lceil\log L\rceil+1$. Also,
note that for any prefix-free code the maximal codeword length is not less
than $\lceil\log L\rceil$.

Let us explain how to decode. First, the decoder reads the first binary
letter. If it is $0$, the decoder uses the codeword of the code $\lambda$ in
order to find the encoded letter. If the first letter is $1$, the next
$\lceil\log L\rceil$ letters contain the binary decomposition of $i$, i.e. the
letter is $a_{i}$.

If the trimmed code is built based on the Shannon code, from (6) and (5) we
obtain

$|\lambda^{tr}_{Sh}(a_{i})|\leq\lceil\log(1/p(a_{i}))\rceil+1\,\leq\log(1/p(a_{i}))+2.$
(7)

###  III-B Randomised prefix-free codes

Let $\lambda$ be a prefix-free code for the alphabet $A$ and

$l=\max_{i=1,...,L}|\lambda(a_{i})|\,.$

The randomized code $\rho_{\lambda}$ maps letters from the alphabet $A$ to the
set $\\{0,1\\}^{l}$ defined as follows.

$\rho_{\lambda}(a_{i})=\lambda(a_{i})\,r^{i}_{|\lambda(a_{i})|+1}r^{i}_{|\lambda(a_{i})|+2}...r^{i}_{l}\,,$
(8)

where $r^{i}_{|\lambda(a_{i})|+1},r^{i}_{|\lambda(a_{i})|+2},...,r^{i}_{l}$
uniformly distributed and independent random bits (for all $i$). Let us define
a probability distribution $\pi_{\lambda}$ on $\\{0,1\\}^{l}$ as follows:

$\pi_{\lambda}(y_{1}y_{2}...y_{l})=p(a_{i})2^{-(l-|\lambda(a_{i})|)}\,$
$\text{if}\quad y_{1}y_{2}...y_{|\lambda(a_{i})|}=\lambda(a_{i}).$ (9)

If for some $y=y_{1}...y_{l}$ any $\lambda(a_{i})$ is not a prefix of $y$,
then $\pi_{\lambda}(y)=0$.

###### Claim 1

$h_{min}(\pi_{\lambda})=l-\max_{i=1,...,L}(|\lambda(a_{i})|-\log(1/p(a_{i}))$.
In particular,

$h_{min}(\pi_{\lambda_{Sh}})>l-1,\,\,h_{min}(\pi_{\lambda^{tr}_{Sh}})>l-2\,.$
(10)

Here the first equation follows from the definition of the min-entropy and
(III-B), whereas (10) follows from (5) and (7).

###  III-C The cipher

Here we describe a cipher with the length of key $2\log(1/\epsilon)+O(1)$
which is $(0,\epsilon)$ entropically secure. It means that this cipher is
$\epsilon$ entropically secure for any probability distribution (i.e. with any
min-entropy). This cipher is based on the application of the entropically
secure cipher of Dodis and Smith [3] to the suggested randomized code. We
describe the suggested cipher for the $\lambda_{Sh}^{tr}$ code, but expanding
to other prefix-free codes is straightforward.

The suggested ciphering is carried out in the following three steps: for a
given $\epsilon\in(0,1)$

i) Build a code $\lambda_{Sh}^{tr}$ for the alphabet $\\{0,1\\}^{n}$ with a
probability distribution $p$.

ii) Calculate $l$ $=\max_{a\in\\{0,1\\}^{n}}$ $|\lambda_{Sh}^{tr}(a)|$ and
probabilities $\pi_{\lambda^{tr}_{Sh}}(u)$ $,u\in\\{0,1\\}^{l}$. (From (6) we
can see that $l\leq n+1$.)

iii) For the alphabet $\\{0,1\\}^{l}$ with the distribution $\pi$ build
$(l-2,\epsilon)$ entropically secure cipher of Dodis and Smith [3] with the
$k$-bit key where

$k=2log(1/\epsilon)+4\,,$ (11)

Note that Dodis and Smith proposed three entropically secure ciphers, any of
which can be used; so we do not describe any particular cipher here.

From the Dodis and Smith Theorem 1 (see (3)) and the estimate of the min-
entropy (10) we can see that such a cipher exists for the distribution
$\pi_{\lambda}$ on $\\{0,1\\}^{l}$.

Strictly speaking, we are dealing with two ciphers. One is applied to the set
$\\{\rho_{\lambda}(M)\\}\subset\\{0,1\\}^{l}$, whereas the second one (the
main one) is applied to $\\{M\\}\subset\\{0,1\\}^{n}$, and include data
compression and randomization. We denote the first one $cipher_{ds}$ and the
second $cipher_{c\&r}$.

The Dodis and Smith Theorem 1 guarantees the entropic security for the first
cipher $cipher_{ds}$, so, we need to prove a similar property for
$cipher_{c\&r}$. The following theorem describes the properties of this
cipher:

###### Theorem 3

Let any message $M$ belong to $\\{0,1\\}^{n},n>0,$ and they obey some
probability distribution $p$. Let $\epsilon>0$. Then, $cipher_{c\&r}$ is
$(0,\epsilon)$ entropically secure with the $k$-bit key with
$k=2log(1/\epsilon)+4\,$, that is, for any function
$A:\,\\{0,1\\}^{l}\to\\{0,1\\}^{*}$ and $f:\,\\{0,1\\}^{n}\to\\{0,1\\}^{*}$

$|Pr\\{A(cipher_{c\&r}(M)=f(M)\\}-Pr\\{\hat{A}(\,)=f(M)\\}|\leq\epsilon,$

where $\hat{A}$ does not use $cipher_{c\&r}(M)$.

Comment 1. This means that the cipher is $\epsilon$\- entropically secure with
the secret keys whose lengths do not depend on the probability distribution on
the set of the messages $\\{M\\}\subset\\{0,1\\}^{n}$.

Proof. From Dodis and Smith theorem 1 we see that for any function $g$

$|Pr\\{A(cipher_{ds}(v)=g(v)\\}-Pr\\{\hat{A}(\,)=g(v)\\}|\leq\epsilon,$

where $v$ is random variable with distribution
$\\{\pi_{\lambda}(M),M\in\\{0,1\\}^{n}\\}$, $g$ is any function defined on
$\\{0,1\\}^{l}$ ($g:\\{0,1\\}^{l}\to\\{0,1\\}^{*})$ and $\hat{A}(\,)$ does not
depend on $v$ (to be short, $\lambda=\lambda_{Sh}^{tr}$). Taking into account
that the code $\lambda$ is prefix-free, we can define such a function $\phi$
that for any $a\in\\{0,1\\}^{n}$ and $u=\rho_{\lambda}(a)$, $\,\,\phi(u)=a$.
For any function $f:\\{0,1\\}^{n}\to\\{0,1\\}^{*}$ and $M$ consider the
function $g(\rho_{\lambda}(M))=f(\phi(\rho_{\lambda}(M))(=f(M))$. The last
inequality is valid for this function $g$ and for $v=\rho_{\lambda}(M)$, hence

$|Pr\\{A(cipher_{ds}(\rho_{\lambda}(M))=f(\phi(\rho_{\lambda}(M))\\}-$
$Pr\\{\hat{A}(\,)=f(\phi(\rho_{\lambda}(M))\\}|\leq\epsilon.$

Taking into account that $cipher_{c\&r}(M)=cipher_{ds}(\rho_{\lambda}(M))$ and
$f(\phi(\rho_{\lambda}(M))=f(M)$, we can see from the latest inequality that

$|Pr\\{A(cipher_{c\&r}(M))=f(M)\\}-$
$Pr\\{\hat{A}(\,)=f(M)\\}|\leq\epsilon\,.$

The theorem is proven.

We can see from Theorem 2 of Dodis and Smith that the cipher $cipher_{c\&r}$
is $2\epsilon$ indistinguishable. Below we directly prove that $cipher_{c\&r}$
is $\epsilon$ indistinguishable with $k=2log(1/\epsilon)+5\,$.

###### Theorem 4

Let there be an alphabet $=\\{0,1\\}^{n},n>0,$ with some probability
distribution. If, instead of (11), the key length $k$ equals
$k=2log(1/\epsilon)+5\,$, the cipher is $(0,\epsilon)$ indistinguishable.

Proof. From Theorem 2 of Dodis and Smith we know that, in fact, the
indistinhuishability is equal to the entropic security, and it is valid for
$cipher_{ds}$, but we are interested in the indistinguishability of the
$cipher_{c\&r}$. In order to prove it suppose that the Dodis and Smith cipher
$cipher_{ds}$ is applied to the words from the set
$\rho_{\lambda}(M)\subset\\{0,1\\}^{l}$ in such a way that it is
$(1,\epsilon/4)$ entropically secure, where the length of the key equals
$2\log(1/(\epsilon/4))+1=2\log(1/\epsilon)+5$. From the Dodis and Smith
theorem 2 we can see that this cipher is $(2,\epsilon)$ indistinguishable,
that is, $SD(cipher_{ds},G)\leq\epsilon$, where $G$ is a random variable on
$\\{0,1\\}^{l}$ which is independent on $cipher_{ds}$.

Define
$U_{a}=\\{cipher_{ds}(\lambda(a)\,r)\\}:r\in\\{0,1\\}^{l-\lambda(a)}\\}$ and
let $G^{\prime}(v)$ be defined as follows:

$Pr\\{G^{\prime}=v\\}=\sum_{w\in U_{v}}Pr\\{G=w\\}.$

The following chain of equalities and inequalities is based on these
definitions and the triangle inequality for $L_{1}$:

$SD(cipher_{c\&r},G^{\prime})=$
$\frac{1}{2}\sum_{u\in\\{0,1\\}^{n}}|Pr\\{cipher_{c\&r}=u\\}-Pr\\{G^{\prime}=u\\}|=$
$\frac{1}{2}\sum_{v\in\\{0,1\\}^{n}}|\sum_{w\in\\{0,1\\}^{l}}Pr\\{cipher_{ds}=w\\}-Pr\\{G=w\\}|\leq$
$\frac{1}{2}\sum_{v\in\\{0,1\\}^{n}}\sum_{w\in\\{0,1\\}^{l}}|Pr\\{cipher_{ds}=w\\}-Pr\\{G=w\\}\,|=$
$\frac{1}{2}\sum_{w\in\\{0,1\\}^{l}}|Pr\\{cipher_{ds}=w\\}-Pr\\{G=w\\}\,|=$
$SD(cipher_{ds},G)\leq\epsilon\,.$

So, $SD(cipher_{c\&r},G^{\prime})\leq\epsilon$.

Theorem is proven.

##  IV Conclusion

As we have seen the suggested cipher is useful for a message distribution with
any min-entropy, whereas ciphers of Russell, and Wang as well as Dodis and
Smith are useful if $k=n-h_{min}+2\log(1/\epsilon)$ is less than $n$, where
$n$ is the length of the ciphered message and $k$ is the length of the key
(otherwise, one can use the one-time-pad with $k=n$ and, hence, shorter $k$).

Let us consider the choice of the data compression code. We used the trimmed
Shannon code, while there are other efficient source codes, among which we
mention versions of Huffman code, Fano (or Shannon-Fano) codes, Rissanen
arithmetic code, and a few others. Taking into account that the difference in
length of the code of the trimmed Shannon code and the minimum possible is not
more than 2, and the same is true for the length of the secret key of the
corresponding ciphers, we consider only the trimmed Shannon code. On the other
hand, it seems that different source codes can be useful in the case of an
unknown probability distribution of messages, as well as some other
situations.

## Acknowledgment

Research was supported by Russian Foundation for Basic Research (grant no.
18-29-03005).

## References

  * [1] Shannon C. E. Communication theory of secrecy systems. The Bell system technical journal. 1949 Oct; 28(4):656-715.
  * [2] Russell A, Wang H. How to fool an unbounded adversary with a short key. IEEE Transactions on Information Theory. 2006 Mar 6;52(3):1130-40.
  * [3] Dodis Y, Smith A. Entropic security and the encryption of high entropy messages. In: Theory of Cryptography Conference 2005 Feb 10 (pp. 556-577). Springer, Berlin, Heidelberg.
  * [4] F. du Pin Calmon, M. Medard, L. M. Zeger, J. Barros, M. M. Christiansen, and K. R. Duffy. Lists that are smaller than their parts: A coding approach to tunable secrecy. In 50th Annual Allerton Conference on Communication, Control, and Computing, Allerton 2012, October 1-5, 2012, pp. 1387–1394. IEEE, 2012.
  * [5] Calmon F. D. Information-theoretic metrics for security and privacy (Doctoral dissertation, Massachusetts Institute of Technology), 2015.
  * [6] Ryabko, B. Ya. A simply realizable ideal cryptographic system. Problems of Information Transmission, 36, (2000), no. 1, pp. 84-89. (see also IACR Cryptology ePrint archive, report 2001/046).
  * [7] Juels A, Ristenpart T. Honey encryption: Security beyond the brute-force bound. InAnnual international conference on the theory and applications of cryptographic techniques 2014 May 11 (pp. 293-310). Springer, Berlin, Heidelberg.
  * [8] Joseph J., Ristenpart T., Tang Q. Honey encryption beyond message recovery security. IACR Cryptology ePrint Archive; 2016.
  * [9] Ryabko, B. The Vernam Cipher Is Robust to Small Deviations from Randomness. Problems of Information Transmission, 2015, 51(1), pp. 82-86.
  * [10] Li X., Tang Q., Zhang Z. Fooling an Unbounded Adversary with a Short Key, Repeatedly: The Honey Encryption Perspective. In 2nd Conference on Information-Theoretic Cryptography (ITC 2021) 2021. Schloss Dagstuhl-Leibniz-Zentrum für Informatik.
  * [11] Gunther C. G. A universal algorithm for homophonic coding. InWorkshop on the Theory and Application of of Cryptographic Techniques 1988 May 25 (pp. 405-414). Springer, Berlin, Heidelberg.
  * [12] Ryabko, B. Fionov, A. Efficient homophonic coding. IEEE Trans. Inform. Theory 45 (1999), no. 6, 2083–2091.
  * [13] Agrikola T., Couteau G., Ishai Y., Jarecki S., Sahai A. On pseudorandom encodings. In Theory of Cryptography Conference 2020 Nov 16 (pp. 639-669). Springer, Cham.
  * [14] J. von Neumann, Various techniques used in connection with random digits, Nat. Bur. Stand. Appl. Math. Ser., vol. 12, pp. 36–38, 1951 (Reprinted in the Collected Works of von Neumann, vol. 5).
  * [15] P. Elias, The efficient construction of an unbiased random sequence, Ann. Math. Statist., vol. 43, no. 3, pp. 864–870, 1972.
  * [16] Ryabko, B.; Matchikina, E. Fast and efficient construction of an unbiased random sequence. IEEE Transactions on Information Theory, V.46, n.3, 2000, p.1090 -1093.
  * [17] Ryabko B. , Ryabko D. Information–Theoretic Approach to Steganographic Systems. IEEE International Symposium on Information Theory, Proceedings. 2007, Nice, France, 2461-2464. (see also https://eprint.iacr.org/2006/063).
  * [18] T. M. Cover and J. A. Thomas, _Elements of information theory_. New York, NY, USA: Wiley-Interscience, 2006.