Shannon's Random-Cipher Result and the Generalized 𝑅-Norm Entropy of Type 𝛽

Abstract

Using the Fano inequality for the generalized 𝑅-norm entropy and Bayess probability of error, a generalized random-cipher result is proved by taking into account the generalized 𝑅-norm entropy of type 𝛽.

1. Introduction

It is known that a good cryptosystem can be built provided that the key rate is greater than the message redundancy [1]. Shannon obtained this result by considering the equivocation of the key over a random cipher. By counting the average number of spurious decipherments over a restricted class of random ciphers, Hellman [2] obtained the same result. A similar result was proved by Lu [3] by using the average probability of correct decryption of a message digit as a measure of performance and the Fano inequality for a class of cryptosystems. The analysis done by Lu is precise, whereas in [1] approximations are used. All of these results are obtained by taking into account the Shannon entropy.

Sahoo [4] generalized the results of Lu by considering Renyi’s entropy and the Bayes probability of error. But in the literature of information theory, there exist various generalizations of Shannon’s entropy. One of these is the R-norm information, which was introduced by Arimoto [5] and extensively studied by Boekee and Van der Lubbe [6]. The objective of this paper is to generalize the results of Lu by considering the generalized R-norm entropy of type 𝛽 and Bayess probability of error.

2. Generalization of Shannon’s Random-Cipher Result

Consider a discrete random variable X, which takes values 𝑥₁,𝑥₂,…,𝑥_𝑛, having the complete probability distribution {𝑝(𝑥_𝑖);𝑖=1,2,…,𝑛}. Also consider the set 𝑅^∗ of positive real numbers not equal to 1; that is, 𝑅^∗={𝑅∶𝑅>0,𝑅≠1}. Then the R-norm information [5] is defined as 𝐻_𝑅(𝑋)=𝑅𝑅−11−^𝑛_𝑖=1𝑝^𝑅𝑥_𝑖^1/𝑅,𝑅∈𝑅^∗. (1)

This measure is different from the entropies of Shannon [1], Renyi [7], Havrda and Charvát [8], and Daroczy [9]. The most interesting property of this measure is that when R →1, it approaches to Shannon’s [1] entropy and in case 𝑅→∞,_𝑅𝐻(𝑃)→(1−max𝑝_𝑖),𝑖=1,2,…,𝑛. The measure (1) can be generalized in so many ways; however, Hooda and Ram [10] studied a parametric generalization as follows: 𝐻_{𝑅/(2−𝛽)}(𝑋)=𝑅×𝑅+𝛽−21−^𝑛_𝑖=1𝑝^{𝑅/(2−𝛽)}𝑥_𝑖^{(2−𝛽)/𝑅}, (2) where 0<𝛽<2,𝑅+𝛽≠2.

The measure (2) may be called the generalized R-norm entropy of type 𝛽 and it reduced to (1) when 𝛽=1. In case R = 1, (2) reduces to 𝐻_1/(2−𝛽)(𝑋)=1𝛽−11−^𝑛_𝑖=1𝑝^1/(2−𝛽)𝑥_𝑖^2−𝛽,0<𝛽<2,𝛽≠1. (3)

Setting 𝛾=1/(2−𝛽) in (3), we get 𝐻_𝛾(𝑋)=𝛾𝛾−11−^𝑛_𝑖=1𝑝^𝛾𝑥_𝑖^1/𝛾,1𝛾>2(≠1). (4)

The information measure (4) has also been mentioned by Arimoto [5] as an example of a generalized class of information measures. Although (4) and (1) are the same form, yet these differ as the ranges of R and 𝛾 are different. However, (2) is a joint representation of (1) and (4). So it is interesting to study the applications of the generalized R-norm entropy of type 𝛽.

Let us consider now another discrete random variable Y, with values 𝑦₁,𝑦₂,…,𝑦_𝑚, having the complete probability distribution {𝑝(𝑦_𝑗);𝑗=1,2,…,𝑚}. Now consider a two-dimensional discrete random variable (𝑋,𝑌) with (𝑥₁,𝑦₁),(𝑥₂,𝑦₂),…,(𝑥_𝑛,𝑦_𝑚) as values with probabilities 𝑝(𝑥₁,𝑦₁),𝑝(𝑥₂,𝑦₂),…,𝑝(𝑥_𝑛,𝑦_𝑚), respectively. If 𝑝(𝑥_𝑖|𝑦_𝑗) is the conditional probability of 𝑥_𝑖 given 𝑦_𝑗, then using Bayes’s theorem, we have 𝑝𝑥_𝑖𝑦_𝑗=𝑝𝑥_𝑖,𝑦_𝑗𝑝𝑦_𝑗. (5)

Definition 1. The joint R-norm information measure of type 𝛽 for 𝑅∈𝑅^∗ and 0<𝛽<2,𝑅+𝛽≠2 is given by 𝐻^𝛽_𝑅()=𝑅𝑋,𝑌×𝑅+𝛽−21−^𝑛𝑚_𝑖=1𝑗=1𝑝^{𝑅/(2−𝛽)}𝑥_𝑖,𝑦_𝑗^{(2−𝛽)/𝑅}. (6) It is easy to see that 𝐻^𝛽_𝑅(𝑋,𝑌) is symmetric in 𝑋 and 𝑌. Due to the nonadditivity property, it follows at once that if 𝑋 and 𝑌 are stochastically independent, 𝐻^𝛽_𝑅(𝑋,𝑌)=𝐻^𝛽_𝑅(𝑋×𝑌)=𝐻^𝛽_𝑅(𝑋)+𝐻^𝛽_𝑅(𝑌)−𝑅+𝛽−2𝑅𝐻^𝛽_𝑅(𝑋)𝐻^𝛽_𝑅(𝑌) (7) holds.
To construct a conditional R-norm information measure of type 𝛽, holds we can use a direct and an indirect methods. The indirect method leads to the following definition.

Definition 2. The average subtractive conditional R-norm information of 𝑋 given 𝑌 is for 𝑅∈𝑅^∗ and 0<𝛽<2,𝑅+𝛽≠2, defined as ¹𝐻^𝛽_𝑅(𝑋∣𝑌)=𝐻^𝛽_𝑅(𝑋,𝑌)−𝐻^𝛽_𝑅(𝑌)=𝑅×𝑅+𝛽−2_𝑚𝑗=1𝑝^{𝑅/(2−𝛽)}𝑦_𝑗^{(2−𝛽)/𝑅}−^𝑛𝑚_𝑖=1𝑗=1𝑝^{𝑅/(2−𝛽)}𝑥_𝑖,𝑦_𝑗^{(2−𝛽)/𝑅}. (8) Note that by choosing this definition, we have assumed additivity in the sense that 𝐻^𝛽_𝑅(𝑋,𝑌)=𝐻^𝛽_𝑅(𝑌)+𝐻^𝛽_𝑅(𝑋∣𝑌). (9) If 𝑋 and 𝑌 are statistically independent, then using Bayes’s theorem, we have 𝐻^𝛽_𝑅(𝑋,𝑌)=𝐻^𝛽_𝑅(𝑋×𝑌)=𝐻^𝛽_𝑅(𝑋)+𝐻^𝛽_𝑅(𝑌). (10) A direct way to construct a conditional R-norm information measure of type 𝛽 is the following.

Definition 3. The average conditional R-norm information measure of type 𝛽 of 𝑋 given 𝑌 is for 𝑅∈𝑅^∗ and 0<𝛽<2,𝑅+𝛽≠2, defined as ²𝐻^𝛽_𝑅()=𝑅𝑋∣𝑌×𝑅+𝛽−21−^𝑚_𝑗=1𝑝𝑦_𝑗^𝑛_𝑖=1𝑝^{𝑅/(2−𝛽)}𝑥_𝑖∣𝑦_𝑗^{(2−𝛽)/𝑅}. (11) To discuss the two forms for conditional R-norm information measure of type 𝛽, we introduce two requirements which can be imposed on conditional information measures; that is,  (a) if 𝑋 and 𝑌 are independent, then 𝐻^𝛽_𝑅(𝑋∣𝑌)=𝐻^𝛽_𝑅(𝑋). (12) (b)𝐻^𝛽_𝑅(𝑋∣𝑌)≤𝐻^𝛽_𝑅(𝑋) (13)

with equality if and only if 𝑋 and 𝑌 are independent.

It is clear that (b) includes (a) and therefore is a stronger restriction. However, it is a basic property since it is of fundamental importance in applications. In the next two theorems, we state the behavior of the two conditional measures with respect to the requirements (a) and (b).

Theorem 4. If 𝑋 and 𝑌 are statistically independent random variables, then for 𝑅∈𝑅^∗ and 0<𝛽<2,𝑅+𝛽≠2, ¹𝐻^𝛽_𝑅()=𝑅𝑋∣𝑌×𝑅+𝛽−2_𝑚𝑗=1𝑝^{𝑅/(2−𝛽)}𝑦_𝑗^{(2−𝛽)/𝑅}−^𝑛_𝑖=1𝑝^{𝑅/(2−𝛽)}𝑥_𝑖^{(2−𝛽)/𝑅}×^𝑚_𝑗=1𝑝^{𝑅/(2−𝛽)}𝑦_𝑗^{(2−𝛽)/𝑅}=𝐻^𝛽_𝑅(𝑋)−𝑅+𝛽−2𝑅𝐻^𝛽_𝑅(𝑋)𝐻^𝛽_𝑅(𝑌).₂𝐻^𝛽_𝑅(𝑋∣𝑌)=𝐻^𝛽_𝑅(𝑋). (14)(15)(16)

Proof. The proof of (14) and (16) follows from the expressions (8) and (11). From (7), we obtain (15).
From this theorem, we may conclude that the measure ¹𝐻^𝛽_𝑅(𝑋∣𝑌), which is obtained by the formal difference between the joint and the marginal information measures, does not satisfy requirement (a). Therefore, it is less attractive than the measure ²𝐻^𝛽_𝑅(𝑋∣𝑌).

In the next theorem, we consider requirement (b), for the conditional information measure ²𝐻^𝛽_𝑅(𝑋∣𝑌).

Theorem 5. If 𝑋 and 𝑌 are discrete random variables, then for 𝑅∈𝑅^∗ and 0<𝛽<2,𝑅+𝛽≠2, ²𝐻^𝛽_𝑅(𝑋∣𝑌)≤𝐻^𝛽_𝑅(𝑋) (17) holds.
The equality signs hold if and only if 𝑋 and 𝑌 are independent.

Proof. We know by [11] that for 𝑅+𝛽>2. Consider ^𝑛_𝑖=1^𝑚_𝑗=1𝑥_𝑖𝑗^{𝑅/(2−𝛽)(2−𝛽)/𝑅}≤^𝑚_𝑗=1^𝑛_𝑖=1𝑥^{𝑅/(2−𝛽)}_𝑖𝑗^{(2−𝛽)/𝑅}. (18) Setting 𝑥_𝑖𝑗=𝑝(𝑥_𝑖,𝑦_𝑗)≥0 in (18), we have ^𝑛_𝑖=1^𝑚_𝑗=1𝑝(𝑥_𝑖,𝑦_𝑗)^{𝑅/(2−𝛽)(2−𝛽)/𝑅}≤^𝑚_𝑗=1^𝑛_𝑖=1𝑝^{𝑅/(2−𝛽)}(𝑥_𝑖,𝑦_𝑗)^{(2−𝛽)/𝑅} (19) or ^𝑛_𝑖=1𝑝^{𝑅/(2−𝛽)}(𝑥_𝑖)^{(2−𝛽)/𝑅}≤^𝑚_𝑗=1𝑝𝑦_𝑗^𝑛_𝑖=1𝑝^{𝑅/(2−𝛽)}(𝑥_𝑖|𝑦_𝑗)^{(2−𝛽)/𝑅}⟹1−^𝑚_𝑗=1𝑝𝑦_𝑗^𝑛_𝑖=1𝑝^{𝑅/(2−𝛽)}(𝑥_𝑖|𝑦_𝑗)^{(2−𝛽)/𝑅}≤1−^𝑛_𝑖=1𝑝^{𝑅/(2−𝛽)}𝑥_𝑖^{(2−𝛽)/𝑅}. (20)(21) Using 𝑅/(𝑅+𝛽−2)>0 as 𝑅+𝛽>2, we find that ²𝐻^𝛽_𝑅(𝑋∣𝑌)≤𝐻^𝛽_𝑅(𝑋). (22) On the same line, we can prove that (22) holds for 𝑅+𝛽<2. Hence, (17) holds for all 𝑅∈𝑅^∗ and 0<𝛽<2,𝑅+𝛽≠2. The equality sign holds if and only if 𝑥_𝑖𝑗 is separable in the sense that 𝑥_𝑖𝑗=𝑝(𝑥_𝑖)𝑝(𝑦_𝑗). This is the independence requirement for probabilities.
It follows from Theorem 5 that ²𝐻^𝛽_𝑅(𝑋∣𝑌) fulfill requirements (a) and (b).

Let us consider the mathematical model as in [3]. For the sake of clarity, we will repeat some definitions of terms from [3]. In this model, the output {𝑀_𝑖} of the message source is a stationary random sequence. Each component {𝑀_𝑖} takes a value from a finite set 𝐴_𝑀. The incoming message sequences {𝑀_𝑖} are converted by the instantaneous block encipherer into message words of length 𝑛. Let us denote a message word by 𝑀={𝑀₁,𝑀₂,…,𝑀_𝑛}. The key source output is a random variable 𝐾,𝐾∈𝐴_𝐾, that is statistically independent of 𝑀 and takes equiprobable values in a finite set. The key rate 𝑟_{𝑛,𝑅,𝛽} is defined as 𝑟_{𝑛,𝑅,𝛽}=1𝑛𝐻^𝛽_𝑅1𝐴_𝐾,1𝐴_𝐾1,…,𝐴_𝐾=𝑅𝑛𝐴𝑅+𝛽−21−_𝐾^{(2−𝛽−𝑅)/𝑅}. (23) It is easy to see that lim_{𝛽=1,𝑅→1}𝑟_{𝑛,𝑅,𝛽}=1𝑛log𝐴_𝐾, (24) which is the key rate as defined in [3].

Also, the generalized R-norm entropy of type 𝛽 redundancy of the message block 𝑀 is defined as the difference between the maximal value of the generalized R-norm entropy of type 𝛽 and the actual generalized R-norm entropy of type 𝛽; that is, 𝑑_{𝑛,𝑅,𝛽}𝐻=−^𝛽𝑅(𝑀)𝑛+𝑅𝑛×𝐴𝑅+𝛽−21−_𝑀^{𝑛(𝑅+𝛽−2)/𝑅}. (25) It is easy to see that lim_{𝛽=1,𝑅→1}𝑑_{𝑛,𝑅,𝛽}𝐻(𝑀)=−𝑛+log𝐴_𝑀, (26) which is the redundancy of the message block 𝑀 in the case of the Shannon entropy.

The key is input to the keyword generator; when the key takes the value 𝐾, the keyword-generator output is a keyword of length 𝑛,𝑐_𝐾=(𝑐_𝐾,1,𝑐_𝐾,𝑛), where 𝑐_𝐾,𝑖 is an element of the key alphabet 𝐴_𝑐. For each digit 𝑖, an instantaneous block encipherer produces the 𝑖th digit of the cryptosystem word 𝑋 using the following combiner: 𝑋_𝑖=𝑓𝑀_𝑖,𝑐_𝐾,𝑖,𝑖=1,2,…,𝑛, (27) where 𝑓 is bijective mapping from 𝐴_𝑀×𝐴_𝑐 to 𝐴_𝑋, the set of cryptogram letters.

It is assumed in this paper that the sets 𝐴_𝑀,𝐴_𝑐, and 𝐴_𝑋 are of finite cardinality and the combiner 𝑓 is one to one in each variable. The instantaneous decipherer uses the key to generate the keyword and applies the inverse of 𝑓,𝑔(⋅,⋅) to each letter 𝑋_𝑖 of the cryptogram word 𝑋 to recover the message word 𝑀; that is, 𝑀_𝑖=𝑔(𝑓(𝑀_𝑖,𝑐_𝐾,𝑖),𝑐_𝐾,𝑖),𝑖=1,2,…,𝑛. The cryptoanalyst intercepts the cryptogram words and attempts to decrypt by using his or her knowledge of the a priori message and key, using probabilities, the combiner 𝑓, the block length 𝑛, the key rate 𝑟_{𝑛,𝑅,𝛽}, and the cryptogram. That is, for the cryptogram, he or she assumes a key 𝐾^∗ and decrypts the message as 𝑀^∗={𝑀^∗₁,𝑀^∗₂,…,𝑀^∗_𝑛}, where 𝑀^∗_𝑖=𝑓𝑋_𝑖,𝑐_𝐾^∗_,𝑖,𝑖=1,2,…,𝑛. (28) The decrypted message word 𝑀^∗ is assumed to be one of the possible message words, given the cryptogram word 𝑋 and the cipher.

Let 𝑀∈𝐴^𝑛_𝑀 be a message word of length 𝑛 and 𝑀^∗ the decrypted word for the message word 𝑀. If 𝑝_𝑒(𝑖,𝑛) denotes the probability of an error in correct decryption of the 𝑖th digit according to the Bayes decision scheme, then 𝑝_𝑒(𝑖,𝑛)=1−^|𝐴𝐾|_𝐾=1𝑝𝑐_𝑘^∗_,𝑖max_𝑖𝑝𝑐_𝑘,𝑖𝑐_𝑘^∗_,𝑖, (29) where |𝐴_𝐾| is the cardinality of the set 𝐴_𝐾. Thus, the average probability of error per letter for a message word of length 𝑛 is defined as 𝑝_𝑒(𝑛)=1𝑛^𝑛_𝑖=1𝑝_𝑒(𝑖,𝑛). (30) In the following theorem a random-cipher result is proved in the case of the generalized R-norm entropy of type 𝛽.

Theorem 6. Consider the stationary random discrete source with alphabet size 𝐴_𝑀. Let 𝑑_{𝑛,𝑅,𝛽} be the generalized R-norm entropy of type 𝛽 redundancy, 𝑟_{𝑛,𝑅,𝛽} the key rate, and 𝑝_𝑒 the average probability of correct decryption. Then 𝑅×𝑅+𝛽−21−1−𝑝_𝑒^{𝑅/(2−𝛽)}+𝐴_𝑀−1^{(2−𝛽−𝑅)/(2−𝛽)}×𝑝_𝑒^{𝑅/(2−𝛽)(2−𝛽)/𝑅}≥𝑟_{𝑛,𝑅,𝛽}−𝑑_{𝑛,𝑅,𝛽}, (31) where 𝑅∈𝑅^∗.

Proof. Since the message and the key are statistically independent, we have 𝐻^𝛽_𝑅(𝑀,𝐾)=𝐻^𝛽_𝑅(𝑀)+𝐻^𝛽_𝑅(𝐾). (32) Now 𝑓 is one to one in each variable and 𝑋=𝑓(𝑀,𝑐_𝐾), so 𝐻^𝛽_𝑅(𝑀,𝐾)=𝐻^𝛽_𝑅(𝑋,𝐾), (33) where 𝑋 is the cryptogram. Then from (32) and (33), we have 𝐻^𝛽_𝑅(𝑋,𝐾)=𝐻^𝛽_𝑅(𝑀)+𝐻^𝛽_𝑅(𝐾). (34) Also we have 𝐻^𝛽_𝑅(𝑋,𝐾)=𝐻^𝛽_𝑅(𝑋)+𝐻^𝛽_𝑅(𝐾∣𝑋). (35) Using (35) in (34), we have 𝐻^𝛽_𝑅(𝐾∣𝑋)=𝐻^𝛽_𝑅(𝑀)+𝐻^𝛽_𝑅(𝐾)−𝐻^𝛽_𝑅(𝑋). (36) Since the total number of cryptograms is equal to |𝐴_𝑀|^𝑛, therefore 𝐻^𝛽_𝑅(𝑋)≤𝑅𝐴𝑅+𝛽−21−_𝑀^{𝑛(2−𝛽−𝑅)/𝑅}. (37) Using (37), (36) becomes 𝐻^𝛽_𝑅(𝐾∣𝑋)≥𝐻^𝛽_𝑅(𝑀)+𝐻^𝛽_𝑅(𝐾)−𝑅𝐴𝑅+𝛽−21−_𝑀^{𝑛(2−𝛽−𝑅)/𝑅}. (38) We assume that the keys are chosen randomly, so that each key is equiprobable and hence 𝐻^𝛽_𝑅(𝐾)≤𝑅𝐴𝑅+𝛽−21−_𝐾^{(2−𝛽−𝑅)/𝑅}. (39) Using (39), the inequality (38) becomes 𝐻^𝛽_𝑅(𝐾∣𝑋)≥𝐻^𝛽_𝑅(𝑀)+𝑅×𝐴𝑅+𝛽−2_{𝑀𝑛(2−𝛽−𝑅)/𝑅}−𝐴_𝐾^{(2−𝛽−𝑅)/𝑅}. (40) Since 𝐾^∗ is a function of 𝑋 only, we have 𝐻^𝛽_𝑅𝐾∣𝐾^∗≥𝐻^𝛽_𝑅(𝐾∣𝑋). (41) Thus using (41), the inequality (40) becomes 𝐻^𝛽_𝑅𝐾∣𝐾^∗≥𝐻^𝛽_𝑅(𝑀)+𝑅×𝐴𝑅+𝛽−2_{𝑀𝑛(2−𝛽−𝑅)/𝑅}−𝐴_𝐾^{(2−𝛽−𝑅)/𝑅}. (42) Associated with each key, there is a keyword 𝑐_𝐾 and the keywords are distinct. Therefore 𝐻^𝛽_𝑅𝑐_𝐾∣𝑐_𝐾^∗=𝐻^𝛽_𝑅𝐾∣𝐾^∗, (43) where 𝑐_𝐾=(𝑐_𝐾,1,𝑐_𝐾,2,…,𝑐_𝐾,𝑛) and 𝑐_𝐾^∗=(𝑐_𝐾^∗_,1,𝑐_𝐾^∗_,2,…,𝑐_𝐾^∗_,𝑛). We also have 𝐻^𝛽_𝑅𝑐_𝐾∣𝑐_𝐾^∗=𝐻^𝛽_𝑅𝑐_𝐾,1∣𝑐_𝐾^∗+𝐻^𝛽_𝑅𝑐_𝐾,2∣𝑐_𝐾,1,𝑐_𝐾^∗+⋯+𝐻^𝛽_𝑅𝑐_𝐾,𝑛∣𝑐_𝐾,1,𝑐_𝐾,2,…,𝑐_{𝐾,𝑛−1},𝑐_𝐾^∗. (44) From (23), we can prove in a simple way that 𝐻^𝛽_𝑅(𝑋∣𝑌,𝑍)≤𝐻^𝛽_𝑅(𝑋∣𝑌), (45) where 𝑋,𝑌, and 𝑍 are three random variables. Using this result, (44) becomes ^𝑛_𝑖=1𝐻^𝛽_𝑅𝑐_𝐾,𝑖∣𝑐_𝐾^∗_,𝑖≥𝐻^𝛽_𝑅𝑐_𝐾∣𝑐_𝐾^∗. (46) Thus using (45) and (43), the inequality (42) becomes ^𝑛_𝑖=1𝐻^𝛽_𝑅𝑐_𝐾,𝑖∣𝑐_𝐾^∗_,𝑖≥𝐻^𝛽_𝑅(𝑀)+𝑅×𝐴𝑅+𝛽−2_{𝑀𝑛(2−𝛽−𝑅)/𝑅}−𝐴_𝐾^{(2−𝛽−𝑅)/𝑅}. (47) Using the Fano inequality for the R-norm information [6], we have 𝐻^𝛽_𝑅𝑐_𝐾,𝑖∣𝑐_𝐾^∗_,𝑖≤𝑅×𝑅+𝛽−21−1−𝑝_𝑒(𝑖,𝑛)^{𝑅/(2−𝛽)}+𝐴_𝑀−1^{(2−𝛽−𝑅)/(2−𝛽)}×𝑝_𝑒(𝑖,𝑛)^{𝑅/(2−𝛽)(2−𝛽)/𝑅}. (48) From (47) and (48), we have 1𝑛𝐻^𝛽_𝑅(𝑀)+𝑅×𝐴𝑅+𝛽−2_{𝑀𝑛(2−𝛽−𝑅)/𝑅}−𝐴_𝐾^{(2−𝛽−𝑅)/𝑅}≤𝑅×1𝑅+𝛽−21−𝑛^𝑛_𝑖=11−𝑝_𝑒(𝑖,𝑛)^{𝑅/(2−𝛽)}+𝐴_𝑀−1^{(2−𝛽−𝑅)/(2−𝛽)}×𝑝_𝑒^{𝑅/(2−𝛽)}(𝑖,𝑛)^{(2−𝛽)/𝑅}. (49) Since the function (∑^𝑛_𝑖=1𝑥_𝑖^{𝑅/(2−𝛽)})^{(2−𝛽)/𝑅} with 𝑥_𝑖≥0 is convex for 𝑅+𝛽>2,   it follows from Jensen’s inequality that for 𝑅+𝛽>2, 1𝑛^𝑛_𝑖=11−𝑝_𝑒(𝑖,𝑛)^{𝑅/(2−𝛽)}+𝐴_𝑀−1^{(2−𝛽−𝑅)/(2−𝛽)}𝑝_𝑒^{𝑅/(2−𝛽)}(𝑖,𝑛)^{(2−𝛽)/𝑅}≥11−𝑛^𝑛_𝑖=1𝑝_𝑒(𝑖,𝑛)^{𝑅/(2−𝛽)}+𝐴_𝑀−1^{(2−𝛽−𝑅)/(2−𝛽)}×1𝑛^𝑛_𝑖=1𝑝_𝑒(𝑖,𝑛)^{𝑅/(2−𝛽)(2−𝛽)/𝑅}. (50) Now using (50), the inequality (49) becomes 1𝑛𝐻^𝛽_𝑅(𝑀)+𝑅×𝐴𝑅+𝛽−2_{𝑀𝑛(2−𝛽−𝑅)/𝑅}−𝐴_𝐾^{(2−𝛽−𝑅)/𝑅}≤𝑅×𝑅+𝛽−21−1−𝑝_𝑒^{𝑅/(2−𝛽)}+𝐴_𝑀−1^{(2−𝛽−𝑅)/(2−𝛽)}𝑝_𝑒^{𝑅/(2−𝛽)(2−𝛽)/𝑅}. (51) It is easy to see that (49) is valid also for 𝑅+𝛽<2. Thus, using (23) and (25), we have 𝑅×𝑅+𝛽−21−1−𝑝_𝑒^{𝑅/(2−𝛽)}+𝐴_𝑀−1^{(2−𝛽−𝑅)/(2−𝛽)}𝑝_𝑒^{𝑅/(2−𝛽)(2−𝛽)/𝑅}≥𝑟_{𝑛,𝑅,𝛽}−𝑑_{𝑛,𝑅,𝛽}, (52) which proves the result.

Remarks. The result in the theorem is valid for all ciphers considered and for any cryptoanalyst performing feasible decryption. The theorem states that in order to design a good cipherer, it is sufficient to use a key rate 𝑟_{𝑛,𝑅,𝛽} greater than the generalized R-norm entropy of type β redundancy of the message.

Particular Case. If 𝛽=1,𝑅→1, the inequality (31) reduces to the inequality 𝐻𝑝_𝑒+𝑝_𝑒log𝐴_𝑀−1≥𝑟_𝑛,1,1−𝑑_𝑛,1,1, (53) where 𝑟_𝑛,1,1=1𝑛log𝐴_𝐾,𝑑_𝑛,1,1=log𝐴_𝑀−1𝑛𝐻(𝑀). (54) This result was derived by Lu [3]. However, instead of using the Bayes probability of error as defined in this paper, Lu [3] considered as definition the probability of error in correct decryption: 𝑝_𝑒=1𝑛^𝑛_𝑖=1𝑝𝑐_𝐾^∗_,𝑖=𝑐_𝐾,𝑖. (55)