Information Leakage Due to Revealing Randomly Selected Bits

Abstract

This note describes an information theory problem that arose from some analysis of quantum key distribution protocols. The problem seems very natural and is very easy to state but has not to our knowledge been addressed before in the information theory literature: suppose that we have a random bit string y of length n and we reveal k bits at random positions, preserving the order but without revealing the positions, how much information about y is revealed? We show that while the cardinality of the set of compatible y strings depends only on n and k, the amount of leakage does depend on the exact revealed x string. We observe that the maximal leakage, measured as decrease in the Shannon entropy of the space of possible bit strings, corresponds to the x string being all zeros or all ones and that the minimum leakage corresponds to the alternating x strings. We derive a formula for the maximum leakage (minimal entropy) in terms of n and k. We discuss the relevance of other measures of information, in particular min-entropy, in a cryptographic context. Finally, we describe a simulation tool to explore these results.

A Proof of Entropy Minimization for Outputs in Deletion Channels via Hidden Word Statistics

“…The number of runs and their respective lengths in x strings play a central role in the distribution of subsequence embeddings, and in turn, in the corresponding entropy. While this property was already hinted at in [2], and directly used in the entropy minimization proof for single and double deletions in [3], our numerical results in this work indicate that the autocorrelation coefficient captures this run-dependent entropy ordering perfectly.…”

“…For example, in the realm of stringology and formal languages, the problem of determining the number of distinct subsequences obtainable from a fixed number of deletions, along with closely related problems, have been studied extensively in [8], [9], [10], [11]. It is worth pointing out that the same entropy extremizing strings conjectured in [2], [3] and characterized in the present work, have been shown to lead to the minimum and maximum number of distinct subsequences, respectively. The problems of finding shortest common supersequences (SCS) and longest common subsequences (LCS) represent two other well-known NP-hard problems [12], [13], [14] that involve subproblems similar to our work.…”

“…This work was originally motivated by an analysis of prepare-and-measure based quantum key distribution (QKD) protocols [1], which suggested some simple changes aimed at reducing leakage of key material and improving the final key rate. These changes also included a modification of the quantum bit error rate (QBER) estimation that gave rise to an independent information theory problem that was studied in [2], [3]. We will abstract away from the details of the original context and simply state the problem as an analysis of entropy extremizing outputs in deletion channels.…”

“…The entropy extremization question was first investigated in [2] where it was conjectured on the basis of experimental data that the entropy conditioned on the observation of a fixed output is minimized and maximized by the uniform (111...1) and the alternating (1010...) bit strings, respectively. In a follow-up work [3], in addition to studying a series of related combinatorial problems, the authors also provided an analysis of the same information theory problem proving the entropy minimization conjecture for the special cases of single and double deletions, i.e., m = n − 1 and m = n − 2.…”

“…Although this problem was first encountered while investigating some of the classical sub-protocols in quantum key exchange, the underlying combinatorial puzzle is closely related to several well-known challenging problems in formal languages, DNA sequencing and coding theory. The common thread shared between the present work and the previous papers in this series [2], [3] can be described as a characterization of the limiting entropic cases of the distribution of subsequence embeddings over candidate bit strings transmitted via a deletion channel. This problem is directly linked to that of enumerating the occurrences of a fixed pattern as a subsequence in a random text, also known as the hidden pattern matching problem [6].…”