![]() |
|
|||
![]() |
![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() |
![]() |
|
![]() |
[an error occurred while processing this directive]
10.2 Computing Deception ProbabilitiesIn this section, we look at the computation of deception probabilities. We begin with a small example of an authentication code. Example 10.1 Suppose and For each It will be useful to study the authentication matrix, which tabulates all the values eij(s). For each key Suppose that the key is chosen at random, i.e., Lets first consider an impersonation attack. Oscar will pick a source state s, and attempt to guess the correct authentication tag. Denote by K0 the actual key being used (which is unknown to Oscar). Oscar will succeed in deceiving Bob if he guesses the tag
Substitution is a bit more complicated to analyze. As a specific case, suppose Oscar observes the message (0, 0) in the channel. This does give Oscar some information about the key: he now knows that Now suppose Oscar replaces the message (0, 0) with the message (1, 1). Then, he will succeed in his deception if and only if K0 = (1, 0). The probability that K0 is the key is 1/3, since the key is known to be in the set {(0, 0), (1, 0), (2, 0)}. A similar analysis can be done for any substitution that Oscar might make. In general, if Oscar observes the message (s, a), and replaces it with any message (s′, a′) where s′ ≠ s, then he deceives Bob with probability 1/3. We can see this as follows. Observation of (s, a) restricts the key to one of three possibilities. Then, for each choice of (s′, a′), there is one key (out of the three possible keys) under which a′ is the authentication tag for s′. Lets now discuss how to compute the deception probabilities in general. First, we consider Pd0. As above, let K0 denote the key chosen by Alice and Bob. For That is, payoff (s, a) is computing by selecting the rows of the authentication matrix that have entry a in column s, and summing the probabilities of the corresponding keys. In order to maximize his chance of success, Oscar will choose (s, a) such that payoff (s, a) is a maximum. Hence, Note that Pd0 does not depend on the probability distribution Pd1 is more difficult to compute, and it may depend on the probability distribution The numerator of this fraction is found by selecting the rows of the authentication matrix that have the value a in column s and the value a′ in column s′, and summing the probabilities of the corresponding keys. Since Oscar wants to maximize his chance of deceiving Bob, he will compute The quantity ps,a denotes the probability that Oscar can deceive Bob with a substitution, given that (s, a) is the message observed in the channel. Now, how do we compute the deception probability Pd1? Evidently, we have to compute a weighted average of the quantities Ps,a with respect to the probabilities
The probability distribution In Example 10.1, for all s, a, so Pd0 = 1/3. Also, it can be checked that for all s, s′, a, a′, s ≠ s′. Hence, Pd1 = 1/3 for any probability distribution Lets look at the computation of Pd0 and Pd1 for a less regular example.
Copyright © CRC Press LLC
![]() |
![]() |
![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() |
![]() |
![]() |