Perfectly Secure Shannon Cipher Construction Based on the Matrix Power Function

Abstract

A Shannon cipher can be used as a building block for the block cipher construction if it is considered as one data block cipher. It has been proved that a Shannon cipher based on a matrix power function (MPF) is perfectly secure. This property was obtained by the special selection of algebraic structures to define the MPF. In an earlier paper we demonstrated, that certain MPF can be treated as a conjectured one-way function. This property is important since finding the inverse of a one-way function is related to an $NP$-complete problem. The obtained results of perfect security on a theoretical level coincide with the $NP$-completeness notion due to the well known Yao theorem. The proposed cipher does not need multiple rounds for the encryption of one data block and hence can be effectively parallelized since operations with matrices allow this effective parallelization.

1. Introduction

The modern design of block ciphers is based on the confusion–diffusion paradigm introduced by Claude Shannon ([1]). A direct implementation of the above paradigm is a substitution–permutation network (SPN), which is used for the block cipher construction when it is realized in multiple rounds, each of which uses a different sub-key derived from the original key. This procedure is used for every data block encryption when all data is divided into separate blocks.

One of the examples of the SPN realization for standardized symmetric block cipher creation is the Data Encryption Standard (DES) adoption in 1977 ([2]). The corresponding block cipher was proposed on this basis. In order to increase the security of the DES, which is only 64 bits key length (while real security relies on 56 bits key length), the Tripple DES (TDES) algorithm was adopted by the ANSI committee X9.F.1 in 1998. Since this algorithm was popular and widely used, some special recommendations were accepted for the Triple Data Encryption Algorithm (TDEA) to modify the block cipher in 2017 ([3]).

The other sound realization of the SPN is the design of a block cipher adopted as an Advanced Encryption Standard (AES) ([4]).

We have restricted our consideration to a single data block encryption using the confusion–diffusion paradigm. Then, this encryption can be considered as the Shannon cipher outlined in ([5]). If the Shannon cipher is proved to be secure under certain conditions, then, on that basis, a secure block cipher can be created. Hence, Shannon cipher can be interpreted as a building block for the block cipher construction. The security of the Shannon cipher is considered in the sense of perfect security which is directly related to the notion of pseudo-randomness ([5]).

Perfect security, which is formulated in Lemma 1 in Section 4, is the “gold standard” in cryptography. Many security proofs are based on the computational relaxation of perfect security. The alternative definition of perfect security states that an encryption scheme is perfectly secure if no adversary can succeed with a probability any better than one half. That is, an adversary cannot be able to distinguish the encryption of one plaintext from the encryption of another. It is called adversarial indistinguishability. On the other hand, adversarial indistinguishability is related to pseudo-randomness. If an encryption key is chosen randomly and uniformly from the key space, the ciphertext is pseudo-random and uniformly distributed on any message space.

Yao A., C. [6] revealed a fundamental relation between one-way functions (OWFs) and pseudo-random generators. Yao A., C. theorem states that pseudo-random generators exist if and only if OWFs exist ([6]). Hence the intriguing idea is to construct a computationally effective block cipher using the one-way function (OWF). According to this, if the OWFs do exist, then a ciphertext is pseudo-random. Until the century dilemma P vs. $NP$ is not solved (and it is unclear if it can be ever solved) it is believed that $NP$-complete problems can be accepted as the conjectured OWFs.

The notion of pseudo-randomness plays a fundamental role in cryptography, in general, and in private-key encryption, in particular. Loosely speaking, a pseudo-random string is a string that looks like a uniformly distributed string, as long as the entity that is “looking” runs in a polynomial time. Just as indistinguishability can be viewed as a computational relaxation of perfect secrecy, pseudo-randomness is a computational relaxation of true randomness.

The main reason of a Shannon cipher construction on the base of the MPF is that the MPF can be interpreted as a conjectured OWF. This conjectured OWF based on the MPF was proposed earlier in our papers ( [7,8,9,10,11]) for some cryptographic protocol construction.

Some solutions of MPF application in a cryptographic function construction were proposed recently. In [12] the MPF is used for an asymmetric cipher construction, and in [13] for a digital signature algorithm. The MPF represents a class of non-commuting cryptography that is in the particular interest of a certain group of cryptographers. The linear algebra attack for cryptographic functions based on the MPF is presented in [14]. This attack was prevented in our subsequent paper [11].

In general, the MPF can be defined over different algebraic structures. [15] demonstrates that a conjectured OWF based on the MPF defined over a modified medial semigroup is $NP$-complete. Hence there is some evidence that the MPF could also be used for the block cipher construction.

This paper presents a Shannon cipher based on the matrix power function defined over the certainly-selected algebraic structures. The first result of a block cipher S-box construction using the MPF is published in [16].

The proof that Shannon cipher based on the MPF defined over the certainly-selected algebraic structures is perfectly secure is presented. A cipher with perfect secrecy is unconditionally secure against a ciphertext-only attack.

Thus far, the main trend of the block cipher construction used the number of rounds for one data block encryption to achieve a good confusion and diffusion, thus providing a required level of security. These rounds are performed sequentially and therefore there is no ability to parallelize computations.

The proposed Shannon cipher is realized in one round using matrix operations. The matrix operations in its turn can be effectively parallelized. So if we have two matrices of order n, then their addition, multiplication and powering matrix by matrix can be effectively performed using n (or integer fraction of n) parallel computations between n rows and n columns of operand matrices. In such a case, these computational results are the entries of a new matrix. Afterwards, obtained matrices are combined, forming a final matrix. Hence, the proposed Shannon cipher can be effectively realized in multiprocessor computation devices.

2. Mathematical Background

Conventionally the field of integers with additive and multiplication operations modulo 3 is denoted by Z${}_3$={0,1,2}. Subset of Z${}_3$ without zero element is denoted by Z${}_{3\setminus 0}$={1,2}. The third order subgroup of multiplication group $Z_7^{*}=\{1,2,\dots ,6\}$ with multiplication operation modulo 7 is denoted by G${}_3$={1,2,4}.

Let S be any finite set. The uniformly and randomly chosen element s in S we denote by

$$\begin{array}{c}\hfill s\leftarrow \mathrm{rand}\left(S\right).\end{array}$$

Let f be a function

$$\begin{array}{c}\hfill f:Z{}_3\to G{}_3,\end{array}$$

(1)

with the following mapping

$$\begin{array}{c}\hfill f\left(0\right)=4,f\left(1\right)=2,f\left(2\right)=1.\end{array}$$

(2)

Evidently this mapping is one-to-one but not an isomorphism with respect to multiplication and addition operations defined in Z${}_3$. Then there exists the inverse one-to-one mapping f${}^{-1}$ defined by Equation (2).

Let Q = {q${}_{ij}$} be a matrix with entries q${}_{ij}$∈G${}_3$. Denote, in general, matrices X = {x${}_{ij}$}, x${}_{ij}$∈Z${}_3$ and Y ={y${}_{ij}$}, y${}_{ij}$∈Z${}_3$. All matrices are square and of order n. Symbolically, the matrix power function (MPF) is defined in the following way:

$$\begin{array}{c}\hfill {}^X{Q}^Y=C,\end{array}$$

(3)

where matrix C = {c${}_{ij}$} is defined over $G_3$.

Group G${}_3$ is named as a platform group and field Z${}_3$ as a power field. Then formally matrices Q and C are defined over the group of direct product $G_3^{n\times n}$ and matrices X, Y over $Z_3^{n\times n}$.

Formally, the MPF is defined by the following relation

$$\prod _{t=1}^m\prod _{s=1}^m{q}_{st}^{x_{is}·y_{tj}}=c_{ij},i,j=1,2\dots ,m.$$

(4)

Then the MPF provides the following mapping

$$MPF:Z_3^{n\times n}\times G_3^{n\times n}\times Z_3^{n\times n}\to G_3^{n\times n},$$

(5)

where C = {c${}_{ij}$} and c${}_{ij}$∈G${}_3$.

Let C${}_1$={c${}_{1,}$${}_{ij}$} be a matrix defined over Z${}_3$. Then mapping $f$ defined in Equations (1) and (2) can be separately applied to all entries of matrix C${}_1$, obtaining a mapping

$$F:Z_3^{n\times n}\to G_3^{n\times n}.$$

For all $C_1\in Z_3^{n\times n}$ we have

$$F\left(C_1\right)=C_2,$$

where $C_2\in G_3^{n\times n}$.

Mapping F just replaces all entries of matrix C${}_1$={c${}_{1,}$${}_{ij}$} to the entries of matrix C${}_2$={c${}_{2,}$${}_{ij}$}, where, according to Equations (1) and (2), $f\left(c_{1,ij}\right)=c_{2,ij}$.

To construct symmetric cipher based on the MPF introduced by Equations (3)–(5) we need an additional matrix, namely matrix M = {m${}_{ij}$}, m${}_{ij}$∈Z${}_3$ defining a message to be encrypted.

The symmetric encryption-decryption key K in our construction is represented by two invertible matrices K = (X, Y). To satisfy security conditions, the matrix Y must be invertible and its entries are randomly generated from the subset Z${}_{3\setminus 0}$, i.e., y${}_{ij}$$\in \{$1, 2}. X is randomly generated from the subset $Z_3$, $x_{ij}\in \{0,1,2\}$.

3. Shannon Cipher Construction Based on the Matrix Power Function (MPF)

Conventionally, the Shannon cipher is any deterministic cipher. It is defined over the key space K, the message space M and the ciphertext space C.

Definition 1.

The Shannon cipher $SC$ is defined by the following triplet $SC=(Gen,Enc,Dec)$, where

• $Gen$ is a function of secret key K generation at random and uniformly distributed inK.
• $Enc$ is the encryption function which takes as an input a key K inKand a message M inMand produces as output a ciphertext C inC.

  $$C=Enc(K,M).$$
• $Dec$ is a decryption function that takes as input a key K inKand a ciphertext C inCand produces a message M inM.

  $$M=Dec(K,C).$$
  The Shannon cipher is defined over (K, M, C) and with this notation we can write:

  $$\begin{array}{c}\hfill Enc:\mathbf{K}\times \mathbf{M}\to \mathbf{C},\\ \hfill Dec:\mathbf{K}\times \mathbf{C}\to \mathbf{M}.\end{array}$$

In general, it is assumed that M is a random variable distributed over the message space M, however, it is not assumed that M is uniformly distributed over M. The key K is uniformly distributed in K and is independent of M, while ciphertext $C=Enc(K,M)$ is a random variable distributed over the ciphertext space C.

The Shannon cipher is constructed for plaintext and ciphertext blocks defined by $n\times n$ matrices $M=\left\{m_{ij}\right\}$ and $C=\left\{c_{ij}\right\}$, respectively, over the field $Z_3=\{0,1,2\}$, where $m_{ij}\in Z_3$ and $c_{ij}\in Z_3$. Hence the message space M consists of $n\times n$ matrices M and ciphertext space C of $n\times n$ matrices C and both spaces are denoted by $Z_3^{n\times n}$.

The key space K consists of two matrices X and Y composing a vector valued symmetric key $K=(X,Y)$, where $X=\left\{x_{ij}\right\}$, $x_{ij}\in Z_3$ and $Y=\left\{y_{ij}\right\}$, $y_{ij}\in Z_{3\setminus 0}$. Then the key space K is a direct product of the spaces $Z_3^{n\times n}\times Z_{3\setminus 0}^{n\times n}$. The additional requirement is that the matrix Y is an invertible matrix.

The encryption operation for one data block M consists of the following three steps:

$$\begin{array}{c}{C}_1=X+M;\\ C_2=F\left(X\right){\odot }^{Y}F{\left(C_1\right)}^Y;\\ C=C_3=F^{-1}\left(C_2\right)+X.,\end{array}$$

(6)

where + is a conventional matrix addition and ⊙ is the Hadamard product of matrices, i.e., matrix entries are multiplied directly as it is done with a conventional matrix addition operation.

Symbolically, these steps can be expressed using three encryption functions Enc1, Enc2 and Enc3 in the following form

$$\begin{array}{ccc}\hfill C_1& =& Enc1(X,M),\hfill \\ \hfill C_2& =& Enc2(X,Y,C_1),\hfill \\ \hfill C_3& =& Enc3(X,C_2).\hfill \end{array}$$

Equations (6) can be rewritten in one single equation

$$\begin{array}{c}C=C_3=F^{-1}\left(F\left(X\right){\odot }^{Y}F{(X+M)}^Y\right)+X.\hfill \end{array}$$

The obtained cipher C is a matrix of order n defined over Z${}_3$ as a message matrix M.

For the decryption we need to introduce an inverse matrix in Hadamard sense in $G_3^{n\times n}$. Let a matrix T be in $G_3^{n\times n}$. Then the inverse matrix $T^A$, in Hadamard sense, of a matrix T is such that

$$T^A\odot T=T\odot T^A=\mathsf{𝟙},$$

where $\mathsf{𝟙}$ is a matrix consisting of all elements equal to $\mathsf{𝟙}\in G_3$.

The decryption procedure is performed in a reverse order. Since matrix $Y$ has its inverse in $Z_{3\setminus 0}^{n\times n}$, while algebraic structures, namely, group $G_3$ and field $Z_3$, are symmetric, then

$$\begin{array}{c}M=(F^{-1}{(}^{Y^{-1}}{\left[{\left(F\left(X\right)\right)}^A\odot F(C-X)\right]}^{Y^{-1}})-X,\hfill \end{array}$$

where $F{\left(X\right)}^A$ is an inverse matrix of matrix $F\left(X\right)$ in Hadamard sense and ⊙ is the Hadamard product of matrices.

By fixing a uniformly and randomly generated key K, two arguments of encryption function $Enc(,)$ can be interpreted as the following one-to-one permutation function ${\Pi }_K\left(M\right):Z_3^{n\times n}\to Z_3^{n\times n}$, where

$$\begin{array}{ccc}\hfill {\Pi }_K\left(M\right)& =& Enc(K,M)=C,\hfill \\ \hfill {\Pi }_{K^{-1}}\left(M\right)& =& Dec(K,C)=M.\hfill \end{array}$$

Looking forward, we intend that the constructed Shannon cipher could be suitable to creating a block cipher with one round per block M operation. The defined block length is $\left|M\right|=|Z_3^{n\times n}|=3n^2$, composed of digits in $Z_3$. The main property required for this application is that ${\Pi }_K$ should behave like a random permutation. However, since a random permutation realization having a practically acceptable block length is impractical, the notion of pseudo-random permutation is introduced. Intuitively, we can call ${\Pi }_K$ pseudorandom if for a randomly and uniformly chosen key K it is indistinguishable from a function chosen uniformly at random from the set of all functions having the same domain and range. For this reason, Shannon introduced the confusion–diffusion paradigm ([1]).

A direct implementation of the confusion–diffusion paradigm is a substitution–permutation network ([17,18]). There are two confusion phases, namely $C_1$ and $C_3$ in Equation (6). The encryption key for these operations is matrix X. The diffusion phase is realized for computing $C_2$ in intermediately encrypted data block $F\left(C_1\right)$ in $G_3^{n\times n}$.

In the next section we demonstrate that ${\Pi }_K$ is a perfectly secure pseudo-random permutation.

4. Security Analysis

Let $M_0$ be a fixed value in a message space M and $C_0=Enc(K,M_0)$ is in C. Referencing to [5] the following Lemma can be formulated.

Lemma 1.

An encryption scheme $(Gen,Enc,Dec)$ over a message spaceMis perfectly secret if and only if for every probability distribution overM, every message $M\in \mathbf{M}$, and every ciphertext $C\in \mathbf{C}$

$$\begin{array}{c}\hfill Pr(C=C_0|M=M_0)=Pr(C=C_0),\end{array}$$

(7)

which means that conditional probability is equal to unconditional probability and hence a ciphertext is independent from the message.

Before proving the main theorem of perfect security we need to prove the following lemmas.

Lemma 2.

If random variables $z_1,z_2$ are independent and uniformly distributed in $Z_{3\setminus 0}$, and w is uniformly distributed in $G_3$ independent of $z_1$ and $z_2$, then distribution of $z_1·z_2$ is uniform in $Z_{3\setminus 0}$, and random variable $w^{z_1·z_2}$ has uniform distribution in $G_3$.

Proof. 

Since $z_1$ is $z_2$ are independent, we can easily write the following probabilities:

$$\begin{array}{ccc}\hfill Pr(z_1·z_2=j)& =& \sum _{j_1·j_2=j}Pr(z_1=j_1,z_2=j_2)=2{\left(\frac{1}{2}\right)}^2=\frac{1}{2},j=\{1,2\},\hfill \end{array}$$

where summation under $j_1·j_2=j$ gives two possible combinations of $j_1,j_2\in Z_{3\setminus 0}$ (see contingency

Table 1. Table of $z_1·z_2$.

${\mathit{z}}_1$	${\mathit{z}}_2$	${\mathit{z}}_1·{\mathit{z}}_2$
1	1	1
1	2	2
2	1	2
2	2	1

).

According to the above, $z_1·z_2$ is uniformly distributed in $Z_{3\setminus 0}$.

Denote $u=z_1·z_2$. Under the assumption of an independence we get the following probabilities (that is also seen in

Table 2. Table of power function.

w	u	${\mathit{w}}^{\mathit{u}}$
1	1	1
1	2	1
2	1	2
2	2	4
4	1	4
4	2	2

):

$$\begin{array}{ccc}\hfill Pr(w^u=j)& =& \sum _{j_1^{j_2}=j}Pr(w=j_1,u=j_2)=2\left(\frac{1}{6}\right)=\frac{1}{3},j=\{1,2,4\},\hfill \end{array}$$

where summation under $j_1^{j_2}=j$ gives two pairs of $j_1,j_2$ ($j_1\in G_3,j_2\in Z_{3\setminus 0}$) to be equal to each j.

These probabilities imply that distribution of $w^u$ is uniform in $G_3$ and the lemma is proved. ☐

Lemma 3.

If random variables $v_1,v_2,\dots v_n$ are independent and uniformly distributed in $G_3$, then the distribution of $v_1{v}_2\dots v_n$ is uniform in $G_3$.

Proof. 

In case $n=2$, this lemma is simply proven by contingency

Table 3. Table of $v_1·v_2$.

${\mathit{v}}_1$	${\mathit{v}}_2$	${\mathit{v}}_1·{\mathit{v}}_2$
1	1	1
1	2	2
1	4	4
2	1	2
2	2	4
2	4	1
4	1	4
4	2	1
4	4	2

.

Or, in short,

$$\begin{array}{ccc}\hfill Pr(v_1·v_2=j)& =& \sum _{j_1·j_2=j}Pr(v_1=j_1,v_2=j_2)=3\left(\frac{1}{9}\right)=\frac{1}{3},j\in G_3,\hfill \end{array}$$

where summation under $j_1·j_2=j$ gives three possible combinations of $j_1,j_2\in G_3$.

We assume that the lemma holds for $n=N$:

$$\begin{array}{c}\hfill Pr(v_1{v}_2\dots v_N=j)=\frac{1}{3},j\in G_3.\end{array}$$

(8)

It is sufficient to show that lemma is valid for $n=N+1$, which follows directly from the assumption of independent random variables and Equation (8):

$$\begin{array}{ccc}\hfill Pr(v_1{v}_2\dots v_N{v}_{N+1}=j)& =& \sum _{j_1·j_2=j}Pr(v_1{v}_2\dots v_N=j_1)Pr(v_{N+1}=j_2)=\sum _{j_1·j_2=j}\frac{1}{3}·\frac{1}{3}=\frac{1}{3}.\hfill \end{array}$$

Hence the lemma is proven. ☐

The Theorem of Perfect Security

Referencing to Lemma 1–3, we prove the following theorem.

Theorem 1.

If a key K is chosen randomly and uniformly fromK, the probability distribution of M overMis arbitrary, the distributions of K and M overKandMare independent and given the encryption algorithm $Enc$, the distribution of C overCis fully determined by the distributions overKandM, then the Shannon cipher in Equation (6) based on MPF is perfectly secure.

Proof. 

Each element of matrix $C_1$ in Equation (6) of order n takes the following form:

$$\begin{array}{c}\hfill c_{1,ij}=x_{ij}+m_{ij},i,j\in \{1,\dots ,n\}.\end{array}$$

If $x_{ij}$ are chosen at random and are uniformly distributed, and $m_{ij}$ are random arbitrary distributed values in $Z_3$, then for all $c_{10}\in Z_3$

$$\begin{array}{ccc}\hfill Pr(c_{1,ij}=c_{10})& =& Pr\left(x_{ij}=c_{10}-m_{ij}\right)=\frac{1}{3}\sum _{m_0\in Z_3}Pr(m_{ij}=m_0)=\frac{1}{3}.\hfill \end{array}$$

(9)

Probability in Equation (9) can be seen directly from the table of values (see

Table 4. Table of $c_{1,ij}$.

${\mathit{c}}_{10}$	${\mathit{m}}_0$	$-{\mathit{m}}_0$	${\mathit{x}}_{\mathit{i}\mathit{j}}$
0	0	0	0
0	1	2	2
0	2	1	1
1	0	0	1
1	1	2	0
1	2	1	2
2	0	0	2
2	1	2	1
2	2	1	0

).

Conditional probabilities:

$$\begin{array}{ccc}\hfill Pr(c_{1,ij}=c_{10}|m_{ij}=m_0)& =& P(x_{ij}=c_{10}-m_0)=\frac{1}{3},\hfill \end{array}$$

(10)

because $x_{ij}$ and $m_{ij}$ are independent, and $c_{10}-m_0\in Z_3$.

Equalities (9) and (10) prove, that

$$\begin{array}{c}\hfill Pr(C_1=C_{10})=Pr(C_1=C_{10}|M=M_0)=\frac{1}{3}.\end{array}$$

(11)

Let us turn to matrix $C_2$ of Equation (6). Denote the elements of matrix $C_2$ of order n by:

$$\begin{array}{ccc}\hfill c_{2,ij}& =& f\left(x_{ij}\right){\left(f\left(c_{11}\right)\right)}^{y_{11}{y}_{11}}{\left(f\left(c_{21}\right)\right)}^{y_{12}{y}_{11}}\dots {\left(f\left(c_{nn}\right)\right)}^{y_{nn}{y}_{nn}}\hfill \\ & =& f\left(x_{ij}\right){\left(f\left(c_{11}\right)\right)}^{y_1}{\left(f\left(c_{21}\right)\right)}^{y_2}{\left(f\left(c_{12}\right)\right)}^{y_3}\dots {\left(f\left(c_{nn}\right)\right)}^{y_{n·n}},i,j\in \{1,\dots ,n\},\hfill \end{array}$$

where $y_{ij}$ are chosen randomly and are uniformly distributed over $Z_{3\setminus 0}$ and $f\left(c_{ij}\right)\in G_3$. According to Lemma 2, multiplication $y_{ij}·y_{kl}$ is uniformly distributed (in $Z_{3\setminus 0}$) random value and all ${\left(f\left(c_{ij}\right)\right)}^{y_k}$ are uniformly distributed in $G_3$. For simplicity, denote $y_{ij}·y_{kl}=y_s,s\in \{1,\dots ,n·n\}$.

Since $c_{2,ij}$ is the product of $(n·n+1)$ independent random variable from $G_3$, Lemma 3 yields that for all $c_{20}\in G_3$ and $i,j=1,\dots ,n$:

$$\begin{array}{c}\hfill Pr(c_{2,ij}=c_{20})=\frac{1}{3}.\end{array}$$

(12)

Conditional probabilities of elements of matrix $C_2$ are the following:

$$\begin{array}{ccc}\hfill & & Pr(c_{2,ij}=c_{20}|c_{11}=c_{11,0},\dots ,c_{nn}=c_{nn,0})\hfill \\ \hfill & =& Pr(c_{2,ij}=c_{20}|f\left(c_{11}\right)=z_{11,0},\dots ,f\left(c_{nn}\right)=z_{nn,0})=\frac{Pr(c_{2,ij}=c_{20},z_{11}=z_{11,0},\dots ,z_{nn}=z_{nn,0})}{Pr(z_{11}=z_{11,0},\dots ,z_{nn}=z_{nn,0})},\hfill \end{array}$$

(13)

here $z_{*}=f\left(c_{*}\right)$. Using the independence of matrices X, Y and $C_1$:

$$\begin{array}{ccc}\hfill & & Pr(c_{2,ij}=c_{20},z_{11}=z_{11,0},\dots ,z_{nn}=z_{nn,0})\hfill \\ \hfill & =& \mathrm{P}(f\left(x_{ij}\right)·z_{11}^{y_1}·\cdots ·z_{nn}^{y_{n·n}}=c_{20},z_{11}=z_{10},\dots ,z_{nn}=z_{nn,0})\hfill \\ \hfill & =& \mathrm{P}(f\left(x_{ij}\right)=c_{20}{(z_{10}^{y_1}·\cdots ·z_{nn,0}^{y_{n·n}})}^{-1},z_{11}=z_{11,0},\dots ,z_{nn}=z_{nn,0})\hfill \\ \hfill & =& \sum _{k_1,\dots ,k_{n·n}\in Z_{3\setminus 0}}\mathrm{P}\left(f\left(x_{ij}\right)=c_{20}{(z_{10}^{k_1}·\cdots ·z_{nn,0}^{k_{n·n}})}^{-1},{\displaystyle \bigcap _{i=1}^{n·n}}{y}_i=k_i,{\displaystyle \bigcap _{i,j=1}^n}{z}_{ij}=z_{ij,0}\right)\hfill \\ \hfill & =& \frac{1}{3}\mathrm{P}(z_{11}=z_{10},\dots ,z_{nn}=z_{nn,0}).\hfill \end{array}$$

(14)

According to Lemma 3, expression $(z_{11}^{y_1}·\dots ·z_{nn}^{y_{n·n}})$ takes values in $G_3$.

The inverse variables are also in $G_3$ (see

Table 5. Table of inverse variables.

${\mathit{z}}^{\mathit{y}}$	${\left({\mathit{z}}^{\mathit{y}}\right)}^{-1}$
1	1
2	4
4	2

).

Equalities (12)–(14) prove, that

$$\begin{array}{c}\hfill Pr(C_2=C_{20})=Pr(C_2=C_{20}|C_1=C_{10})=\frac{1}{3},\end{array}$$

(15)

that is, elements of matrix $C_2$ are independent of the elements of matrix $C_1$. Since matrix M is in the expression of $C_1$, matrix $C_2$ is independent of M too.

The third equation in Equation (6) for each element of the matrix of order n can be rewritten in the following form

$$\begin{array}{c}\hfill c_{3,ij}=f^{-1}\left(c_{2,ij}\right)+x_{ij},i,j\in \{1,\dots ,n\}.\end{array}$$

Similarly as in Equations (9) and (10) we obtain that

$$\begin{array}{c}\hfill Pr(C_3=C_{30}|C_2=C_{20})=Pr(C_3=C_{30})=\frac{1}{3}.\end{array}$$

(16)

Thus, the elements of matrix $C_3$ are independent of the elements of matrix $C_2$. By this, $C_3$ does not depend on the value of M.

By taking equalities (11), (15) and (16) all together it is proved that Equation (7) holds. Hence we have proved that the proposed Shannon cipher is perfectly secure. ☐

5. Conclusions and Discussions

One realization of the Sahnnon cipher is proposed. It is based on the MPF defined over specially selected algebraic structures, namely the finite field of integers $Z_3$ and the subgroup $G_3$ of group $Z_7$ of residue classes modulo 7. Due to this special selection, it is proved that the proposed Shannon cipher is perfectly secure.

Such a cipher can be interpreted as one data block cipher consisting of $n\times n$ digits in $Z_3$. The data in this block is encoded by numbers $\{0,1,2\}$, i.e., by two bits. The obtained result can be extended to the block cipher construction if the entire data is split into the different blocks of length of $n\times n$ digits. Then we directly obtain the Electronic Code Book (ECB) mode of encryption and on this base, the other known secure modes of encryption, e.g., Cipher Block Chaining (CBC), can be constructed.

This research proves that the proposed confusion–diffusion transformation provides perfect security in a single round of operation. The distinguishing property of the proposed cipher is that it does not require a number of round operations for one data block encryption.

The single round operation for a single data block encryption is based on matrix operations. That is a result of the other distinguishing property, namely, that one block encryption can be carried out by effectively parallelizing encryption computations. Since round operations in traditional ciphers must be performed sequentially, the parallelization of round operations cannot be realized in such a case.

The matrix operations can be effectively parallelized. Let us assume we have two operand matrices of order n. Then their addition, Hadamard product and powering matrix by matrix can be effectively performed using n (or integer fraction of n) parallel computations between n rows and n columns of operand matrices. The entries of the resulting matrix are computed in parallel using operations between two n-dimensional vectors. For matrix addition or Hadamard product, two vectors are added or multiplied representing two columns (or rows) of corresponding operand matrices. For matrix powering by matrix, one base vector is powered by the other power vector elementwise, and power operation results are multiplied together. The analogy of this operation can be found in an inner product of two vectors, when addition is replaced with multiplication and multiplication with exponentiation operations, respectively. This parallelization allows us to replace the operations between matrices of order n to n operations between n-dimensional vectors.

For example, let us have a data block size represented by matrix of order $n=16$. Such a data block has $16\times 16=256$ elements encoded by the numbers $\{0,1,2\}$. Then, parallel computations can be performed using $16,8,4$ or even 2 microprocessors. Hence, the proposed Shannon cipher can be effectively realized in multiprocessor computation devices.