Doubt on unicity distance and the number of possible messages encryptable with the same key

Question

While reading the Wikipedia page about the "unicity distance" I've come across a passage that I cannot fully understand. Let N(L) be the number of possible plaintexts of length L, and M(L) the subset of these plaintexts that actually convey an english message. K is then the number of possible keys that can be used to encrypt the plaintext. For example I can use a simple Caesar cipher, and K will be equal to 25.

Then the unicity distance is defined as the particular length $L_1$ that verifies: $$K \cdot \frac{M(L_1)}{N(L_1)} = 1$$

I understand it means that if the ciphertext has length $L_1$, only 1 key will yield the corrisponding plaintext. If $L < L_1$, there can be multiple "valid" keys, and the code cannot be cracked.

But what if $L > L_1$? As stated in the Wikipedia page, $M/N$ can be made arbitrarily small, but K is constant, and defined by the encryption scheme I use.

This formula then says (if I'm interpreting it correctly) that less than one "valid" key exists. What does it mean practically?

Answer 1

This formula then says (if I'm interpreting it correctly) that less than one "valid" key exists. What does it mean practically?

The explanation of the Wikipedia article must be understood in an "average" sense. And the average is taken over all the encripted texts (that is, with inputs corresponding to all the $N$ plaintexts, not only from the $M$ legit -"readable"- ones).

Then, it's clear that as $K M/N \ll 1$, if we take a random encrypted text the average number of keys that will "work" will be less than one - or the probability that some key will work will be low.

Now, you might object: but, in the typical brute-force atttack scenario, don't we already know that the encrypted text corresponds to a legit plaintext? Don't we already know that a key works, and we are worried about extra -spurious- working keys? Well, it doesn't change much the scenario - or put in other way, to ask when the global average of working keys is about one is roughly equivalent to ask when the average number of spurious keys is significant.

If we restrict the average to the legit encrypted messages, of course the mean working keys will be greater than one. Here's a possible approach: assuming the coding-decoding with a fixed key can be modelled as a uniformly random one-to-one mapping, the probability that a random key for a random encrypted message "works" (gives a readable message) is $M/N$, hence $T=$ the number of working keys is roughly a Binomial $B(M/N,K)$ with mean $\mu=KM/N$. For small $M/N$ and large $K$, this can be approximated by a Poisson of mean $\mu$. If we are insterested only in the encripted message produced by a legit plaintext, then we are interested in the Trucanted Poisson. Specifically, we are interested in the probability $$P(T>1 \mid T>0)\approx \frac{e^\mu-1-\mu}{e^\mu -1}$$ We see that for $\mu=1$ the probability is $(e-2)/(e-1)\approx 0.42$ Because we are just interested in an order-of-magnitude value, this seems reasonable.

The graph above show the probability of spurious keys (in the model above) as a function of $\mu=K M/N$ (log scale). Again, $\mu=1$ looks as a fair threshold.