On a mnemonic construction of permutations

1 Introduction

Random permutations constitute one of the most important and the most frequent cryptographic primitives. Thus, a considerable effort has been devoted to the design of their generators. Here we only mention an algorithm of R. A. Fischer and F. Yates, first published in 1938; see also [8].

In 1555, when only “paper and pencil” ciphers were available, Giovan Battista Bellaso [2, 3] introduced a method that enables one to remember easily a long numerical password; to a colloquial passphrase of length n a permutation on [n]={1,2,…,n} is assigned. Formally, let {kn} be the set of all words of length n on Ak, an alphabet of k linearly ordered symbols, and let {n!} be the set of all permutations on the set [n]. Then Bellaso’s method can be described by a recursively defined mapping f:{kn}→{n!}. For a word w and π=f⁢(w), we have:

1. Let s be the smallest symbol in w, and let the first, from the left, occurrence of s in w be in the i-th position of w. Then we mark this occurrence of s in w and set π⁢(i)=1.

2. Assume that already t≥1 symbols in w have been marked. Let s′ be the smallest unmarked symbol in w, whose first (unmarked) occurrence from the left is in the i-th position. Then we mark the symbol s′ in the i-th position and set π⁢(i)=t+1.

As an example, we note that f assigns to a passphrase “gateway” the permutation 4153627. Moreover, there are other meaningful passphrases producing the same permutation: pathway, parkway, hardway, halfway, handsaw, halfman, mangoes, etc. (see also the end of Section 3.1).

Bellaso’s method was and has been widely in use. From the well-known classical ciphers we mention different variations of transposition ciphers, e.g., transposition tables where a secret permutation is required in the heading line.

There is a strong evidence that methods to generate a permutation by the Bellaso’s are still applied [9]. Recently, several modifications of Bellaso’s method have been considered. Rivest [12] presented and analyzed a method where passphrases play a central role. His main idea: Key is a “bag of words” agreed upon by sender and receiver, and there is a possibility to add/delete some words from this bag. Zajac and his students [14] studied “tweakable random permutations” for so-called Tweakable Block Ciphers [10]. Their goal was to create random, but grammatically and structurally correct sentences. These sentences do not need to be meaningful, but their structure is set in advance.

Further, the standard Shannon principle of designing a symmetric cipher suggests to interlace a confusion and diffusion layer several times, where diffusion is realized by a permutation. This permutation could be also given by a passphrase if there are enough rounds. Also, in many block or stream ciphers random permutations on {1,…,16} might be used in principle as a part of the key, e.g., in DES, GOST, EDON80, etc. Such permutations can be given by a mnemonic passphrase.

In most applications of paper and pencil ciphers, the simplicity of usage of Bellaso’s method plays a key role. However, to be able to evaluate security of a cipher using Bellaso’s method it is necessary to know the probability distribution of obtained permutations. To our best knowledge, such study has not been carried out yet. We found in the literature only results on a distribution of special classes of permutations, see, e.g., [1], where Bard et al. analyzed the probabilities of random permutations having given cycle structures.

To initiate research in this direction first we will consider a theoretical model. In this model Bellaso’s method will be applied to the set of all words of a given length over an alphabet (not only to the meaningful phrases) assuming that the probability distribution on the set of all words (i.e., on all n-grams) is uniform. We find it quite surprising that Eulerian numbers play an essential role there. As far as we know this is the first occurrence of these famous numbers in cryptography.

In order to understand how good this theoretical model is, how close it mimics a real life application, we will measure the distance of the probability distribution of permutations in our model to the uniform distribution (the ideal one) and to an English language model. In this English language model, the probability distribution on the domain of all possible n-grams is taken from standardized corpora of English language. It turns out that for small values of parameters, there is a good consistency of the two models. We also analyze sensitivity of our model to its parameters.

2 Theoretical model

As mentioned in the introduction, the Bellaso’s method is still nowadays used in several cryptographic algorithms. Therefore, in order to be able to evaluate security of a cipher, it is necessary to know the probability distribution on the pertinent set of permutations in {n!}.

In this section we will investigate this distribution in a theoretical model where we assume the uniform distribution on the domain (= all words of length n on an alphabet Ak of k linearly ordered symbols). That is, for each permutation π it is necessary to find out the cardinality |f-1⁢(π)|, and to determine the number of permutations π with the same value of |f-1⁢(π)|, where f:{kn}→{n!} is the function describing Bellaso’s method.

The matrices A and B given below contain pertinent values for n=5; the element ai⁢k equals the number of permutations π with |f-1⁢(π)|=bi for the given value of k. For example, for k=7, there are a44=26 permutations π such that b4=|f-1⁢(π)|=56, and other a64=26 permutations π with b6=|f-1⁢(π)|=252.

As the size of domain is kn, we get the following formula as a dot product of the k=7 column of A and B, respectively:

In what follows the elements of matrices A and B will be determined in general. We start by introducing a key notion of this section. It will be said that a permutation π contains a consecutive pair {j,j+1}, if the number j precedes j+1, that is, when π-1⁢(j)<π-1⁢(j+1). The next theorem provides all possible values of |f-1⁢(π)| for a fixed number n. As usual, we set (ab):=0 for a<b.

Hence, the elements in A are closely related to the numbers of permutations on [n] with m consecutive pairs; we denote them by D⁢(n,m). The proof of Corollary 2.2 explains the symmetry of columns of A.

The next statement provides a closed formula for the number of permutation on [n] with m consecutive pairs.

It turns out that D⁢(n,m) are in fact very well-known numbers. In 1755, Leonard Euler [5] investigated polynomials whose coefficients E⁢(n,m), 0≤m<n, are nowadays called Eulerian numbers. These numbers are found in many different areas of mathematics, cf. [11]. In combinatorics, E⁢(n,m) represents the number of permutations π=(π1,…,πn) with m ascents, i.e., with m indices i such that πi<πi+1.

This statement follows from [13], where it is shown that E⁢(n,m)=∑i=0m(-1)i⁢(n+1i)⁢(m+1-i)n.

The next corollary provides a direct proof of the identity D⁢(n,m)=E⁢(n,m).

We illustrate the above proof by an example. The permutation π=(2,4,…,2⁢k,1,3,…,2⁢k-1) has 2⁢k-2 ascents and k-1 increasing pairs, and π-1=(k+1,1,k+2,2,k+3,3,…,2⁢k-2,k-1,2⁢k-1,k) has k-1 ascents and 2⁢k-2 increasing pairs.

3 Statistical analysis of the theoretical model

In this section we will study how the probability distribution on {n!} in our theoretical model differs from the probability distribution in the English language model, and how these two distributions differ from the uniform distribution on {n!}. It is common to use the Manhattan metric dM (a.k.a. variation distance, zigzag metric, l1 metric) [6] to measure the statistical distance of two discrete distributions over the same sample space. For two probability distributions P and Q of the set of all permutations πi on [n] with probabilities pi and qi we have

Obviously, d⁢(P,Q)≤2 with equality if and only if pi⁢qi=0 for all i.

As for the probability p of a permutation π, it depends on the probability distribution on the domain. It is

where the sum runs over all n-grams in f-1⁢(π). We set p=0 if |f-1⁢(π)|=0.

In the theoretical model introduced in the previous section, the uniform distribution is assumed on the domain {kn}. It has been shown there that in this case we have |f-1⁢(π)|=(k+mn) where m is the number of consecutive pairs of π. Hence, by (4), for the probability p of π in our theoretical model,

3.1 Consistency of the theoretical model with the English language model

First we focus on to what extent the English language model is consistent with the theoretical one. In the theoretical model and in the English language model we denote the probability distribution of permutations by P and Q, and the probability of a permutation πi in P and Q will be denoted by pi and qi, respectively.

For our English language model we selected texts of different lengths from the Open American National Corpus (AONC, www.anc.org/data/oanc/download/).^[1] We have chosen texts of size {1-5,10-50}×106 letters. As for the distribution on the domain (unlike the theoretical model, where the uniform distribution is considered), we have calculated probabilities of n-grams as follows: In each corpus, we set a window of length n and slid it over the whole corpus; to get the probability (= the relative frequency) of an n-gram the obtained frequency has been divided by the total number of n-grams in the corpus, i.e., by T-n+1, where T is the total length of the corpus. The probability qi is then calculated by (4).

The distance of the two distributions Pand Q was evaluated for all n from 1 to 10; in all cases, the parameter k was set to be 26.

The obtained results tend to indicate that the statistical distance increases with increasing n and decreases with the increasing corpus size. Figure 1 shows the statistical distance of the English language model to the theoretical one for n=1,2,…,10 and corpora of size c×106 for various values of c.

It is clear that the distance of the two models depends also on the total number of n-grams occurring in the given corpus; i.e., on the number of n-grams with a non-zero probability. As expected, our experiments show that the ratio rn of all n-grams with a non-zero probability in the English language model to all possible n-grams is rapidly decreasing with growing n. Figures 2 and 3 depict this ratio for the corpus size c×106, c=1,10,20,30,40,50. As the ratio becomes very small for n≥6, Figure 3 is in a logarithmic scale.

Figure 1

The statistical distance of the English language model to the theoretical one for n=1,2,…,10and corpora of size c×106 for various values of c.

Figure 2

Ratio rn of all n-grams with a non-zero probability in the English language model to all possible n-grams.

Figure 3

Ratio rn of all n-grams with a non-zero probability in the English language model to all possible n-gramsin a logarithmic scale.

At the end of this subsection we point out that although the ratio rn decreases dramatically with growing n, the Bellaso’s mapping is “nearly onto”; i.e., the size of the range of f in the English language model is nearly n!. In greater detail, in corpora of all considered sizes c×106, and n≤7, the mapping f is onto. Even for n=8 and c=1 there are only 13 permutations without preimages, and for c=2 there is only one such permutation. In all other cases we have multiple preimages for all permutations.

For n=9 the number of permutations without a preimage gradually decreases from 79 734 permutations for c=1 to 7 for the largest c=50, i.e. less than 0.002% in this case.

For n=10 the number of permutations without a preimage gradually decreases from 2 954 193 permutations in the case of c=1 to 206 797 for the largest corpus, i.e. less than 5.7%.

4 Conclusions

In this paper we have initiated a study of the security of ciphers employing Bellaso’s method with respect to the probability distribution of permutations generated in this way. As usual we have assumed that the uniform probability distribution of permutations is the ideal one. The intuition suggests that for n large, Bellaso’s mnemonic method does not provide a distribution on {n!} that is close to the uniform one. However, for small n up to 8, Tables 2 and 4 demonstrate that the probability distribution of permutations both in the theoretical model and the English model are close to the ideal one. To get a better probability distribution even for larger values of n it suffices to reduce the range of the mapping f in a suitable way and, additionally, also to increase k, the size of the alphabet. In [4], it is shown that for n→∞, Eulerian numbers E⁢(n,m) can be approximated by a Gaussian distribution with the mean μ=n+12 and σ2=n+112. Thus confining the range of f to permutations with m consecutive pairs, m∈[n+12-δ,n+12+δ] for suitably small δ, is likely the best way how to modify it. For n=16, a frequent length of a part of the key (cf. the introduction) and setting m∈[6,9], the range of f comprises 92% of all permutations and the domain contains 82% of all 16-grams for k=26 (90% for k=52). The distance of the probability distribution to the uniform one in the case k=26 is 0.486 but it decreases to 0.2531 for k=52. Limiting m to 7,8 still leads to 61% of all permutations, and a half of all passphrases for k=26 (58% for k=52) while the probability distribution of the range of f is now the uniform one.