### Abstract

Researchers have proposed formal definitions of quantitative information flow based on information theoretic notions such as the Shannon entropy, the min entropy, the guessing entropy, and channel capacity. This paper investigates the hardness of precisely checking the quantitative information flow of a program according to such definitions. More precisely, we study the "bounding problem" of quantitative information flow, defined as follows: Given a program M and a positive real number q, decide if the quantitative information flow of M is less than or equal to q. We prove that the bounding problem is not a k-safety property for any k (even when q is fixed, for the Shannon-entropy-based definition with the uniform distribution), and therefore is not amenable to the self-composition technique that has been successfully applied to checking non-interference. We also prove complexity theoretic hardness results for the case when the program is restricted to loop-free boolean programs. Specifically, we show that the problem is PP-hard for all the definitions, showing a gap with non-interference which is coNP-complete for the same class of programs. The paper also compares the results with the recently proved results on the comparison problems of quantitative information flow.

Original language | English |
---|---|

Title of host publication | Computer Security, ESORICS 2010 - 15th European Symposium on Research in Computer Security, Proceedings |

Pages | 357-372 |

Number of pages | 16 |

DOIs | |

Publication status | Published - 2010 Nov 8 |

Event | 15th European Symposium on Research in Computer Security, ESORICS 2010 - Athens, Greece Duration: 2010 Sep 20 → 2010 Sep 22 |

### Publication series

Name | Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) |
---|---|

Volume | 6345 LNCS |

ISSN (Print) | 0302-9743 |

ISSN (Electronic) | 1611-3349 |

### Other

Other | 15th European Symposium on Research in Computer Security, ESORICS 2010 |
---|---|

Country | Greece |

City | Athens |

Period | 10/9/20 → 10/9/22 |

### ASJC Scopus subject areas

- Theoretical Computer Science
- Computer Science(all)

## Fingerprint Dive into the research topics of 'On bounding problems of quantitative information flow'. Together they form a unique fingerprint.

## Cite this

*Computer Security, ESORICS 2010 - 15th European Symposium on Research in Computer Security, Proceedings*(pp. 357-372). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 6345 LNCS). https://doi.org/10.1007/978-3-642-15497-3_22