🔢 mathematics

Observer-Quotient Security: Composable Leakage Bounds for Hidden State Continuations

This paper introduces the Observer-Quotient Security framework, which establishes composable real/ideal emulation theorems for interactive cryptographic systems by quantifying leakage bounds across diverse side-channels and hidden state continuations through observer-indexed experiments and control-theoretic refinements.

Original authors: Faruk Alpay, Levent Sarioglu

Published 2026-07-07

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Faruk Alpay, Levent Sarioglu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Idea: What You See vs. What Is Happening

Imagine you are watching a magician perform a trick. You see the magician put a card in a box, shake it, and pull out a different card. To your eyes (the observer), the trick is a mystery.

However, inside the box, the magician might be doing a complex series of moves: swapping cards, shuffling them, or even changing the box itself. These internal moves are the hidden state.

This paper asks a critical question: Does it matter what the magician is doing inside the box if you can't see it?

The answer is: It depends on who is watching and how long they watch.

The "Observer": This is anyone or anything trying to figure out what's happening. It could be a hacker, a security camera, a power meter, or a timing sensor.
The "Quotient": This is a fancy math word for "grouping things together." If two different internal states (like "Card A is in the box" and "Card B is in the box") look exactly the same to the observer, the observer groups them into the same bucket. The paper calls this the Observer Quotient.
The "Hidden Continuation": This is when the system changes inside the box (the state evolves) but stays in the same bucket from the observer's point of view. The system is moving, but the observer thinks nothing happened.

The Core Problem: The "Silent Move"

The paper argues that many security proofs fail because they only look at the transcript (the public record of what happened). They assume that if the public record looks the same, the system is secure.

But the paper shows that a system can make a "silent move" (a hidden continuation) that doesn't change the public record right now, but sets up a trap for the future.

The Analogy of the Delayed Leak:
Imagine a secret counter inside a computer that increments every time you click a button.

Observer A only sees the final result on the screen. They see the same result whether the counter is at 10 or 11. To them, the system looks identical.
The Hidden Move: The system increments the counter from 10 to 11. The screen doesn't change.
The Trap: Later, a maintenance packet is sent that reveals the counter is "odd." Suddenly, the observer realizes, "Ah! The counter was at 10, now it's at 11. I can tell the difference!"

The paper says: Security isn't just about what you see now; it's about whether a future observation can reveal a move that happened silently in the past.

The Solution: A New Way to Measure Security

The authors propose a new framework called Observer-Quotient Security. Instead of just asking "Is the output the same?", they ask:

Who is watching? (Are they just reading the transcript, or are they also measuring timing, power usage, or electromagnetic waves?)
What is the "Bucket"? (Which internal states look the same to this specific watcher?)
Can the system move inside the bucket? (Can the system change its internal state without the watcher noticing?)
Can the watcher catch it later? (If the system moves inside the bucket, can a future observation or a side-channel reveal that move?)

The "Real vs. Ideal" Test

The paper uses a "Real/Ideal" game to prove security.

The Real Game: The actual system running with all its messy internal details.
The Ideal Game: A perfect, simplified version where the system only shows the "bucket" (the quotient) and hides everything else.

The paper proves that the Real Game is secure if it behaves exactly like the Ideal Game from the perspective of the specific observer. If the Real Game does something the Ideal Game can't do (like a hidden move that later leaks), the security proof breaks.

The Control Theory Twist: Designing Better Sensors

The paper also connects this to control theory (how engineers design systems to stay stable).

The Problem: Sometimes, a system is "blind" to its own internal changes because the sensors aren't good enough.
The Solution: The paper suggests we can treat security like a design problem. If we know a "hidden move" is dangerous, we can redesign the observer (add a better sensor) to break the "bucket."
The Trade-off: Adding a better sensor costs money or power. The paper provides a mathematical way to calculate: "How much does adding this sensor reduce the risk?" It helps engineers decide if a new sensor is worth the cost to close a security gap.

Key Takeaways in Plain English

Security is relative to the observer. A system can be secure against a hacker who only reads the screen, but insecure against a hacker who also measures how long the computer takes to think.
Silent changes are dangerous. Just because the public output doesn't change doesn't mean the system is safe. Internal changes can accumulate and leak later.
You can't just ignore side channels. If you prove a system is safe against "transcript-only" attacks, but then someone adds a "timing" sensor, your proof is instantly invalid. You have to re-prove it for the new, more powerful observer.
Math can help design sensors. The paper gives a formula to help engineers figure out exactly which sensors they need to add to stop a specific type of hidden attack, balancing the cost of the sensor against the reduction in risk.

Summary Metaphor

Think of a safe.

Old View: If the safe looks locked and the dial hasn't moved, it's secure.
New View (This Paper): Even if the dial hasn't moved, the internal gears might be shifting silently. If you listen closely (timing), feel the heat (power), or wait long enough (future sessions), you might hear the gears clicking.
The Paper's Goal: It gives a rulebook for checking if the gears are shifting in a way that could be heard later, and it tells you how to build a better listening device (sensor) to catch them before they cause a breach.

Technical Summary: Observer-Quotient Security

Problem Statement

Modern cryptographic security assertions are fundamentally statements about observations. Two system executions may differ internally (in their raw state $X$ ) while remaining indistinguishable to a specific class of observers. However, this indistinguishability is fragile: it may fail if the observer class is refined (e.g., by adding timing, cache, power, or electromagnetic side channels) or if the system undergoes "hidden continuations"—internal state transitions that preserve the current public transcript but alter the state in a way that could be exploited by future observations, repeated sessions, or post-processing.

The core problem addressed is the lack of a unified framework that treats cryptographic indistinguishability, side-channel leakage, and control-theoretic observability under a single geometric and algebraic structure. Existing definitions often assume a fixed observer model; when that model changes (e.g., adding a side channel), proofs often break without a clear mechanism to quantify the resulting leakage or to design sensors that mitigate it.

Methodology

The paper formalizes Observer-Quotient Security by defining the security state space not as the raw implementation state $X$ , but as the observer quotient $X/\Pi$ , where $\Pi$ is a class of admissible observation channels.

Core Mathematical Constructs

Observer Quotient and Pseudometric: The paper defines a pseudometric $d_\Pi(x, x')$ based on the total variation distance between the output distributions of all observers in $\Pi$ . States $x, x'$ are equivalent ( $x \equiv_\Pi x'$ ) if $d_\Pi(x, x') = 0$ . The quotient space $X/\Pi$ represents the "visible" state space.
Hidden Continuations: A transition $T(x)$ is a hidden continuation if $T(x) \neq x$ but $T(x) \equiv_\Pi x$ . These are internal state changes invisible to the current observer class.
Interactive Security Games: The framework introduces interactive games with session identifiers, oracle forwarding, adaptive observer schedulers, and post-processing. The security definition is a Real/Ideal theorem: a real game $G$ emulates an ideal quotient functionality $F_{\Pi, B}$ if the adversary's distinguishing advantage is bounded by the sum of specific "defect" terms.
Boundary Functionals and Dissipativity: To handle time evolution and noise, the paper introduces scalar boundary functionals $B_\Pi$ and stochastic dissipativity conditions. These allow the system to prove that the "leakage floor" (the residual distinguishing advantage) converges to zero or remains bounded, even in the presence of persistent noise or implementation drift.

Proof Strategy

The main Real/Ideal theorem is proved via a fully indexed hybrid sequence. The proof decomposes the security gap into named defect terms:

Observer defects: Failure of the observer to distinguish states within a quotient class.
Kernel defects: Failure of the transition kernel to be compatible with the quotient (i.e., splitting equivalent states into distinguishable future distributions).
Post-processing defects: Failure of the observer family to be closed under admissible transformations.
Simulator/Interface defects: Errors in mapping the real interface to the ideal quotient functionality.
Statistical/Residual terms: Bounds derived from stochastic dissipativity and boundary-to-advantage mappings.

Key Contributions

Formal Definition of Observer-Quotient Security Games: The paper defines a comprehensive game structure including session identifiers, adaptive schedulers, and ideal quotient functionalities. It establishes a pseudometric on states induced by the observer class, making the "observer model" an explicit parameter of the security theorem.
Compositional Real/Ideal Theorem: It provides a theorem that bounds the distinguishing advantage of adaptive environments. The bound is a sum of explicit, named terms (observer, kernel, post-processing, simulator, statistical, and residual), allowing for modular analysis of complex systems.
Computational Instantiations: The framework is instantiated for concrete cryptographic scenarios:
- IND-CPA with Timing Leakage: A theorem bounding advantage based on ciphertext-only security plus explicit timing boundary parameters and profiling noise.
- Deterministic Encryption: A ledger-based approach tracking entropy consumption against alphabet-size and smooth max-information leakage.
- Nonce-Refreshing Authenticated Encryption: A state-machine analysis tracking nonce collisions and leakage-state drift.
Control-Theoretic Interpretation and Synthesis: The paper bridges cryptography and control theory. It interprets observer refinement as sensor redesign and hidden continuations as elements of an observability kernel. It formulates observer design as an optimization problem (e.g., minimizing leakage subject to utility and cost constraints) and provides KKT conditions for relaxed sensor selection.
Algorithmic Verification for Finite Systems: The paper presents constructive algorithms for finite state machines to compute observer signatures, check quotient compatibility, and refine partitions until a stable quotient is reached. This allows for the automated detection of "delayed leakage" where states are equivalent now but distinguishable later.

Results and Claims

The paper claims that its framework unifies three previously distinct domains:

Cryptographic Indistinguishability: Standard IND-CPA is recovered as a special case where the observer class is limited to transcripts.
Side-Channel Analysis: The framework explicitly models how adding a side channel (refining $\Pi$ ) coarsens the quotient, potentially invalidating previous proofs. It provides a method to quantify the "leakage floor" caused by persistent noise or implementation drift.
Resilient Control: It connects security to observability. A "stealthy attack" is defined as an input sequence that moves the system through the kernel of the observer. The paper demonstrates how adding sensor rows (refining the observer) reduces the kernel dimension and lowers the residual advantage bound.

The paper demonstrates that hidden continuations are harmless only if the quotient dynamics are compatible (i.e., the transition kernel maps equivalent states to equivalent future distributions). If the kernel is incompatible, or if the observer class is refined later, the hidden state can be exposed.

Significance

The paper argues that security assertions are inherently relative to the observer class. A proof valid for a transcript-only observer is not automatically valid for a transcript-plus-timing observer. The significance of this work lies in:

Explicitness: It forces the explicit declaration of the observer class, the horizon, and the adversary model, preventing "implicit" assumptions that lead to security failures.
Modularity: By decomposing security bounds into named defect terms, it allows system designers to isolate the source of a security failure (e.g., is it a kernel incompatibility or a post-processing issue?).
Design Integration: It provides a mathematical language to trade off measurement cost, utility, and leakage. Instead of treating side-channel mitigation as an afterthought, it frames sensor design and leakage control as an optimization problem over the observer quotient.
Quantitative Residuals: It moves beyond qualitative "secure/insecure" binary states to provide quantitative bounds on the "residual advantage" or "leakage floor" in the presence of noise and drift, offering a more realistic assessment of long-term security.

The paper concludes that the "gap" between raw state equality and observer equality is where hidden continuations live. Security is maintained not by ensuring raw states are identical, but by ensuring that the quotient dynamics are compatible and that the boundary functional (representing the leakage gap) is driven to zero or a negligible floor.