symbols have the best path to each node at time step + 1, and updates the stored sufficient significance that an eavesdropper could deduce informa- records of the paths and metrics. tion from them wherever they were, and perhaps alter them. Trans- In theory the decoder has to wait until the hypothetical end of position is desirable to prevent the eavesdropper deducing transmission before it can decide the overall maximum likelihood information by comparing messages, or corrupting known parts of path from start to finish. Fortunately it can be shown that a fixed a message, even if he does not know what they have been altered to. finite delay between input and output is all that is necessary to give The most completely secure system is known as the one-time pad. nearly optimum performance. In particular, it can be shown that if This is a symbol-by-symbol substitution system in which the key is all the reasonably likely paths at time-step i are traced backwards in as long as the message; hence no deductions about one part of the time, they will converge to the same path within about 5L time- ciphertext help the eavesdropper to decipher the rest. The problem steps. The decoder therefore operates with a fixed delay of 8 steps, is in distribution of the key itself (key management), which is now where o N 5L; at time i it selects one of the reasonably likely paths as big a problem as the original problem of sending the message and the bit from that path at time 8 is output as the decoded securely. 14/12 Coding Practical encryption systems must have manageable keys, and are of N. The difficulty of factoring numbers of order means that based on algorithms for which it is too difficult, rather than theore- the eavesdropper cannot work out the two factors of N and cannot tically impossible, to decrypt the ciphertext. Various (worst case) decrypt the message. assumptions are made in designing and analysing the security of the system; it is normally assumed that the eavesdropper knows the encryption and decryption algorithms,