early work on language - based security , such as volpano and smith s type systems , precluded the use of high security variables to affect control flow . specifically , the conditions in if - commands and while - commands were restricted to using only low security information .if this restriction is weakened , it opens up the possibility that high security data may be leaked through the different timing behaviour of alternative control paths .this kind of leakage of information is said to form a _ covert timing channel _ and is a serious threat to the security of programs ( cf . e.g. ) .we develop a new notion of security against timing attacks where the attacker is able to simultaneously observe the execution time of a ( probabilistic ) program and the probability of the values of low variables .this notion is a non - trivial extension of similar ideas for deterministic programs  which also covers attacks based on the combined observation of time and low variables .this earlier work presents an approach which , having identified a covert timing channel , provides a program transformation which neutralises the channel .we start by introducing a semantic model of timed probabilistic transition systems .our approach is based on modelling programs essentially as markov chains ( mc ) where the stochastic behaviour is determined by a joint distribution on both the values assigned to the program s variables and the time it takes the program to perform a given command .this is very different from other approaches in the area of automata theory which are also dealing with both time and probability . in this areathe timed automata constitute a well - established model .these automata have been extended with probability and used in model - checking for the verification of probabilistic timed temporal logic properties of real - time systems .the resulting model is essentially a markov decision process where rewards are interpreted as time durations and is therefore quite different from our mc approach . in particular ,the presence of non - determinism makes it not very appropriate as a base of our quantitative analysis aiming at measuring timing leaks .we next present a concrete programming language with a timed probabilistic transition system as its execution model .this language is based on the language studied in  but is extended with a probabilistic choice construct whilst this may not play a role in user programs , it has an essential role in our program transformation . in order to determine and quantify the security of systems and the effectiveness of potential counter - measures against timing attacks we then discuss an approximate notion of timed bisimilarity and construct an algorithm for computing a quantitative estimate of the vulnerability of a system against timing attacks ; this is given in terms of the mismatch between the actual transition probabilities and those of an ideal perfectly confined program .finally , we present a probabilistic variation of agat s padding algorithm which we use to illustrate via an example a technique for formally analysing the trade - off between security costs and protection .we introduce a general model for the semantics of programs where time and probability are explicitly introduced in order to keep track of both the probabilistic evolution of the program / system state and its running time .the scenario we have in mind is that of a multilevel security system and an attacker who can observe the system looking at the values of its public variables and the time it takes to perform a given operation or before terminating , or other similar properties related to its timing behaviour .  in order to keep the model simple , we assume that the time to execute a statement is constant and that there is no distinction between any ` local ' and ` global ' clocks . in a more realistic model ,one has of course to take into account also that the execution speed might differ depending on which other process is running on the same system and/or delays due to uncontrollable events in the communication infrastructure , i.e. network .our reference model is the timed probabilistic transition system we define below .the intuitive idea is that of a probabilistic transition system ( similar to those defined in all generality in ) where transition probabilities are defined by a joint distribution of two random variables representing the variable updates and time , respectively .let us consider a finite set , and let denote the set of all _ probability distributions _ on , that is the set of all functions  ] a probabilistic transition relation , and a state labelling function .   1 .  for all we have , and 2 .  for all is _ at most one _ tuple .if for all there exists at most one , we can also represent a timed probabilistic transition system with labelled states as a quadruple with \times \t ] represents the usual semantics of operators ) :\ ! ] } v_2 } \end{array}\ ] ]  the small step semantics is then define as a timed pts via the sos rules in table [ opsem ] .  ' '' ''   ' '' ''  the time labels represent the time it takes to perform certain operations : is the time to store a variable , is the time it takes to evaluate an expression , represents the time to perform an assignment , is the time required for a branching step , and is the time to perform a probabilistic choice . by denote any sequence of time labels and with we indicate termination .  the rule ( choose ) is the only new rule with respect to the original semantics in .it states that the execution of a probabilistic choice construct leads , after a time , to a state where either the command or the command is executed with probability or , respectively .this rule together with the standard transition rules for the other constructs of the language define a tpts for our pwhile language according to definition [ tpts ] . in this tpts ,the state labels are given by the environment , i.e. .according to the notion of security we consider in this paper , an observer or attacker can only observe the changes in low variables .therefore , we can simplify the semantics by ` collapsing ' the execution tree in such a way that execution steps during which the value of all low variables is unchanged are combined into one single step .we call an execution sequence _ deterministic _ if , and we call it _ low stable _ if for all . the empty path ( of length zero ) is by definition deterministic and low stable .an execution sequence is _ maximal deterministic / low stable _ if it is not a proper sub - sequence of another deterministic / low stable path .observing the low variables and the running time separately is not the same as observing them together ; a correlation between the two random variables ( probability and time ) has to be taken into account ( cf .section [ model ] ) . a naive probabilistic extension of the -bisimulation notion introduced in might not take this into account .more precisely , this may happen if time and probability are treated as two independent aspects which are observed separately in a mutual exclusive way .according to such a notion an attacker must set up two different covert channels if she wants to exploit possible interference through both the probabilistic and the timing behaviour of the system .  the notion of bisimulationwe introduce here allows us to define a stronger security condition : an attacker must be able to distinguish the probabilities that two programs compute a given result in a given execution time .this is obviously different from being able to distinguish the probability distributions of the results _ and _ the running time .probabilistic bisimulation was first introduced in  and refers to an equivalence on probability distributions over the states of the processes .this latter equivalence is defined as a lifting of the bisimulation relation on the support sets of the distributions , namely the states themselves .an equivalence relation on can be lifted to a relation between probability distributions on via ( cf ( * ? ? ?* thm 1 ) ) : \in { { s}/_{\sim } } : \mu([s ] ) = \nu([s]).\ ] ] it follows that is also an equivalence relation ( ( * ? ? ?* thm 3 ) ) .  for any equivalence relation on the set of configurations ,we define the associated _ low equivalence _ relation by if and .obviously is again an equivalence relation .we can lift a low equivalence to which we simply denote by .  given a security typing ,a probabilistic time bisimilarity is the largest symmetric relation on configurations such that whenever , then   we say that two configurations are probabilistic time bisimilar or pt - bisimilar , , if there exists a probabilistic time bisimilarity relation in which they are related .this definition generalises the one in  which only applies to deterministic transition systems .note that there is a difference between and ; in fact , only the former is able to take into account the correlation between time and low variables , while the latter would be a straightforward generalisation of the time bisimulation in which is unable to model such a correlation .we now exploit the notion of bisimilarity introduced above in order to introduce a security property ensuring that a system is confined against any combined attacks based on both timing and probabilistic covert channels .a pwhile program is _ probabilistic time secure _ or pt - secure if for any set of initial states and such that , we have .the papers  introduce an approximate version of bisimulation and confinement where the approximation can be used as a measure for the information leakage of the system under analysis .the quantity is formally defined in terms of the norm of a linear operator representing the partition induced by the ` minimal ' bisimulation on the set of the states of a given system , i.e. the one minimising the observational difference between the system s components .we show here how to compute a non - trivial upper bound to by essentially exploiting the algorithmic solution proposed by paige and tarjan  for computing bisimulation equivalence .this was already adapted to pts s in , where it was used for constructing a padding algorithm as part of a transformational approach to the timing leaks problem . in this approachthe computational paths of a program are transformed so as to make it perfectly secure by eliminating any possible timing covert channel while preserving its i / o behaviour .the algorithm we present here is an instantiation of that algorithm where the abstract labels are replaced by the statements in a concrete language ( pwhile ) and their execution times .moreover , instead of transforming the execution trees , our algorithm accumulates the information about the difference between their transition probabilities and uses this information to compute an upper bound to the maximal information leakage of the given program . execution tree with states , and execution tree with states   choose ,  ,    choose , for all  choose , for all  find best match   algorithm [ compdelta ] describes a procedure that can be used inside an algorithm for constructing a lumping ( i.e. a pt - bisimulation equivalence ) of two tpts s and . in particular , algorithm [ qlumping ] refers to a such a procedure which follows the algorithmic paradigm for partition refinement introduced by paige and tarjan in ( see also ) .the paige - tarjan algorithm constructs a partition of a state space which is _ stable _ for a given transition relation .it is a well - known result that this partition corresponds to a bisimulation equivalence on the transition system .the refinement procedure used in the algorithm consists in _ splitting _ the blocks in a given partition by replacing each block with and , where and .  in order to check whether two execution trees and in our tpts model are pt - bisimilar , in algorithm [ qlumping ]we apply this refinement technique to the set of states formed by the disjoint union of the states in and .the strategy of our lumping procedure  is as follows : it proceeds iteratively layer by layer starting from the leaves layer , and splits the blocks in the current partition restricted to the current layer . the procedure computes for each two layers and , the maximal difference between the probabilities to get from states in and , respectively , into states of layer . in the original lumping procedurethis would determine a splitting of the states in layer .this value is stored in a variable and compared with the current value of a variable which contains the maximal difference up to that iteration .when the lumping algorithm terminates ( that is when we have reached the root of the union tree ) , one of the following situations will occur : either the roots of and belong to the same class in the constructed partition ( i.e. and are pt - bisimilar ) or not . in the latter case will contain a maximal difference in the transition probabilities of the two processes which makes them non - bisimilar .this is therefore an estimate of the information leakage of the system .note that , by construction , will be zero in the first case .the strategy for constructing the lumping described above determines the _ coarsest partition _ of a set which is stable wrt a given relation , that is in our case the coarsest pt - bisimulation equivalence .obviously , this does not necessarily coincide with the ` minimal ' one corresponding to the quantity defined in .thus , will be in general only a safe approximation , namely an upper bound to the capacity of probabilistic timing covert channel defined by .the following proposition is therefore a corollary of proposition 45 in  stating a similar assertion for -bisimulation . is pt - secure iff for any pair of initial configurations the corresponding execution trees and are such that returns .   the actual value of is determined by the way we compute the best match between the joint probability distributions and in line 8 of . in order to compute we use the _ supremum norm _, , between two distributions , i.e. the largest absolute difference between corresponding entries in and , respectively .in other words , we try to identify a class of states ( in the layer below ) and a time interval such that the probability of reaching this class in that time from differs maximally from the one for .one can argue that this is a fair approach as we treat all classes and time labels the same way .however , it might be useful to develop a measure which reflects the fact that certain times and classes are more similar than others .  from the point of view of the attacker , such a measure would encode her / his ability in detecting similarity as given by the nature and the precision of the instruments he is actually using .for example , suppose it is possible to reach the same class from and with different times and , such that the corresponding probabilities determine ( i.e. we have the maximal difference in this case ) .however , we might in certain circumstances also want to express the fact that and are more or less similar , e.g. for and we might want a smaller than for and . in terms of the attacker, this means that we make our estimate dependent on the actual power of the time detection instrument that he / she possesses .  in order to incorporate similarity of times and/or classeswe need to modify the way we determine the best match in line 8 of . instead of determining the norm between and we can compute a weighted version as : where re - scales the entries in and so as to reflect the relative importance of certain times and/or classes . note that `` '' denotes here the component - wise and not the matrix multiplication : . if , for example , an attacker is not able to detect the absolute difference between times but can only measure multiplicities expressing approximative proportions , we could re - scale the s via .  in the followingwe will use a weighted version which reflects the similarity of classes .the idea is to weight according to the `` replaceability '' of a class . to this purposewe associate to every class ( in the layers below ) a matching measure , i.e. we determine the between a ( sub)tree with a root in the class in question and all ( sub)trees with roots in any of the other classes .we can take any representative of the classes and as these are by definition bisimilar .the measure indicates how easy it is to replace class by another one , or how good / precise is the attacker in distinguishing successor states .then is simply the weighted version of as described above with .note that there is no problem with the fact that is defined recursively as we always know the in the layers below before we compute in the current layer .if we compute the and values between all the pairs of systems we get the following results : from this we see that and are symmetric , i.e. the difference between two systems is symmetric ; that every system is bisimilar with itself , i.e. ( as we have an empty diagonal ) ; and that the difference between two systems is between zero and one with values in between very well possible .in a recent article on `` software bugtraps '' in _ the economist _ the authors report on some ongoing research at nist on `` software assurance metrics and tool evaluation '' .they claim that `` _ the purpose of the research is to get away from the feeling that ` all software has bugs ' and say ` it will cost this much money to make software of this kind of quality ' _ '' .they then conclude : `` _ rather than trying to stamp out bugs altogether , in short , the future of `` software that makes software better '' may lie in working out where the pesticide can be most cost - effectively applied _ '' .our aim is to introduce `` cost factors '' in a similar way into computer security . instead of trying to achieve perfect security we will look at the trade - off between costs of security counter measures such as increased average running time and the improvement in terms of security , which we can measure viathe introduced above . even in simple examples we are able to exhibit interesting effects .   in introduces a program transformation to remove covert timing channels ( _ timing leaks _ ) from programs written in a sequential imperative programming language .the language used is a language of security types with two security levels that is based on earlier work by volpano and smith .whilst volpano and smith restrict the condition in both while - loops and if - commands to being of the lowest security level , agat allows the condition in an if - command to be high security providing that an external observer can not detect which branch was taken .he shows that if a program is typeable in his system , then it is secure against timing attacks .this result depends critically on a notion of bisimulation ; an if - command with a high security condition is only typeable if the two branches are bisimilar .agat s notion of bisimilarity is timing aware and based on a notion of low - equivalence which ensures stepwise non - interference .he does not give an algorithm for bisimulation checking .if a program fails to type , agat presents a transformation system to remove the timing leak .the transformation pads the branches of if - commands with high security conditions with dummy commands .the objective of the padding is that both branches end up with the same timing and thus become indistinguishable by an external observer .the transformation utilises the concept of a _ low - slice _ : for a given command , its low - slice has the same syntactic structure as but only has assignments to low security variables ; all assignments to high security variables and branching on high security conditions are replaced by skip commands of appropriate duration .the transformation involves extending the branches in a high security if - command by adding the low - slice from the other branch .the effect of this transformation is that the timing of the execution of both branches are the same and equal to the sum of timing of the two branches in the untransformed program .agat demonstrates that the transformation is semantically sound and that transformed programs are secure ( correctness ) .  in order to extend this system to our language, we only have to add a rule for the * choose * statement ( essentially a straight forward extension of the rule for * if * ) . in detail, we present the typing rules in table [ sectypes ] . note that the rule ( if ) refers to the _ semantic _notion of timed bisimilarity ( as introduced in section [ ptbisim ] ) .  ' '' ''   ' '' ''   we consider a probabilistic variant of agat s language .probabilities play an important role in the transformation . rather than just adding the low slice from the other branch to each branch of a high security conditional, we transform each branch to make a probabilistic choice between its padded and untransformed variant .this allows us to trade - off the increased run - time of the padded program versus the vulnerability to attack of the untransformed program .the transformation described is just one on a whole spectrum of probabilistic transformations at the other extreme we could probabilistically decide whether or not to execute each command in the low slice .all the formal transformation rules for probabilistic padding are the same as in .the only exception is the rule ( if ) : here we replace provided certain typing conditions are fulfilled the branches of an * if * statement not just by the correctly `` padded '' version as in ; instead we introduce in every branch a choice such that the secure replacement will be executed only with probability while with probability the original code fragment will be executed .  in order to transform programs into secure versions we need to introduce an auxiliary notion , namely the notion of global effect of commandsthis is used to identify ( global ) variables which might be changed when a command is executed .here is its formal definition :   the judgments or transformation rules in table [ progtrans ] are of the general form : which represents the fact that with a certain ( security ) typing we can transform the statement into  we also recorder as a side - product the so - called _ low slice _ of .  ' '' ''   ' '' ''   our probabilistic version of agat s padding algorithm allows us to obtain _ partially _ fixed programs . depending on the parameter with which we introduce empty low slices to obfuscate the timing leaks we can determine the ( average ) execution time of the fixed program in comparison with the improvement in security .agat presents in his paper  an example which itself is based on kocher s study  of timing attacks against the rsa algorithm . in order to illustrate our approach we simplify the example slightly : the insecure program agat we start with is depicted on the left side in table [ agatprogs ] .the fully padded version agat s algorithm produces , fagat , is on the right hand side of table [ agatprogs ] ( to keep things simple we omit agat s empty statements like skipasn s s ; as skip as well as s:=s can be used just to ` spend time ' without having any real effect on the store we can use e.g. s:=s in place of agat s skipasn s s ) .the program , pagat , presented in the middle of table [ agatprogs ] is the result of _ probabilistic padding _ :the original program agat is transformed in such a way that the compensating statements , i.e. low slices , are executed only with probability while with probability the original code is executed .for we have the same behaviour as the original program agat while for this program behaves in the same way as agat s fully padded version fagat .  ' '' ''  .... i : = 1 ; while i<=3 do  if k[i]==1 then   s : = s ;   else   skip ;  fi ;  i : = i+1 ; od ; ....    .... i : = 1 ; while i<=3 do  if k[i]==1 then   choose p : s : = s ; skip   or   q : s : = s   ro  else   choose p : skip   or   q : s : = s ; skip   ro  fi ;  i : = i+1 ; od ; ....    .... i : = 1 ; while i<=3 do  if k[i]==1 then   s : = s ; skip  else   s : = s ; skip  fi ;  i : = i+1 ; od ; ....  ' '' ''  in our concrete experiments we used the following assumptions .the variable can take values in while is a three dimensional array with values in  nothing is concretely assumed about .the variables , representing a _ secret key _ , and have security typing , while is the only low variable which can be observed by an attacker .we implemented this example using ( arbitrary ) execution times : ( assign time ) , ( test / branch time ) , and ( skip time ) , and ( choice time ) .  the abstract semantics for the pagat program which only records choice points and the moments in time when the low variable changes its value produces the following execution trees if we start with keys k=011 and k=010 : {1:5 } &   \bullet \ar@/^/[r]^{q:4 }        \ar@/_/[r]_{p:7 } &   \bullet \ar[r]_{1:2 } &   \bullet \ar@/^/[r]^{q:6 }        \ar@/_/[r]_{p:7 } &   \bullet \ar[r]_{1:2 } &   \bullet \ar@/^/[r]^{q:6 }        \ar@/_/[r]_{p:7 } &   \bullet \ar[r]_{1:1 } &   \bullet  } \ ] ] {1:5 } &   \bullet \ar@/^/[r]^{q:4 }        \ar@/_/[r]_{p:7 } &   \bullet \ar[r]_{1:2 } &   \bullet \ar@/^/[r]^{q:6 }        \ar@/_/[r]_{p:7 } &   \bullet \ar[r]_{1:2 } &   \bullet \ar@/^/[r]^{q:4 }        \ar@/_/[r]_{p:7 } &   \bullet \ar[r]_{1:1 } &   \bullet  } \ ] ] one can easily see from this how probabilistic padding influences the behaviour of a program : for every bit in the key  i.e. every iteration we have a choice between executing the original code with probability or the ` safe ' code with probability .the new code always takes the same time ( in our case ticks ) while the original code s execution time depends on whether } ] , and thus can deduce the secrete value by just observing the execution times. however , as the execution time is always the same for the replacement code , it is impossible to do the same for . for values of between and , the ( average ) execution times for }=0 ] become more and more similar .this means in practical terms that the attacker has to spend more and more time ( i.e. repeated observations of the program ) in order to determine with high confidence the exact execution time and thus deduce the value of }$ ] ( cf .e.g. ) .( 0,28 ) grid[ystep=5mm , xstep=6.66 mm ] ( 10,38 ) ; ( 0,27.33 ) node ; in 1, ... ,9 ( , 27.33 ) node ; ( 10,27.33 ) node ; in 28, ... ,38 ( -0.5 , ) node ; ( 0.00,29.00 ) ( 1.00,29.90 ) ( 2.00,30.80 ) ( 3.00,31.70 ) ( 4.00,32.60 ) ( 5.00,33.50 ) ( 6.00,34.40 ) ( 7.00,35.30 ) ( 8.00,36.20 ) ( 9.00,37.10 ) ( 10.00,38.00 ) ; ( 0.00,31.00 ) ( 1.00,31.70 ) ( 2.00,32.40 ) ( 3.00,33.10 ) ( 4.00,33.80 ) ( 5.00,34.50 ) ( 6.00,35.20 ) ( 7.00,35.90 ) ( 8.00,36.60 ) ( 9.00,37.30 ) ( 10.00,38.00 ) ; ( 0.00,31.00 ) ( 1.00,31.70 ) ( 2.00,32.40 ) ( 3.00,33.10 ) ( 4.00,33.80 ) ( 5.00,34.50 ) ( 6.00,35.20 ) ( 7.00,35.90 ) ( 8.00,36.60 ) ( 9.00,37.30 ) ( 10.00,38.00 ) ; ( 0.00,33.00 ) ( 1.00,33.50 ) ( 2.00,34.00 ) ( 3.00,34.50 ) ( 4.00,35.00 ) ( 5.00,35.50 ) ( 6.00,36.00 ) ( 7.00,36.50 ) ( 8.00,37.00 ) ( 9.00,37.50 ) ( 10.00,38.00 ) ; ( 0.00,31.00 ) ( 1.00,31.70 ) ( 2.00,32.40 ) ( 3.00,33.10 ) ( 4.00,33.80 ) ( 5.00,34.50 ) ( 6.00,35.20 ) ( 7.00,35.90 ) ( 8.00,36.60 ) ( 9.00,37.30 ) ( 10.00,38.00 ) ; ( 0.00,33.00 ) ( 1.00,33.50 ) ( 2.00,34.00 ) ( 3.00,34.50 ) ( 4.00,35.00 ) ( 5.00,35.50 ) ( 6.00,36.00 ) ( 7.00,36.50 ) ( 8.00,37.00 ) ( 9.00,37.50 ) ( 10.00,38.00 ) ; ( 0.00,33.00 ) ( 1.00,33.50 ) ( 2.00,34.00 ) ( 3.00,34.50 ) ( 4.00,35.00 ) ( 5.00,35.50 ) ( 6.00,36.00 ) ( 7.00,36.50 ) ( 8.00,37.00 ) ( 9.00,37.50 ) ( 10.00,38.00 ) ; ( 0.00,35.00 ) ( 1.00,35.30 ) ( 2.00,35.60 ) ( 3.00,35.90 ) ( 4.00,36.20 ) ( 5.00,36.50 ) ( 6.00,36.80 ) ( 7.00,37.10 ) ( 8.00,37.40 ) ( 9.00,37.70 ) ( 10.00,38.00 ) ;  ( 0,0 ) grid[ystep=5mm , xstep=6.66 mm ] ( 10,10 ) ; ( 0,-0.66 ) node ; in 1, ...,9 ( , -0.66 ) node ; ( 10,-0.66 ) node ; in 0, ... ,9 ( -0.5 , ) node0 . ; ( -0.5,10 ) node1.0 ; ( 0.00,0.00 ) ( 1.00,0.00 ) ( 2.00,0.00 ) ( 3.00,0.00 ) ( 4.00,0.00 ) ( 5.00,0.00 ) ( 6.00,0.00 ) ( 7.00,0.00 ) ( 8.00,0.00 ) ( 9.00,0.00 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,8.10 ) ( 2.00,6.40 ) ( 3.00,4.90 ) ( 4.00,3.60 ) ( 5.00,2.50 ) ( 6.00,2.40 ) ( 7.00,2.10 ) ( 8.00,1.60 ) ( 9.00,0.90 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,9.00 ) ( 2.00,8.00 ) ( 3.00,7.00 ) ( 4.00,6.00 ) ( 5.00,5.00 ) ( 6.00,4.00 ) ( 7.00,3.00 ) ( 8.00,2.00 ) ( 9.00,1.00 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,8.10 ) ( 2.00,6.40 ) ( 3.00,4.90 ) ( 4.00,3.60 ) ( 5.00,2.50 ) ( 6.00,2.40 ) ( 7.00,2.10 ) ( 8.00,1.60 ) ( 9.00,0.90 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,0.00 ) ( 1.00,0.00 ) ( 2.00,0.00 ) ( 3.00,0.00 ) ( 4.00,0.00 ) ( 5.00,0.00 ) ( 6.00,0.00 ) ( 7.00,0.00 ) ( 8.00,0.00 ) ( 9.00,0.00 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,8.10 ) ( 2.00,6.40 ) ( 3.00,4.90 ) ( 4.00,3.60 ) ( 5.00,2.50 ) ( 6.00,2.40 ) ( 7.00,2.10 ) ( 8.00,1.60 ) ( 9.00,0.90 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,9.00 ) ( 2.00,8.00 ) ( 3.00,7.00 ) ( 4.00,6.00 ) ( 5.00,5.00 ) ( 6.00,4.00 ) ( 7.00,3.00 ) ( 8.00,2.00 ) ( 9.00,1.00 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,8.10 ) ( 2.00,6.40 ) ( 3.00,4.90 ) ( 4.00,3.60 ) ( 5.00,2.50 ) ( 6.00,2.40 ) ( 7.00,2.10 ) ( 8.00,1.60 ) ( 9.00,0.90 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,8.10 ) ( 2.00,6.40 ) ( 3.00,4.90 ) ( 4.00,3.60 ) ( 5.00,2.50 ) ( 6.00,2.40 ) ( 7.00,2.10 ) ( 8.00,1.60 ) ( 9.00,0.90 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,0.00 ) ( 1.00,0.00 ) ( 2.00,0.00 ) ( 3.00,0.00 ) ( 4.00,0.00 ) ( 5.00,0.00 ) ( 6.00,0.00 ) ( 7.00,0.00 ) ( 8.00,0.00 ) ( 9.00,0.00 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,8.10 ) ( 2.00,6.40 ) ( 3.00,4.90 ) ( 4.00,3.60 ) ( 5.00,2.50 ) ( 6.00,2.40 ) ( 7.00,2.10 ) ( 8.00,1.60 ) ( 9.00,0.90 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,9.00 ) ( 2.00,8.00 ) ( 3.00,7.00 ) ( 4.00,6.00 ) ( 5.00,5.00 ) ( 6.00,4.00 ) ( 7.00,3.00 ) ( 8.00,2.00 ) ( 9.00,1.00 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,8.10 ) ( 2.00,6.40 ) ( 3.00,4.90 ) ( 4.00,3.60 ) ( 5.00,2.50 ) ( 6.00,2.40 ) ( 7.00,2.10 ) ( 8.00,1.60 ) ( 9.00,0.90 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,0.00 ) ( 1.00,0.00 ) ( 2.00,0.00 ) ( 3.00,0.00 ) ( 4.00,0.00 ) ( 5.00,0.00 ) ( 6.00,0.00 ) ( 7.00,0.00 ) ( 8.00,0.00 ) ( 9.00,0.00 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,8.10 ) ( 2.00,6.40 ) ( 3.00,4.90 ) ( 4.00,3.60 ) ( 5.00,2.50 ) ( 6.00,2.40 ) ( 7.00,2.10 ) ( 8.00,1.60 ) ( 9.00,0.90 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,9.00 ) ( 2.00,8.00 ) ( 3.00,7.00 ) ( 4.00,6.00 ) ( 5.00,5.00 ) ( 6.00,4.00 ) ( 7.00,3.00 ) ( 8.00,2.00 ) ( 9.00,1.00 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,9.00 ) ( 2.00,8.00 ) ( 3.00,7.00 ) ( 4.00,6.00 ) ( 5.00,5.00 ) ( 6.00,4.00 ) ( 7.00,3.00 ) ( 8.00,2.00 ) ( 9.00,1.00 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,8.10 ) ( 2.00,6.40 ) ( 3.00,4.90 ) ( 4.00,3.60 ) ( 5.00,2.50 ) ( 6.00,2.40 ) ( 7.00,2.10 ) ( 8.00,1.60 ) ( 9.00,0.90 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,0.00 ) ( 1.00,0.00 ) ( 2.00,0.00 ) ( 3.00,0.00 ) ( 4.00,0.00 ) ( 5.00,0.00 ) ( 6.00,0.00 ) ( 7.00,0.00 ) ( 8.00,0.00 ) ( 9.00,0.00 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,8.10 ) ( 2.00,6.40 ) ( 3.00,4.90 ) ( 4.00,3.60 ) ( 5.00,2.50 ) ( 6.00,2.40 ) ( 7.00,2.10 ) ( 8.00,1.60 ) ( 9.00,0.90 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,9.00 ) ( 2.00,8.00 ) ( 3.00,7.00 ) ( 4.00,6.00 ) ( 5.00,5.00 ) ( 6.00,4.00 ) ( 7.00,3.00 ) ( 8.00,2.00 ) ( 9.00,1.00 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,8.10 ) ( 2.00,6.40 ) ( 3.00,4.90 ) ( 4.00,3.60 ) ( 5.00,2.50 ) ( 6.00,2.40 ) ( 7.00,2.10 ) ( 8.00,1.60 ) ( 9.00,0.90 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,0.00 ) ( 1.00,0.00 ) ( 2.00,0.00 ) ( 3.00,0.00 ) ( 4.00,0.00 ) ( 5.00,0.00 ) ( 6.00,0.00 ) ( 7.00,0.00 ) ( 8.00,0.00 ) ( 9.00,0.00 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,8.10 ) ( 2.00,6.40 ) ( 3.00,4.90 ) ( 4.00,3.60 ) ( 5.00,2.50 ) ( 6.00,2.40 ) ( 7.00,2.10 ) ( 8.00,1.60 ) ( 9.00,0.90 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,8.10 ) ( 2.00,6.40 ) ( 3.00,4.90 ) ( 4.00,3.60 ) ( 5.00,2.50 ) ( 6.00,2.40 ) ( 7.00,2.10 ) ( 8.00,1.60 ) ( 9.00,0.90 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,9.00 ) ( 2.00,8.00 ) ( 3.00,7.00 ) ( 4.00,6.00 ) ( 5.00,5.00 ) ( 6.00,4.00 ) ( 7.00,3.00 ) ( 8.00,2.00 ) ( 9.00,1.00 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,8.10 ) ( 2.00,6.40 ) ( 3.00,4.90 ) ( 4.00,3.60 ) ( 5.00,2.50 ) ( 6.00,2.40 ) ( 7.00,2.10 ) ( 8.00,1.60 ) ( 9.00,0.90 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,0.00 ) ( 1.00,0.00 ) ( 2.00,0.00 ) ( 3.00,0.00 ) ( 4.00,0.00 ) ( 5.00,0.00 ) ( 6.00,0.00 ) ( 7.00,0.00 ) ( 8.00,0.00 ) ( 9.00,0.00 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,8.10 ) ( 2.00,6.40 ) ( 3.00,4.90 ) ( 4.00,3.60 ) ( 5.00,2.50 ) ( 6.00,2.40 ) ( 7.00,2.10 ) ( 8.00,1.60 ) ( 9.00,0.90 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,9.00 ) ( 2.00,8.00 ) ( 3.00,7.00 ) ( 4.00,6.00 ) ( 5.00,5.00 ) ( 6.00,4.00 ) ( 7.00,3.00 ) ( 8.00,2.00 ) ( 9.00,1.00 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,8.10 ) ( 2.00,6.40 ) ( 3.00,4.90 ) ( 4.00,3.60 ) ( 5.00,2.50 ) ( 6.00,2.40 ) ( 7.00,2.10 ) ( 8.00,1.60 ) ( 9.00,0.90 ) ( 10.00,0.00 ) ; ( 0.00,10.00 ) ( 1.00,7.29 ) ( 2.00,5.12 ) ( 3.00,3.43 ) ( 4.00,2.16 ) ( 5.00,1.25 ) ( 6.00,1.44 ) ( 7.00,1.47 ) ( 8.00,1.28 ) ( 9.00,0.81 ) ( 10.00,0.00 ) ; ( 0.00,0.00 ) ( 1.00,0.00 ) ( 2.00,0.00 ) ( 3.00,0.00 ) ( 4.00,0.00 ) ( 5.00,0.00 ) ( 6.00,0.00 ) ( 7.00,0.00 ) ( 8.00,0.00 ) ( 9.00,0.00 ) ( 10.00,0.00 ) ;  the price we have to pay for increased security , i.e. indistinguishability of behaviours , is an increased ( average ) execution time .the graph on the left in figure [ agatgraphs ] shows how the running time ( vertical axis ) increases in dependence of the padding probability ( horizontal axis ) for the eight execution trees we have to consider in this example , i.e. for , , , etc .depending on the number of bits set in we get four different curves which show how , for example for the running time increases from time steps ( for , i.e. agat program ) to ( for , i.e. fagat program ) .we can employ the bisimilarity measures and in order to determine the security of the partially padded program .for this we compute using our algorithm and for all possible keys , i.e. .it turns out that for all values of and any pair of keys and with ; only for we get , as one would expect , for all key pairs .the weighted measure is more sensitive and we get for example for the following values when we compare and : the diagonal entries are , of course , all zero as every execution tree is bisimilar to itself .the other entries however are different from and and reflect the similarity between the two keys and thus the resulting execution trees .if we plot the development of as a function of we observe only three patterns as depicted in the right graph in figure [ agatgraphs ] . in all three cases decreases from an original value to , but in different ways .  in analysing the trade - off between increased running time and security we need to define a _cost _ function .for example , one could be faced with a situation where a certain code fragment needs to be executed in a certain maximal time , i.e. there is a ( cost ) penalty if the execution takes longer than a certain number of micro - seconds . in our casewe will consider a very simple cost function with and the average between all possible execution trees and the average running time .the diagram in figure [ tradeoff ] depicts how , and depend on the padding parameter .( 0,3 ) grid[ystep=5mm , xstep=10 mm ] ( 10,10 ) ; ( 0,2.33 ) node ; in 1, ... ,9 ( , 2.33 ) node ; ( 10,2.33 ) node ; ( -0.50,3.00 ) node ; ( 0.00,3.00 ) ( 1.00,3.60 ) ( 2.00,4.20 ) ( 3.00,4.80 ) ( 4.00,5.40 ) ( 5.00,6.00 ) ( 6.00,6.60 ) ( 7.00,7.20 ) ( 8.00,7.80 ) ( 9.00,8.40 ) ( 10.00,9.00 ) ; ( -0.50,8.50 ) node ; ( 0.00,8.83 ) ( 1.00,7.53 ) ( 2.00,6.44 ) ( 3.00,5.54 ) ( 4.00,4.82 ) ( 5.00,4.25 ) ( 6.00,4.21 ) ( 7.00,4.09 ) ( 8.00,3.86 ) ( 9.00,3.50 ) ( 10.00,3.00 ) ; ( -0.50,10.00 ) node ; ( 0.00,10.00 ) ( 1.00,9.04 ) ( 2.00,8.33 ) ( 3.00,7.85 ) ( 4.00,7.58 ) ( 5.00,7.50 ) ( 6.00,8.06 ) ( 7.00,8.51 ) ( 8.00,8.83 ) ( 9.00,9.00 ) ( 10.00,9.00 ) ;  one can argue about the practical relevance of the particular cost function we chose .nevertheless , this example illustrates already nicely the non - linear nature of security cost optimisation : the optimal , i.e. minimal , cost is reached in this case for , i.e. keeping the cost of security counter measures in mind it is better to use a `` half - fixed '' program rather than a completely safe one .the idea of defining a secure system via the requirement that an attacker must be unable to observe different behaviours as a result of different secrets i.e. the system `` operates in the same way '' whatever value a secret key has goes back at least to the seminal work of goguen and meseguer .this led in a number of settings to formalisations of security concepts such as `` non - interference '' via various notions of behavioural equivalencies ( see e.g. ) .one of the perhaps most prominent of these equivalence notions , namely _ bisimilarity _ , plays an important role in the context of security of concurrent systems but also found application for sequential programs such as in agat s work ( as the interaction between system and attacker can be modelled as a parallel composition ) . in order to allow for a decision theoretic analysis of security counter - measures and associated efforts it appears to be desirable to introduce a `` quantitative '' notion of the underlying behavioural equivalence . in the case of _ bisimilarity_ a first step was the introduction of the notion of _ probabilistic bisimulation _ by larson and skou .however , this notion turns out to be still too strict and a number of researchers developed `` approximate '' versions ; among them we just name the approaches by desharnais et.al . and van breugel  and our work  ( an extensive bibliography on this issue can be found in ) .we based this current paper on the latter approach because it allows for an implementation of the semantics of pwhile via linear operators , i.e. matrices , and an efficient computation of and using standard software such as octave .further research will be needed in order to clarify the relation between our measures and existing notions of _ approximate bisimilarity _ mentioned above , e.g. the in .furthermore , we also would like to shed more light on the relationship between our notion and information theoretic concepts used in the work of , for example clark et.al . and boreale .kocher , p. : timing attacks on implementations of diffie - hellman , rsa , dss , and other systems . in : proceedings of crypto 96 .volume 1109 of lecture notes in computer science . , springer verlag ( 1996 ) 104113    kwiatkowska , m. , norman , g. , sproston , j. , wang , f. : symbolic model checking for probabilistic timed automata . in lakhnech , y. , yovine , s. ,proceedings of formats / ftrtft04 .volume 3253 of lecture notes in computer science ., springer verlag ( 2004 ) 293308      , a. , hankin , c. , wiklicky , h. : quantitative relations and approximate process equivalences . in lugiez , d. ,ed . : proceedings of concur03 .volume 2761 of lecture notes in computer science . ,springer verlag ( 2003 ) 508522          focardi , r. , gorrieri , r. : classification of security properties ( part i : information flow ) . in : foundations of security analysis and design - tutorial lectures .volume 2171 of lecture notes in computer science ., springer verlag ( 2001 ) 331396  desharnais , j. , jagadeesan , r. , gupta , v. , panangaden , p. : metrics for labeled markov systems . in : proceedings of concur99 .volume 1664 of lecture notes in computer science ., springer verlag ( 1999 ) 258273   , f. : a behavioural pseudometric for metric labelled transition systems . in abadi , m. , de alfaro , l. , eds . : proceedings of concur05 .volume 3653 of lecture notes in computer science . , springer verlag ( 2005 ) 141155      boreale , m. : quantifying information leakage in process calculi . in bugliesi , m. , preneel , b. , sassone , v. , wegener , i. , eds . : proceedings of icalp06 .volume 4052 of lecture notes in computer science . ,springer verlag ( 2006 ) 119131

Abstract: we develop a new notion of security against timing attacks where the attacker is able to simultaneously observe the execution time of a program and the probability of the values of low variables . we then show how to measure the security of a program with respect to this notion via a computable estimate of the timing leakage and use this estimate for cost optimisation .


after the work by , the possibility that gamma - ray bursts ( grbs ) originate from a beamed emission has been one of the most debated issue about the nature of the grb sources in the current literature ( see e.g. * ? ? ?* ; * ? ? ?* and references therein ) .in particular , on the ground of the theoretical considerations by , it was conjectured that , within the framework of a conical jet model , one may find that the gamma - ray energy released in all grbs is narrowly clustered around ergs .in a recent letter we analyzed the approximate power - law relations between the lorentz gamma factor and the radial coordinate usually adopted in the current grb literature .we pointed out how such relations are found to be mathematically correct but only approximately valid in a very limited range of the physical and astrophysical parameters and in an asymptotic regime which is reached only for a very short time , if any .therefore , such relations were there shown to be not applicable to grbs . instead , the exact analytic solutions of the equations of motion of a relativistic thin and uniform shell expanding in the interstellar medium ( ism ) in the fully radiative and adiabatic regimes were there presented .this program of identifying the exact analytic solutions instead of approximate power - law solution is in this letter carried one step forward . using the above exact solutions, we here introduce the exact analytic expressions of the relations between the detector arrival time of the grb afterglow radiation and the corresponding half - opening angle of the expanding source visible area due to the relativistic beaming ( see e.g. * ? ? ?such visible area must be computed not over the spherical surface of the shell , but over the equitemporal surface ( eqts ) of detector arrival time ,i.e. over the surface locus of points which are source of the radiation reaching the observer at the same arrival time ( see * ? ? ?* ; * ? ? ?* for details ) .the exact analytic expressions for the eqtss in grb afterglows , which have been presented in , are therefore crucial in our present derivation .this approach clearly differs from the ones in the current literature , which usually neglect the contributions of the radiation emitted from the entire eqts .the analytic relations between and presented in this letter allow to compute , assuming that the expanding shell is not spherically symmetric but is confined into a narrow jet with half - opening angle , the value of the detector arrival time at which we start to `` see '' the sides of the jet .a corresponding `` break '' in the observed light curve should occur later than ( see e.g. * ? ? ?* ) . in the current literature, is usually defined as the detector arrival time at which , where is the lorentz factor of the expanding shell ( see e.g. * ? ? ?* and also our eq.([sist ] ) below ) .in our formulation we do not consider effects of lateral spreadings of the jet .  in the current literature , in the case of adiabatic regime ,different approximate power - law relations between and have been presented , in contrast to each other ( see e.g. * ? ? ?* ; * ? ? ?* ; * ? ? ?we show here that in four specific cases of grbs , encompassing more than orders of magnitude in energy and more than orders of magnitude in ism density , both the one by and the one by overestimate the exact analytic result . a third relation just presented by underestimate the exact analytic result .we also present an empirical fit of the numerical solutions of the exact equations for the adiabatic regime , compared and contrasted with the three above approximate relations . in the fully radiative regime , and therefore in the general case , no simple power - law relation of the kind found in the adiabatic regime can be established and the general approach we have outlined has to be followed .although evidence for spherically symmetric emission in grbs is emerging from observations and from theoretical argumentations , it is appropriate to develop here an exact theoretical treatment of the relation between and .this will allow to make an assessment on the existence and , in the positive case , on the extent of beaming in grbs , which in turn is going to be essential for establishing their correct energetics .the boundary of the visible region of a relativistic thin and uniform shell expanding in the ism is defined by ( see e.g. * ? ? ? * and references therein ) : where is the angle between the line of sight and the radial expansion velocity of a point on the shell surface , is the velocity of the expanding shell and is the speed of light . to find the value of the half - opening beaming angle corresponding to an observed arrival time , this equation must be solved together with the equation describing the eqts of arrival time  . in other words, we must solve the following system : \right|_{eqts\left[(t_a^d)_{jet}\right]}\right\ } \end{array } \right.\ , .\label{sist}\ ] ] it should be noted that , in the limit and , this definition of is equivalent to the one usually adopted in the current literature ( see sec . [ intro ] ) .   in this case , the analytic solution of the equations of motion gives ( see * ? ? ?* ; * ? ? ?* ) : }}{1+\left(m_{ism}/m_b\right)\left(1+\gamma_\circ^{-1}\right)\left[1+\textstyle\frac{1}{2}\left(m_{ism}/m_b\right)\right]}\ , , \label{vrad}\ ] ] where and are respectively the values of the lorentz gamma factor and of the mass of the accelerated baryons at the beginning of the afterglow phase and is the value of the ism matter swept up to radius : , where is the starting radius of the baryonic matter shell , is the proton mass and is the ism number density . using the analytic expression for the eqts given in , eq.([sist ] ) takes the form : }}{1+\left(m_{ism}/m_b\right)\left(1+\gamma_\circ^{-1}\right)\left[1+\textstyle\frac{1}{2}\left(m_{ism}/m_b\right)\right]}\\[18pt ] \cos\vartheta_\circ & = & \frac{m_b  - m_i^\circ}{2r\sqrt{c}}\left ( { r - r_\circ } \right ) + \frac{m_i^\circ r_\circ } { 8r\sqrt{c}}\left [ { \left ( { \frac{r}{{r_\circ } } } \right)^4  - 1 } \right ] \\[6pt ] & + & \frac{{r_\circ \sqrt{c } } } { { 12rm_i^\circ a^2 } } \ln \left\ { { \frac{{\left [ { a + \left(r / r_\circ\right ) } \right]^3 \left(a^3  + 1\right)}}{{\left[a^3  + \left ( r / r_\circ \right)^3\right ] \left ( { a + 1 } \right)^3 } } } \right\ } \\[6pt ] & + & \frac{ct_\circ}{r } - \frac{c(t_a^d)_{jet}}{r\left(1+z\right ) } + \frac{r^\star}{r } \\[6pt ] & + & \frac{{r_\circ \sqrt{3c } } } { { 6rm_i^\circ a^2 } } \left [ \arctan \frac{{2\left(r / r_\circ\right ) - a}}{{a\sqrt{3 } } } - \arctan \frac{{2 - a}}{{a\sqrt{3 } } } \right ] \end{array } \right . \label{sistrad}\ ] ] where is the value of the time at the beginning of the afterglow phase , , is the initial size of the expanding source , ^{1/3}$ ] , and is the cosmological redshift of the source .   in this case, the analytic solution of the equations of motion gives ( see * ? ? ?* ; * ? ? ?* ) : using the analytic expression for the eqts given in , eq.([sist ] ) takes the form : \cos\vartheta_\circ & = & \frac{m_i^\circ}{4m_b\sqrt{\gamma_\circ^2 - 1}}\left[\left(\frac{r}{r_\circ}\right)^3  - \frac{r_\circ}{r}\right ] + \frac{ct_\circ}{r } \\[6pt ] & - & \frac{c(t_a^d)_{jet}}{r\left(1+z\right ) } + \frac{r^\star}{r } - \frac{\gamma_\circ-\left(m_i^\circ / m_b\right)}{\sqrt{\gamma_\circ^2 - 1}}\left[\frac{r_\circ}{r } - 1\right ] \end{array } \right . \label{sistad}\ ] ] where all the quantities have the same definition as in eq.([sistrad ] ) .   )assuming fully radiative regime ( blue line ) and the corresponding one of eq.([sistad ] ) assuming adiabatic regime ( red line ) .the departure from power - law behavior at small arrival time follows from the constant lorentz factor regime , while the one at large angles follows from the approach to the non - relativistic regime ( see details in section [ fit ] and fig .[ beam_comp_num_fit_log ] , as well as in * ? ? ?]  in fig .[ beam_comp_rad_ad ] we plot the numerical solutions of both eq.([sistrad ] ) , corresponding to the fully radiative regime , and eq.([sistad ] ) , corresponding to the adiabatic one .both curves have been plotted assuming the same initial conditions , namely the ones of grb 991216 ( see * ? ? ?+    three different approximate formulas for the relation between and have been given in the current literature , all assuming the adiabatic regime . proposed : ^{3/4 } \ , , \label{thetapm99}\ ] ] , instead , advanced : ^{3/8 } \ , .\label{thetasph99}\ ] ] in both eq.([thetapm99 ] ) and eq.([thetasph99 ] ) , is measured in seconds , is the source initial energy measured in ergs and is the ism number density in particles/ .the formula by has been applied quite often in the current literature ( see e.g. * ? ? ?* ; * ? ? ?* ; * ? ? ?* ) .  both eq.([thetapm99 ] ) and eq.([thetasph99 ] )compute the arrival time of the photons at the detector assuming that all the radiation is emitted at ( i.e. on the line of sight ) , neglecting the full shape of the eqtss .recently , a new expression has been proposed by , again neglecting the full shape of the eqtss but assuming that all the radiation is emitted from , i.e. from the boundary of the visible region .such an expression is : ^{3/8 } \ , .\label{thetap06}\ ] ]  in fig .[ beam_comp ] we plot eq.([thetapm99 ] ) , eq.([thetasph99 ] ) and eq.([thetap06 ] ) together with the numerical solution of eq.([sistad ] ) relative to the adiabatic regime .all four curves have been plotted assuming the same initial conditions for four different grbs , encompassing more than orders of magnitude in energy and more than orders of magnitude in ism density : a ) grb 991216 ( see * ? ? ?* ) , b ) grb 980519 ( see * ? ? ?* ) , c ) grb 031203 ( see * ? ? ?* ) , d ) grb 980425 ( see * ? ? ? * ) . the approximate eq.([thetasph99 ] ) by and eq.([thetap06 ] ) by both imply a power - law relation between and with constant index for any value of , while eq.([thetapm99 ] ) by implies a power - law relation with constant index only for ( for greater values the relation is trigonometric ) .all the above three approximate treatments are based on the approximate power - law solutions of the grb afterglow dynamics which have been shown in to be not applicable to grbs .they also do not take fully into account the structure of the eqtss , although in different ways . both eq.([thetapm99 ] ) and eq.([thetasph99 ] ) , which assume all the radiation coming from , overestimate the behavior of the exact solution . on the other hand , eq.([thetap06 ] ) , which assumes all the radiation coming from , is a better approximation than the previous two , but still slightly underestimates the exact solution .) ( thick green lines ) and the approximate fitting function given in eq.([thetafit ] ) ( thin red lines ) is shown in the four cases ( a d ) represented in fig .[ beam_comp ] . ]  for completeness , we now fit our exact solution with a suitable explicit functional form in the four cases considered in fig .[ beam_comp ] .we chose the same functional form of eq.([thetap06 ] ) , which is the closer one to the numerical solution , using the numerical factor in front of it ( i.e. ) as the fitting parameter .we find that the following approximate expression : ^{3/8 } \label{thetafit}\ ] ] is in agreement with the numerical solution in all the four cases presented in fig .[ beam_comp ] ( see fig .[ beam_comp_num_fit ] ) . however , if we enlarge the axis ranges to their full extension ( i.e. the one of fig .[ beam_comp_rad_ad ] ) , we see that such approximate empirical fitting formula can only be applied for _ and _ s ( see the gray dashed rectangle in fig . [ beam_comp_num_fit_log ] ) .  )( think green lines ) and the approximate fitting function given in eq.([thetafit ] ) ( thin red lines ) in all the four cases ( a d ) represented in fig . [ beam_comp ] .the ranges of the two axes have been chosen to have their full extension ( i.e. the one of fig .[ beam_comp_rad_ad ] ) .the dashed gray lines are the boundaries of the region where the empirical fitting function can be applied . ]an equivalent empirical fit in the fully radiative regime is not possible . in this case , indeed , there is a domain in the plane where the numerical solution shows a power - law dependence on time , with an index ( see fig .[ beam_comp_rad_ad ] ) .however , the dependence on the energy can not be factorized out with a simple power - law . therefore , in the fully radiative regime , which is the relevant one for our grb model ( see e.g. * ? ? ?* ) , the application of the full eq.([sistrad ] ) does not appear to be avoidable .we have presented in eqs.([sistrad],[sistad ] ) the exact analytic relations between the jet half - opening angle and the detector arrival time at which we start to `` see '' the sides of the jet , which may be used in grb sources in which an achromatic light curve break is observed .the limiting cases of fully radiative and adiabatic regimes have been outlined .such relations differs from the approximate ones presented in the current literature in the adiabatic regime : both the ones by and by overestimate the exact analytic result , while the one just presented by slightly underestimate it .  for a limited domain in the plane defined in fig .[ beam_comp_num_fit_log ] , and only in the adiabatic regime , an empirical fit of the numerical solution of the exact eq.([sistad ] ) has been given in eq.([thetafit ] ) .however , in the fully radiative regime such a simple empirical power - law fit does not exist and the application of the exact eq.([sistrad ] ) is needed . this same situation is expected also to occur in the general case .  in light of the above results ,the assertion that the gamma - ray energy released in all grbs is narrowly clustered around ergs should be reconsidered .in addition , the high quality data by swift , going without gaps from the `` prompt emission '' all the way to latest afterglow phases , will help in uniquely identifying the equations of motion of the grb sources and the emission regimes .consequently , on the ground of the results presented in this letter , which encompass the different dynamical and emission regimes in grb afterglow , an assessment on the existence and , in the positive case , on the extent of beaming in grbs will be possible . this is a step in the determination of their energetics .ruffini , r. , bianco , c.l . ,chardonnet , p. , fraschetti , f. , vitagliano , l. , & xue , s .- s .2003a , in `` cosmology and gravitation '' , ed .m. novello , & s.e .perez - bergliaffa , aip conference proceedings , vol .

Abstract: we present the exact analytic expressions to compute , assuming the emitted gamma - ray burst ( grb ) radiation is not spherically symmetric but is confined into a narrow jet , the value of the detector arrival time at which we start to `` see '' the sides of the jet , both in the fully radiative and adiabatic regimes . we obtain this result using our exact analytic expressions for the equitemporal surfaces ( eqtss ) in grb afterglows . we re - examine the validity of three different approximate formulas currently adopted for the adiabatic regime in the grb literature . we also present an empirical fit of the numerical solutions of the exact equations , compared and contrasted with the three above approximate formulas . the extent of the differences is such as to require a reassessment on the existence and entity of beaming in the cases considered in the current literature , as well as on its consequences on the grb energetics .