¹The astute reader will notice that E_k(D_k(c)) might differ from c for c not in the range of E_k. However, in most of the cryptosystems we consider, the message space and ciphertext space are the same. When that is the case, the range of E_k is all of , so every c can be written as c = E_k(y) for some message y, and E_k(D_k(c)) = E_k(D_k(E_k(y))) = E_k(y) = c.