# Why is D_K only required to be infeasible to derive from E_K for almost every key K?

In DH76 'New Directions in Cryptography', it states that

3) for almost every $$K \in \{K\}$$, each easily computed algorithm equivalent to $$D_K$$ is computationally infeasible to derive from $$E_K$$

($$E_K$$ and $$D_K$$ means an encryption and decryption algorithm with key $$K$$, respectively.)

Then, why 'almost every', and not just 'every'?

• When an algorithm has possible keys where that isn't true, that's called a weak class of keys. If the key generation algorithm can avoid them, it won't typically be a problem when using it. – Natanael May 8 at 13:18