Rate-distortion theory for the Shannon cipher system