Table Of Content1
Secret-Key Generation Using Compound Sources
and One-Way Public Communication
Nima Tavangaran, Student Member, IEEE, Holger Boche, Fellow, IEEE, and Rafael F. Schaefer, Member, IEEE
Abstract—In the classical Secret-Key generation model, Com- is further studied in [5]–[9]. In practice, this kind of security
mon Randomness is generated by two terminals based on the canbeintegratedinthephysicallayerofwirelesssystems[10].
observationofcorrelatedcomponentsofacommonsource,while
However, in all these models which were used for SK
keeping it secret from a non-legitimate observer. It is assumed
generation, perfect knowledge of the source statistics was
that the statistics of the source are known to all participants.
6 In this work, the Secret-Key generation based on a compound assumed. In a more general approach, the source uncertainty
1
source is studied where the realization of the source statistic should be taken into account where the terminals do not
0
is unknown. The protocol should guarantee the security and have the knowledge of the actual realization of the source.
2
reliability of the generated Secret-Key, simultaneously for all
An achievable SK rate for a compound Discrete Memoryless
n possible realizations of the compound source. A single-letter
Multiple Source (DMMS) {(X,Y ,Z )} was given in [11].
a lower-bound of the Secret-Key capacity for a finite compound s s s∈S
J sourceisderivedasafunctionofthepubliccommunicationrate In [12], the compound DMMS {(Xs,Ys)}s∈S was studied and
7 constraint. A multi-letter capacity formula is further computed theSKcapacitywascomputed.Asrelatedproblems,compound
2 for a finite compound source for the case in which the public sourcecoding,SKgenerationwithArbitrarilyVaryingChannel
communication is unconstrained. Finally a single-letter capacity
(AVC), compound wiretap channels and robust biometric
formula is derived for a degraded compound source with an
] authentication were studied in [13]–[18].
T arbitrary set of source states and a finite set of marginal states.
In this work, a SK generation model for a compound
I
. Index Terms—Compound source, Secret-Key capacity, Com- DMMS with one-way communication in presence of an
s mon Randomness, hypothesis testing.
c eavesdropper is studied. The terminals observe a compound
[ source S := {XYZ,s} := {(X ,Y ,Z )} , and two
s∈S s s s s∈S
1 I. INTRODUCTION of them generate a shared SK by using only a one-way
v communication over a public noiseless channel while keeping
3 Current cryptographic approaches are dependent on the it secret from the third terminal (eavesdropper). As the source
1 computational capabilities of the non-legitimate terminals. By
realization index s ∈ S is unknown to the terminals, an
5 increasing technological advances, the security of transmitted
estimationmethodsuchashypothesistestingisincorporatedto
7
information can not be guaranteed for sure. In contrast, an
0 findthemarginalsourceindexofthetransmitter.Thisapproach
information theoretic approach provides us with a framework
. isusedtogeneralizetheresultin[5,Theorem2.6],[7,Theorem
1 for future coding schemes that guarantee security independent
17.21] to the compound setup for the source S.
0
of computational capabilities of the eavesdroppers.
6 In Section II, the model for SK generation is presented.
1 Information theoretic security was first introduced by Shan- Section III gives the main results. A single-letter lower-bound
v: non in [1]. In the so called one-time pad method, each for the SK capacity of a finite compound source is derived
transmittingmessageisencryptedbyaSecret-Key(SK).Ifthere
i as a function of the communication rate constraint over the
X is no SK available, it has to be generated first. One approach
publicchannel.Amulti-letterSKcapacityformulaiscomputed
r is to generate a shared SK based on a common source. In as well for the case where the public communication rate is
a
this model, two terminals observe correlated components of
unconstrained. We proposed these two results which are stated
a common source and communicate over a public noiseless
inTheorems1and2,originallyin[19]inwhichtheproofideas
channeltogenerateacommonSK.Afterwards,theycanencrypt
have been outlined. In the present paper, in contrast, we give
subsequentcommunicationusingthisSK.Thisprocedurerelies
the complete proofs of both theorems as well as the proofs for
on the generation of Common Randomness (CR) which was
random coding and security lemmas. The third and main result
introducedin[2]andlaterusedbyMaurerin[3]andAhlswede
of this work which is not available in [19] gives a single-letter
andCsisza´rin[4]todeterminetheSKcapacity.TheSKsharing
SK capacity formula for a degraded compound source, where
the set of source states may be infinite and the set of marginal
ThisworkwaspresentedinpartatIEEE-ITW,JejuIsland,Korea,2015.
states is finite. Compared with previous theorems, this result
N. Tavangaran and H. Boche are with Lehrstuhl fu¨r Theoretische
Informationstechnik, Technische Universita¨t Mu¨nchen, 80290 Mu¨nchen, which is stated in Theorem 3 is more practical in the sense
Germany,e-mail:[email protected],[email protected] that the SK capacity is single-letter and also valid for sources
R.F.SchaeferwaswiththeDepartmentofElectricalEngineering,Princeton
with an infinite set of source states S. The complete formal
University,NJ08544,USA.HeisnowwithTechnischeUniversita¨tBerlin,
10587Berlin,Germany,email:[email protected] proofs are given in Section IV. Section V concludes the paper.
ThisworkofN.TavangaranandH.BochewassupportedbytheGerman Notation: R and N denote the set of real numbers and
ResearchFoundation(DFG)undergrantBO1734/20-1.
natural numbers respectively. The complement of a set A
This work of R. F. Schaefer was supported by the German Research
Foundation(DFG)undergrantWY151/2-1. is denoted by Ac and the subtraction of two sets A and B
2
As RVs Xn and Yn are correlated, Alice and Bob may
s s
generate some CR by communicating over the public channel.
Compound DMMS
In this work, only a one-way communication over the public
S={XYZ,s} channel,initiatedbyAlice,isallowed.Thefollowingdefinition
s∈S
gives a more precise description of this procedure.
K K
A B
Xn Zn Yn Definition 2. A one-way SK generation protocol for the model
s s s
CR CR in Definition 1 with source S={XYZ,s} consists of the
s∈S
Eve following two steps:
Alice Bob
• AfterobservingXsn,Alicetransmitsamessagefc(Xsn)to
f (Xn) f (Xn) f (Xn) Bob over the public noiseless channel. fc is called public
c s c s c s communication function.1
Public Noiseless Channel • Next, Alice generates a SK, represented by a RV KA,
based on her knowledge Xn and Bob generates a
s
Fig. 1: SK generation protocol for compound DMMS model SK, represented by a RV K , based on his knowledge
B
(Yn,f (Xn)). K and K take their values in K.
s c s A B
As the communication over the public channel is overheard
is given by A−B := A∩Bc. The underlying probability
by Eve, this should not reveal any information about the SK.
measure is represented by Pr. The log(·) and exp(·) are to
Moreover,thegeneratedSKshouldhaveauniformdistribution.
the basis 2 and ln(·) is the natural logarithm to the basis
Combiningthesetwocriteriatogetherleadstoacompactnotion,
e. For any function f, the cardinal number of the range of
called security index, which was first introduced in [6].
the function is denoted by (cid:107)f(cid:107). Random Variables (RVs) are
denoted by capital letters (e.g. Xn,U,···), their realizations Definition 3. For RVs K and V, taking values in the sets K
A
by small letters (e.g. xn,u,···), their ranges (alphabets) by and V respectively, the security index is given by
script letters (e.g. Xn,U,···), and their Probability Distri-
S(K |V):=log(|K|)−H(K )+I(K ;V).
butions (PDs) by Roman letters (e.g. P ,P ,···). All A A A
Xn U
alphabets corresponding to RVs are supposed to be finite. Inourcontext,K representstheSKandV Eve’sknowledge.
A
H(X) and I(X;Y) represent the entropy of a RV X and This short notion is a powerful tool which can be used to
the mutual information between X and Y respectively. h(a) describe both strong secrecy [20] and the uniformity of the
with a ∈ [0,1] is the binary entropy function and is given generated SK. The next definition, uses this concept to define
by h(a):=−aloga−(1−a)log(1−a). For any two proba- an achievable SK rate and capacity of a compound source.
(cid:80)
bility measures P and Q, (cid:107)P−Q(cid:107) := |P(x)−Q(x)|
denotes their 1-norm distance. 1 (·) denxo∈tXes the indicator Definition 4. A real number Rsk ≥ 0 is an achievable SK
A
function for a set A. E [X] represents the expectation of rate for the model in Definition 1 with compound source
U
S={XYZ,s} and a one-way communication over the
a RV X with respect to the RV U. A stochastic matrix s∈S
public noiseless channel with rate constraint Γ∈(0,+∞], if
W : X → P(Y) is a function from the set X to P(Y),
and only if, for all δ >0, and all n∈N large enough, there
where P(Y) is the set of all PDs defined on the set Y. Finally,
exists a SK generation protocol with public communication
X−Y −Z denotes a Markov chain for RVs X, Y, and Z.
function f , giving rise to the RVs K and K with values in
c A B
K, for which it holds:
II. SKGENERATIONMODEL
1
Figure 1 shows the SK generation model which is nlog(cid:107)fc(cid:107)<Γ+δ, (1)
used throughout this work. Transmitter (Alice), receiver 1
R < log|K|+δ, (2)
(Bob) and eavesdropper (Eve) observe a compound DMMS sk n
S={XYZ,s}s∈S for time duration n ∈ N. It is assumed ∀s∈S, Pr(KA (cid:54)=KB)<δ, (3)
that all terminals know the set of source states S as well as its
∀s∈S, S(K |Zn,f (Xn))<δ. (4)
statistics with PDs {P } . However, they do not have A s c s
XYZ,s s∈S
the knowledge of the actual realization s ∈ S of the source The SK capacity C (S,Γ) for this model is defined to
sk
statistic. Therefore, RVs Xn,Yn and Zn represent their initial be the supremum of all achievable SK rates. If there is no
s s s
knowledge for the source state s ∈ S. The next definition communication rate constraint, i.e. Γ=∞, then condition (1)
describes the model which is studied through out this work. in the definition is inactive and the capacity is simply denoted
by C (S).
Definition1. TheSKgenerationmodelconsistsofatransmitter sk
(Alice), a receiver (Bob), an eavesdropper (Eve), a compound Similarly as in [5], [7], the communication rate constraint is
DMMS by which their initial knowledge is given, and a public also part of the achievability definition. This is because, in a
noiseless communication channel between all terminals. The
source is given for an arbitrary set of states S, by a sequence 1Similarlyasin[7,Problem17.15(a)],itcanbeshownthatarandomized
of generic RVs S={XYZ,s} taking their values in the fc intheone-waySKgenerationprotocoldoesnotincreasetheSKcapacity.
s∈S Therefore,thecommunicationfunctionfc isassumedtobeadeterministic
finite set X ×Y ×Z. functionofXn andnorandomizationisconsideredhere.
s
3
realistic model where the communication cost is an important Finally, as seen in Figure 1, Alice and Bob generate their
parameter,theinformationexchangeratebetweentheterminals SKs K and K based on the CR by using a SK generator.
A B
is restricted. However, f (Xn) is also received by Eve. Lemma 8, again
c s
In the following, a subset of the compound set S is defined. from Subsection IV-A, assures the existence of a SK generator
This definition is required for stating the results in Section III. which guarantees the strong secrecy and the uniformity of the
SK K , for all possible s∈I(sˆ).
Definition5. LetforthecompoundsourceS={XYZ,s} , A
s∈S As a second result, a multi-letter SK capacity formula
Sˆ be the set of all possible states of marginal RV X. For a
is computed for the case, in which no communication rate
given marginal state sˆ∈Sˆ, corresponding to the RV X , the
sˆ constraint is given and the set of source states is again finite.
set of all possible source states is given by
(cid:110) Theorem 2. For a finite compound DMMS model with a
I(sˆ):= s∈S :∀x∈X,
sourceS={XYZ,s} andaone-waycommunicationover
s∈S
(cid:88)(cid:88) (cid:111) a public noiseless channel, it holds:
P (x,y,z)=P (x) . (5)
XYZ,s Xsˆ 1
y∈Yz∈Z C (S)= lim minmax
sk n→∞n sˆ∈SˆUsˆ,Vsˆ
III. SKCAPACITYRESULTS (cid:110) min I(V ;Yn|U )− max I(V ;Zn|U )(cid:111), (8)
sˆ s sˆ sˆ s sˆ
In this section, SK capacity results of compound DMMS s∈I(sˆ) s∈I(sˆ)
models are presented. Moreover, short proof sketches are where the outer max is taken over all RVs U and V such
sˆ sˆ
provided for the first and third theorems. The complete formal that it holds:
proofsaregiveninSectionIV.Foralltheoremswhicharestated ∀s∈I(sˆ), U −V −Xn−YnZn. (9)
in this section, the sets Sˆ and I(sˆ) are given by Definition 5. sˆ sˆ sˆ s s
Inthefollowing,Theorem1givesasingle-letterlower-bound Finallyasthemainresult,asingle-letterSKcapacityformula
for the capacity of a compound DMMS source model with a is given in the following for a degraded compound source with
finite set of source states where the public communication rate an arbitrary set of source states S which might be infinite.
is limited. Theorem3. ConsideracompoundDMMSmodelwithasource
Theorem 1. For a finite compound DMMS model with a S={XYZ,s}s∈S with an arbitrary set S, a finite set of
sourceS={XYZ,s} andaone-waycommunicationover marginalstatesSˆ,andaone-waycommunicationoverapublic
s∈S
a public noiseless channel with constraint Γ∈(0,∞], it holds: noiseless channel. If the following Markov chains are satisfied,
∀sˆ∈Sˆ, ∀r,t∈I(sˆ), X −Y −Z , (10)
C (S,Γ)≥minmax sˆ r t
sk
sˆ∈SˆUsˆ,Vsˆ then it holds:
(cid:110) (cid:111)
min I(V ;Y |U )− max I(V ;Z |U ) , (6) (cid:110) (cid:111)
sˆ s sˆ sˆ s sˆ C (S)=min inf I(X ;Y )− sup I(X ;Z ) . (11)
s∈I(sˆ) s∈I(sˆ) sk sˆ r sˆ t
sˆ∈Sˆ r∈I(sˆ) t∈I(sˆ)
where the outer max is taken over all RVs U and V such
sˆ sˆ Proof sketch: In the first step, the achievability result from
that it holds:
Theorem1isusedtoshowthattheSKratein(11)isachievable
∀s∈I(sˆ), U −V −X −Y Z and for a finite set of source states S.
sˆ sˆ sˆ s s
Next, for the infinite source S = {XYZ,s} , fix the
s∈S
max I(U ;X |Y )+ max I(V ;X |U Y )<Γ. (7)
sˆ sˆ s sˆ sˆ sˆ s marginalPDP anddefinetheinfinitefamilyofstochasticma-
s∈I(sˆ) s∈I(sˆ) Xsˆ
trices{P :X →P(Y×Z)} .ByusingLemma5
Proof sketch: To achieve the SK rate in (6), Alice estimates YZ,s|Xsˆ s∈I(sˆ)
fromSubsectionIV-A,itfollowsthatthereexistsafinitefamily
her marginal state sˆ ∈ Sˆ by hypothesis testing such that
of stochastic matrices {W :X →P(Y×Z)} , which
the estimation error is exponentially small [21]. Similarly as s(cid:48) s(cid:48)∈I(cid:48)(sˆ)
approximates the infinite family. The finite set I(cid:48)(sˆ) contains
in [12], she sends this along with other information related to
all indices of this finite family for the given sˆ.
her observation over the public channel to Bob. In Figure 1,
Define the finite source S(cid:48) := {XYZ,s(cid:48)} by
thisisdenotedbyf (Xn).Givenanestimatedmarginalsource s(cid:48)∈I(cid:48)(sˆ),sˆ∈Sˆ
c s P (x,y,z) := P (x)W (y,z|x) for all s(cid:48) ∈ I(cid:48)(sˆ),
state of Alice sˆ∈Sˆ, the joint source state s is not necessarily sˆX∈YSZˆ,,s(cid:48)and (x,y,z) ∈XXsˆ×Y ×s(cid:48)Z. It is shown that the SK
known to the terminals. However, by Definition 5, it is known
generation protocol, which is used for the finite source S(cid:48),
that s∈I(sˆ).
also guarantees the achievability of the given rate in (11) for
ForthecorrectlyestimatedAlice’sstate,saysˆ∈Sˆ,Lemma7
the infinite source S.
fromSubsectionIV-A,assuresthatAliceandBobcangenerate
The orders of Markov chains in Theorem 3 are crucial in
someCRbyusingtheirknowledgewithanexponentiallysmall
determining the SK capacity. For example, assume that the
error. This CR is universal for all source states s∈I(sˆ).
orders of (10) are changed as given in the following,
Furthermore, the public communication rate should be lower
than a given Γ>0. Therefore, the coding scheme, introduced ∀sˆ∈Sˆ, ∀r,t∈I(sˆ), Xsˆ−Zt−Yr.
in Lemma 7, should work with respect to this limitation
In this case the capacity is C (S)=0. This is because, by [4,
sk
which is given by (7). This problem for the case where no
Theorem 1], it holds that
communication constraint is given is easier to solve and a
∀sˆ∈Sˆ, ∀r,t∈I(sˆ), C (S)≤I(X ;Y |Z )=0.
non-compound version is available in [7, Problem 17.15b]. sk sˆ r t
4
IV. PROOFS Lemma 2 ([7]). Let RVs U and X take their values in U and
X respectively. Consider N = exp(nR) sequences un with
This section is divided into 3 parts. Subsection IV-A gives l
l ∈ L := {1,2···N}, which are independently drawn by a
a short review of definitions and results which are required in
PD Pn with I(U;X)<R. Then for all τ ∈(0,R−I(U;X)),
the proofs. In Subsection IV-B, Lemmas 7 and 8 for random U
all ζ > 0 sufficiently small, all n ∈ N sufficiently large, and
coding and security are presented. Finally, Subsection IV-C
all xn such that Tn (xn)(cid:54)=∅, it holds that
presents the formal proofs of Theorems 1, 2, and 3. [UX]ζ
A. Preliminaries (cid:12)(cid:12)(cid:12)(cid:12)n1 log(cid:12)(cid:12)(cid:12)(cid:8)l∈L:unl ∈T[UnX]ζ(xn)(cid:9)(cid:12)(cid:12)(cid:12)−(cid:0)R−I(U;X)(cid:1)(cid:12)(cid:12)(cid:12)(cid:12)<τ,
For the typical sequences and their related sets the same
with a probability approaching one, doubly exponentially fast.
definitions as in [7, Chapters 2 and 17] are taken. Let N(x|xn)
give the number of repetitions of an element x in the sequence Lemma3([7]). LetRVsU,V,andX taketheirvaluesinU,V,
xn and N(x,y|xn,yn) the number of repetitions of the pair andX respectively.ConsiderN =exp(nR)sequencesvn with
l
(x,y)inthepairsequence(xn,yn).FortwoRVsX andY and l∈L:={1,2···N},whichareindependentlydrawnbyaPD
stochastic matrix P :X →P(Y), the following definitions Pn (.|un) for a given un with I(V;X|U)<R. Then for all
Y|X V|U
are used when (cid:15)>0: τ ∈(0,R−I(V;X|U)),allσ >0sufficientlysmall,alln∈N
(cid:110) sufficiently large, and all xn such that Tn (un,xn)(cid:54)=∅,
Tn := (xn,yn)∈Xn×Yn :∀(x,y)∈X ×Y, [UVX]σ
[XY](cid:15) it holds that
(cid:12)(cid:12)∧PX(cid:0)PY(x,(yx),−y)n1=N0(⇒x,yN|x(nx,,yyn|x)(cid:12)(cid:12)n≤,yn(cid:15))=0(cid:1)(cid:111), (cid:12)(cid:12)(cid:12)(cid:12)n1log(cid:12)(cid:12)(cid:12)(cid:8)l∈L:vln∈T[UnVX]σ(un,xn)(cid:9)(cid:12)(cid:12)(cid:12)−(cid:0)R−I(V;X|U)(cid:1)(cid:12)(cid:12)(cid:12)(cid:12)<τ,
XY with a probability approaching one, doubly exponentially fast.
Tn (xn):=(cid:110)yn ∈Yn :∀(x,y)∈X ×Y, This holds uniformly for all given un ∈Un.
[Y|X](cid:15)
(cid:12)(cid:12)n1N(x|xn)PY|X(y|x)− n1N(x,y|xn,yn)(cid:12)(cid:12)≤(cid:15) Lanedmmka∈4N(b[7e],gi[v2e2n])a.nLdeUt (cid:15)b,ηe a>R0Vatankdinλg v>alu0eailnl Uin. RIf
∧(cid:0)P (y|x)=0⇒N(x,y|xn,yn)=0(cid:1)(cid:111), PU({u ∈ U : PU(u) ≤ λ1}) ≥ 1−η, then for a randomly
Y|X selected function κ:U →{1,2,··· ,k} it holds,
(cid:110) (cid:111)
T[XnY](cid:15)(xn):= yn ∈Xn :(xn,yn)∈T[XnY](cid:15) . Pr(cid:16)(cid:13)(cid:13)κ(PU)−P0(cid:13)(cid:13)>(cid:15)+2η(cid:17)≤2ke−λ2(cid:15)k2((11+−(cid:15)η)),
In the following, a series of lemmas and propositions is
where P (i) = 1/k for all i = 1,2,···k. Random selection
provided which will be used in the proofs. 0
means that the κ(u),u ∈ U are chosen independently and
Lemma1([7]). LetU,X,andY beRVstakingvalueinU,X, identically distributed (iid) uniformly.
and Y respectively. Assume 0<ξ <ζ <σ, and τ >0 are all
in R and n∈N. Then, it holds that Lemma 5 ([23]). Let S be an arbitrary set and possibly
infinite and {W :X →P(U)} be a family of stochastic
1) ∀xn ∈Tn , Tn (xn)⊃Tn (xn). s s∈S
[X]ξ [XY]ζ [Y|X]ζ−ξ matrices. For every l∈N with l≥2|U|2, there exists a family
2) Pn(Tn )≥1−2|X|e−2ξ2n. of stochastic matrices {Ws(cid:48) :X →P(U)}s(cid:48)∈S(cid:48) with a finite
X [X]ξ set S(cid:48), such that |S(cid:48)| ≤ (l +1)|X×U|, where the following
3) ∀τ > 0, ∀ξ > 0 sufficiently small, and ∀xn ∈ Tn , it properties hold: ∀s∈S, ∃s(cid:48) ∈S(cid:48),∀x∈X,∀u∈U,
[X]ξ
holds (cid:12)(cid:12)− 1 logPn(xn)−H(X)(cid:12)(cid:12)<τ. 1
n X |W (u|x)−W (u|x)|≤ |U|, W (u|x)≤e2|U|2/lW (u|x).
4) ∀τ > 0, ∀ξ > 0 sufficiently small, and ∀n ∈ N s s(cid:48) l s s(cid:48)
sufficiently large, it holds (cid:12)(cid:12)1 log|Tn |−H(X)(cid:12)(cid:12)<τ. Lemma6([24]). Let(X,Y)and(X(cid:48),Y(cid:48))betwopairsofRVs
n [X]ξ
takingvaluesinX×Y withPDsP andP respectively.
XY X(cid:48)Y(cid:48)
5) ∀τ > 0, ∀ζ > 0 sufficiently small, ∀n ∈ N suffi- Furthermore, let γ := 1(cid:107)P −P (cid:107) and γ ≤1− 1 .
2 XY X(cid:48)Y(cid:48) |X×Y|
ciently large, and ∀un with Tn (un) (cid:54)= ∅ it holds Then, it holds that
[UX]ζ
(cid:12)(cid:12)n1 log|T[UnX]ζ(un)|−H(X|U)(cid:12)(cid:12)<τ. |I(X;Y)−I(X(cid:48);Y(cid:48))|≤3γlog(|X ×Y|−1)+3h(γ).
6) For U −X−Y and ∀(un,xn)∈Tn it holds
[UX]ξ
Pn (cid:0)Tn (un,xn)|xn(cid:1)≥1−2|U||X||Y|e−2(σ−ξ)2n. B. Random Coding and Security Lemmas
Y|X [UXY]σ
In this subsection, Lemmas 7 and 8 for finite compound sets
7) ∀τ > 0, ∀ζ > 0 sufficiently small, ∀n ∈ N sufficiently with their proofs are presented. Similar techniques which are
large, and ∀yn ∈ Yn if Tn (yn) (cid:54)= ∅ then it holds
[XY]ζ used in the non-compound versions in [7, Lemmas 17.5 and
(cid:12) (cid:12)
(cid:12)− 1 logPn(cid:0)Tn (yn)(cid:1)−I(X;Y)(cid:12)<τ. 17.22], [5], [25], are used in the following proofs and extended
(cid:12) n X [XY]ζ (cid:12)
tothecompoundsetup.Forcompleteness,wepresentallproofs
8) ∀τ > 0, ∀ζ > 0 sufficiently small, ∀n ∈ N sufficiently indetail.TheselemmasarerequiredfortheproofofTheorem1.
large,and∀(un,yn)∈Un×Yn ifTn (un,yn)(cid:54)=∅ Assume in Lemma 7, if the values in the equations (12), (13),
[UXY]ζ
then it holds (14),and(15)arenotintegernumbers,thenthesmallestinteger
(cid:12)(cid:12)−1 logPn (cid:0)Tn (un,yn)|un(cid:1)−I(X;Y|U)(cid:12)(cid:12)<τ. which is larger than the given expression is taken.
n X|U [UXY]ζ
5
Lemma 7. Let δ > 0 and σ > ζ > 0 be all in R and Proof: a) Let R be the rate of choosing the sequences
sufficientlysmall. Furthermore,let Alice’sstate sˆ∈Sˆbegiven {un(sˆ)} which implies that N N =exp(nR).
ij (i,j)∈I×J sˆ,1 sˆ,2
and for all s∈I(sˆ), RVs X and Y take their values in X Therefore, by (12) and (13) and properties of the Markov
sˆ s
and Y respectively. Let also RVs U and V be given such that chain, it follows that
sˆ sˆ
for all s∈I(sˆ) the Markov chains U −V −X −Y hold.
sˆ sˆ sˆ s R= max I(U ;X |Y )+ min I(U ;Y )+δ
Assume N N random sequences un(sˆ) ∈ Un, chosen sˆ sˆ s sˆ s
sˆ,1 sˆ,2 ij s∈I(sˆ) s∈I(sˆ)
independently according to PD Pn , are given and known to
Usˆ =I(Usˆ;Xsˆ)+ max[I(Usˆ;Ys|Xsˆ)−I(Usˆ;Ys)]
Alice and Bob where s∈I(sˆ)
(cid:8) (cid:9) (cid:8) (cid:9) + min I(U ;Y )+δ =I(U ;X )+δ. (19)
i∈I := 1,2,··· ,N , j ∈J := 1,2,··· ,N , sˆ s sˆ sˆ
sˆ,1 sˆ,2 s∈I(sˆ)
(cid:104) (cid:0) (cid:1)(cid:105)
N :=exp n max I(U ;X |Y )+3δ , (12) Similarlyasin[7,Lemma17.22],forallxn ∈T,itholdsby
sˆ,1 sˆ sˆ s
s∈I(sˆ) the definition in (16) that Tn (xn)(cid:54)=∅. Thus, Lemma 2
(cid:104) (cid:0) (cid:1)(cid:105) [UX,sˆ]ζ
N :=exp n min I(U ;Y )−2δ . (13) together with (19) implies for all τ ∈(0,R−I(U ;X )), all
sˆ,2 sˆ s sˆ sˆ
s∈I(sˆ) ζ >0 sufficiently small, all n∈N sufficiently large, and all
Moreover, let for each unij(sˆ), Nsˆ,3Nsˆ,4 random sequences xn ∈T that
vPpinVjqsˆn|U(sˆsˆ()·|∈uniVj(nsˆ,))c,hobseengicvoenndaitniodnkanlloywinndteopeAnlidceentalnydacBcoobrdwinhgertoe n1 log(cid:12)(cid:12)(cid:12)(cid:110)(i,j)∈I×J :unij(sˆ)∈T[UnX,sˆ]ζ(xn)(cid:111)(cid:12)(cid:12)(cid:12)
(cid:8) (cid:9) (cid:8) (cid:9) ≥R−I(U ;X )−τ,
p∈P := 1,2,··· ,N , q ∈Q:= 1,2,··· ,N , sˆ sˆ
sˆ,3 sˆ,4
N :=exp(cid:104)n(cid:0) max I(V ;X |U Y )+3δ(cid:1)(cid:105), (14) with a probability approaching one, doubly exponentially fast.
sˆ,3 sˆ sˆ sˆ s
s∈I(sˆ) Therefore, for each xn ∈T, the number of chosen sequences
(cid:104) (cid:0) (cid:1)(cid:105) un(sˆ)whichareinTn (xn)isnon-zeroandthefunctions
Nsˆ,4 :=exp n min I(Vsˆ;Ys|Usˆ)−2δ . (15) ij [UX,sˆ]ζ
s∈I(sˆ) f and g as mentioned in the lemma, do exist with this
ThenCRcanbegeneratedbetweenAliceandBobintwoways: probability.
Define for all i∈I and yn ∈Yn, the decoder as follows:
a) For n∈N sufficiently large, there exist encoder functions
f :T →I and g :T →J, with a probability approaching 1, j if j∈J,un(sˆ)∈ (cid:83)Tn (yn)
doubly exponentia(cid:110)lly fast where (cid:111) and ∀mi∈j J,ms∈I(cid:54)=(sˆ)j[U⇒Y,s]σ|X|
Aanlidceifenfc(oxdnTe)s=:h=eir,oxgbn(sxe∈rnvX)a=tnio:njT[xtUnhnXen∈,sˆ](ζTu(xnijbn(y)sˆ)t(cid:54)=h,xe∅sne),f∈unTct[UinoXn(,ss1ˆ]6tζo). g˜(i,sˆ,yn):=0 otheurwnimis(esˆ.)(cid:54)∈s∈(cid:83)I(sˆT)[UnY,s]σ|X|(yn) (20)
the sequence un(sˆ) where j is the CR. Moreover, define
ij
For functions f and g, extending their domain to Xn by (cid:110)
defining for all xn (cid:54)∈ T, f(xn) = g(xn) = 0, there exists a T0 := (xn,yn)∈Xn×Yn :xn ∈T
decoder g˜:I×Sˆ×Yn →J such that for all s∈I(sˆ), (cid:91) (cid:111)
∧(un (sˆ),xn,yn)∈ Tn .
Pr(cid:110)g(Xsˆn)(cid:54)=g˜(cid:0)f(Xsˆn),sˆ,Ysn(cid:1)(cid:111)<exp(−nδ0), (17) f(xn)g(xn) s∈I(sˆ) [UXY,s]σ
Inthefollowing,itisshownthatAliceandBob’sobservation
for some δ >0. Thus, Bob can reconstruct g(xn)=j from
0 (xn,yn) ∈ Xn × Yn is in the set T with a probability
(f(xn),sˆ,yn) for given realizations Xn =xn and Yn =yn. 0
sˆ s exponentially close to one. It holds that
b) For each f and g from part a), and n ∈ N sufficiently
large,thereexistencoderfunctionsϕ:T →P andρ:T →Q PnXY,s(T0c)
with a probability approaching 1, doubly exponentially fast, = (cid:88) Pn (xn,yn)+ (cid:88) Pn (xn,yn)
XY,s XY,s
such that if f(xn) = i, g(xn) = j, ϕ(xn) = p, ρ(xn) = q
then (unij(sˆ),vpijqn(sˆ),xn) ∈ T[UnVX,sˆ]σ. Alice encodes her =xPnn∈T(cT,ycn)∈+Yn (cid:88) xnP∈nT,((xxnn,y)n)(cid:54)∈T0
observationxn ∈T bythesefunctionstothesequencevijn(sˆ) Xsˆ Xsˆ
pq
where q is the CR. xn∈T,(xn,yn)(cid:54)∈T0
For functions ϕ and ρ, extending their domain to Xn by ×Pn (cid:16) (cid:92) Tn c (un (sˆ),xn)(cid:12)(cid:12)xn(cid:17). (21)
Ys|Xsˆ [UXY,s]σ f(xn)g(xn)
defining for all xn (cid:54)∈ T, ϕ(xn) = ρ(xn) = 0, there exists s∈I(sˆ)
a decoder ρ˜:I×J ×P ×Sˆ×Yn →Q such that for all
Lemma 1.1 implies for every xn ∈Tn with ξ ∈(0,ζ) that
s∈I(sˆ), Tn (xn)(cid:54)=∅ for n large enough[X. Tsˆ]hξus by the definition
Pr(cid:110)ρ(Xn)(cid:54)=ρ˜(cid:0)f(Xn),g(Xn),ϕ(Xn),sˆ,Yn(cid:1)(cid:111) in[U(1X6,sˆ)],ζitfollowsthatT ⊃Tn andthusLemma1.2implies
sˆ sˆ sˆ sˆ s [Xsˆ]ξ
for some c >0 that
<exp(−nδ(cid:48)), (18) 0
0
Pn (Tc)<exp(−nc ). (22)
for some δ(cid:48) >0. Thus, Bob can reconstruct ρ(xn)=q from Xsˆ 0
0
(f(xn),g(xn),ϕ(xn),sˆ,yn) for given realizations Xn = xn On the other hand, for every xn ∈ T with f(xn) = i and
sˆ
and Yn =yn. g(xn)=j, it holds that (un(sˆ),xn)∈Tn . Since for all
s ij [UX,sˆ]ζ
6
s∈I(sˆ), the Markov chains U −X −Y hold, Lemma 1.6 where the equality follows again by RVs {Un }
sˆ sˆ s ij,sˆ (i,j)∈I×J
implies for c sufficiently small that being independent. The inequality is a result of Lemma 1.7.
0
Pn (cid:0)Tn c (un (sˆ),xn)|xn(cid:1)<exp(−nc ). Moreover, the definitions in (12) and (13) imply that
Ys|Xsˆ [UXY,s]σ f(xn)g(xn) 0
This inequality together with (21) and (22) gives Nsˆ,1Nsˆ,2(Nsˆ,2−1)≤Nsˆ,1Nsˆ,2Nsˆ,2
Pn (Tc)<exp(−nc ), (23) =exp(cid:104)n(cid:0)I(U ;X )+ minI(U ;Y )−δ(cid:1)(cid:105). (29)
XY,s 0 1 sˆ sˆ sˆ s
s∈I(sˆ)
for some c >0 and n sufficiently large.
1
By using (28) and (29), it follows that the inner summation
Therefore, to compute the upper-bound of the probability
in (17), we may just concentrate on all (xn,yn)∈T with in (27) is upper-bounded by (cid:12)(cid:12)I(sˆ)(cid:12)(cid:12)exp(cid:2)−n(δ −τ −τ(cid:48))(cid:3),
0
which implies that
g˜(f(xn),sˆ,yn)(cid:54)=g(xn). (24)
A necessary condition for (xn,yn)∈T0 is given by EU˜sˆ(cid:104)es(U˜sˆ)(cid:105)≤|I(sˆ)|exp(cid:2)−n(δ−τ −τ(cid:48))(cid:3). (30)
(cid:91)
(un (sˆ),yn)∈ Tn , Let δ be sufficiently small such that 0<δ <δ−τ −τ(cid:48).
f(xn)g(xn) [UY,s]σ|X| 1 1
s∈I(sˆ) By the Markov inequality, it follows that
which together with (24) and (20) implies that (cid:104) (cid:105)
E e (U˜ )
∃m(cid:54)=g(xn), (un (sˆ),yn)∈ (cid:91) Tn . (25) Pr(cid:16)e (U˜ )≥exp(−nδ )(cid:17)≤ U˜sˆ s sˆ . (31)
f(xn)m [UY,s]σ|X| s sˆ 1 exp(−nδ )
s∈I(sˆ) 1
Furthermore, it follows for all (xn,yn) ∈ T that xn ∈T Therefore, (30) and (31) imply for all ζ and σ sufficiently
0
and thus for f(xn)=i and g(xn)=j (cid:54)=m, it holds that small, and all n large enough that
(unij(sˆ),xn)∈T[UnX,sˆ]ζ. (26) Pr(cid:16) (cid:92) (cid:110)es(U˜sˆ)<exp(−nδ1)(cid:111)(cid:17)
Define the RV s∈I(sˆ)
U˜ :={Un } =(Un ,Un ,··· ,Un ) ≥1−|I(sˆ)|2exp(−n(δ−τ−τ(cid:48)−δ1)). (32)
sˆ ij,sˆ (i,j)∈I×J 11,sˆ 12,sˆ |I||J|,sˆ
and let u˜(sˆ):={un(sˆ)} be an arbitrary realization. Thus, there exists a realization u˜(sˆ) = {un(sˆ)}
ij (i,j)∈I×J ij (i,j)∈I×J
For all s∈I(sˆ) and (xn,yn)∈T0, the relations (25) and (26) of the RV U˜sˆ, where for all s ∈ I(sˆ) and (xn,yn) ∈ T0,
givethefollowingupper-boundfortheerrorprobabilityin(17) the upper-bound of the error probability in (17) is given by
e (cid:0)u˜(sˆ)(cid:1):= (cid:88) Pn (xn,yn) exp(−nδ1). This implies by using (23) that the total error
s XY,s
probability in (17) is exponentially small with some δ >0.
(xn,yn)∈T0 0
(cid:88) b)Theproofofthesecondpartisverysimilartothefirstpart.
× 1Tn (unij(sˆ),xn)1(cid:83) Tn (unim(sˆ),yn). For a given (i,j)∈I×J, the number of chosen random se-
[UX,sˆ]ζ [UY,s]σ|X|
i∈I,j∈J s∈I(sˆ) quencesvijn isN N =exp(nR(cid:48)),whereR(cid:48) istherateof
m∈J−{j} pq sˆ,3 sˆ,4
choosingtherandomsequences.Similarto(19),conditions(14)
The upper-bound of e (u˜(sˆ)) is given by taking its expecta-
s and (15) imply that R(cid:48) =I(V ;X |U )+δ. Furthermore, as
tion with respect to U˜ as follows sˆ sˆ sˆ
sˆ a result of Lemma 1.1, from (un(sˆ),xn)∈Tn follows
E (cid:104)e (U˜ )(cid:105)= (cid:88) Pn (xn,yn) (cid:88) E Tn (un(sˆ),xn)(cid:54)=∅. Thereijfore, Lemma[U3Xi,msˆ]ζplies that
U˜sˆ s sˆ XY,s (Uinj,sˆ,Uinm,sˆ) [UVX,sˆ]σ ij
(xn,yn)∈T0 i∈I,j∈J functions ϕ and ρ as mentioned in the lemma do exist.
m∈J−{j} Accordingtoparta)ofthislemma,Bobisabletoreconstruct
(cid:104) (cid:105)
1Tn (Uinj,sˆ,xn)1 (cid:83) Tn (Uinm,sˆ,yn) , (27) g(xn)=j, by knowing f(xn),sˆand yn. Therefore, he knows
[UX,sˆ]ζ s∈I(sˆ) [UY,s]σ|X| also un(sˆ). Let ϑ ∈ R be given such that ϑ > σ. Similar
ij
where the equality follows by RVs {Un } being to (20), the decoder is defined as ρ˜(i,j,p,sˆ,yn):=q if
ij,sˆ (i,j)∈I×J
independent and using the Fubini theorem [26, Chapter II,
§6]. In the following, an upper-bound for the inner summation q ∈Q, vpijqn(sˆ)∈(cid:91)T[UnVY,s]ϑ|X|(unij(sˆ),yn) and
in (27) is derived, which automatically gives the upper-bound s∈I(sˆ)
for the expectation on the left hand side. ∀r ∈Q,r (cid:54)=q ⇒vijn(sˆ)(cid:54)∈(cid:91)Tn (un(sˆ),yn),
pr [UVY,s]ϑ|X| ij
Let i∈I,j ∈J,m∈J −{j} and τ,τ(cid:48) >0 be given such
s∈I(sˆ)
that δ > τ +τ(cid:48). It holds for all (xn,yn) ∈ T , all ζ,σ > 0
0
sufficiently small, and n sufficiently large that andotherwisezero.DefinethesetT0(cid:48)asfollows.Similarto(23),
E(Uinj,sˆ,Uinm,sˆ)(cid:104)1T[nUX,sˆ]ζ(Uinj,sˆ,xn)1(cid:83) T[nUY,s]σ|X|(Uinm,sˆ,yn)(cid:105) the pro(cid:110)bability PnXY,s(T0(cid:48)c) is exponentially small.
s∈I(sˆ) T(cid:48) := (xn,yn)∈Xn×Yn :xn ∈T
(cid:16) (cid:17) (cid:16) (cid:91) (cid:17) 0
=Pr Un ∈Tn (xn) Pr Un ∈ Tn (yn)
ij,sˆ [UX,sˆ]ζ im,sˆ [UY,s]σ|X| ∧(un (sˆ),vf(xn)g(xn)n(sˆ),xn,yn)∈(cid:91)Tn (cid:111).
s∈I(sˆ) f(xn)g(xn) ϕ(xn)ρ(xn) [UVXY,s]ϑ
(cid:104) (cid:0) s∈I(sˆ)
≤|I(sˆ)|exp −n I(U ;X )
sˆ sˆ
+ minI(Usˆ;Ys)−τ −τ(cid:48) (cid:1)(cid:105), (28) Fleotrv˜ag(isˆv)en:=(i{,vj)ij∈nI(sˆ×)}J defineV˜ijb,sˆe:=an{aVrpbiqji,tsnˆra}r(yp,qr)e∈aPli×zaQtioann.d
s∈I(sˆ) ij pq (p,q)∈P×Q
7
Define for all (xn,yn)∈T(cid:48) with f(xn)=i, g(xn)=j, Proof: Let s∈I(sˆ) be given. Define:
0
es(cid:0)v˜ij(sˆ)(cid:1):= (cid:88) 1 (cid:83) Tn (unij(sˆ),vpijqn(sˆ),xn,yn) λ:=α3· min |Bs,d|, (41)
p∈P,q∈Q s∈I(sˆ)[UVXY,s]ϑ s∈I(sˆ),d∈Ds
r∈Q−{q} D(cid:48) :=(cid:110)d∈D :P (d|sˆ)≥ α2|Bs,d|(cid:111), (42)
×1(cid:83) Tn (unij(sˆ),vpijrn(sˆ),yn). (33) s Ds|Sˆsˆ |Bs|
s∈I(sˆ)[UVY,s]ϑ|X| B(cid:48) :=B ∩(C×D(cid:48)), (43)
s s s
Similarlyasinparta),itcanbeshownthattheerrorprobability (cid:110) 1(cid:111)
in (18) is upper-bounded for all (xn,yn)∈T0(cid:48) by Gs := (c,d)∈C×D :PC|DSˆ,s(c|d,sˆ)≤ λ , (44)
(cid:110) (cid:111)
(cid:88) (cid:88) PnXY,s(xn,yn)es(cid:0)v˜ij(sˆ)(cid:1). (34) Gs,d := c∈C :(c,d)∈Gs , (45)
i∈I,j∈J (xn,yn)∈T(cid:48) (cid:110) (cid:111)
f(xn)=i,g(xn0)=j Es := d∈D :PC|DSˆ,s(Gs,d|d,sˆ)<1−η . (46)
For τ,τ(cid:48) >0 with τ +τ(cid:48) <δ, Lemma 1.8 implies that Similarly as in [7, Lemma 17.5], we show in the first step
E(Vpiqj,×snˆ,V1pirj,snˆ(cid:83))(cid:104)1Tsn∈(cid:83)I(sˆ)T[nUV(XuYni,js](ϑsˆ()u,niVjp(irsjˆ,)snˆ,,Vypniqj,)snˆ(cid:12)(cid:12),xUninj,,ysˆn=) unij(sˆ)(cid:105) Tthhaitsthineeqfoulaloliwtyinigs rineqePquuiDraesld|iStˆysˆla(itEsesrt|rsˆtuo)e<:shoηw. that (40) holds.(F47o)r
[UVY,s]ϑ|X|
(cid:12) (cid:12)s2∈I(sˆ) (cid:104) (cid:0) this, let (c,d)∈Bs(cid:48) be given and s∈I(sˆ). It follows that
≤(cid:12)I(sˆ)(cid:12) ·exp −n I(Vsˆ;Xsˆ|Usˆ)
+sm∈Ii(nsˆ)I(Vsˆ;Ys|Usˆ)−τ −τ(cid:48))(cid:1)(cid:105). (35) PC|DSˆ,s(c|d,sˆ)= PCPDD,ss||SSˆˆssˆˆ((cd,|sˆd)|sˆ) ≤ α2(|Bα|sB,ds|||)B−s1|−1 ≤λ1,
where the first inequality follows by (37), (42), and (43) and
Moreover, by (14) and (15), it follows that
the last one by (41). This implies by the definition in (44) that
N N (N −1)≤N N N
sˆ,3 sˆ,4 sˆ,4 sˆ,3 sˆ,4 sˆ,4
(cid:104) (cid:0) (cid:1)(cid:105) Bs(cid:48) ⊂Gs. (48)
=exp n I(V ;X |U )+ minI(V ;Y |U )−δ . (36)
sˆ sˆ sˆ sˆ s sˆ
s∈I(sˆ) Moreover, by (42) and (43) it holds for all s∈I(sˆ) that
Thus, (35) and (36) imply by using the definition in (33) that P (D(cid:48)c|sˆ)= (cid:88)P (d|sˆ)< (cid:88)α2|Bs,d|=α2, (49)
EV˜ij,sˆ(cid:104)es(V˜ij,sˆ)(cid:12)(cid:12)Uinj,sˆ=unij(sˆ)(cid:105)≤(cid:12)(cid:12)I(sˆ)(cid:12)(cid:12)2exp(cid:104)−n(δ−τ−τ(cid:48))(cid:105). Ds|Sˆsˆ s d∈Ds(cid:48)c Ds|Sˆsˆ d∈D |Bs|
P (B ∪(C×D(cid:48))|sˆ)
Therefore, it follows for all 0<δ1(cid:48) <δ−τ −τ(cid:48) that CD,s|Sˆsˆ s s
Pr(cid:16) (cid:92) (cid:110)e (V˜ )<exp(−nδ(cid:48))(cid:111)(cid:12)(cid:12)Un =un(sˆ)(cid:17) =PCD,s|Sˆsˆ(Bs|sˆ)+PDs|Sˆsˆ(Ds(cid:48)|sˆ)−PCD,s|Sˆsˆ(Bs(cid:48)|sˆ). (50)
s ij,sˆ 1 (cid:12) ij,sˆ ij
The relations (49) and (50) together with the assumption (38)
s∈I(sˆ)
≥1−(cid:12)(cid:12)I(sˆ)(cid:12)(cid:12)3exp(cid:0)−n(δ−τ −τ(cid:48)−δ(cid:48))(cid:1). of the lemma imply that
1
P (B(cid:48)|sˆ)≥P (B |sˆ)−P (D(cid:48)c|sˆ)
This implies that there exist sequences v˜ij(sˆ), for which the CD,s|Sˆsˆ s CD,s|Sˆsˆ s Ds|Sˆsˆ s
error upper-bound in (34) is exponentially small. ≥1−(η2−α2)−α2 =1−η2. (51)
Lemma8. LetAlice’sstatesˆ∈SˆbegivenandC,Ds,andSˆsˆ By (48) and (51), it follows that PCD,s|Sˆsˆ(Gs| sˆ) ≥ 1−η2.
with s∈I(sˆ) be RVs taking value in C,D, and Sˆrespectively. This implies by the definition in (45) for all s∈I(sˆ) that
RVs C and D denote the CR and part of Eve’s Knowledge (cid:88)
s 1−η2 ≤ P (d|sˆ)P (G |d,sˆ)
respectively. Assume α∈(0,1] and η ∈(0,1] with α≤η are Ds|Sˆsˆ C|DSˆ,s s,d
6 3 d∈D
given and for all s∈I(sˆ), there exist sets B ⊂C×D with
s (cid:88) (cid:88)
< P (d|sˆ)(1−η)+ P (d|sˆ)
∀(c,d)∈B , P (c,d|sˆ)<(α|B |)−1, (37) Ds|Sˆsˆ Ds|Sˆsˆ
s CD,s|Sˆsˆ s d∈Es d(cid:54)∈Es
PCD,s|Sˆsˆ(Bs|sˆ)≥1−(η2−α2). (38) =−η (cid:88) PDs|Sˆsˆ(d|sˆ)+1,
Furthermore, define the sets B := (cid:8)c ∈ C : (c,d) ∈ B (cid:9) d∈Es
s,d s
(cid:8) (cid:9) where the second inequality follows by (46). The desired
and D := d∈D :B (cid:54)=∅ , and assume
s s,d
relation (47) follows by simplifying this inequality.
k∈N, k <α6 min |Bs,d|, k <e1/α(2|D||I(sˆ)|)−1. (39) In the second step, we show that a SK generator κ,
s∈I(sˆ),d∈Ds satisfying (40), exists. For this, consider each member of the
Then, there exists a SK generator κ:C →{1,2,··· ,k} which family of PDs P (.|d,sˆ) with d (cid:54)∈ E and s ∈ I(sˆ).
C|DSˆ,s s
maps the CR to a SK κ(C) such that for all s∈I(sˆ), Lemma 4 implies for a randomly selected SK generator κ that
S(cid:0)κ(C)|Ds,Sˆsˆ=sˆ(cid:1)≤(α+2η)logk+h(α+η), (40) Pr(cid:16)(cid:13)(cid:13)κ(PC|DSˆ,s(.|d,sˆ))−P0(cid:13)(cid:13)>2(α+η)(cid:17)≤2ke−λαk2, (52)
withaprobabilityatleast1−2k|I(sˆ)||D|e−α5mink|Bs,d| where where P0(i)=1/k for all i=1,2···k. The universal upper-
theminintheexponentistakenoveralls∈I(sˆ)andd∈D . boundin(52)wascalculatedbytaking(cid:15)=2αinLemma4and
s
8
by the inequalities α≤1/6 and η ≤1/3 from the assumption sˆ1 un11(sˆ1) ··· unij(sˆ1) ··· unNsˆ1,1Nsˆ1,2(sˆ1)
of the lemma. Therefore, for the following events . . . .
. . . .
(cid:110)(cid:13) (cid:13) (cid:111) . . . .
As,d := (cid:13)κ(PC|DSˆ,s(.|d,sˆ))−P0(cid:13)≤2(α+η) , sˆm un11(sˆm) ··· unij(sˆm) ··· unNsˆm,1Nsˆm,2(sˆm)
it follows by (41) and (52) that
Table I: Random sequences for a DMMS with |Sˆ|=m
Pr(cid:16) (cid:92) A (cid:17)≥1− (cid:88) Pr(cid:0)Ac (cid:1)
s,d s,d
s∈I(sˆ),d(cid:54)∈Es s∈I(sˆ),d(cid:54)∈Es corresponding sequences {vijn(sˆ)} are known to
≥1−2k|D||I(sˆ)|e−α5mink|Bs,d|, (53) Alice and Bob. pq (p,q)∈P×Q
Toshowtheachievabilityof(6),theproofisdividedintotwo
where the min in (53) is taken over all s∈I(sˆ) and d∈D .
s parts. In part a), the following rate is shown to be achievable:
This means that a SK generator κ satisfies the relation
(cid:107)κ(PC|DSˆ,s(.|d,sˆ))−P0(cid:107)≤2(α+η) simultaneously for all Rs(cid:48)k :=sm∈Ii(nsˆ)I(Usˆ;Ys)−sm∈Ia(xsˆ)I(Usˆ;Zs), (54)
d (cid:54)∈ E and s ∈ I(sˆ) with the probability stated in (53).
s
when R(cid:48) is positive and RV U satisfies for all s∈I(sˆ)
Therefore, it holds by the same probability that sk sˆ
S(cid:0)κ(C)|D ,Sˆ =sˆ(cid:1) Usˆ−Xsˆ−YsZs and max I(Usˆ;Xsˆ|Ys)<Γ. (55)
s sˆ s∈I(sˆ)
= (cid:88)P (d|sˆ)(cid:104)logk−H(cid:0)κ(C)|D =d,Sˆ =sˆ(cid:1)(cid:105) This gives a special case of (6) and (7). In part b), the
Ds|Sˆsˆ s sˆ
d∈D achievability of the SK rate in (6) is shown, when it is positive.
(cid:88) (cid:2) (cid:3) Part a) Assume R(cid:48) from (54) is positive i.e.
≤ PDs|Sˆsˆ(d|sˆ) (α+η)logk+h(α+η) sk
d(cid:54)∈Es min I(Usˆ;Ys)> max I(Usˆ;Zs). (56)
(cid:88) s∈I(sˆ) s∈I(sˆ)
+ P (d|sˆ)logk ≤(α+2η)logk+h(α+η),
Ds|Sˆsˆ As explained in Section III, Alice estimates her marginal
d∈Es statistic by hypothesis testing. Assume that sˆ∈Sˆ is the index
which gives the desired relation in (40). The equality is the correspondingtothecorrectdecisionandallothers˜∈Sˆ−{sˆ}
result of Definition 3 and the first inequality follows from the
correspond to a wrong decision. For any observation Xn, let
uniform continuity of entropy [24], [7, Problem 3.10]. The last the resulting estimated state be denoted by the RV Sˆ , tsaˆking
sˆ
step is a result of the inequality (47). Moreover, by combining value in the set Sˆ and having the PD P . It holds by [21]
the two assumptions in (39), it implies that Sˆsˆ
and [7, Problem 2.13b] for some c ,c >0 that
0 1
kln(cid:0)2k|D|·|I(sˆ)|(cid:1)<α5· min |B |,
s,d P (sˆ)≥1−exp(−nc ), (57)
s∈I(sˆ),d∈Ds Sˆsˆ 0
and consequently, the probability in (53) is non-zero. ∀s˜∈Sˆ−{sˆ}, PSˆsˆ(s˜)≤exp(−nc1). (58)
Next,AlicesendsherestimatedmarginalsourcestatetoBob
C. Proof of Main Results over the public noiseless channel. Assume that the hypothesis
testing has led to the correct decision sˆ. Alice and Bob find
In the following, the proofs of Theorems 1, 2, and 3 are
thecorrespondingfamilyofsequences{un(sˆ)} from
presented. For the proof of the first two theorems, similar ij (i,j)∈I×J
Table I by knowing sˆ. Lemma 7a implies the existence of the
techniques which are used for deriving the non-compound
encoder functions f :Xn →I∪{0} and g :Xn →J ∪{0}.
SK capacity results in [7, Theorem 17.21], [5], are used and
These encoders give the indices f(xn)=i and g(xn)=j of
extended to the finite compound setup. For completeness, all
the sequence un(sˆ) to be chosen from the family of sequences
proofsarepresentedindetail.TheproofofTheorem3isbased ij
{un(sˆ)} .
on an approximation technique and uses Lemmas 5 and 6. ij (i,j)∈I×J
As shown in Figure 2, in addition to the transmitted sˆ,
Proof of Theorem 1: Let δ >0, and 0<ξ <ζ <σ, all
in R be given. For each sˆ∈Sˆ={sˆ ,...sˆ }, let U and V Alice sends further the index f(xn) = i to Bob over the
1 m sˆ sˆ
public channel. Lemma 7a implies the existence of a decoder
satisfyforalls∈I(sˆ)theMarkovchainsU −V −X −Y Z .
Consider N N sequences un(sˆ) ∈sˆ Unsˆ as gsˆivens ins g˜ : I ×Sˆ×Yn → J, with which, Bob can reconstruct the
Table I, whichsˆa,1re csˆ,h2osen independeijntly by PD Pn with index g(xn)=j. This j is the CR between Alice and Bob.
Usˆ Intotal,forallAlice’sestimationresultswhichmayleadtoa
i∈I :={1,2,··· ,N }, j ∈J :={1,2,··· ,N }, correct or incorrect decision, the error probability upper-bound
sˆ,1 sˆ,2
for all s∈I(sˆ) is given by
and N and N satisfying (12) and (13) from Lemma 7.
Moreosvˆ,e1r, for evsˆe,2ry unij(sˆ) from Table I, consider Nsˆ,3Nsˆ,4 Pr(cid:110)g(Xsˆn)(cid:54)=g˜(cid:0)f(Xsˆn),Sˆsˆ,Ysn(cid:1)(cid:111)
sinedqeupeenncdeesnvtlpiyjqnb(ysˆ)PD∈PVnVnsˆ|U,sˆ(w.|huinicjh(sˆa))rewcithhosen conditionally =Pr(cid:110)g(Xsˆn)(cid:54)=g˜(cid:0)f(Xsˆn),sˆ,Ysn(cid:1)∧Sˆsˆ=sˆ(cid:111)
p∈P :={1,2,··· ,Nsˆ,3}, q ∈Q:={1,2,··· ,Nsˆ,4}, + (cid:88)PSˆsˆ(s˜)Pr(cid:110)g(Xsˆn)(cid:54)=g˜(cid:0)f(Xsˆn),Sˆsˆ,Ysn(cid:1)(cid:12)(cid:12)Sˆsˆ=s˜(cid:111)
s˜∈Sˆ−{sˆ}
and N and N satisfying (14) and (15) from Lemma 7.
Assumseˆ,3that the srˆa,4ndom sequences un(sˆ) in Table I and their ≤exp(−nδ0)+exp(−nc1)·|Sˆ|, (59)
ij
9
j j
wheretheinequalityisaresultof(17)forsomeδ >0and(58). xn yn
0
Thus, condition (3) of Definition 4 is satisfied.
Public Channel
The whole message which is sent over the public channel is
representedbytheRVf (Xn)=(f(Xn),Sˆ )havingtherange Alice (i,sˆ) Bob
c sˆ sˆ sˆ
size (cid:107)f(cid:107)·|Sˆ|. As shown in the following, the communication
rate satisfies condition (1) of Definition 4:
{un(sˆ)} {un(sˆ)}
ij (i,j)∈I×J ij (i,j)∈I×J
1 1 1
log(cid:107)f (cid:107)= log((cid:107)f(cid:107)·|Sˆ|)= log(N ·|Sˆ|)
n c n n sˆ,1 Fig. 2: Generating the CR j
1
= maxI(U ;X |Y )+3δ+ log|Sˆ|<Γ+3δ,
s∈I(sˆ) sˆ sˆ s n
For δ and τ sufficiently small and n large enough, it holds
where the last equality follows by (12) and the inequality is a
that η2−α2 >exp(−nc ). Therefore, it follows by (62) that
result of (55) and is valid for all n sufficiently large. 3
After the index g(xn) = j is reconstructed by Bob, both P (B |sˆ)≥1−(η2−α2).
Alice and Bob may generate their SK, based on this CR. CD,s|Sˆsˆ s
Thus, it remains to show that there exists a SK generator This guarantees condition (38) of Lemma 8. Moreover, the
κ:J →{1,2··· ,k}, giving rise to the RV K =κ(g(Xn)), conditions α∈(0,1/6] and η ∈(0,1/3] are also satisfied.
A sˆ
which satisfies condition (4) of Definition 4. To check condition (37) of Lemma 8, we find first
Again the condition is verified for both estimation results. an upper-bound of |Bs|. The non-emptiness constraint
Assume hypothesis testing has led to the correct decision and T[UnXZ,s]σ(unij(sˆ),zn)(cid:54)=∅ from the definition of the set Bs is
sˆis sent to Bob over the public channel. Define for s∈I(sˆ) a sufficient condition for un(sˆ)∈Tn (zn) and thus
ij [UZ,s]σ|X|
(cid:110)
Ts := (xn,zn)∈Xn×Zn : xn ∈T ∧ |B |≤ (cid:88) (cid:12)(cid:12)(cid:110)(i,j)∈I×J :un(sˆ)∈Tn (zn)(cid:111)(cid:12)(cid:12).
s (cid:12) ij [UZ,s]σ|X| (cid:12)
(cid:111)
(unf(xn)g(xn)(sˆ),xn,zn)∈T[UnXZ,s]σ , zn∈T[nZs]ξ (64)
whereT isgivenin(16).Asimilardiscussionasfor(23)from
Furthermore, for R being the rate of choosing the random
Lemma 7, implies for some c >0 and n large enough that
2 sequences {un(sˆ)} , it holds by (12) and (13) that
ij (i,j)∈I×J
Pn (Tc)<exp(−nc ). (60)
XZ,s s 2
R= max I(U ;X |Y )+ min I(U ;Y )+δ
sˆ sˆ s sˆ s
Similarly as in [7, Theorem 17.21] for the non-compound s∈I(sˆ) s∈I(sˆ)
version, define for all s ∈ I(sˆ), the RVs C and Ds and the > min I(Usˆ;Ys)> max I(Usˆ;Zs),
set B to be used in Lemma 8, as follows s∈I(sˆ) s∈I(sˆ)
s
C :=g(Xn), D :=(cid:0)f(Xn),Zn,1 (Xn,Zn)(cid:1), where the last inequality is the result of the assumption (56).
sˆ s sˆ s Ts sˆ s Moreover, for all (j,(i,zn,1))∈B it holds that zn ∈Tn
Bs :=(cid:110)(cid:0)j,(i,zn,1)(cid:1):(i,j)∈I×J,zn ∈T[Zns]ξ, which implies by using Lemma 1.1s for n large enough[Zthsa]ξt
(cid:111) Tn (zn)(cid:54)=∅. Therefore, it follows by (64) and Lemma 2
Tn (un(sˆ),zn)(cid:54)=∅ . (61) [UZ,s]ζ
[UXZ,s]σ ij for ξ and ζ sufficiently small and n large enough that
DAressspuemceti,vRelVy.sMCoarnedovDers, tthakeestehtesirDvsalauneds iBns,tdhearseetsdeCfinanedd |Bs|≤(cid:12)(cid:12)T[Zns]ξ(cid:12)(cid:12)exp(cid:104)n(cid:0)R−I(Usˆ;Zs)+τ(cid:1)(cid:105)
as in Lemma 8. In the following, it will be shown that all (cid:104) (cid:0) (cid:1)(cid:105)
≤exp n H(Z )+τ
s
conditions of Lemma 8 are satisfied. It holds that
P (B |sˆ)= (cid:88) P (cid:0)j,(i,zn,1)|sˆ(cid:1) ×exp(cid:104)n(cid:0)I(Usˆ;Xsˆ)+δ−I(Usˆ;Zs)+τ(cid:1)(cid:105), (65)
CD,s|Sˆsˆ s CD,s|Sˆsˆ
(j,(i,zn,1))∈Bs where the last inequality follows by (19) and Lemma 1.4.
(cid:88) (cid:88)
= P (xn,zn|sˆ) In the second step of verifying condition (37), we
=(Pj,X(isˆn,z(cid:104)Znsn,1|S)ˆ)sˆ∈(cid:16)BTss∩xn(cid:110):f1((Txxsnn(x,)=nz,inz,g)n(∈)x=nX1)=nj×, ZXnsˆnZ:sznn|Sˆ(cid:105)∈sˆ T[Zns]ξ(cid:111)(cid:12)(cid:12)sˆ(cid:17) (fijn,(cid:0)d(1i,−aznne,xu1p)p()p−e∈nr-cBb0os),u(cid:1)ni·tdPhCofloDdr,ss|bPSˆysˆC(cid:0)Dujs,,si(n|iSˆg,sˆz(cid:0)(n5j,,71()i),a|sˆzn(cid:1)nd,(16)1|sˆ)(cid:1)t.haFtor all
≥1− PXsˆnZsn|Sˆsˆ(Tsc|sˆ)+PZsn|Sˆsˆ(T[Zns]ξc|sˆ) ≤PCD,s(cid:0)j,(i,zn,1)(cid:1)
≥1− PXsˆnZsn(Tsc)+PZsn(T[Zns]ξc) ≥1−exp(−nc ), (62) ≤ (cid:88) PnXZ,s(xn,zn)
1−exp(−nc ) 3 xn∈Tn (un(sˆ),zn)
0 [UXZ,s]σ ij
for some c3 > 0 and n sufficiently large. The last two ≤(cid:12)(cid:12)T[UnXZ,s]σ(unij(sˆ),zn)(cid:12)(cid:12)exp(cid:104)−n(cid:0)H(XsˆZs)−τ(cid:1)(cid:105)
inequalities follow by (57), (60) and Lemma 1.2.
(cid:104) (cid:0) (cid:1)(cid:105)
Furthermore, define the parameters α and η for some ≤exp n H(X |U Z )−H(X Z )+2τ , (66)
sˆ sˆ s sˆ s
arbitrary τ >0 as follows
where the third inequality follows by Lemma 1.3 and the last
α:=exp(−n(δ+5τ)), η :=exp(−nδ). (63)
one by Lemma 1.5 for σ sufficiently small and n large enough.
10
q q
Moreover, by using Markov chains in (55), it holds that xn yn
H(X |U Z )−H(X Z ) Public Channel
sˆ sˆ s sˆ s
=−I(U ;X )−H(Z )+I(U ;Z ). (67) Alice (i,p,sˆ) Bob
sˆ sˆ s sˆ s
Therelations(65),(66),and(67)togetherwiththedefinition
of α in (63) imply for n large enough that {un(sˆ)} {un(sˆ)}
ij (i,j)∈I×J ij (i,j)∈I×J
|B |P (cid:0)j,(i,zn,1)|sˆ(cid:1)α≤ exp(−nτ) <1. {vpijqn(sˆ)}(p,q)∈P×Q {vpijqn(sˆ)}(p,q)∈P×Q
s CD,s|Sˆsˆ 1−exp(−nc0) Fig. 3: Generating the CR q
Thus, condition (37) of Lemma 8 is also satisfied.
Therefore,Lemma8impliesthatthereexistsaSKgenerator
κ : J → {1,2,··· ,k} with k satisfying (39), such that the Thus, for δ sufficiently small, assumption (56) gives
relation (40) holds. By the definitions in (63), both α and η
approach zero exponentially fast. Moreover, by (39) and (65), R2 > max I(Usˆ;Zs). (72)
s∈I(sˆ)
it follows that k does not increase faster than exponentially.
Thus, the inequality (40) implies for K =κ(g(Xn)) that Moreover,inderivingtheinequality(65),itwasshownthatfor
S(cid:0)KA(cid:12)(cid:12)f(Xsˆn),Zsn,1Ts(Xsˆn,Zsn),Sˆsˆ=A sˆ(cid:1) sˆ Talhlu(sj,,Ld)em=m(cid:0)aj,2(it,ozgnet,h1e)r(cid:1)w∈itBhs(,7i0t)h,o(7ld1s),thaantdT([7Un2Z),si]mζ(pzline)s(cid:54)=tha∅t.
≤(α+2η)logk+h(α+η)
(cid:12)(cid:110) (cid:111)(cid:12)
min |B |≥ min (cid:12) j :un(sˆ)∈Tn (zn) (cid:12)
≤n·exp(−nc4)+exp(−nc4)≤exp(−nc5), (68) s∈I(sˆ),d∈Ds s,d s∈I(sˆ),d∈Ds(cid:12) ij [UZ,s]ζ (cid:12)
for some c4,c5 > 0. Consequently, the security index is ≥exp(cid:104)n(cid:0)R2− max I(Usˆ;Zs)−τ(cid:1)(cid:105)
exponentially small for the case of correct estimation decision. s∈I(sˆ)
Intotal,forallestimationresultswhichmayleadtoacorrect ≥exp(cid:104)n(cid:0) min I(U ;Y )−maxI(U ;Z )−2δ−τ(cid:1)(cid:105).
sˆ s sˆ s
or incorrect decision, the security index is upper-bounded as s∈I(sˆ) s∈I(sˆ)
shown in the following Therefore, by keeping k lower than the left hand side of (69),
S(cid:0)K=AP(cid:12)(cid:12)f((Xsˆ)sˆnS)(cid:0),KZsn,|Z1Tns,(fX(Xsˆn,nZ)s,n1),Sˆ(sˆX(cid:1) n,Zn),Sˆ =sˆ(cid:1) istatfiosfilleoswcsobnydit(i6o3n)(a2n)dof(5D4e)fitnhiattionn1 l4o.g|K| > Rs(cid:48)k −8δ. This
Sˆsˆ A s sˆ Ts sˆ s sˆ Part b) In this part, it is shown that if
+ (cid:88) P (s˜)S(cid:0)K |Zn,f(Xn),1 (Xn,Zn),Sˆ =s˜(cid:1)
Sˆsˆ A s sˆ Ts sˆ s sˆ Rsk := min I(Vsˆ;Ys|Usˆ)− max I(Vsˆ;Zs|Usˆ)>0,
s˜∈Sˆ−{sˆ} s∈I(sˆ) s∈I(sˆ)
≤exp(−nc5)+n·exp(−nc6)·|Sˆ|, then Rsk is achievable for all RVs Usˆ and Vsˆ satisfying (7). It
may be assumed that
forsomec >0.Thelastinequalityisaresultof(58)and(68)
6
and the fact that k does not increase faster than exponentially.
min I(U ;Y )≤ max I(U ;Z ). (73)
sˆ s sˆ s
Therefore, condition (4) of Definition 4 is satisfied. s∈I(sˆ) s∈I(sˆ)
In the rest of this part, we show that R(cid:48) satisfies condi-
sk Because otherwise, it follows by Markov chains in (7) that
tion (2) of Definition 4. By using the definition of α from (63)
(cid:104) (cid:105)
and the set D being the alphabet of RV Ds, it follows that Rsk = min I(Vsˆ;Ys)+I(Usˆ;Ys|Vsˆ)−I(Usˆ;Ys)
the expression e1/α(2|D||I(sˆ)|)−1 from (39) increases doubly s∈I(sˆ)
(cid:104) (cid:105)
exponentially fast. For any d:=(i,zn,1)∈Ds and Bs,d from − max I(Vsˆ;Zs)+I(Usˆ;Zs|Vsˆ)−I(Usˆ;Zs)
Lemma8,itfollowsby(65)that|B |doesnotincreasefaster s∈I(sˆ)
s,d
than exponentially. Therefore, for n large enough, it holds that ≤ min I(V ;Y )− max I(V ;Z )
sˆ s sˆ s
s∈I(sˆ) s∈I(sˆ)
α6· min (cid:12)(cid:12)Bs,d(cid:12)(cid:12)<e1/α(2|D||I(sˆ)|)−1. (69) −(cid:104) min I(U ;Y )− max I(U ;Z )(cid:105),
s∈I(sˆ),d∈Ds s∈I(sˆ) sˆ s s∈I(sˆ) sˆ s
Thus,toguaranteecondition(39)ofLemma8itisnecessary
which implies by using part a) that R is achievable.
thatk belowerthanthelefthandsideof(69).Forthis,alower- sk
Similarly as in part a), Alice sends her estimated marginal
bound for min |B | should be first determined.
s∈I(sˆ),d∈Ds s,d source state to Bob over the public noiseless channel. For the
Lemma 1.1 implies that un(sˆ)∈Tn (zn) is a sufficient
ij [UZ,s]ζ case that hypothesis testing has led to the correct decision sˆ,
condition for Tn (un(sˆ),zn) (cid:54)= ∅. Therefore for all
[UXZ,s]σ ij bothAliceandBobfindthecorrespondingfamilyofsequences
s∈I(sˆ) and d=(i,zn,1)∈D , it holds that
s {un(sˆ)} fromTableIandalsotherelatedfamiliesof
(cid:12)(cid:12)Bs,d(cid:12)(cid:12)≥(cid:12)(cid:12)(cid:12)(cid:110)j ∈J :unij(sˆ)∈T[UnZ,s]ζ(zn)(cid:111)(cid:12)(cid:12)(cid:12). (70) seqiujence(si,{j)v∈pijIq×n(Jsˆ)}(p,q)∈P×Q foreachmemberofthechosen
rowofthetable.Lemma7bimpliestheexistenceoftheencoder
Furthermore by using (13), the rate of choosing the random functions ϕ:Xn →P ∪{0} and ρ:Xn →Q∪{0}. These
sequences unij(sˆ) for a fixed index i, is given by encoders give the indices ϕ(xn) = p and ρ(xn) = q of the
R2 =sm∈Ii(nsˆ)I(Usˆ;Ys)−2δ. (71) s{evqijunen(scˆe)}vpijqn(sˆ) to fboercghiovesenninfrdoicmesthieafnadmjil.y of sequences
pq (p,q)∈P×Q
