PaperlayerView exact revision on arXiv

Source-linked AI summary

Strong Secrecy from Channel Resolvability

Matthieu R. Bloch, J. Nicholas Laneman

arXiv:1105.5419v3cs.IT

TL;DR

The paper addresses whether secrecy over noisy channels should be built from eavesdropper-channel capacity or channel resolvability, especially under strong secrecy metrics and arbitrary channels. It develops resolvability-based constructions and applies them across broadcast, wireless, mixed, compound, and secret-key models. The results show that resolvability can achieve strong secrecy where random capacity-based constructions may fail, while yielding broad achievable-rate and capacity results with simple proofs.

  • Problem

    Capacity-based secrecy constructions can be difficult to extend to channels with memory and may provide secrecy metrics considered too weak for cryptographic applications.

  • Method

    The paper ties secrecy coding to channel resolvability, using message-indexed sub-codes operating above the eavesdropper channel’s resolvability and extending the analysis to strong secrecy metrics and arbitrary channels.

  • Results

    Channel-resolvability constructions achieve strong secrecy capacity for at least some symmetric wiretap channels and establish strong-secrecy regions or rates for broadcast, wireless, mixed, compound, and secret-key models.

  • Takeaways & Limitations

    Channel resolvability provides a versatile mechanism for strong-secrecy analysis, with conceptually simple proofs across several secure-communication models.

Abstract

from arXiv · show

We analyze physical-layer security based on the premise that the coding mechanism for secrecy over noisy channels is tied to the notion of channel resolvability. Instead of considering capacity-based constructions, which associate to each message a sub-code that operates just below the capacity of the eavesdropper's channel, we consider channel-resolvability-based constructions, which associate to each message a sub-code that operates just above the resolvability of the eavesdropper's channel. Building upon the work of Csiszar and Hayashi, we provide further evidence that channel resolvability is a powerful and versatile coding mechanism for secrecy by developing results that hold for strong secrecy metrics and arbitrary channels. Specifically, we show that at least for symmetric wiretap channels, random capacity-based constructions fail to achieve the strong secrecy capacity while channel-resolvability-based constructions achieve it. We then leverage channel resolvability to establish the secrecy-capacity region of arbitrary broadcast channels with confidential messages and a cost constraint for strong secrecy metrics. Finally, we specialize our results to study the secrecy capacity of wireless channels with perfect channel state information, mixed channels and compound channels with receiver Channel State Information (CSI), as well as the secret-key capacity of source models for secret-key agreement. By tying secrecy to channel resolvability, we obtain achievable rates for strong secrecy metrics with simple proofs.

I. INTRODUCTION

The paper argues that channel resolvability offers an alternative to capacity-based secrecy coding, supporting strong secrecy across general communication models. It develops this connection through motivating examples, metric comparisons, and results for wiretap, wireless, broadcast, mixed, compound, and secret-key settings.

  • Capacity-based secrecy codes operate just below the eavesdropper’s channel capacity, but memory-containing models are difficult to analyze and the resulting metrics may be too weak cryptographically.
  • A. Motivating Examples: Channel resolvability instead links secrecy to coding mechanisms that make all messages induce the same or approximately the same eavesdropper output distribution.The one-time pad uses secret-key randomness, while Gaussian channel noise can make message-conditioned outputs approximately indistinguishable.
  • C. Summary of Results: The paper clarifies statistical independence by relating average mutual information to variational distance and other measures of closeness between joint and product distributions.These metric relations support measures that are both analytically tractable and cryptographically relevant.
  • C. Summary of Results: Channel resolvability is used to analyze Shannon’s cipher system and broadcast channels, including secrecy-capacity regions for general broadcast channels with cost constraints and strong secrecy metrics.
  • C. Summary of Results: The approach also provides strong-secrecy results for ergodic-fading wireless channels, mixed channels, and compound channels with receiver CSI using conceptually simple proofs.
  • C. Summary of Results: For general discrete source models, the paper bounds secret-key capacity and finds a form involving conditional entropy that suggests channel intrinsic randomness rather than channel resolvability.

III. PRELIMINARIES: SECRECY METRICS

The paper formalizes secrecy through multiple measures of asymptotic independence and orders their strength. It then applies these metrics to Shannon’s cipher system, showing when secrecy capacities coincide and how source randomness controls the eavesdropper’s observations.

  • Secrecy metrics: Information-theoretic secrecy is modeled as asymptotic independence between message W and eavesdropper observation Z, measured by several distributional distances.The framework introduces six secrecy metrics, including divergence, variational distance, and information-density criteria.
  • Secrecy metrics: Strong secrecy corresponds to metric S1, while metric S4 corresponds to Wyner’s weak secrecy condition.The strong-secrecy condition requires the relevant divergence to vanish without normalization; weak secrecy uses normalized information leakage.
  • Metric ordering: Proposition 1 orders the six metrics, establishing S1 ⪰ S2 ⪰ S3 ⪰ S4 and S2 ⪰ S5 ⪰ S6, with the stated relations derived using information inequalities.The proof explicitly establishes S3 ⪰ S4 in addition to the direct orderings.
  • Metric ordering: A scheme satisfying S1 automatically satisfies every weaker metric, whereas failure under S6 rules out satisfaction of the stronger metrics.This ordering lets coding theorems prove achievability using a strong metric or converses using a weak one.
  • Shannon’s cipher system: For Shannon’s cipher system, the secrecy capacity is identical for metrics S2 through S6; for memoryless sources, it is also identical for S1.Theorem 1 gives the common capacity through a spectral conditional-entropy expression, while i.i.d. sources additionally yield exponential strong secrecy.
  • Shannon’s cipher system: The encoder uses source randomness to control the eavesdropper’s observation distribution, interpreting secure communication as channel resolvability.The secure rate is maximized when legitimate terminals’ keys are almost perfectly uniform.

V. SECRECY FROM CHANNEL RESOLVABILITY OVER NOISY CHANNELS

The paper formulates confidential communication over arbitrary broadcast channels with common and private messages, cost constraints, and explicit encoder randomness. It defines reliability and secrecy through achievable rate pairs and specializes the model to wiretap channels.

  • Channel model: The broadcast channel has input X, outputs Y and Z, and transition probabilities varying with blocklength, under a sequence of input cost constraints.Bob observes Y, Eve observes Z, and every transmitted input sequence must satisfy the prescribed cost bound.
  • Channel model: Alice sends a common message W0 to Bob and Eve and an individual message W1 intended for Bob while treating Eve as the eavesdropper for W1.Bob estimates both messages, whereas Eve estimates only the common message.
  • Code construction: A code includes an encoder, decoders, an auxiliary message W′, and local randomness used to randomize message encoding.The auxiliary-message rate may vary with blocklength, and local randomness is known only to Alice.
  • Code construction: The eavesdropper is assumed to know the code, including the statistics of Alice’s local randomness.This makes secrecy depend on the induced joint distribution rather than on hiding the code or its randomization law.
  • Achievability: Reliability is measured by average decoding error, while secrecy is measured by a selected metric Si applied to W1 and Eve’s observation.A rate pair is achievable when both error probability and the chosen secrecy metric vanish as blocklength grows.
  • Wiretap specialization: With no common message, the model reduces to a wiretap channel whose randomness is split between local randomness and a uniformly distributed auxiliary message.The paper restricts attention to full secrecy rates R1 = Re when connecting to earlier equivocation-region results.

A. Capacity-Based Wiretap Codes and Strong Secrecy

Capacity-based wiretap codes use auxiliary subcodes tied to the eavesdropper’s channel capacity, but random instances can achieve weak secrecy capacity without achieving strong secrecy capacity. The paper therefore turns to channel resolvability for stronger secrecy results and general broadcast-channel regions.

  • Capacity-Based Wiretap Codes: Capacity-based codes set the auxiliary message rate just below the eavesdropper’s channel capacity and require auxiliary-message decodability given the eavesdropper’s observation and the confidential message.The construction uses R′_n = C_e − ϵ_n with ϵ_n tending to zero.
  • Strong-Secrecy Limitation: Random capacity-based wiretap codes can achieve the weak secrecy capacity while failing to achieve the strong secrecy capacity.This result holds for the specified symmetric discrete memoryless wiretap-channel setting and random code ensemble.
  • Scope and Limitation: The paper conjectures that this strong-secrecy limitation extends beyond random codes and symmetric channels, while Proposition 2 itself has narrower scope.A related remark establishes a non-random-code impossibility for a noiseless main channel and symmetric eavesdropper channel under metrics S2 and S1.
  • General Broadcast Channels: For arbitrary broadcast channels with confidential messages and a cost constraint, the secrecy-capacity region is the same across the stated strong secrecy metrics.The channel alphabets and transition probabilities may be arbitrary, including continuous channels and channels with memory.
  • Resolvability-Based Construction: The achievability proof combines superposition coding and binning, using channel resolvability to make the eavesdropper’s output distribution nearly independent of the confidential messages.Reliability and secrecy are established separately, then combined to obtain a single suitable code sequence.
  • Resolvability-Based Construction: The resulting framework supports rates beyond the eavesdropper’s channel capacity and can yield exponential decay of strong secrecy metrics under suitable conditions.The paper emphasizes designing practical schemes for the strongest secrecy metric despite region invariance across metrics.

C. Memoryless Broadcast Channels with Additive Cost Constraint

For memoryless broadcast channels with additive cost constraints, the paper specializes its general result and characterizes the secrecy-capacity region under several secrecy metrics. Under additional regularity conditions, the strongest metric also follows with exponential convergence.

  • Model: The memoryless specialization assumes transition probabilities factor across channel uses and imposes an additive cost constraint.The model includes channels that are not necessarily discrete.
  • Capacity Region: The secrecy-capacity region is identical for secrecy metrics S_i with i ∈ J2, 4K.The theorem gives the region for memoryless broadcast channels with confidential messages and additive cost constraint P.

X, Y, WY Z|X, Z

The memoryless wiretap specialization gives a secrecy capacity under additive cost constraints that is common to the stated secrecy metrics. Additional moment-generating-function conditions extend the result to the strongest metric and provide exponential decay.

  • Wiretap Capacity: The memoryless wiretap secrecy capacity with additive cost constraint is identical for secrecy metrics S_i with i ∈ J2, 4K.The result is the no-common-message specialization of the memoryless broadcast-channel theorem.
  • Wiretap Capacity: The admissible optimization uses random variables satisfying V → X → YZ and the expected cost condition E[c(X)] ⩽ P.These conditions define the feasible set for the secrecy-capacity expression.
  • Strong Secrecy: If the relevant moment-generating functions converge uniformly near zero and are differentiable at zero, the same capacity applies to metric S1.The condition concerns I(V; Z) and c(X) for the maximizing random variables.
  • Converse: For general memoryless channels, the converse follows from standard arguments with metric S4, while discrete memoryless channels also inherit a converse for metric S6.The paper distinguishes these converse routes by channel class and secrecy metric.
  • Strong Secrecy: Under the moment-generating-function conditions, S1(C_n) vanishes exponentially fast with n.This is stronger than the theorem’s stated asymptotic vanishing result.

VI. APPLICATIONS

The section applies channel resolvability to wireless, mixed, and compound wiretap channels, obtaining secrecy capacities and simpler proofs under strong secrecy metrics. It also highlights that mixed and compound channels can share capacities while requiring fundamentally different coding schemes.

  • Ergodic wireless channels: The wireless secrecy capacity maximizes over power allocation functions satisfying E[γ(Hm, He)] ⩽P.
  • Ergodic wireless channels: Channel resolvability gives a simple achievability proof for ergodic-fading wireless channels with full CSI.The channel is decomposed into independent Gaussian wiretap channels indexed by fading realizations and power allocation functions.
  • Mixed and compound channels: Mixed and compound wiretap channels with receiver CSI address uncertainty about the channel known imperfectly or not at the transmitter.Compound-channel secrecy and reliability must hold for every realized channel, whereas mixed channels use a distribution over channel components.
  • Mixed and compound channels: The mixed-wiretap secrecy capacity is the same for secrecy metrics Si with i ∈J2, 6K.
  • Mixed and compound channels: The compound-wiretap secrecy capacity with receiver CSI is likewise the same for secrecy metrics Si with i ∈J2, 6K.
  • Mixed and compound channels: Mixed and compound channels can have identical secrecy capacities even though their achieving coding schemes may be fundamentally different.
  • Mixed and compound channels: The general compound-channel result requires the number of channels K to remain fixed and independent of the blocklength n.
  • Mixed and compound channels: For Proposition 6, exponentially many compound channels are allowed when K = 2^βn with β < mink∈J1,KK ǫk.

C. Secret-Key Agreement from General Sources.

This section connects secret-key agreement from general sources to wiretap coding through a conceptual channel. It characterizes forward secret-key capacities and notes that the resulting coding mechanism is better understood through intrinsic randomness and privacy amplification than channel resolvability.

  • Source model: Secret-key agreement lets Alice and Bob distill a key from correlated observations X and Y while communicating over an unlimited-capacity public authenticated channel.The eavesdropper observes Z and all public communication.
  • Source model: A key-distillation strategy must achieve vanishing error, secrecy, and nonuniformity measures.The defining limits are lim n→∞Pe(Sn) = 0, lim n→∞Si(Sn) = 0, and lim n→∞U(Sn) = 0.
  • Capacity results: The forward secret-key capacity is the supremum of achievable key rates for the source model.
  • Capacity results: For i.i.d. discrete sources under S1, the capacity satisfies SK ⩽min (I(X; Y ), I(X, Y |Z)).
  • Capacity results: For i.i.d. sources, an achievable expression is max (I(X; Y ) −I(X; Z), I(X; Y ) −I(Y ; Z)).
  • Proof strategy: The achievability proof constructs a conceptual wiretap channel by publicly transmitting U ⊕X, with U independent and uniformly distributed.The resulting channel has input U and uses wiretap coding to obtain an achievable secret-key rate.
  • Scope and interpretation: For general sources, achievable key rates use conditional entropy rather than the mutual-information expressions used for wiretap channels.
  • Scope and interpretation: The proof provides limited insight into practical secret-key distillation because the relevant mechanisms are channel intrinsic randomness and privacy amplification, not channel resolvability.

VII. CONCLUSION

The conclusion presents channel resolvability as a simple mechanism for strong-secrecy analysis across generic secure-communication models. It also identifies code-design opportunities and directions for extending the framework.

  • Channel resolvability supports results for generic channels and stronger secrecy metrics than average information leakage.
  • The approach provides a conceptually simple way to derive secure achievable rates for mixed, compound, wireless, and other communication models.
  • The connection between strong secrecy and channel resolvability opens perspectives for code design.
  • Capacity-based wiretap codes cannot always achieve strong secrecy capacity, whereas resolvability-based approaches circumvent this weakness.
  • The coding mechanisms for secrecy in Shannon’s cipher system and wiretap channels could be combined, while secret-key agreement mechanisms warrant further study.

APPENDIX A SUPPORTING LEMMAS

The appendix supplies probabilistic and information-theoretic lemmas used to analyze random codes, resolvability, variational distance, and strong-secrecy failure. These tools support bounds on codeword distinctness and secrecy metrics.

  • Supporting lemmas: Chernoff-type bounds apply to i.i.d. real-valued variables when the moment generating function is locally uniformly convergent and differentiable at zero.
  • Supporting lemmas: The appendix states basic properties and data processing for variational distance.Variational distance obeys the triangle inequality and cannot increase under a common channel.
  • Resolvability analysis: The appendix combines random-coding lemmas with source-coding results to relate decoding error and resolvability for arbitrary sources.
  • Random coding: A random code with Mn ≜2^nR uniformly generated length-n codewords supports the appendix’s resolvability analysis under a rate condition involving the input alphabet size.
  • Random coding: For sufficiently small rates, all randomly generated codewords are distinct with probability tending to one as n grows.
  • Strong-secrecy analysis: For symmetric eavesdropper channels, Berry–Esseen analysis helps bound the relevant information-density probabilities.
  • Strong-secrecy analysis: Random capacity-based codes can retain nonvanishing secrecy leakage: S2(Cn) ⩾η and limn→∞S1(Cn) ⩾η∗ for positive constants.

A. Proof of Lemma 1

The proof uses symmetry of the random code construction and analyzes reliability through associated events. Standard arguments then show the expected error probability becomes small for sufficiently large blocklength under the stated condition.

  • Symmetry reduces the random-code analysis to representative events.
  • The proof analyzes reliability through the resulting events.
  • For sufficiently large n, standard arguments give E[Pe(Cn)] < ǫ under the stated condition.

B. Proof of Lemma 2

The proof bounds the secrecy quantity S2(Cn) by a variational distance between the eavesdropper distribution induced by each sub-codebook and a target distribution. Channel resolvability and random coding then make this distance, and hence S2(Cn), vanish.

  • The proof first develops an upper bound for S2(Cn) that is simpler to analyze.
  • The key bracketed term is a variational distance between two distributions at the eavesdropper’s channel output.
  • One distribution is induced by the uniformly selected codewords in a sub-codebook.
  • The other is induced by the input process conditioned on the auxiliary variable, so vanishing distance provides a sufficient secrecy condition.
  • Each sub-codebook is therefore required to be a channel resolvability code, established through a random coding argument.
  • The remaining bounds use symmetry, standard resolvability estimates, and auxiliary calculations to show the secrecy quantity becomes small for large n.

APPENDIX E PROOF OF THEOREM 3

Theorem 3 is proved by adapting the earlier random-coding construction while enforcing a power constraint through a suitable input distribution. Reliability and channel-resolvability bounds yield exponentially decreasing secrecy quantities, and Markov’s inequality selects a code satisfying both requirements.

  • The proof adapts Theorem 2 while showing S2(Cn) decreases exponentially and transferring the bound to S1(Cn).
  • The construction handles the power constraint by using an appropriate distribution during random code generation.
  • Theorem 3 introduces arbitrary auxiliary variables and imposes uniform convergence and differentiability assumptions on relevant moment-generating functions.
  • Reliability is established through a dedicated lemma, while channel-resolvability conditions control the secrecy term.
  • For sufficiently large n, E[S2(Cn)] ⩽ 2^-αγ,δn, and a specific code can be selected with small error and exponentially small secrecy.
  • The selected code also satisfies S1(Cn) ⩽ 2^-βγ,δn for some βγ,δ > 0.
Loading 1105.5419v3…