PaperlayerView exact revision on arXiv

Source-linked AI summary

Key-Reuse Vulnerability of Phase-Keyed Fourier-Curve Modulation: Relation Leakage and Key-Refresh Cost on Coded Links

Bin Han, Muxia Sun, H. Vincent Poor, Hans D. Schotten

arXiv:2610.01484v1cs.CR

TL;DR

Key-space size and high error rates for key-less receivers do not establish security when a harmonically coupled waveform reuses its key. The paper characterizes data-cancelling key relations and turns them into a non-data-aided attack. In the evaluated coded link, the attack compromises most one-codeword settings, while refresh schedules meeting the selected resistance criterion carry substantial key cost.

  • Problem

    Key-space size and wrong-key error rates do not bound what an eavesdropper can infer when a reused key and harmonically coupled waveform admit data-cancelling statistics.

    Source: §I · p. 1

  • Method

    The paper characterizes exposed key characters through a modular relation lattice and uses a non-data-aided relation-moment estimator to attack a coded link.

    Source: §I · pp. 1–2

  • Results

    With one key per 168-symbol codeword, the attack meets the predeclared BLERE upper-95%-limit criterion of 0.1 in eleven of twelve cells; at ηE = 0.9, every configuration costs at least 1.52 fresh key bits per information bit.

    Source: B. Reuse dependence · p. 4, D. Finite key protocol and key-refresh… · p. 5

  • Takeaways & Limitations

    Tangent artificial noise and the tested odd-harmonic family raise measured error at some intermediate reuse lengths, but neither removes the one-codeword vulnerability.

    Source: C. Artificial noise and relation order · p. 4, §VII · p. 6

    The refresh-cost comparison depends on the product-grid protocol and the selected operational error criterion.

    Source: §VI · p. 5

Abstract

from arXiv · show

The security of keyed modulation is often argued from the key-space size and the error rate of a key-less receiver. This evidence fails when the key is reused and the waveform is harmonically coupled. For a phase-keyed Fourier-curve constellation, whose $k$ tones share one data parameter, integer relations among the harmonic indices yield data-cancelling mixed moments of the received tones that expose key characters. A modular relation lattice characterizes the exposed characters; for consecutive harmonics, third-order moments recover the relative phases and a fourth-order moment completes the key up to cyclic relabeling whenever its coefficient is nonzero, as in all evaluated settings. A non-data-aided relation-moment estimator turns this leakage into an attack that never enumerates the key space. On a regular $(3,6)$ LDPC-coded link, one key per 168-symbol codeword leaves the eavesdropper a block error rate below $0.04$ at the middle noise level, and the attack meets a predeclared $0.1$ compromise criterion in eleven of twelve operating points. Tangent artificial noise and a harmonic set without relations below order four raise her measured error rate at intermediate reuse lengths but do not remove the one-codeword vulnerability. For a grid of $2^{128}$ protocol keys at the middle noise level, equal-length refresh schedules that keep a $95\%$ lower confidence bound of her block error rate above $0.9$ consume at least $1.52$ fresh key bits per information bit, $1.52$ times the entropy rate of a one-time pad on the data.

I. INTRODUCTION

The introduction argues that key size and wrong-key error rates do not establish security when a reused key and harmonically coupled waveform permit data-cancelling statistics. It studies which key characters such statistics expose, then evaluates a relation-moment attack and the entropy cost of refresh.

Motivation

  • Integer relations among harmonic indices cancel the shared data parameter and expose key-phase functions through mixed moments.For tones with h_r + h_s = h_{r+s}, the product Z_rZ_sZ_{r+s} estimates a function of the key without a search.Source: §I · p. 1

Related work

  • Power-law recovery, cumulants, bispectral methods, and code-aided estimators already use data-cancelling statistics; this paper identifies their relevance to harmonically coupled keyed designs.A common secret rotation can be recovered up to constellation symmetry, while symbolwise remapping driven by a cryptographic generator inherits security from that generator.Source: §I · p. 1

Contributions

  • The paper characterizes exposed key characters with a modular relation lattice and evaluates a non-data-aided attack and refresh cost on a coded link.For consecutive harmonics, third-order relations recover relative phases and a fourth-order relation can complete the key up to cyclic relabeling when its coefficient is nonzero; the odd-harmonic comparison has no exposing relation below order four.Source: §I · pp. 1–2

Scope

  • The analysis concerns waveforms whose observed components share one latent data parameter, and the paper delimits its relation argument from related keyed designs.The study treats key reuse and the secret entropy consumed by refresh schedules that frustrate the evaluated attack.Source: §I · pp. 1–2

II. SYSTEM, PROTOCOL, AND THREAT MODEL

The system uses phase-keyed modulation in which each symbol occupies multiple harmonically related tones driven by one data parameter. It permits tangent artificial noise and compares consecutive and odd harmonic families.

A. Phase-keyed harmonic modulation

  • Each symbol occupies k complex tones whose phases are integer multiples of one data parameter, offset by a secret phase vector.The modulation may add tangent artificial noise along the curve.Source: A. Phase-keyed harmonic modulation · p. 2
  • The consecutive family uses h = (1, …, k), while the comparison family uses odd harmonics h = (1, 3, …, 2k − 1).The scalar tangent artificial-noise sample is independent across symbols, and receiver noise is independent across tones and symbols.Source: A. Phase-keyed harmonic modulation · p. 2
  • Bob uses the covariance-aware max-log demapper as the legitimate receiver, and Eve applies it after estimating the key.Source: A. Phase-keyed harmonic modulation · p. 2

B. Key reuse and finite key protocol

A codeword is divided into equal-length segments, each using an independent key, under a public labeling convention that removes a cyclic key ambiguity. The key-cost analysis draws keys uniformly from a finite product grid.

B. Key reuse and finite key protocol

  • One LDPC codeword occupies n_s symbols and is split into n_s/L segments, each using an independent key for L symbols.Source: B. Key reuse and finite key protocol · p. 2
  • The signal set is invariant under a phase-key shift that only relabels symbols; keys are drawn from a fundamental domain with the labeling fixed publicly.No secret label shift is added.Source: B. Key reuse and finite key protocol · p. 2
  • For key-cost analysis, keys are drawn uniformly from a product grid with entropy H(K_b) = bk bits per refresh.At b = 8 and k = 16, the text specifies a product grid of 2128 protocol keys; the attack does not search that grid.Source: B. Key reuse and finite key protocol · p. 2

C. Threat model and metric

The threat model measures compromise through Eve’s coded block error rate while she reuses unknown segment keys without known payload or signaling. Integer relations among harmonics yield data-cancelling moments that expose key characters, with residual ambiguity and moment-order conditions determined by the harmonic family.

C. Threat model and metric

  • Eve knows the system, code, decoder, and attack details but not the segment keys, and the primary metric is her coded block error rate.She receives no pilot, preamble, header, CRC, or known payload under a key.Source: C. Threat model and metric · p. 2

III. RELATION LEAKAGE

  • For c in the modular relation lattice, the mixed-moment law is independent of the data; when K_c is nonzero, its mean reveals the key character e^{i⟨c,φ⟩}.Rotation-invariant noise and independence across tones remove noise terms from the moment.Source: §III · p. 2
  • Observed relation characters determine the key only up to the annihilator of their integer span; using the full lattice leaves cyclic relabeling ambiguity of order M/g.Equal real rank alone is insufficient: the observed relations must generate the full lattice over the integers.Source: §III · pp. 2–3
  • For consecutive harmonics, positive-coefficient third-order moments recover relative phases, and a fourth-order relation completes the key up to cyclic relabeling when its coefficient is nonzero.At (M, k) = (64, 16), that coefficient vanishes only at isolated β values and is nonzero at the evaluated β values 0 and 0.3.Source: §III · p. 3
  • For the odd harmonic set (1, 3, …, 31) at M = 64, no nonzero lattice relation has order at most three, while fourth-order relations generate the lattice.Its completing coefficient is negative at β = 0.3, and the known sign correction absorbs it.Source: §III · p. 3

IV. RELATION-MOMENT ATTACK

The attack selects exact-zero and modular relations whose moments expose the key, then estimates it without exhaustive key-space enumeration.

IV. RELATION-MOMENT ATTACK

  • The fixed relation set combines exact-zero relations S0 with modular relations S1 satisfying ⟨c, h⟩ = 64; the tested sets generate the lattice of index 64.At the evaluated β values, all selected moment coefficients are nonzero, leaving only cyclic relabeling as ambiguity.Source: §IV · p. 3
  • The nondegeneracy condition holds on the tested β grid, but not at every β because the completion-relation coefficients vanish at isolated values..Source: §IV · p. 3
  • The attack estimates modular relation phases, averages them on the circle, and uses segment-local parity-check counts to select among candidate keys.The selector uses only decisions from the segment and considers at most 24 candidates.Source: §IV · pp. 3–4

A. Setup

The experiments test two harmonic families, three noise levels, and reuse lengths dividing a 168-symbol codeword, with fresh instances in every cell.

A. Setup

  • The study uses a regular (3,6) LDPC code of length 1008 and rate 506/1008, with codewords spanning 168 symbols.It evaluates (M, k) = (64, 16), Gray labeling, and 50 scaled min-sum iterations.Source: A. Setup · p. 4
  • The evaluation covers consecutive and odd harmonic families, β ∈ {0, 0.3}, three noise levels, and twelve reuse lengths that divide 168.The noise levels are σ ∈ {0.10, 0.13, 0.16}; each cell has 500 independent instances.Source: A. Setup · p. 4
  • Bob decoded every codeword without error in every cell, with a one-sided 95% upper block-error bound of approximately 6.0·10^-3 per cell.The reported Eve error rate equals that of an Eve with independent receiver noise at the same SNR.Source: A. Setup · p. 4

B. Reuse dependence

Eve’s coded error rate falls as key reuse grows, reaching below 0.04 at one key per 168-symbol codeword in all but one configuration.

B. Reuse dependence

  • At L = 168 and σ = 0.13, Eve’s BLERE is 0.004, 0.014, 0.006, and 0.038 across the four configurations, and the attack meets the criterion in eleven of twelve cells.The criterion is an upper 95% limit of BLERE at most 0.1; the exception is the odd family with AN at σ = 0.16, where BLERE = 0.096 with upper limit 0.125.Source: Table II · p. 4, B. Reuse dependence · p. 4
  • Eve’s error rate decreases monotonically with reuse length, remaining one for L ≤ 8 and dropping below 0.05 only at L = 168.It falls below 0.9 between L = 24 and L = 42, depending on configuration, and crosses about 0.5 near L = 56 to 84.Source: B. Reuse dependence · p. 4
  • At every intermediate reuse length, a better channel for Eve lowers her error rate, with the same ordering at all three noise levels.At L = 168, Eve’s error rate remains below 0.04 except for the noted odd-family-with-AN cell.Source: B. Reuse dependence · p. 4

C. Artificial noise and relation order

Artificial noise and the odd harmonic family can raise Eve’s error at intermediate reuse lengths, but neither removes the one-codeword vulnerability.

C. Artificial noise and relation order

  • At L = 168, Eve succeeds with or without tangent AN, and neither AN nor the odd harmonic family removes the one-codeword vulnerability.AN raises measured error by up to 0.21 at L = 56; for the consecutive family, the difference interval excludes zero at L = 42, 56, and 84 across all three noise levels.Source: C. Artificial noise and relation order · p. 4
  • The odd family raises Eve’s error by up to 0.16 at σ = 0.13 and 0.26 at σ = 0.16 in some cells, while other intervals include zero.Because the families differ in multiple relation and geometry properties, the modest, nonuniform difference may reflect their joint effect.Source: C. Artificial noise and relation order · p. 4
  • Minimum relation order identifies which characters leak, while the full relation structure affects how quickly they can be estimated.AN raises predicted and measured key error at every tested reuse length, consistent with lower relation-phase SNR.Source: C. Artificial noise and relation order · pp. 4–5
  • The relation-phase covariance approximation agrees with measured median key error within 12% in most tested settings, but overstates it by up to 44% for the consecutive family with AN.The approximation applies locally before canonicalization and candidate selection, when retained moments are nonzero and residuals stay on one wrapped branch.Source: Table IV · p. 5, C. Artificial noise and relation order · p. 5

D. Finite key protocol and key-refresh cost

At σ = 0.13, the paper compares key-refresh cost with Eve’s coded BLERE and reports the cost at the largest tested reuse length meeting a specified error-bound criterion. The finite-grid key-error rates are close to the continuous-key rates, but exact grid-key recovery is uncommon in the measured segments.

D. Finite key protocol and key-refresh cost

  • Across 64 cells, finite-grid and continuous-key error rates differ by at most 0.046, with every 95% Newcombe interval for the difference including zero.The selected candidate equals the transmitted grid key in less than 10% of segments.Source: D. Finite key protocol and key-refresh… · p. 5
  • Fig. 3 plots Eve’s coded BLERE against fresh key bits per information bit for reuse lengths from 14 to 168 symbols at σ = 0.13.The dotted line denotes the one-time pad on the information bits; ρK normalizes fresh key bits per symbol by 3.01 information bits per symbol.Source: Figure 3 · p. 5, D. Finite key protocol and key-refresh… · p. 5
  • At ηE = 0.9, the 2128-key grid requires at least 1.52 fresh key bits per information bit; the consecutive family without AN requires 3.04.The latter value reflects its lower bound of 0.886 at L = 21; Table V reports ρK at the largest qualifying tested L.Source: D. Finite key protocol and key-refresh… · p. 5, Table V · p. 5

VI. DISCUSSION

The discussion finds that independent key refresh can match or exceed the one-time-pad entropy rate under the tested large-grid, 0.9 criterion, while the comparison depends on protocol and criterion. The conclusion also notes that stronger attacks and deployment choices can affect the operational transition from algebraic leakage to message recovery.

VI. DISCUSSION

  • For the tested 2128-key grid and post-hoc 0.9 criterion, every tested independent-refresh schedule frustrating the attack consumes at least as much secret entropy as a one-time pad on the information bits.The comparison is protocol- and criterion-dependent; the 264-key grid and the 0.5 criterion give different costs.Source: §VI · p. 5
  • A short-key cryptographic generator can make frequent refresh cheap, but confidentiality then rests on that generator, which could also encrypt the bits.The modulation geometry itself provides no fresh secret entropy or computational security guarantee.Source: §VI · p. 6
  • The measured operational transition applies to one regular (3, 6) code, labeling, and decoder, and reuse length may depend on those choices.Channel-estimation errors and front-end impairments remain unstudied; code-aware attacks, known frame structure, or multiple antennas would lower Eve’s error rates further.Source: §VI · p. 6

VII. CONCLUSION

  • In the coded Fourier-curve case study, the evaluated attack recovers messages reliably when one key spans a 168-symbol codeword, while tangent AN and the tested odd-harmonic family do not remove that vulnerability.Both checks raise Eve’s measured block error rate at several intermediate reuse lengths.Source: §VII · p. 6

Related papers

Loading 2610.01484v1…