Multiterminal Secret Key Agreement at Asymptotically Zero Discussion Rate

In the multiterminal secret key agreement problem, a set of users want to discuss with each other until they share a common secret key independent of their discussion. We want to characterize the maximum secret key rate, called the secrecy capacity, asymptotically when the total discussion rate goes to zero. In the case of only two users, the capacity is equal to the Gács-Körner common information. However, when there are more than two users, the capacity is unknown. It is plausible that a multivariate extension of the Gács-Körner common information is the capacity, however, proving the converse is challenging. We resolved this for the hypergraphical sources and finite linear sources, and provide efficiently computable characterizations. We also give some ideas of extending the techniques to more general source models.

READ FULL TEXT VIEW PDF
POST COMMENT

Comments

There are no comments yet.

Authors

page 1

page 2

page 3

page 4

05/08/2018

Secrecy Capacity under Limited Discussion Rate for Minimally Connected Hypergraphical Sources

We investigate the secret key generation in the multiterminal source mod...
10/04/2019

Secret key agreement for hypergraphical sources with limited total discussion

We consider the multiterminal secret key agreement problem under the tot...
04/25/2019

Multiterminal Secret Key Agreement with Nearly No Discussion

We consider the secret key agreement problem under the multiterminal sou...
02/13/2020

Conditional Disclosure of Secrets: A Noise and Signal Alignment Approach

In the conditional disclosure of secrets (CDS) problem, Alice and Bob (e...
11/01/2018

Unique Information and Secret Key Agreement

The partial information decomposition (PID) is a promising framework for...
06/08/2021

On the Linear Capacity of Conditional Disclosure of Secrets

Conditional disclosure of secrets (CDS) is the problem of disclosing as ...
02/02/2021

Secret Key Agreement and Secure Omniscience of Tree-PIN Source with Linear Wiretapper

While the wiretap secret key capacity remains unknown for general source...
This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

I Introduction

We consider the multiterminal secret key agreement problem where a set of users want to agree on a common secret key after observing some private correlated sources and discussing in public at asymptotically zero rate. Following the work of [1], which showed that public discussion helped agree on a secret key, the problem was formulated in the two-user case by [2, 3]. The model was later extended to the case with a helper in [4] and the general multiterminal case in [5] with arbitrary number of users and helpers. The goal is to characterize the maximum achievable secret key rate called the secrecy capacity.

The trade-off between the secrecy capacity and discussion rate was first studied in [4]. However, the problem is difficult and only solvable or partially solvable in special cases, such as the case in [4] with certain order of discussion, the two-user gaussian case in [6, 7], the high-rate regime where the secrecy capacity is maximized [8, 9, 10], the multiterminal case in [11] with hypergraphical sources [12] and linear discussion, and the multiterminal case in [13, 14] with hypergraphical sources and the pairwise independent networks proposed in [15, 16].

We simplify the problem by considering the case with asymptotically zero discussion rate. Unlike the case with no discussion at all, some discussion is allowed as long as the rate is zero. While it is well-known that the secrecy capacity with no discussion is the Gács–Körner common information [17] because the problem formulations are the same, the secrecy capacity at asymptotically zero discussion rate appears to be unknown in the general multiterminal case with interactive public discussion. To the best of our knowledge, other than the special discussion model in [4], the equivalence was known only in the two-user case for the general source model, following from the result of [9] (evaluated using the double Markov inequality as in [8]). The proof techniques using Csiszár sum inequality does not seem to extend to the multiterminal case.

In this work, we conjecture that the secrecy capacity with no discussion is equivalent to the case with asymptotically zero discussion in the general multiterminal case. We show that the conjecture holds for both the hypergraphical sources and finite linear sources, and obtain explicit characterizations of the corresponding secrecy capacities. In proving the results, we also strengthened an upper bound on the secrecy capacity in [14] that uses the lamination technique in submodular function optimization. We also explain how the idea can be extended to more general source models to give non-trivial bounds.

Ii Problem formulation

We are given a finite set of users and a discrete memoryless multiple source

with the joint distribution denoted as

and a finite alphabet set

. (We will use sans serif font for random variables and the normal font their alphabet set.) Each user

can generate a private random variable independently, with . Then, user observes privately an -sequence i.i.d. generated according to , with .

The users can then discuss in public interactively in multiple rounds. More precisely, at the -th round, for some , some user broadcast to everyone in public the message

which is a function of the previous message and the private knowledge of user . For convenience, the entire sequence of public messages is denoted by

The users then identify and recover a secret key , satisfying the following recoverability and secrecy constraints: There exists some functions for such that

(2.1)
(2.2)

N.b., since we will focus on the converse proof techniques, weak secrecy is used to derive stronger results.

The secrecy capacity under the total discussion rate is defined as

(2.3)
(2.4)

We are interested in characterizing , namely, the secrecy capacity with asymptotically zero discussion rate.

Iii Preliminaries

Following from the result of Gács and Körner in [17], a secret key rate achievable without public discussion is as follows:

Proposition 3.1

where

(3.1)

is called the (multivariate) Gács–Körner common information.

The optimal solution is called the maximum common function, since it is a function of each , and its entropy is maximized. It can be shown that every common function of ’s is a function of . Although can be computed systematically using the ergodic decomposition in [17], the computation may take exponential time.

The proof of the achievable result is quite straightforward because, without any discussion, users can agree on perfectly with no error. From , a secret key of rate can be extracted by the usual compression technique. The challenge is prove the converse and resolve the following conjecture:

Conjecture 1

.

To simplify the problem, we further consider the following source models.

Definition 3.1 ([12])

The source is said to be hypergraphical if, for all , is equivalent to

(3.2)

up to bijections,111 is said to be a bijection of iff . where is the edge set and is called the edge function. The hypergraph and the edge (random) variables ’s define the source.

A simple example of the hypergraphical source is as follows:

Example 3.1

Let , and be uniformly random and independent bits. With , define

This source is hypergraphical with , , and .

Another source model we will consider is:

Definition 3.2 ([18])

The source is said to be a finite linear source if, for all , is equivalent to

(3.3)

up to bijections, where

is a uniformly random vectors with elements taking values from some finite field

, and is a deterministic matrix with elements from .

The following is an example of a finite linear source that is not hypergraphical.

Example 3.2

Again with , and being uniformly random and independent bits, define ,

where is the XOR operation. This is a finite linear source because, with ,

and

is uniformly distributed over

, where the matrix multiplications are over , and is uniformly over . Note that ’s are pairwise independent and so there is no edge variable with strictly positive entropy covering more than one node. There is no edge covering one node either, because each is completely determined by other ’s. However, , and so it cannot be a hypergraphical source with no edge variable.

Iv Main results

Conjecture 1 can be resolved in the affirmative for both hypergraphical and finite linear sources. The characterization of the capacity can also be evaluated more explicitly and computed efficiently.

Theorem 4.1

For hypergraphical sources (in Definition 3.1), with the optimal solution to (3.1) being

(4.1)

namely the edge variables observed by every user.

For the hypergraphical source defined in Example 3.1, we have and so . To the best of our knowledge, this simple result is not directly covered by any existing results.

Theorem 4.2

For finite linear sources (in Definition 3.2), with the optimal solution to (3.1) being

(4.2)

where is a matrix whose column space is , namely the intersection of the column spaces of all ’s. is also the maximum common subspace .

For the finite linear source defined in Example 3.2, the maximum common subspace of the column spaces of ’s is the trivial vector space . A non-trivial example is given below.

Example 4.1

Again with , and being uniformly random and independent bits, define ,

This is a finite linear source because, with ,

and is uniformly distributed over .

Before computing in (4.2), notice that does not have full column rank because the last column is the sum of the first two. We may remove the last column and consider instead

(4.3)

To compute , note that the null space of is spanned by with . Therefore, the matrix

(4.4)

spans the desired intersection . Hence, .

V Proofs

V-a Proof of Theorem 4.1

To prove the result for hypergraphical sources, we will strengthen the lamination bound in [14, Theorem 4.3] as follows:

Lemma 5.1

For any hypergraphical sources and partition of into at least two non-empty disjoint sets,

(5.1a)
(5.1b)

where as defined in (4.1).

N.b., the original bound in [14, (4.7)] has neither the term nor the condition in (5.1a).

To prove Theorem 4.1 using the above lemma, it suffices to show that for some partition , because then, (5.1a) with implies . Since is a common function of ’s, we have , which must be satisfied with equality as desired by Proposition 3.1. Now, substitute into (5.1b) the partition of into singletons:

which is within as desired because .

It remains to prove the above lemma.

Proof (Lemma 5.1)

By the recoverability condition (2.1), for some , we have

By [5, Lemma B.1] for interactive discussion ,

To bound , let be the same hypergraphical source as but with all edges such that removed. For convenience, write for , just like for . Since is determined by for any ,

where the last inequality is by the lamination technique. (See [19, Proposition B.1] and its application in [19, (B.10)].)

Altogether, we have

Assuming the secret key agreement scheme achieves , the above inequality implies (5.1a) as desired because by independence,

by the secrecy constraint (2.2) and the definition of the capacity (2.3), and

by (2.4).

V-B Proof of Theorem 4.2

To prove the result for finite linear sources, we first show the base case with two users, i.e., , and then extend it to the more general case with multiple users. The base case follows immediately from that of hypergraphical sources because of the following observation, the proof of which will be given later in this section:

Lemma 5.2

A finite linear source involving users is hypergraphical.

Unfortunately, the above result does not extend to . A counter-example is in Example (3.2), which gives a finite linear source that is not hypergraphical. To prove the desired Theorem 4.2 with the above lemma, we will use a more contrived argument below.

First of all, similar to the proof of Lemma 5.1, the recoverability constraint (2.1) implies that, for some ,

where by [5, Lemma B.1]. We will show by induction that

(5.1)

where as defined in (4.2) with being the maximum common subspace of the column spaces of ’s. It follows that

which implies that with by the secrecy constraint (2.2), definition (2.3) of the capacity and the discussion rate constraint (2.4). The inequality must be satisfied with equality because is a common function of ’s and so as desired.

To prove (5.1) by induction. For the base case ,

(5.2)

where the first equality is because is a common function of ’s, the second inequality follows again from the lamination technique in [19, Proposition B.1] since is hypergraphical by Lemma 5.2. For the induction, consider and any . Assume as an inductive hypothesis that

(5.3)

where and . Then,

where the first inequality is by the inductive hypothesis (5.3) and the fact that is a common function of all ’s. The last inequality is again by the lamination technique in [19, Proposition B.1] because and defines a finite linear source , which is also hypergraphical by Lemma 5.2. It remains to prove this lemma.

Proof (Lemma 5.2)

By (3.3), write and , for some uniformly random with elements from a finite field . Without loss of generality, we can choose and such that they both have full column ranks. This is because, if the column rank of is not full, any column of linearly dependent on others columns correspond to redundant observations that can be removed.

Let be the matrix such that as in (4.2). Without loss of generality, suppose

(5.4)

for some matrices . This is possible by some invertible transformations of the rows of

’s (post-multiplying an invertible matrix), because

is a common subspace of the column spaces of and .

It follows that

(5.5)

must have full column rank. Suppose to the contrary that does not have full column rank, i.e., for some row non-zero row vector . Then, is non-zero because, otherwise, is non-zero but , contradicting the assumption that has full column rank. Similarly, is non-zero. Hence, we can write , which is therefore in and therefore , contradicting the assumption that has full column rank.

To show that is hypergraphical, write

where

denotes the identity matrix. The above equalities can be easily verified by substituting the value of

in (5.5) to give (5.4). Since has full column rank, the elements of are independent and uniformly random over . Furthermore, since every column of and contains only one non-zero entry, the source is hypergraphical.

We will illustrate the above proof using Example 4.1. Recall the source written in (4.3) in terms of the matrices and . Recall also the matrix defined in (4.4) for (4.2) that spans the intersection of the column spaces of and . The orthogonal complements of in and are spanned respectively by

and so, as in (5.4), we can equivalently consider

With defined in (5.5), and

we have uniformly distributed over ,

Hence, is hypergraphical (see Definition 3.1) with , , and .

Vi Extensions to more general sources

In this work, we showed for hypergraphical and finite linear sources that the secrecy capacity at asymptotically zero discussion rate is given by the multivariate Gács–Körner common information. The main property for proving the results is the lamination technique in [14] for hypergraphical sources. In the case with two users , it simplifies to (5.2):

where is the maximum common function of and . The proof for finite linear source also boils down to this case, by noticing that a finite linear source for two users is a hypergraphical source. For more general source models, however, the above inequality does not hold, and so the techniques considered does not directly extend.

It is easy to show, however, that the above inequality still holds for the general sources if is replaced by a random variable

that satisfies the Markov chain

. In particular, can be the Wyner common information [20] between and . This allows us to derive upper bounds on for general sources such as

for any with and the Markov chains for all . For hypergraphical and finite linear sources, it can be shown that the tightest bound is given by the choice of being the Wyner common information between and . Since the Wyner common information is the same as the Gács–Körner common information for two-user hypergraphical or finite linear sources, the above bound is precisely . In general, however, Wyner common information may not be equal to the Gács–Körner common information, so the bound may not be tight. There are also possible improvements to the bound, by considering different ordering of elements in , and impose a Markov tree instead of a chain. Proving conjecture 1 for general sources remains an interesting open problem.

References

  • [1] C. H. Bennett, G. Brassard, and J.-M. Robert, “Privacy amplification by public discussion,” SIAM journal on Computing, vol. 17, no. 2, pp. 210–229, 1988.
  • [2] U. M. Maurer, “Secret key agreement by public discussion from common information,” IEEE Transactions on Information Theory, vol. 39, no. 3, pp. 733–742, 1993.
  • [3] R. Ahlswede and I. Csiszár, “Common randomness in information theory and cryptography—Part I: Secret sharing,” IEEE Transactions on Information Theory, vol. 39, no. 4, pp. 1121–1132, Jul. 1993.
  • [4] I. Csiszár and P. Narayan, “Common randomness and secret key generation with a helper,” IEEE Transactions on Information Theory, vol. 46, no. 2, pp. 344–366, 2000.
  • [5] I. Csiszár and P. Narayan, “Secrecy capacities for multiple terminals,” IEEE Transactions on Information Theory, vol. 50, no. 12, pp. 3047–3061, Dec. 2004.
  • [6] S. Watanabe and Y. Oohama, “Secret key agreement from correlated gaussian sources by rate limited public communication,” IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences, vol. 93, no. 11, pp. 1976–1983, 2010.
  • [7] ——, “Secret key agreement from vector gaussian sources by rate limited public communication,” IEEE Transactions on Information Forensics and Security, vol. 6, no. 3, pp. 541–550, 2011.
  • [8] H. Tyagi, “Common information and secret key capacity,” IEEE Transactions on Information Theory, vol. 59, no. 9, pp. 5627–5640, Sep. 2013.
  • [9] J. Liu, P. W. Cuff, and S. Verdú, “Common randomness and key generation with limited interaction,” CoRR, vol. abs/1601.00899, 2016.
  • [10] M. Mukherjee, N. Kashyap, and Y. Sankarasubramaniam, “On the public communication needed to achieve sk capacity in the multiterminal source model,” IEEE Transactions on Information Theory, vol. 62, no. 7, pp. 3811–3830, July 2016.
  • [11] T. A. Courtade and T. R. Halford, “Coded cooperative data exchange for a secret key,” IEEE Transactions on Information Theory, vol. 62, no. 7, pp. 3785–3795, July 2016.
  • [12] C. Chan and L. Zheng, “Mutual dependence for secret key agreement,” in Proceedings of 44th Annual Conference on Information Sciences and Systems, 2010.
  • [13] C. Chan, M. Mukherjee, N. Kashyap, and Q. Zhou, “When is omniscience a rate-optimal strategy for achieving secret key capacity?” in IEEE Information Theory Workshop (ITW), Sep. 2016, pp. 354–358.
  • [14] ——, “Secret key agreement under discussion rate constraints,” in IEEE International Symposium on Information Theory Proceedings (ISIT), June 2017, pp. 1519–1523.
  • [15] S. Nitinawarat and P. Narayan, “Perfect omniscience, perfect secrecy, and Steiner tree packing,” IEEE Transactions on Information Theory, vol. 56, no. 12, pp. 6490–6500, Dec. 2010.
  • [16] S. Nitinawarat, C. Ye, A. Barg, P. Narayan, and A. Reznik, “Secret key generation for a pairwise independent network model,” IEEE Transactions on Information Theory, vol. 56, no. 12, pp. 6482–6489, Dec 2010.
  • [17] P. Gács and J. Körner, “Common information is far less than mutual information,” Problems of Control and Information Theory, vol. 2, no. 2, pp. 149–162, Feb. 1972.
  • [18] C. Chan, “Generating secret in a network,” Ph.D. dissertation, Massachusetts Institute of Technology, 2010.
  • [19] C. Chan, M. Mukherjee, N. Kashyap, and Q. Zhou, “Secret key agreement under discussion rate constraints,” CoRR, vol. abs/1701.05008, 2017. [Online]. Available: http://arxiv.org/abs/1701.05008
  • [20] A. Wyner, “The common information of two dependent random variables,” IEEE Transactions on Information Theory, vol. 21, no. 2, pp. 163–179, Mar 1975.