We consider the multiterminal secret key agreement problem where a set of users want to agree on a common secret key after observing some private correlated sources and discussing in public at asymptotically zero rate. Following the work of , which showed that public discussion helped agree on a secret key, the problem was formulated in the two-user case by [2, 3]. The model was later extended to the case with a helper in  and the general multiterminal case in  with arbitrary number of users and helpers. The goal is to characterize the maximum achievable secret key rate called the secrecy capacity.
The trade-off between the secrecy capacity and discussion rate was first studied in . However, the problem is difficult and only solvable or partially solvable in special cases, such as the case in  with certain order of discussion, the two-user gaussian case in [6, 7], the high-rate regime where the secrecy capacity is maximized [8, 9, 10], the multiterminal case in  with hypergraphical sources  and linear discussion, and the multiterminal case in [13, 14] with hypergraphical sources and the pairwise independent networks proposed in [15, 16].
We simplify the problem by considering the case with asymptotically zero discussion rate. Unlike the case with no discussion at all, some discussion is allowed as long as the rate is zero. While it is well-known that the secrecy capacity with no discussion is the Gács–Körner common information  because the problem formulations are the same, the secrecy capacity at asymptotically zero discussion rate appears to be unknown in the general multiterminal case with interactive public discussion. To the best of our knowledge, other than the special discussion model in , the equivalence was known only in the two-user case for the general source model, following from the result of  (evaluated using the double Markov inequality as in ). The proof techniques using Csiszár sum inequality does not seem to extend to the multiterminal case.
In this work, we conjecture that the secrecy capacity with no discussion is equivalent to the case with asymptotically zero discussion in the general multiterminal case. We show that the conjecture holds for both the hypergraphical sources and finite linear sources, and obtain explicit characterizations of the corresponding secrecy capacities. In proving the results, we also strengthened an upper bound on the secrecy capacity in  that uses the lamination technique in submodular function optimization. We also explain how the idea can be extended to more general source models to give non-trivial bounds.
Ii Problem formulation
We are given a finite set of users and a discrete memoryless multiple source
with the joint distribution denoted asand a finite alphabet set
. (We will use sans serif font for random variables and the normal font their alphabet set.) Each usercan generate a private random variable independently, with . Then, user observes privately an -sequence i.i.d. generated according to , with .
The users can then discuss in public interactively in multiple rounds. More precisely, at the -th round, for some , some user broadcast to everyone in public the message
which is a function of the previous message and the private knowledge of user . For convenience, the entire sequence of public messages is denoted by
The users then identify and recover a secret key , satisfying the following recoverability and secrecy constraints: There exists some functions for such that
N.b., since we will focus on the converse proof techniques, weak secrecy is used to derive stronger results.
The secrecy capacity under the total discussion rate is defined as
We are interested in characterizing , namely, the secrecy capacity with asymptotically zero discussion rate.
Following from the result of Gács and Körner in , a secret key rate achievable without public discussion is as follows:
is called the (multivariate) Gács–Körner common information.
The optimal solution is called the maximum common function, since it is a function of each , and its entropy is maximized. It can be shown that every common function of ’s is a function of . Although can be computed systematically using the ergodic decomposition in , the computation may take exponential time.
The proof of the achievable result is quite straightforward because, without any discussion, users can agree on perfectly with no error. From , a secret key of rate can be extracted by the usual compression technique. The challenge is prove the converse and resolve the following conjecture:
To simplify the problem, we further consider the following source models.
Definition 3.1 ()
The source is said to be hypergraphical if, for all , is equivalent to
up to bijections,111 is said to be a bijection of iff . where is the edge set and is called the edge function. The hypergraph and the edge (random) variables ’s define the source.
A simple example of the hypergraphical source is as follows:
Let , and be uniformly random and independent bits. With , define
This source is hypergraphical with , , and .
Another source model we will consider is:
Definition 3.2 ()
The source is said to be a finite linear source if, for all , is equivalent to
up to bijections, where
is a uniformly random vectors with elements taking values from some finite field, and is a deterministic matrix with elements from .
The following is an example of a finite linear source that is not hypergraphical.
Again with , and being uniformly random and independent bits, define ,
where is the XOR operation. This is a finite linear source because, with ,
is uniformly distributed over, where the matrix multiplications are over , and is uniformly over . Note that ’s are pairwise independent and so there is no edge variable with strictly positive entropy covering more than one node. There is no edge covering one node either, because each is completely determined by other ’s. However, , and so it cannot be a hypergraphical source with no edge variable.
Iv Main results
Conjecture 1 can be resolved in the affirmative for both hypergraphical and finite linear sources. The characterization of the capacity can also be evaluated more explicitly and computed efficiently.
For the hypergraphical source defined in Example 3.1, we have and so . To the best of our knowledge, this simple result is not directly covered by any existing results.
For the finite linear source defined in Example 3.2, the maximum common subspace of the column spaces of ’s is the trivial vector space . A non-trivial example is given below.
Again with , and being uniformly random and independent bits, define ,
This is a finite linear source because, with ,
and is uniformly distributed over .
Before computing in (4.2), notice that does not have full column rank because the last column is the sum of the first two. We may remove the last column and consider instead
To compute , note that the null space of is spanned by with . Therefore, the matrix
spans the desired intersection . Hence, .
V-a Proof of Theorem 4.1
To prove the result for hypergraphical sources, we will strengthen the lamination bound in [14, Theorem 4.3] as follows:
For any hypergraphical sources and partition of into at least two non-empty disjoint sets,
where as defined in (4.1).
To prove Theorem 4.1 using the above lemma, it suffices to show that for some partition , because then, (5.1a) with implies . Since is a common function of ’s, we have , which must be satisfied with equality as desired by Proposition 3.1. Now, substitute into (5.1b) the partition of into singletons:
which is within as desired because .
It remains to prove the above lemma.
Proof (Lemma 5.1)
By the recoverability condition (2.1), for some , we have
By [5, Lemma B.1] for interactive discussion ,
To bound , let be the same hypergraphical source as but with all edges such that removed. For convenience, write for , just like for . Since is determined by for any ,
Altogether, we have
Assuming the secret key agreement scheme achieves , the above inequality implies (5.1a) as desired because by independence,
V-B Proof of Theorem 4.2
To prove the result for finite linear sources, we first show the base case with two users, i.e., , and then extend it to the more general case with multiple users. The base case follows immediately from that of hypergraphical sources because of the following observation, the proof of which will be given later in this section:
A finite linear source involving users is hypergraphical.
Unfortunately, the above result does not extend to . A counter-example is in Example (3.2), which gives a finite linear source that is not hypergraphical. To prove the desired Theorem 4.2 with the above lemma, we will use a more contrived argument below.
where by [5, Lemma B.1]. We will show by induction that
where as defined in (4.2) with being the maximum common subspace of the column spaces of ’s. It follows that
which implies that with by the secrecy constraint (2.2), definition (2.3) of the capacity and the discussion rate constraint (2.4). The inequality must be satisfied with equality because is a common function of ’s and so as desired.
To prove (5.1) by induction. For the base case ,
where the first equality is because is a common function of ’s, the second inequality follows again from the lamination technique in [19, Proposition B.1] since is hypergraphical by Lemma 5.2. For the induction, consider and any . Assume as an inductive hypothesis that
where and . Then,
where the first inequality is by the inductive hypothesis (5.3) and the fact that is a common function of all ’s. The last inequality is again by the lamination technique in [19, Proposition B.1] because and defines a finite linear source , which is also hypergraphical by Lemma 5.2. It remains to prove this lemma.
Proof (Lemma 5.2)
By (3.3), write and , for some uniformly random with elements from a finite field . Without loss of generality, we can choose and such that they both have full column ranks. This is because, if the column rank of is not full, any column of linearly dependent on others columns correspond to redundant observations that can be removed.
Let be the matrix such that as in (4.2). Without loss of generality, suppose
for some matrices . This is possible by some invertible transformations of the rows of
’s (post-multiplying an invertible matrix), becauseis a common subspace of the column spaces of and .
It follows that
must have full column rank. Suppose to the contrary that does not have full column rank, i.e., for some row non-zero row vector . Then, is non-zero because, otherwise, is non-zero but , contradicting the assumption that has full column rank. Similarly, is non-zero. Hence, we can write , which is therefore in and therefore , contradicting the assumption that has full column rank.
To show that is hypergraphical, write
denotes the identity matrix. The above equalities can be easily verified by substituting the value ofin (5.5) to give (5.4). Since has full column rank, the elements of are independent and uniformly random over . Furthermore, since every column of and contains only one non-zero entry, the source is hypergraphical.
We will illustrate the above proof using Example 4.1. Recall the source written in (4.3) in terms of the matrices and . Recall also the matrix defined in (4.4) for (4.2) that spans the intersection of the column spaces of and . The orthogonal complements of in and are spanned respectively by
and so, as in (5.4), we can equivalently consider
With defined in (5.5), and
we have uniformly distributed over ,
Hence, is hypergraphical (see Definition 3.1) with , , and .
Vi Extensions to more general sources
In this work, we showed for hypergraphical and finite linear sources that the secrecy capacity at asymptotically zero discussion rate is given by the multivariate Gács–Körner common information. The main property for proving the results is the lamination technique in  for hypergraphical sources. In the case with two users , it simplifies to (5.2):
where is the maximum common function of and . The proof for finite linear source also boils down to this case, by noticing that a finite linear source for two users is a hypergraphical source. For more general source models, however, the above inequality does not hold, and so the techniques considered does not directly extend.
It is easy to show, however, that the above inequality still holds for the general sources if is replaced by a random variable
that satisfies the Markov chain. In particular, can be the Wyner common information  between and . This allows us to derive upper bounds on for general sources such as
for any with and the Markov chains for all . For hypergraphical and finite linear sources, it can be shown that the tightest bound is given by the choice of being the Wyner common information between and . Since the Wyner common information is the same as the Gács–Körner common information for two-user hypergraphical or finite linear sources, the above bound is precisely . In general, however, Wyner common information may not be equal to the Gács–Körner common information, so the bound may not be tight. There are also possible improvements to the bound, by considering different ordering of elements in , and impose a Markov tree instead of a chain. Proving conjecture 1 for general sources remains an interesting open problem.
-  C. H. Bennett, G. Brassard, and J.-M. Robert, “Privacy amplification by public discussion,” SIAM journal on Computing, vol. 17, no. 2, pp. 210–229, 1988.
-  U. M. Maurer, “Secret key agreement by public discussion from common information,” IEEE Transactions on Information Theory, vol. 39, no. 3, pp. 733–742, 1993.
-  R. Ahlswede and I. Csiszár, “Common randomness in information theory and cryptography—Part I: Secret sharing,” IEEE Transactions on Information Theory, vol. 39, no. 4, pp. 1121–1132, Jul. 1993.
-  I. Csiszár and P. Narayan, “Common randomness and secret key generation with a helper,” IEEE Transactions on Information Theory, vol. 46, no. 2, pp. 344–366, 2000.
-  I. Csiszár and P. Narayan, “Secrecy capacities for multiple terminals,” IEEE Transactions on Information Theory, vol. 50, no. 12, pp. 3047–3061, Dec. 2004.
-  S. Watanabe and Y. Oohama, “Secret key agreement from correlated gaussian sources by rate limited public communication,” IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences, vol. 93, no. 11, pp. 1976–1983, 2010.
-  ——, “Secret key agreement from vector gaussian sources by rate limited public communication,” IEEE Transactions on Information Forensics and Security, vol. 6, no. 3, pp. 541–550, 2011.
-  H. Tyagi, “Common information and secret key capacity,” IEEE Transactions on Information Theory, vol. 59, no. 9, pp. 5627–5640, Sep. 2013.
-  J. Liu, P. W. Cuff, and S. Verdú, “Common randomness and key generation with limited interaction,” CoRR, vol. abs/1601.00899, 2016.
-  M. Mukherjee, N. Kashyap, and Y. Sankarasubramaniam, “On the public communication needed to achieve sk capacity in the multiterminal source model,” IEEE Transactions on Information Theory, vol. 62, no. 7, pp. 3811–3830, July 2016.
-  T. A. Courtade and T. R. Halford, “Coded cooperative data exchange for a secret key,” IEEE Transactions on Information Theory, vol. 62, no. 7, pp. 3785–3795, July 2016.
-  C. Chan and L. Zheng, “Mutual dependence for secret key agreement,” in Proceedings of 44th Annual Conference on Information Sciences and Systems, 2010.
-  C. Chan, M. Mukherjee, N. Kashyap, and Q. Zhou, “When is omniscience a rate-optimal strategy for achieving secret key capacity?” in IEEE Information Theory Workshop (ITW), Sep. 2016, pp. 354–358.
-  ——, “Secret key agreement under discussion rate constraints,” in IEEE International Symposium on Information Theory Proceedings (ISIT), June 2017, pp. 1519–1523.
-  S. Nitinawarat and P. Narayan, “Perfect omniscience, perfect secrecy, and Steiner tree packing,” IEEE Transactions on Information Theory, vol. 56, no. 12, pp. 6490–6500, Dec. 2010.
-  S. Nitinawarat, C. Ye, A. Barg, P. Narayan, and A. Reznik, “Secret key generation for a pairwise independent network model,” IEEE Transactions on Information Theory, vol. 56, no. 12, pp. 6482–6489, Dec 2010.
-  P. Gács and J. Körner, “Common information is far less than mutual information,” Problems of Control and Information Theory, vol. 2, no. 2, pp. 149–162, Feb. 1972.
-  C. Chan, “Generating secret in a network,” Ph.D. dissertation, Massachusetts Institute of Technology, 2010.
-  C. Chan, M. Mukherjee, N. Kashyap, and Q. Zhou, “Secret key agreement under discussion rate constraints,” CoRR, vol. abs/1701.05008, 2017. [Online]. Available: http://arxiv.org/abs/1701.05008
-  A. Wyner, “The common information of two dependent random variables,” IEEE Transactions on Information Theory, vol. 21, no. 2, pp. 163–179, Mar 1975.