Stealthy Secret Key Generation

TL;DR

This paper analyzes the capacity of stealthy secret key generation (SSKG) in covert communication systems, showing that stealth constraints do not reduce capacity under certain Markov conditions and providing practical conditions for achieving these bounds.

Contribution

It demonstrates that SSKG capacity bounds are unaffected by stealth constraints and relaxes conditions for attaining capacity, with practical implications for Gaussian satellite models.

Findings

SSKG capacity bounds are unaffected by stealth constraints.

Capacity can be achieved under Markov chain conditions.

Practical conditions for Gaussian satellite models are derived.

Abstract

In this work, we consider a complete covert communication system, which includes the source-model of a stealthy secret key generation (SSKG) as the first phase. The generated key will be used for the covert communication in the second phase of the current round and also in the first phase of the next round. We investigate the stealthy SK rate performance of the first phase. The derived results show that the SK capacity lower and upper bounds of the source-model SKG are not affected by the additional stealth constraint. This result implies that we can attain the SSKG capacity for free when the sequences observed by the three terminals Alice ($X^n$), Bob ($Y^n$) and Willie ($Z^n$) follow a Markov chain relationship, i.e., $X^n-Y^n-Z^n$. We then prove that the sufficient condition to attain both, the SK capacity as well as the SSK capacity, can be relaxed from physical to stochastic degradedness. In order to underline the practical relevance, we also derive a sufficient condition to attain the degradedness by the usual stochastic order for Maurer's fast fading Gaussian (satellite) model for the source of common randomness.

Figures

Equations

$$\log K={\omega }_n\sqrt{n}[(1+\xi )D(P_Z||Q_Z)-(1-\xi )D(P_Y||Q_Y){]}^{+},$$

$$P_{Z^n\mathbf{F}|U^n}$$

$$P_{Z^n\mathbf{F}}$$

$$Q_{Z^n\mathbf{F}}$$

$$\text{mathds}{P}_e\triangleq \text{mbox}Pr(K\ne \hat{K})$$

$$R-H(K)$$

$$D(P_{K{Z}^n\mathbf{F}}||P_K{P}_{Z^n\mathbf{F}})+D(P_{Z^n\mathbf{F}}||Q_{Z^n\mathbf{F}})$$

$$=$$

$$\triangleq$$

$$D(P_{K{Z}^n\mathbf{F}}||P_K{Q}_{Z^n\mathbf{F}})+\log |\mathcal{K}|-H(K)=$$

$$=$$

$$R_{SSK}=1+\frac{o(1)}{\sqrt{n}}bits/channeluse.$$

$$\max \{I(X;Y)-I(X,Z),I(Y;X)-I(Y;Z)\}\le C_{SK}^{Eff}\le \min \{I(X;Y),I(X,Y|Z)\}.$$

$$C_{SK}^{Eff}=I(X;Y)-I(X;Z).$$

$$D(P_{K{Z}^n\mathbf{F}}||P_K{Q}_{Z^n\mathbf{F}})$$

$$=D(P_{Z^n\mathbf{F}|K}||Q_{Z^n\mathbf{F}}|P_K),$$

$$\text{mathds}{E}_{\mathcal{C}}[D(P_{Z^n\mathbf{F}|K}||Q_{Z^n\mathbf{F}}|P_K)]\le \text{mathds}{E}_{Z^n\mathbf{F}{U}^n}\left[\log \left(\frac{P_{Z^n\mathbf{F}|U^n}}{L_1{Q}_{Z^n\mathbf{F}}}+1\right)\right],$$

$$\frac{P_{Z^n\mathbf{F}|U^n}}{L_1{Q}_{Z^n\mathbf{F}}}$$

$$\stackrel{(b)}{=}\frac{P_{Z^n\mathbf{F}{U}^n}}{L_1{P}_{Z^n{U}^n}}\frac{1}{Q_{\mathbf{F}}}$$

$$=\frac{P_{\mathbf{F}|Z^n{U}^n}}{L_1{Q}_{\mathbf{F}}},$$

$$\text{mathds}{E}_{\mathcal{C}}[D(P_{Z^n\mathbf{F}|K}||Q_{Z^n\mathbf{F}}|P_K)]\le \text{mathds}{E}_{Z^n\mathbf{F}{U}^n}\left[\log \left(\frac{P_{\mathbf{F}|Z^n{U}^n}}{L_1{Q}_{\mathbf{F}}}+1\right)\right].$$

$$d_1$$

$$d_2$$

$$P\left(\frac{N(a|x^n)}{n}\le (1+\delta )P_X(a)\right)\le e^{-{\delta }^2{P}_X(a)n/3}.$$

$$P(x^n\notin T_{\delta })\le 2|S_X|e^{-{\delta }^2{\mu }_{X}n/3},$$

$$d_1$$

$$\stackrel{(b)}{\le }\log \left(\frac{2^{-n[H(F|UZ)-\delta ]}}{L_1{2}^{-n(1+ϵ)H(F)}}+1\right)$$

$$\stackrel{(c)}{=}\log \left(2^{-n\left(R_1-I(F;UZ)-{ϵ}^{\prime }\right)}+1\right),$$

$$R_1>I(F;UZ)\stackrel{(a)}{=}I(U\oplus X;UZ)\stackrel{(b)}{=}H(U)-H(X|Z),$$

$$d_2$$

$$\stackrel{(b)}{\le }\sum _{(z^n,u^n,\mathbf{f})\notin T_{\delta }^n(P_{Z^n,U^n,\mathbf{F}})}{P}_{Z^n\mathbf{F}{U}^n}(z^n,\mathbf{f},u^n)\log \left(\frac{1}{{\mu }_f}+1\right)$$

$$\stackrel{(c)}{=}P((z^n,u^n,\mathbf{f})\notin T_{\delta }^n(P_{Z^n,U^n,\mathbf{F}}))\log \left(\frac{1}{{\mu }_f}+1\right)$$

$$\stackrel{(d)}{\le }2|S_{ZUF}|e^{-{\delta }^2{\mu }_{ZUF}n/3}\log \left(\frac{1}{{\mu }_f}+1\right),$$

$$n(R+R_1)$$

$$=H(U^n\oplus X^n,Y^n)-H(U^n\oplus X^n,Y^n|U^n)$$

$$\stackrel{(a)}{=}H(U^n)+H(Y^n)-H(X^n,Y^n)$$

$$=H(U^n)-H(X^n|Y^n),$$

$$nR$$

Full text

I Introduction

To realize a secure physical layer, concealing the action of transmitting signals from a warden Willie can be seen as a first step to protect information. If the action of the transmission is detected by Willie, the secrecy/confidentiality (or the hidability [1]) provided by the wiretap coding [2] can be interpreted as a further protection. There are two main notions to conceal the transmission of signals (or to attain the deniability [1]): 1) stealthy communications [3], [1], and 2) covert communications/low probability of detection [4], [1, 5, 6]. Roughly speaking, both notions conceal the desired signal in an ambient signal, such that Willie is not able to distinguish from his observed distributions whether a meaningful transmission is ongoing or not. In particular, in the first notion the meaningful and meaningless signals are transmitted separately in time. Because these two signals have close distributions at Willie, he cannot distinguish them. In contrast, in the second notion the transmitter is either ON or OFF and then the meaningful signal is superimposed on the meaningless one, i.e., the additive noise. The number of messages, which can be covertly transmitted, follows the square root law[4, 1, 5, 6] of the block length, i.e., the corresponding Shannon’s rate is zero. In contrast, a positive capacity can be achievable for the stealth communications. Note that for both notions, if the main (Bob’s) channel has no advantage over Willie’s channel, additional keys are necessary to conceal the signals, e.g., [5], [6]. For a more detailed comparison please refer to [7].

In this paper we aim to design a complete covert communication system by investigating the stealthy secret key generation (SSKG) scheme with rate-unlimited public discussions. In each round of such transmission, SSKG in the first phase can provide keys to enable the covert communications in the second phase, when Willie has a stronger channel than Bob [6]. Instead of using normal SKG, the SSKG can avoid Willie’s awareness during the first phase. Therefore, combining the first with the second phase, we can attain the complete covert communication. On the contrary, normal SKG schemes may utilize public communications for advantage distillation, information reconciliation, and privacy amplification [8], which may raise Willie’s attention. Therefore, directly applying the normal SKG scheme for the keys violates the constraints of stealthy/covert communications. Note that when the divergence between the distributions of channel outputs for meaningful and meaningless signals at Willie is higher than that at Bob, secret keys shared between Alice and Bob are necessary [6, Theorem 2] to achieve covert communications. These keys are used to switch between different codebooks to calm Willie.

The reason we consider stealth but not covert communications for the SKG is due to the latency. It is known that covert communications result in a zero rate when the block length approaches infinity (but the number of transmitted messages can be positive) [6], [5]. Even under finite block length, the extreme low rate due to the covert communications constraint will incur an extremely high latency if, for example, we exploit covert communications in the public discussion to avoid Willie’s awareness. Further theoretical analysis on the minimum rate of public discussion necessary for maximum SK rate can be referred to [9]***Please note that this reference considers the model where Willie observes an independent source to Alice’s and Bob’s observation.. The main contributions of this work are summarized as follows:

• •

We consider the stealthy source-model SKG and the effective secrecy [3] for the source-model SKG. Based on the effective secrecy constraint, we derive the capacity lower and upper bounds for SSKG, which correspond to those of SKG without the stealth constraint. It implies that the stealthy SK capacity is unchanged when the common randomness is degraded.

• •

We then prove that the sufficient condition to attain the SSK capacity can be relaxed from physical to stochastic degradedness.

• •

We also derive a sufficient condition to attain the degradedness by the usual stochastic order [10] for Maurer’s fast fading Gaussian (satellite) model [11] for the source of common randomness.

The rest of the paper is organized as follows. In Section II we introduce the preliminaries and the considered system model. In Section III we derive our main results. In Section IV we derive the sufficient condition to attain the degradedness. Finally Section V concludes this paper.

Notation: Upper case normal/bold letters denote random variables/random vectors (or matrices), which will be defined when they are first mentioned; lower case bold letters denote vectors. And we denote the probability mass function (pmf) by $P$. The entropy of $X$ is defined as $H(X)$. The mutual information between two random variables $X$ and $Y$ is denoted by $I(X;Y)$. The divergence between distributions $P_{X}$ and $P_{Y}$ is denoted by $D(P_{X}||P_{Y})$. The complementary cumulative density function (CCDF) is denoted by $\bar{F}_{X}(x)=1-F_{X}(x)$, where $F_{X}(x)$ is the CDF of $X$. The notion $\,X\sim\,F$ denotes that the random variable $X$ follows the distribution $F$. The subscript $i$ in $X_{i}$ denotes the $i$-th symbol and $X^{i}\triangleq[X_{1},\,X_{2},\,\cdots,\,X_{i}]$. $X-Y-Z$ denotes the Markov chain. $o(.)$ is the little-o notation for computational complexity. Let $\lceil.\rceil$ denote the ceil operator. All logarithms are with base 2. The stochastic independence between $X$ and $Y$ is denoted by $X\perp\!\!\!\!\perp Y$.

II Preliminaries and system model

From [6, Theorem 2] we know that given two channels to Bob and Willie, respectively, if Willie can distinguish meaningful and meaningless signals better than Bob, the following amount of secret key bits are necessary to enable covert communications:

[TABLE]

where $P_{Y}$and $Q_{Y}$ are the output distributions at Bob when Alice is ON and OFF, respectively. Same definitions for $P_{Z}$ and $Q_{Z}$ at Willie; $\omega_{n}\sqrt{n}$ is the number of the transmitted non-innocent symbols within the codeword length $n$ with the constraint $\omega_{n}=o(1)\cap\omega(1/\sqrt{n})$ when $n\rightarrow\infty$. On the contrary, if Bob can distinguish meaningful or meaningless signals better than Willie in terms of the divergence of these two distributions, no additional keys are needed for covert communications. However, for the former case to generate the key, normal SKG schemes may attract Willie’s attention. Therefore, to attain complete covert communications, we investigate the SKG with the stealth constraint. In the considered system, there are two phases for each round of the complete covert communication as shown in Fig. 1. In the first phase, Alice and Bob will use the SSKG to generate keys. In the second phase, part of the generated keys are used for the covert communications to fulfill (1). Note that the remaining keys will be used for the next round of SSKG, which will be explained later†††A one-time initial key should be shared between Alice and Bob before the whole operation, which is out of the scope of this work.. In the following we focus on the development of the first phase, where the $n$-time source observations at Alice, Bob, and Willie are denoted by $X^{n}$, $Y^{n}$, and $Z^{n}$, respectively, following the distribution $P_{X^{n}Y^{n}Z^{n}}=\prod_{i=1}^{n}P_{XYZ}$ with alphabets $\mathcal{X},\,\mathcal{Y},\,\mathcal{Z}$, respectively. Denote the public discussion between Alice and Bob by a vector $\bm{F}\in\mathcal{X}^{r}$ through a noiseless channel, from which Willie can perfectly observe $\bm{F}$.

The main step for deriving the SSK capacity lower bound in this paper hinges on constructing a conceptual wiretap channel (CWTC) as in [12], where we set $r=n$. Note that the selection of $r=n$ is due to the construction of the CWTC. In [13], the authors proposed a different scheme with $r=1$ to achieve the same SK capacity lower bound. We construct an equivalent wiretap codebook $\{U^{n}(m,w)\}$, where $m=1,\cdots,L$ and $w=1,\cdots,L_{1}$, $L\triangleq 2^{nR}$ and $L_{1}\triangleq 2^{nR_{1}}$ are the numbers of secure and confusion messages, respectively; $m$ and $w$ are uniformly selected, respectively; $U^{n}(m,w)\in\mathcal{X}^{n},\,\forall(m,w)$. In addition, $(Z^{n},\bm{F},U^{n})\sim P_{Z^{n}\bm{F}U^{n}}=\prod_{i=1}^{n}P_{ZFU}=\prod_{i=1}^{n}P_{ZF|U}P_{U}$, where we consider the equivalent channel from Alice to Willie as:

[TABLE]

i.e., the equivalent channel output at Willie is $(Z^{n},\,\bm{F})$. Similarly, the equivalent channel output at Bob is $(Y^{n},\,\bm{F})$. Let $U^{n}$ be independent to $\{X^{n},\,Y^{n},\,Z^{n}\}$. To consider the behavior of stealth, the distributions of the meaningful and meaningless signals at the equivalent channel output at Willie are respectively expressed as:

[TABLE]

In this work, we consider the following constraints:

[TABLE]

where (5) is the average error probability constraint at Bob; (6) is the uniformity constraint of the keys; (7) is the effective secrecy constraint, where the first term denotes the non-confusion [3] in a strong secrecy manner. In addition, the second term of (7) denotes the non-stealth. We can further rearrange (7) by the following:

[TABLE]

Borrowing the terminology from [3], we coin (8) as the effective secrecy for SSKG. The main difference of this work to [3] will be discussed later.

In fact, we can combine the uniformity constraint of the SKG (6) with (8) as follows:

[TABLE]

Note that a common assumption for the public discussion channel is that all parties can access the same discussed signal. To operate under this assumption, additional keys shared between Alice and Bob are necessary for them to distinguish the meaningful signal when Willie is kept unaware, which is one of the main reason that we need the SSKG in the first phase. Otherwise, from channel resolvability it is clear that Bob cannot distinguish whether the received signal is meaningful or meaningless, either. We define the rate of the additional keys as $R_{k,st}$. In the following we derive a SSK rate generated by the SSKG, namely, $R_{SSK}$, which is sufficient to encompass both $R_{k,st}$ (for the first phase in the next round of transmission) and the key rate required by the covert communications (for the second phase in the current round).

Lemma 1**.**

To achieve a complete covert communication system, the following SK rate $R_{SSK}$ is sufficient

[TABLE]

Proof.

For each discussion it takes at most 1 bit to indicate that it is meaningful or not. Therefore, we set $R_{k,st}=1$ due to the specific use of public channel [12], which results in $r=n$. In addition, the square root law of the key rate required by covert communications [6, Theorem 2] results in the key rate upper bound $o(1)/\sqrt{n}$. ∎

Remark 1**.**

The generated SSK bits can be used in different ways for the first phase of each round of transmission. For example, the SSK bit can be used to indicate either each transmitted symbol, or $n$-symbol (i.e., the length of the SSKG), are meaningful or not. Lemma 1 corresponds to the former case, which consumes the largest number of keys. Therefore, Lemma 1 provides us an upper bound of SSK rate for a complete covert communication. On the other hand,

III Main Result And Proof

Theorem 1**.**

The lower and upper bounds of the stealthy secret key capacity $C_{SK}^{Eff}$ of the source-model stealthy secret key generation given a discrete memoryless source $(\mathcal{X},\mathcal{Y},\mathcal{Z},P_{X,Y,Z})$ are

[TABLE]

Remark 2**.**

Note that we do not directly apply the effective secrecy [3] which includes both secrecy and stealth constraints, to the public discussion in SKG problems. In contrast, we impose the stealth constraint to the CWTC [12] of the SKG and the secrecy constraint is still applied to the source-model SKG.

Unlike the wiretap channel with the stealth constraint whose capacity result is shown in [3], Theorem 1 only provides the lower and upper bounds. These bounds coincide with those of the secret key capacity without the stealth constraint. However, the same upper and lower bounds of the secret key capacity do not guarantee that the secret key capacity is unchanged when we impose the additional stealth constraint. Therefore, we consider the following case in which the two bounds match. This case leads to the fact that we can get the SSKG for free even with the additional stealth constraint.

Corollary 1**.**

For the discrete memoryless source $(\mathcal{X},\mathcal{Y},\mathcal{Z},P_{XYZ})$, if $X-Y-Z$ forms a Markov chain, then

[TABLE]

Remark 3**.**

By applying the quantization scheme used in [14, Proof of Theorem 3.3 and Remark 3.8] or [15, Appendix B], we may extend the SK rate results in Theorem 1 and Corollary 1 to the Gaussian source.

The proofs are derived in the following subsections.

III-A Lower Bound of $C_{SK}^{Eff}$

To derive the lower bound of $C_{SK}^{Eff}$ in (11), we first decompose the RHS of (8) as follows:

[TABLE]

where (a) follows the chain rule of divergence from [16, Th.2.2.2].

Based on the CWTC, we then apply the channel resolvability analysis [17] to find the rate constraint on $R_{1}$, i.e., the rate of confusion messages for the codebook generation, which guarantees that the effective secrecy constraint (7) is fulfilled.

From the random coding analysis derived in Appendix I, we have:

[TABLE]

where we recall that $L_{1}=2^{\lceil nR_{1}\rceil}$ is the number of confusion message per bin, which is to be designed to guarantee that (14) is asymptotically zero. The main difference of this proof to that in [3] is that, by constructing a CWTC for the considered SKG model, we introduce an additional channel output at both Bob and Willie. This difference makes the considered conceptual channel distinct from that in [3], and those results cannot directly be applied.

To proceed, we reexpress the ratio in the logarithm on the right hand side (RHS) of (14) as follows:

[TABLE]

where (a) is due to the fact that $Z^{n}$ and $\bm{F}$ are independent when the discussion $\bm{F}$ is meaningless, whose pmf is denoted by $Q_{\bm{F}}$; (b) is due to the fact that $U^{n}$ is selected to be independent to $Z^{n}$, i.e., $P_{Z^{n}U^{n}}=P_{Z^{n}}P_{U^{n}}$.

Then we can rewrite (14) as follows:

[TABLE]

Similar to [3], the RHS of (16) can be divided into two cases as follows according to whether $(z^{n},\,\bm{f},\,u^{n})$ are jointly typical or not:

[TABLE]

where $T_{\delta}^{n}$ follows the $\delta$-robust typicality [18] definition for the subsequent derivation. Note that the set of sequences $x^{n}$ satisfying the definition of robust typicality is denoted by $T_{\delta}^{n}(P_{X})$.

Remark 4**.**

Note that even though $Z^{n}$ and $\bm{F}$ are independent and $Z^{n}$ and $U^{n}$ are independent by assumption, that does not mean $Z^{n}$, $\bm{F}$, and $U^{n}$ are necessarily generated according to $P_{Z^{n},\,\bm{F},\,U^{n}}=P_{Z^{n}}P_{\bm{F},\,U^{n}}$ or $P_{Z^{n},\,\bm{F},\,U^{n}}=P_{Z^{n}}P_{\bm{F}}P_{U^{n}}$. In fact, since pairwise independence does not imply mutual independence [19, Chapter 7.1, 7.2], there exists joint distribution $P_{Z^{n},\,\bm{F},\,U^{n}}$ such that we can apply the jointly typical arguments.

The Chernoff bound and the important upperbound which will be used later are restated in the following.

Lemma 2**.**

*(Chernoff Bound [18, Lemma 16]:) For every $a\in\mathcal{X},$

[TABLE]

Lemma 3**.**

(Upper bound of the probability of non-typical set [18, Lemma 17]:)

[TABLE]

where $S_{X}\triangleq\{x\in\mathcal{X}:\,P(x)>0\}$ and $\mu_{x}\triangleq\min_{x\in S_{X}}P(x)$.

Note that the total rate constraint in the CWTC, i.e., Bob should be able to decode both the secret and confusion messages successfully, which is a point to point transmission problem without secrecy, can be seen from [18]. Therefore, we neglect the proof.

Next, we derive the constraint on $R_{1}$ as follows:

[TABLE]

where (a) is by [18, Lemma 18, Lemma 20] for the typicality and conditional typicality bounds; (b) is by the fact that the sum probability of jointly typical set is less than 1; (c) is by the definition of $L_{1}$ and $\epsilon^{\prime}\triangleq\epsilon(1+H(U))$. Then we know that $d_{1}\rightarrow 0$ when $n\rightarrow\infty$ if

[TABLE]

where (a) is by the specific use of the public discussion according to [12, Theorem 3], $\oplus$ is the modulo addition in $\mathcal{X}$; (b) is due to the fact that $U$ is uniformly distributed followed by the crypto lemma. In addition, we can derive that $d_{2}\rightarrow 0$ as $n\rightarrow\infty$ as follows:

[TABLE]

where (a) is due to the fact that $P_{\bm{F}|U^{n}Z^{n}}(\bm{f}|u^{n}z^{n})\leq 1$ and $L_{1}>1$, and therefore, removing $P_{\bm{F}|U^{n}Z^{n}}(\bm{f}|u^{n}z^{n})/L_{1}$ will upper bound $d_{2}$; (b) is by lower bounding $Q_{\bm{F}}^{n}(\bm{f})$ with $\mu_{f}=\min_{\bm{f}\in S_{\bm{F}}}Q_{\bm{F}}(\bm{f})$, where $S_{\bm{F}}\triangleq\{Q_{\bm{F}}\in\mathcal{X}^{r}:P(\bm{f})>0\}$; (c) is by definition of probability; (d) is by Lemma 3. From (21) it can be easily seen that if $n\rightarrow\infty$, $d_{2}\rightarrow 0$ exponentially fast.

Then from (19) and (21) it is clear that (7) is fulfilled.

From the CWTC construction we know that the following rate between Alice and Bob is achievable:

[TABLE]

where (a) is due to the crypto lemma and the selection of $U^{n}$ is independent to $Y^{n}$. Then from (20) and (22), we can derive the achievable SSK rate as follows:

[TABLE]

where (a) is by substituting (20) in addition to the assumption of memoryless and independent and identically distributed (i.i.d.) common randomness. Due to symmetry between Alice and Bob, their role can be exchanged and the other lower bound derived. This completes the proof.

Note that from the chain rule of the divergence we know that

[TABLE]

Since the left hand side of (24) is constrained by (7) and the conditional divergence is nonnegative, we know that the effective secrecy of the SSKG implies $D(P_{\bm{F}}||Q_{\bm{F}})\leq\epsilon$.

Remark 5**.**

When applying the crypto lemma in (20) or (22) for unbounded $X$, e.g., Gaussian cases, we may follow the argument in [20, Appendix B]. In particular, a mutual information gap $\delta_{1}$ can be introduced. Note that $\delta_{1}\rightarrow 0$ when the modulo size approaches infinity.

III-B Upper Bound of $C_{SK}^{Eff}$

In this subsection we derive the upper bound of $C_{SK}^{Eff}$ as follows, which is mainly adapted from the normal steps to derive the upper bound of source-model SKG, e.g., [8, Sec. 4.2.1], with modification to encompass the effective secrecy constraint:

[TABLE]

where (a) is by (6); (b) is by definition of divergence and the fact that divergence is positive; (c) is from (7); (d) is due to Fano’s inequality: $H(K|\hat{K},\bm{F},Z^{n})\leq\epsilon_{1}$ and by defining $\epsilon_{2}\triangleq 2\epsilon+\epsilon_{1}$; (e) follows the chain rule $K-X^{n}R_{X}\bm{F}^{B}-Y^{n}R_{Y}\bm{F}^{A}-\hat{K}$, where $R_{X}$ and $R_{Y}$ are the local randomness, $\bm{F}^{A}$ and $\bm{F}^{B}$ are the discussion signals sent by Alice and Bob, respectively, and $\bm{F}=(\bm{F}^{A},\,\bm{F}^{B})$; (f) is due to [8, Lemma 4.2]; (g) is due to the fact that the local randomness $(R_{X},R_{Y})$ is selected to be independent to $(X^{n},Y^{n},Z^{n})$; (h) follows from the fact that $(X,Y,Z)$ is a memoryless source.

Following the same steps, we can derive another upper bound without conditioning on $Z$, which completes the proof.

Remark 6**.**

Other tighter outer bounds derived by, e.g., the intrinsic conditional information [8, P. 130] and reduced intrinsic conditional information [8, P. 133] can be proved unchanged even when the stealthy public discussion is considered. This is because that those derivation is irrelevant to the stealth constraint.

IV On the Sufficient Conditions for Degraded Common Randomness

In the following, we prove that the sufficient condition to achieve $C_{SK}^{Eff}=I(X;Y)-I(X;Z)$, i.e., the common randomness forming a Markov chain $X-Y-Z$, which is physically degraded, can be relaxed to be stochastically degraded. We then show that the relaxed condition can be fulfilled in a broader sense by considering Maurer’s fast fading Gaussian (satellite) model [11]. More specifically, there exists a central random source $S$ passing through fast fading additive white Gaussian noise (AWGN) channels and then observed as $X$, $Y$, and $Z$ at Alice, Bob, and Willie, respectively. We apply the usual stochastic order [10] to derive a sufficient condition on the fading channels such that $C_{SK}^{Eff}$ is achieved. The derived sufficient condition provides a simple way to verify the stochastic degradedness and thereby to identify the effective SK capacity. We first give the definition on the degraded relation between the common randomness followed by our result.

Definition 1**.**

A source of common randomness $(\mathcal{X},\mathcal{Y},\mathcal{Z},P_{X\tilde{Y}\tilde{Z}})$ is called stochastically degraded if the conditional marginal distributions $P_{\tilde{Y}|X}$ and $P_{\tilde{Z}|X}$ are identical to those of another source of common randomness $(\mathcal{X},\mathcal{Y},\mathcal{Z},P_{XYZ})$ following the physical degradedness, i.e., $X-Y-Z$.

Theorem 2**.**

If a source of common randomness $(\mathcal{X},\mathcal{Y},\mathcal{Z},P_{X\tilde{Y}\tilde{Z}})$ is stochastically degraded such that $P_{\tilde{Y}|X}=P_{Y|X}$ and $P_{\tilde{Z}|X}=P_{Z|X}$, where $X-Y-Z$, then $C_{SK}^{Eff}=I(X;Y)-I(X;Z)$.

Proof.

We prove that the stochastically degraded source $(X,\tilde{Y},\tilde{Z})$ implies that the corresponding CWTC is also stochastically degraded. This implies that $C_{SK}^{Eff}$ is the same as that of the CWTC from a physically degraded source of common randomness by the same marginal property of WTC. We start from checking the CWTC of the source $(X,Y,Z)$, where the equivalently received signals at Bob and Willie are $Y^{\prime}\triangleq(Y,U\oplus X)$ and $Z^{\prime}\triangleq(Z,U\oplus X)$, respectively. If $X-Y-Z$, then $U-Y^{\prime}-Z^{\prime}$, i.e., the CWTC is a physically degraded one, which can be proved by showing $I(U;Z^{\prime}|Y^{\prime})=0$ as follows:

[TABLE]

where (a) is by definition of $Y^{\prime}$ and $Z^{\prime}$; (b) is by the chain rule of entropy; (c) is by the crypto lemma and $U$ is selected to be independent to $Y$ and $Z$; (d) is again by the chain rule of entropy; (e) is from the fact that given $U$, we can know $X$ from $U\oplus X$; (f) is by again by the selection that $U$ is selected to be independent to $X$, $Y$ and $Z$; (g) is due to $X-Y-Z$. Due to the CWTC, we can invoke the same marginal property [21, Lemma 2.1]: if there exist other equivalent channel outputs $Y^{\prime\prime}\triangleq(\tilde{Y},U\oplus X)$ and $Z^{\prime\prime}\triangleq(\tilde{Z},U\oplus X)$ at Bob and Willie, respectively, and if $P_{Y^{\prime\prime}|U}=P_{Y^{\prime}|U}$ and $P_{Z^{\prime\prime}|U}=P_{Z^{\prime}|U}$, then the two WTCs have the same capacity-equivocation region. Since

[TABLE]

where (a) is due to the crypto lemma and (b) is by the selection of $U$ to be independent to the common randomness, we then have $P_{Y^{\prime}|U}=P_{Y}$. Similarly, we have $P_{Z^{\prime}|U}=P_{Z}$, $P_{Y^{\prime\prime}|U}=P_{\tilde{Y}}$, and $P_{Z^{\prime\prime}|U}=P_{\tilde{Z}}$. If $(U,Y^{\prime\prime},Z^{\prime\prime})$ forms a stochastically degraded WTC corresponding to the physically degraded WTC $(U,Y^{\prime},Z^{\prime})$, from [22, Lemma 13.16] we have

[TABLE]

where (a) is by $P_{Y^{\prime\prime}|U}=P_{Y^{\prime}|U}=P_{Y}$. Therefore, by $P_{Z^{\prime\prime}|U}=P_{Z^{\prime}|U}$, we have

[TABLE]

Now consider the stochastically degraded source of common randomness $(X,\tilde{Y},\tilde{Z})$ fulfilling $P_{\tilde{Y}|X}=P_{Y|X}$ and $P_{\tilde{Z}|X}=P_{Z|X}$. Similar to CWTC, we consider the following property for the stochastically degraded source $(X,\tilde{Y},\tilde{Z})$ according to Definition 1:

[TABLE]

where (a) is by $P_{\tilde{Y}|X}=P_{Y|X}$. After marginalization over $X$ on both sides of (29), we get

[TABLE]

In addition, we can derive that

[TABLE]

where (a) is by definitions of $Y^{\prime}$ and $Z^{\prime}$ and due to (26); (b) is by the crypto lemma; (c) is by the selection of $U$. From (IV) we know that the expressions of the stochastic degradedness of the source and CWTC, i.e., (28) and (30), are the same. Then it follows that the stochastically degraded $(X,\tilde{Y},\tilde{Z})$ implies that $(U,Y^{\prime\prime},Z^{\prime\prime})$ is also stochastically degraded, vice versa. In addition, by the same marginal property, the WTCs formed by $(U,Y^{\prime},Z^{\prime})$ and $(U,Y^{\prime\prime},Z^{\prime\prime})$ have the same secrecy capacity, which completes the proof. ∎

From Theorem 2 we can have the following observation.

Corollary 2**.**

The lower bound in Theorem 1 is tight for stochastically degraded source of common randomness $(X,\,\tilde{Y},\,\tilde{Z})$.

Proof.

Due to same marginal property, we have $P_{\tilde{Y}|X}=P_{Y|X}$ and $P_{\tilde{Z}|X}=P_{Z|X}$, which imply $P_{\tilde{Y}}=P_{Y}$ and $P_{\tilde{Z}}=P_{Z}$. Then by definition of mutual information, we can easily see that

[TABLE]

∎

Remark 7**.**

However, the upper bound in Theorem 1 cannot be tight when Theorem 2 is valid. This is because

[TABLE]

where (a) is by the same marginal property. Note that $I(X;\tilde{Z}|\tilde{Y})$ cannot be zero since $I(X;\tilde{Z}|\tilde{Y})=0$ if and only if $X-\tilde{Y}-\tilde{Z}$ [16, Theorem 2.5]. But here there is no such Markov chain $X-\tilde{Y}-\tilde{Z}$.

In the following we give an example scenario of Theorem 2.

Example 1: Consider Maurer’s fast fading Gaussian (satellite) model [11] as follows:

[TABLE]

where $N_{Y}$ and $N_{Z}$ are independent AWGNs at Bob and Willie, respectively, while both are with zero mean and unit variance; $A_{X}$ and $A_{Z}$ follow CDFs $F_{X}$ and $F_{Z}$, respectively, are the i.i.d. fast fading channel gains from the source $S$ to Alice and Willie, respectively. Note that $Y$ and $Z$ have no degradedness relation in general due to the random fading. Commonly, we only consider deterministic channel gains with the order $a_{X}^{2}\geq a_{Z}^{2}$ to form the stochastic degradedness, where $a_{X}$ and $a_{Z}$ are realizations of $A_{X}$ and $A_{Z}$, respectively. However, the following result broadens the scenarios to get the degradedness among different observations of the same source.

Theorem 3**.**

If the random channels $A_{X}$ and $A_{Z}$ fulfill $\bar{F}_{{A_{X}^{2}}}(x)\geq\bar{F}_{{A_{Z}^{2}}}(x)$ for all $x$, where the subscripts denote the absolute square of the channels, then $(X,Y,Z)$ is equivalent to the observations of a source $(\hat{X},\hat{Y},\hat{Z})$, which is degraded, where $\hat{X}=\hat{A}_{X}S$, $\hat{Y}=\hat{A}_{X}S+N_{Y}$, $\hat{Z}=\hat{A}_{Z}S+N_{Z}$, $\hat{A}_{X}^{2}=F_{A_{X}^{2}}^{-1}(U)$, $\hat{A}_{Z}^{2}=F_{A_{Z}^{2}}^{-1}(U)$, $U\sim$Unif(0,1), $U\perp\!\!\!\!\perp\{N_{Y},N_{Z},S\}$.

Proof.

To proceed, we first introduce the following definition and theorem.

Definition 2**.**

[10, (1.A.3)] For random variables $A$ and $B$, $A\leq_{st}B$ if and only if $\bar{F}_{A}(a)\leq\bar{F}_{B}(a)$ for all $a$.

Let $A=_{st}A^{\prime}$ denote that $A$ and $A^{\prime}$ have the same distribution.

Theorem 4**.**

Coupling [23]: $A\leq_{st}B$ if and only if there exists random variables $\hat{A}=_{st}A$ and $\hat{B}=_{st}B$ such that $\hat{A}\leq\hat{B}$ almost surely.

Therefore, from Theorem 4 we have observations at Bob and Willie as $\hat{Y}=\hat{A}_{X}S+N_{Y}$ and $\hat{Z}=\hat{A}_{Z}S+N_{Z}$, respectively, where $\hat{A}_{X}^{2}\geq\hat{A}_{Z}^{2}$ almost surely, and $F_{A_{X}^{2}}(x)=F_{\hat{A}_{X}^{2}}(x)$ and $F_{A_{Z}^{2}}(x)=F_{\hat{A}_{Z}^{2}}(x)$, for all $x$. Similar to the proof steps in Theorem 2, by the same marginal property when considering the CWTC, $(\hat{X},\hat{Y},\hat{Z})$ form equivalently stochastically degraded observations to the original ones $(X,Y,Z)$ in the sense of having the same SK capacity. Therefore, it is clear that $\bar{F}_{{A_{X}^{2}}}(x)\geq\bar{F}_{{A_{Z}^{2}}}(x)$ is a relaxed sufficient condition to guarantee that $Z$ is an equivalently stochastically degraded version of $Y$. The equivalent channels can be explicitly constructed as $\hat{A}_{X}^{2}=F_{A_{X}^{2}}^{-1}(U)$ and $\hat{A}_{Z}^{2}=F_{A_{Z}^{2}}^{-1}(U)$, is according to, e.g., the proof of [24, Proposition 2.3]. ∎

Example 2: Continuing Example 1, assume $A_{X}$ and $A_{Z}$ are from fading channels with their magnitudes following Nakagami-$m$ distribution with shape parameters $m_{x}$ and $m_{z}$, and spread parameters $w_{x}$ and $w_{z}$ [25], respectively. From Theorem 2 we know that $Z$ is a degraded version of $Y$ if

[TABLE]

where $\gamma(s,x)=\int_{0}^{x}t^{s-1}e^{-t}dt$ is the incomplete gamma function and $\Gamma(s)=\int_{0}^{\infty}t^{s-1}e^{-t}dt$ is the ordinary gamma function. An example satisfying the above inequality is $(m_{x},w_{x})=(1,3)$ and $(m_{z},w_{z})=(1,2)$.

V conclusion

In this work we investigate the effect of stealthy public discussion used in the source-model of secret key generation. The results show that the SK capacity lower and upper bounds of the source-model are not affected by the additional stealth constraint. This implies that we can attain the stealthy SK capacity for free when the common randomness forms a Markov chain. We then prove that the sufficient condition to attain the SK capacity can be relaxed from physical to stochastic degradedness. We also derive a sufficient condition to attain the degradedness by the usual stochastic order for Maurer’s fast fading Gaussian (satellite) model for the common randomness source.

Appendix I Proof of (14)

[TABLE]

[TABLE]

where (a) is by constructing a CWTC, such that the key $K$ is interchangeable with the message $M$; (b) is by definition of the divergence [16, Definition 2.2]; (c) is due to the fact that $P_{Z^{n},F|M}$ is the marginalization of $P_{Z^{n},\bm{F}|U^{n}}$ with respect to $w$, which is the index of the confusion message; in (d) we expand the expectation with respect to $M$; (e) is by defining $\sum_{l=1}^{L_{1}}P_{Z^{n},\bm{F}|U^{n}}(z^{n},\bm{f}|u^{n}(m,l))$ and $L_{1}Q_{Z^{n},\bm{F}}(z^{n},\bm{f})$ by $\vartriangle_{m}(z^{n},\bm{f}|u^{n})$ and $\square(z^{n},\bm{f})$, respectively, to simplify the expression; (f) is by definition of the expectation over $\{U^{n}(m,w)\}_{m=1,w=1}^{L,L_{1}}$. Since $\{U^{n}(m,w)\}$ are generated independent and identically distributed using $P_{U}^{n}$, the joint distribution of codewords in a codebook is the product of marginal distributions; in (g) we expand the summation with respect to $m$ and $w$; in (h) we expand the product according to the form in step (g); in (i) we collect terms to form the expectation $\mathds{E}_{\underline{U}^{n}\setminus\underline{U}^{n}(k,l)}$; in (j) we collect the terms by introducing additional indices $(a,b)$; in (k) we apply Jensen’s inequality to the logarithm; (l) is by expanding the expectation $\mathds{E}_{\underline{U}^{n}\setminus\underline{U}^{n}(k,l)}$; (m) is by adding the term $P_{Z^{n}\bm{F}U^{n}}(z^{n},\bm{f},u^{n}(a,b))$; (n) is by definition of marginalization over $P_{Z^{n}\bm{F}U^{n}}$ with respect to $U^{n}$. In particular, the 2nd term on the RHS of the numerator in (m) becomes $\mathds{E}_{U^{n}}[P_{Z^{n},\bm{F}|U^{n}}]=Q_{Z^{n}\bm{F}}$ from (4); (o) is by definition of the expectation.