Covert Secret Key Generation with an Active Warden

TL;DR

This paper introduces an adaptive protocol for covert and secret key generation over state-dependent channels, ensuring communication remains undetectable from an active warden and partially characterizes the covert secret key capacity.

Contribution

It proposes a novel adaptive protocol for covert secret key generation that works against active wardens and provides capacity characterization for passive adversaries.

Findings

Protocol achieves covert secret key exchange with active wardens.

Capacity equals covert capacity in some cases, enabling secret keys without additional cost.

Partial characterization of covert secret key capacity for passive adversaries.

Abstract

We investigate the problem of covert and secret key generation over a state-dependent discrete memoryless channel with one-way public discussion in which an adversary, the warden, may arbitrarily choose the channel state. We develop an adaptive protocol that, under conditions that we explicitly specify, not only allows the transmitter and the legitimate receiver to exchange a secret key but also conceals from the active warden whether the protocol is being run. When specialized to passive adversaries that do not control the channel state, we partially characterize the covert secret key capacity. In particular, the covert secret key capacity is sometimes equal to the covert capacity of the channel, so that secrecy comes "for free."

Equations

$$P_{X|YZ}\circ P_Z$$

$$P_{Z|Y}\times P_{X|YZ}$$

$$I(P_X,P_{Y|X})$$

$$P_x^s$$

$$\text{ and }(PQ{)}_x^s$$

$$\underset{n\to \infty }{\lim }{ϵ}_n=\underset{n\to \infty }{\lim }{\delta }_n=\underset{n\to \infty }{\lim }{\tau }_n=0,m_n=\omega (\log n)$$

$$\underset{n\to \infty }{\lim }\mathbb{P}\left(\frac{{\ell }_n^B-r_n}{\sqrt{n{\tau }_n}}⩾R\right)=1.$$

$$\underset{n\to \infty }{\lim }{ϵ}_n=\underset{n\to \infty }{\lim }{\delta }_n=\underset{n\to \infty }{\lim }{\tau }_n=0,m_n=\omega (\log n),$$

$$\underset{n\to \infty }{\mathrm{liminf}}\frac{m_n}{\sqrt{n{\tau }_n}}⩾R.$$

$$\begin{gathered} \sqrt{\frac{2}{{\chi }_2(Q_1\Vert Q_0)}}\left(\mathbb{D}\left((PQ{)}_1\Vert (PQ{)}_0\right)-\mathbb{D}\left(Q_1\Vert Q_0\right)\right)⩾C_{\text{csk}} \\ ⩾\sqrt{\frac{2}{{\chi }_2(Q_1\Vert Q_0)}}(\mathbb{D}\left((PQ{)}_1\Vert (PQ{)}_0\right)-\mathbb{D}\left(Q_1\Vert Q_0\right) \\ -\mathbb{D}\left((PQ{)}_1\Vert P_1\times Q_1\right)). \end{gathered}$$

$$C_{\text{csk}}=\sqrt{\frac{2}{{\chi }_2(Q_1\Vert Q_0)}}\mathbb{D}\left(P_1\Vert P_0\right).$$

$$R(\beta )\triangleq \sqrt{2}\frac{\mathbb{D}\left((1-\beta )P_1^0+\beta P_1^1\Vert P_0\right)-\left((1-\beta )I^0+\beta I^1\right)}{\sqrt{(1-\beta ){\chi }_2(Q_1^0\Vert Q_0^0)+\beta {\chi }_2(Q_1^1\Vert Q_0^1)}},$$

$$\begin{gathered} I^s\triangleq \mathbb{D}\left(Q_1^s\Vert Q_0^s\right)+\mathbb{D}\left(P_1^s\Vert P_0^s\right)-\mathbb{D}\left((PQ{)}_1^s\Vert (PQ{)}_0^s\right) \\ +\mathbb{D}\left((PQ{)}_1^s\Vert P_1^s\times Q_1^s\right). \end{gathered}$$

$$R⩽\sqrt{2}\sqrt{\beta \frac{(\mathbb{D}\left(P_1^1\Vert P_0\right)-I^1{)}^2}{{\chi }_2(Q_1^0\Vert Q_0^0)}+(1-\beta )\frac{(\mathbb{D}\left(P_1^0\Vert P_0\right)-I^0{)}^2}{{\chi }_2(Q_1^1\Vert Q_0^1)}},$$

$$\sqrt{n{\tau }_n}R⩽(1+o(1))\sum _{i=1}^n\mathbb{I}\left(X_i;Y_i|Z_i{S}_i=s_i\right).$$

$$\begin{gathered} R⩽(1+o(1)) \\ \times \frac{\beta {\mu }^1\left(\mathbb{D}\left(P_1^1\Vert P_0\right)-I^1\right)+(1-\beta ){\mu }^0\left(\mathbb{D}\left(P_1^0\Vert P_0\right)-I^0\right)}{\sqrt{\beta ({\mu }^1{)}^2{\chi }_2(Q_1^1\Vert Q_0^1)+(1-\beta )({\mu }^0{)}^2{\chi }_2(Q_1^0\Vert Q_0^0)}}. \end{gathered}$$

$$\begin{gathered} \mathbb{P}\left(\left|\frac{1}{1+{\sum }_{i=1}^n{X}_i}-\frac{1}{(n+1)p}\right|⩾\frac{ϵ}{(n+1)p}\right) \\ ⩽2\exp \left(-\frac{np{ϵ}^2}{32}\right), \end{gathered}$$

$$\begin{gathered} \mathbb{E}\left(\left|\frac{1}{1+{\sum }_{i=1}^n{X}_i}-\frac{1}{(n+1)p}\right|\right) \\ ⩽\frac{ϵ}{(n+1)p}+\left(1+\frac{1}{(n+1)p}\right)e^{-\frac{np{ϵ}^2}{32}}. \end{gathered}$$

$$\begin{gathered} P_{W_1{W}_2|Y\tilde{\mathbf{Y}}}(w_1,w_2|y,\tilde{\mathbf{y}}) \\ =\{\begin{array}{ll}\frac{\text{mathds}1\left\{y={\tilde{y}}_{w_1{w}_2}\right\}}{{\sum }_{w_1^{\prime }{w}_2^{\prime }}\text{mathds}1\left\{y={\tilde{y}}_{w_1^{\prime }{w}_2^{\prime }}\right\}}& {\sum }_{w_1^{\prime }{w}_2^{\prime }}\text{mathds}1\left\{y={\tilde{y}}_{w_1^{\prime }{w}_2^{\prime }}\right\}\ne 0\\ \frac{1}{M_1{M}_2}& {\sum }_{w_1^{\prime }{w}_2^{\prime }}\text{mathds}1\left\{y={\tilde{y}}_{w_1^{\prime }{w}_2^{\prime }}\right\}=0\end{array}. \end{gathered}$$

$${\hat{w}}_1=\varphi (x,\tilde{\mathbf{y}},w_2)\triangleq {\mathrm{argmax}}_{w_1}\nu \left(x,{\tilde{y}}_{w_1{w}_2}\right)$$

$$\begin{gathered} \mathbb{P}\left(W_1\ne {\hat{W}}_1\right)⩽\sum _{x,y}{P}_{XY}(x,y)\min (1,M_{1}q(x,y)) \\ +(2+M_1{M}_2)e^{-\frac{(M_1{M}_2-1){\mu }_Q{\delta }^2}{32}}+\delta , \end{gathered}$$

$$\begin{gathered} \mathbb{V}\left(P_{W_{1}Z\tilde{\mathbf{Y}}},P_{W_1}^{\mathrm{unif}}\times P_{Z\tilde{\mathbf{Y}}}\right)⩽ \\ \sum _{y,z}{P}_{YZ}(y,z)\text{mathds}1\left\{P_{YZ}(y,z)⩾\gamma P_Z(z)Q_Y(y)\right\}+\frac{1}{2}\sqrt{\frac{\gamma }{M_2}} \\ +\frac{1}{2}\delta +\frac{1}{2}(2+M_1{M}_2)e^{-\frac{(M_1{M}_2-1){\mu }_Q{\delta }^2}{32}}. \end{gathered}$$

$$\mathbb{P}\left(F(\mathbf{y})=(w_1,w_2)\right)=\frac{{\sum }_{w_3}\text{mathds}1\left\{\mathbf{y}={\tilde{\mathbf{Y}}}_{w_1{w}_2{w}_3}\right\}}{{\sum }_{w_1^{\prime }{w}_2^{\prime }{w}_3^{\prime }}\text{mathds}1\left\{\mathbf{y}={\tilde{\mathbf{Y}}}_{w_1^{\prime }{w}_2^{\prime }{w}_3^{\prime }}\right\}}$$

$$\Phi (\mathbf{x},w_2)\triangleq {\mathrm{argmax}}_{w_1}\left(\underset{w_3}{\max }I(\mathbf{x}\wedge {\tilde{\mathbf{Y}}}_{w_1{w}_2{w}_3})\right).$$

$$P_e(f,\varphi |\mathbf{s})$$

$$S(f,\varphi |\mathbf{s})$$

$$Q_{SXYZ}^{\beta }(s,x,y,z)\triangleq Q_S(s)Q_X(x)W_{YZ|XS}(y,z|x,s).$$

$$\log M_1+\log M_2+\log M_3$$

$$\log M_1+\log M_3$$

$$\log M_3⩾\lceil (1+\zeta )$$

$${\mathbb{E}}_{F,\Phi }\left(P_e(F,\Phi |\mathbf{s})\right)$$

$${\mathbb{E}}_{F,\Phi }\left(S(F,\Phi |\mathbf{s})\right)$$

$$\frac{1}{L}\sum _{i=1}^L{P}_e(f_i,{\varphi }_i|\mathbf{s})⩽{ϵ}^{\prime }\text{ and }\frac{1}{L}\sum _{i=1}^{L}S(f_i,{\varphi }_i|\mathbf{s})⩽{ϵ}^{\prime }$$

$${ϵ}^{\prime }>2\log (1+ϵ)\text{ and }L>\frac{2}{{ϵ}^{\prime }}(1+n).$$

Full text

I Introduction

Following the early results of Ahlswede and Csiszár [1] and Maurer [2], secret key generation from correlated observations using an authenticated public channel has attracted significant attention, especially in the context of wireless channels [3, 4]. We investigate here the problem of covert secret key generation, in which legitimate parties must not only agree on a common secret key but also keep the key generation protocol undetectable by an adversary, referred to as the warden.

Our work builds upon recent results on covert [5, 6, 7, 8] and stealth [9, 10] communications, which have characterized how many information bits can be transmitted reliably over noisy channels while escaping detection by a warden. In particular, the number of reliable and covert bits that can be transmitted in $n$ channel uses is limited by a square root law to $O(\sqrt{n})$ [5]. When the warden’s channel is of higher quality, in a sense precisely defined in [7], covert communication is possible but at the expense of using a shared secret key between legitimate parties. Notice that this implicitly requires the existence of a secret key exchange mechanism that does improve the detection capability of the warden. Our work also capitalizes on efforts to consider state-dependent models for covert communication such as [11], in which covert rates are identified for a fading channel with randomly varying states only statistically known to the legitimate users, or [12], in which the covert capacity is characterized for a state-dependent channels with causal or non-causal channel knowledge at the transmitter. Another relevant work is [13], in which the warden’s uncertainty about the channel is shown to allows the circumvention of the square root law. Finally, covert communication over adversarial channels, in which the warden flips a certain fraction of the transmitted bits, has been investigated in [14]; covert communication is shown to be possible for all warden’s states if the legitimate users have access to enough shared secret key, which again prompts the question of how to covertly generate such a secret key.

Our work partially addresses the question by showing that, under conditions that we shall precisely specify, covert and secret key generation is possible even with an active warden. Specifically, the results reported here extend our preliminary results restricted to a passive warden [15] to a model with an active warden who can arbitrarily vary the channel state, except when no information is sent on the main channel. While this restriction arises from the technicalities in our proofs, it is justified in certain practical scenarios. Specifically, for wireless channels in which the action of the warden corresponds to tampering with the gain of the legitimate receiver, the gain has no effect when no signal is transmitted because fading acts as a multiplicative coefficient.

As in most results on secret key generation, the presence of an authenticated public communication is pivotal in our coding scheme to enable covert secret key generation and therefore covert communication for channels over which a secret key is required [7]. To avoid improving the warden’s detection ability, we impose a probability distribution on the public communication and make certain that the warden cannot detect the communication with any test jointly performed on the observations of the noisy channel and of the public channel. This model relates to stealth secret key generation from a source model [16]; however, stealth is a less stringent requirement than covertness, so that our results are of a different nature and exploit different proof techniques to characterize the covert secret key capacity. We emphasize that our approach differs from previous studies on two accounts. First, we neither impose any limit on the warden’s actions nor consider any statistical model for the channel states, so that the warden may take any action and our coding scheme remains reliable and covert for all possible state sequences. Second, the covert throughput is adapted to the warden’s actions, i.e., legitimate parties decide how many bits are extracted based on the quality of the channels, and we use ideas for estimation that we introduced in [17] in the context of learning over wiretap channels.

The remainder of the paper is organized as follows. In Section II, we formally introduce our model for covert secret key generation. In Section III and Section IV, we develop our results on covert secret key generation for passive and active models, respectively.

II Notation and Problem Formulation

II-A Notation

We denote random variables by uppercase letters (e.g., $X$), their realizations by lowercase letters (e.g., $x$), sets by calligraphic letters (e.g., ${\mathcal{X}}$), and vectors by bold face letters (e.g., $\mathbf{x}$). For $\mathbf{x}=(x_{1},\cdots,x_{n})\in{\mathcal{X}}^{n}$ and $a\in{\mathcal{X}}$, let $N(\mathbf{x}|a)\triangleq|\{i:x_{i}=a\}|$. For $\mathbf{x}\in\{0,1\}^{n}$, let $\textnormal{wt}(\mathbf{x})\triangleq N(\mathbf{x}|1)$ and $\alpha(\mathbf{x})\triangleq\frac{\textnormal{wt}(\mathbf{x})}{n}$. If $P_{X}$ is a Probability Mass Function (PMF) over ${\mathcal{X}}$, let ${\mathcal{T}}_{P_{X}}\triangleq\{\mathbf{x}\in{\mathcal{X}}^{n}:\text{for all }a\in{\mathcal{X}}:~{}N(\mathbf{x}|a)=P(a)n\}$. We denote by ${\mathcal{P}}_{n}({\mathcal{X}})$ the set of all PMFs $P_{X}$ for which ${\mathcal{T}}_{P_{X}}\neq\emptyset$ and by ${\mathcal{P}}_{n}({\mathcal{X}}|{\mathcal{Y}})$ the set of all conditional PMFs $P_{X|Y}$ for which there exists a joint PMF $P_{XY}$ such that $P_{X|Y}=\frac{P_{XY}}{P_{Y}}$ and ${\mathcal{T}}_{P_{XY}}\neq 0$. For $\mathbf{x}\in{\mathcal{X}}^{n}$ and a conditional PMF $P_{Y|X}$, we also define ${\mathcal{T}}_{P_{Y|X}}(\mathbf{x})\triangleq\{\mathbf{y}\in{\mathcal{Y}}^{n}:\text{for all }a\in{\mathcal{X}},b\in{\mathcal{Y}}:N(\mathbf{x},\mathbf{y}|a,b)=P_{Y|X}(b|a)N(\mathbf{x}|a)\}$. For three discrete random variables $(X,Y,Z)$ with joint PMF $P_{XYZ}$, we define

[TABLE]

For two sequences $\mathbf{x}\in{\mathcal{X}}^{n}$ and $\mathbf{y}\in{\mathcal{Y}}^{n}$ such that $(\mathbf{x},\mathbf{y})\in{\mathcal{T}}_{P_{XY}}$, we define $I(\mathbf{x}\wedge\mathbf{y})\triangleq I(P_{XY}).$ For two integers $a$ and $b$ such that $a\leqslant b$, we denote the set $\{a,a+1,\cdots,b-1,b\}$ by $\llbracket{a},{b}\rrbracket$. If $a>b$, then $\llbracket{a},{b}\rrbracket\triangleq\emptyset$. Throughout the paper, we measure the information in bits and $\log(\cdot)$ should be understood to be base $2$; we use $\ln(\cdot)$ for the logarithm base $e$. We denote by ${\mathbb{P}_{P}}{\left(\cdot\right)}$ the probability measure induced by a PMF $P$. $P^{\mathrm{unif}}_{X}$ is the uniform probability distribution over ${\mathcal{X}}$.

II-B Problem Formulation

We consider the channel model for secret key generation illustrated in Fig. 1, in which two legitimate parties, Alice and Bob, attempt to generate a secret key while keeping the entire key generation process undetectable by a warden Willie. The channel is a state-dependent Discrete Memoryless Channel (DMC) $({\mathcal{X}}\times{\mathcal{S}},W_{YZ|XS},{\mathcal{Y}}\times{\mathcal{Z}})$, in which the state $S$ is under Willie’s control while the input $X$ is under Alice’s control. Bob and Willie’s channel outputs are $Y$ and $Z$, respectively. For simplicity, we assume that ${\mathcal{X}}={\mathcal{S}}\triangleq\{0,1\}$, where [math] is the input corresponding to the absence of communication. For $x,s\in\{0,1\}$, we define

[TABLE]

Secret key generation is enabled by the presence of a public authenticated link of unlimited capacity, which Bob may use to transmit symbols in alphabet ${\mathcal{F}}$. Alice and Bob have access to a source of secret common randomness $({\mathcal{R}}_{C},P_{R_{C}})$ and each possess a local source of randomness denoted by $({\mathcal{R}}_{A},P_{R_{A}})$, $({\mathcal{R}}_{B},P_{R_{B}})$, respectively. To make the problem non-trivial, the entropy of $P_{R_{C}}$ is subtracted from the number of generated key bits in our throughput analysis.

In the presence of an active attacker controlling the channel state, the final length of the key is not known ahead of time. Alice and Bob must therefore merely agree a priori on a maximum number of channel uses and bits of secret key. Formally, a code for key generation ${\mathcal{C}}$ over $n$ channel uses for a maximum of $m$ key bits consists of the following.

• •

$n$ encoding function for Alice $\mathbf{f}^{A}=(f_{1}^{A},\cdots,f_{n}^{A})$, where $f_{i}^{A}:\mathcal{F}^{i-1}\times\mathcal{R}^{A}\times{\mathcal{R}}^{C}\to\mathcal{X}$ specifies the symbol sent by Alice at time $i\in\llbracket{1},{n}\rrbracket$;

• •

$n$ encoding functions for Bob $\mathbf{f}^{B}=(f_{1}^{B},\cdots,f_{n}^{B})$, where $f_{i}^{B}:\mathcal{Y}^{i}\times\mathcal{R}^{B}\times{\mathcal{R}}^{C}\to{\mathcal{F}}$ specifies the symbol sent by Bob at time $i\in\llbracket{1},{n}\rrbracket$ over the public channel;

• •

a key extraction function $\phi^{A}:\mathcal{F}^{n}\times\mathcal{R}^{A}\times{\mathcal{R}}^{C}\to\{0,1\}^{m}$ for Alice;

• •

a key extraction function $\phi^{B}:\mathcal{Y}^{n}\times\mathcal{R}^{B}\times{\mathcal{R}}^{C}\to\{0,1\}^{m}$ for Bob;

• •

an estimator for the number of key bits $\ell^{A}:\mathcal{F}^{n}\times\mathcal{R}^{A}\times{\mathcal{R}}^{C}\to\llbracket{0},{m}\rrbracket$ for Alice;

• •

an estimator for the number of key bits $\ell^{B}:\mathcal{Y}^{n}\times\mathcal{R}^{B}\times{\mathcal{R}}^{C}\to\llbracket{0},{m}\rrbracket$ for Bob.

We assume that the protocol is known to all parties. The sequence of $n$ random symbols transmitted by Alice is denoted $\mathbf{X}\in{\mathcal{X}}^{n}$, while the sequence of states is denoted $\mathbf{s}\in{\mathcal{S}}^{n}$. Note that we do not require the existence of a probability distribution for the state sequence. The sequence of observations at Bob and Willie are denoted $\mathbf{Y}\in{\mathcal{Y}}^{n}$ and $\mathbf{Z}\in{\mathcal{Z}}^{n}$, respectively. Bob’s public communication is collectively denoted by $\mathbf{F}$ and the generated keys are denoted $K_{A}$, $K_{B}$, respectively. For a fixed state sequence $\mathbf{s}$, the distribution induced by the coding scheme is denoted $\widehat{P}_{\mathbf{X}\mathbf{Y}\mathbf{Z}\mathbf{F}K^{A}K^{B}\ell^{A}\ell^{B}|\mathbf{s}}$. Note that our model allows for an arbitrary $\mathbf{s}$ but does not allow the warden to adapt $\mathbf{s}$ to its observations.

The performance of the key generation scheme is measured in terms of the following metrics:

• •

the probability of error P_{e}(\mathcal{C}|\mathbf{s})\triangleq{\mathbb{P}_{\widehat{P}_{K^{A}K^{B}}}}{\left(\ell^{A}\neq\ell^{B}\text{ or }K^{A}(i)\neq K^{B}(i)\text{ for }i\in\llbracket{1},{\ell^{B}}\rrbracket\big{|}\mathbf{s}\right)}, where $K^{A}(i)$ and $K^{B}(i)$ denote the $i^{th}$ bit in Alice’s key and Bob’s key, respectively;

• •

the secrecy ${{\mathbb{D}}\!\left({\widehat{P}_{K^{B}\mathbf{F}\mathbf{Z}|\mathbf{s}}\|P_{K^{B}}^{\mathrm{unif}}\times\widehat{P}_{\mathbf{F}\mathbf{Z|\mathbf{s}}}}\right)}$;

• •

the covertness $C(\mathcal{C}|\mathbf{s})\triangleq{{\mathbb{D}}\!\left({\widehat{P}_{\mathbf{F}\mathbf{Z}|\mathbf{s}}\|P_{\mathbf{F}}^{\mathrm{unif}}\times\prod_{i=1}^{n}Q_{0}^{s_{i}}}\right)}$.

We call $\mathcal{C}$ a $(2^{m},n,r,\epsilon,\delta,\tau,\mathbf{s})$ code if ${\mathbb{H}}\!\left(R^{C}\right)\leqslant r$, $P_{e}(\mathcal{C}|\mathbf{s})\leqslant\epsilon$, $S(\mathcal{C}|\mathbf{s})\leqslant\delta$, and $C(\mathcal{C}|\mathbf{s})\leqslant\tau$.

While the definitions of the probability of error and secrecy metrics are standard, there are somewhat arbitrary choices in our definition of covertness. We require Alice’s transmission to be indistinguishable from an all-[math] transmission, but we allow Bob to send symbols on the public channel as long as their observation does not help Willie’s detection. For small $\tau>0$, the covertness constraint ensures that the public communication is nearly uniformly distributed and independent of the Willie’s observation on the noisy channel. One can think of Bob as a terminal emitting seemingly random “beacons” that do not divulge the existence of a secret key generation protocol.

The throughput achieved by a protocol is defined as follows.

Definition 1**.**

A throughput $R$ is achievable with respect to (w.r.t.) the sequence $\{\mathbf{s}_{n}\}_{n\geqslant 1}$, if there exists a sequence of $(2^{m_{n}},n,r_{n},\epsilon_{n},\delta_{n},\tau_{n},\mathbf{s}_{n})$ codes $\{\mathcal{C}_{n}\}_{n\geqslant 1}$ such that

[TABLE]

[TABLE]

The special case of a passive attacker consists of the situation in which the state sequence is fixed and known ahead of time. We set this sequence to be $\mathbf{s}=\mathbf{0}$ and drop the indices referring to the state to simplify notation. In this case, note that the estimators $\ell^{A}$ and $\ell^{B}$ are not needed and that the total number of key bits $m$ may be fixed ahead of time. We can then formally define the covert secret key capacity as follows.

Definition 2**.**

A throughput $R$ is achievable with a passive attacker if there exists a sequence of $(2^{m_{n}},n,0,\epsilon_{n},\delta_{n},\tau_{n})$ codes $\{\mathcal{C}_{n}\}_{n\geqslant 1}$ such that

[TABLE]

[TABLE]

The supremum of all achievable throughputs is denoted $C_{\text{csk}}$.

Remark 1**.**

Our restriction to $\left|{{\mathcal{S}}}\right|=\left|{{\mathcal{X}}}\right|=2$ simplifies the technical details in our proofs. By following [7, Section VII-B], one can extend the results to any finite ${\mathcal{X}}$. When $\left|{S}\right|>2$, one can adapt our estimation protocol to operate on the type of the state sequences instead of their weight.

III Covert secret key capacity with a passive warden

For completeness, we recall without proof the partial characterization of the covert secret key capacity in the presence of a passive warden, which is our main result from [15].

Theorem 1**.**

If $(PQ)_{0}=P_{0}\times Q_{0}$, then

[TABLE]

Proof:

See [15]. ∎

As an application of the above result, we characterize the exact covert secret key capacity when the channels from Alice to Bob and Willie are independent.

Corollary 1**.**

If $(PQ)_{1}=P_{1}\times Q_{1}$ and $(PQ)_{0}=P_{0}\times Q_{0}$, then

[TABLE]

Corollary 1 may be somewhat surprising in that it suggests that secrecy comes “for free” since the covert secret-key capacity is equal to the covert capacity of the channel. In practice, however, some small amount of privacy amplification would still be needed and the effect of the warden’s channel only disappears in the asymptotic limit of large sequences. This result is an artifact of the model, which ensures that the information leakage from Bob to Willie has negligible scaling compared to the information transfer from Bob to Alice.

IV Covert throughput with an Active Warden

We now develop results for an active warden and show the existence of a sequence of coding schemes generating a key for any sequence of states. The number of generated key bits depends on the state sequences only through their weights.

Theorem 2**.**

Let $({\mathcal{X}}\times{\mathcal{S}},W_{YZ|XS},{\mathcal{Y}},{\mathcal{Z}})$ be an arbitrarily varying DMC with ${\mathcal{X}}={\mathcal{S}}=\{0,1\}$, $P_{0}^{0}=P_{0}^{1}=P_{0}$, $P_{1}^{1}\neq P_{1}^{0}$, and $(PQ)_{0}^{s}=P_{0}^{s}\times Q_{0}^{s}$ for $s\in{\mathcal{S}}$. There exists a sequence of codes $\{{\mathcal{C}}_{n}\}_{n\geqslant 1}$ such that for all $\beta\in[0,1]$ and all sequences $\{\mathbf{s}_{n}\}_{n\geqslant 1}$ with $\lim_{n\to\infty}\frac{{\textnormal{wt}(\mathbf{s}_{n})}}{n}=\beta$, the following covert throughput is achievable

[TABLE]

where for $s\in{\mathcal{S}}$,

[TABLE]

Remark 2**.**

Comparing the throughputs in (10) and (12), note that the quantities corresponding to the main channel in (10) are replaced by the same quantities for the channel $\sum_{i=1}^{n}\frac{1}{n}W_{Y|XS=s_{i}}$, and the quantities corresponding to the warden’s channel are replaced by the average of those quantities over the different channel uses. The intuition is that Alice and Bob have no direct access to the state sequences and only approximate the weight through their noisy observations. From their perspective, the best approximation of the main channel is $\sum_{i=1}^{n}\frac{1}{n}W_{Y|XS=s_{i}}$. In contrast, Willie knows the exact state sequence therefore obtains information from each realized channel use.

Remark 3**.**

For an Arbitrarily Varying Channel (AVC), one can eliminate the common randomness when the channel is non-symmetrizable as the capacity without common randomness is non-zero [18]. However, such consideration does not directly apply to our model, which includes a feedback link from the receiver.

We also establish a straightforward converse result for Theorem 2. Note that it is challenging to obtain a converse that matches our achievability result for a couple of reasons. First, even without covertness constraint and active adversaries, it is generally hard to provide a tight converse for the secret key generation problem because of the interactions allowed by the existence of the public communication. Second, our achievability result proves the possibility of covert secret key generation for all channel state sequences, which makes the problem of finding a tight converse more difficult.

Theorem 3**.**

For any sequence of codes $\{{\mathcal{C}}_{n}\}_{n\geqslant 1}$ that achieves covert throughput $R$ over the channel in Theorem 2 for a state sequence $\{\mathbf{s}_{n}\}_{n\geqslant 1}$ with $\lim_{n\to\infty}\frac{\textnormal{wt}(\mathbf{s}_{n})}{n}=\beta$, we have

[TABLE]

where $I^{0}$ and $I^{1}$ are defined in Theorem 2.

Proof:

To obtain a converse, we can assume that Alice and Bob know the state sequence $\mathbf{s}_{n}=(s_{1},\cdots,s_{n})$ so that the result follows from the same argument as for the passive warden [15]. In particular, let ${\mathcal{C}}_{n}$ be a $(2^{m},n,r,\epsilon,\delta,\tau,\mathbf{s})$. By [1], we obtain that

[TABLE]

Let $J$ be uniformly distributed over $\llbracket{1},{n}\rrbracket$ and $\mu^{s}={\mathbb{P}}{\left(X_{J}=1|S_{J}=s\right)}$. Using [15, Eq. (60) and Eq. (61)] and $\textnormal{wt}(\mathbf{s}_{n})=n(\beta+o(1))$, we obtain

[TABLE]

Maximizing over $\mu^{1}$ and $\mu^{0}$ yields the desired result.

∎

In Fig. 2, we illustrate the result of Theorem 2 and 3 for the following example. When $s=0$, Bob and Willie’s channel are independent BSC(0.1) and BSC(0.4), respectively. When $s=1$, Bob’s channel is a binary asymmetric channel with flipping probability 0.1 and 0.2 for $x=0$ and $x=1$, respectively, while Willie’s channel is BSC(0.3). The bounds are reasonably tight but, as expected, do not match.

IV-A Proof of Theorem 2

We break down the proof of Theorem 2 into six steps.

We first establish a technical lemma pertaining to a concentration inequality for the reciprocal of the sum of independent and identically distributed (i.i.d.) random variables. 2. 2.

We define an auxiliary problem and derive one-shot reliability and secrecy results. 3. 3.

We specialize the auxiliary problem to an arbitrarily varying DMC and assume that an oracle provides the weight of the warden’s state sequence. We use the result of Step 2 to develop a universal secrecy and reliability scheme. 4. 4.

We reduce the amount of common randomness required for the coding scheme developed in Step 3. 5. 5.

We remove the oracle from the coding scheme by introducing estimators for the weight of the warden’s state sequence. 6. 6.

Finally, we combine all steps to prove the result.

IV-A1 A Concentration Inequality

Suppose $\{X_{i}\}_{i=1}^{n}$ are i.i.d. according to Bernoulli($p$). Since ${\mathbb{E}}{\left(\sum_{i=1}^{n}X_{i}\right)}=np$, one could expect ${\mathbb{E}}{\left(\left|\frac{1}{1+\sum_{i=1}^{n}X_{i}}-\frac{1}{(n+1)p}\right|\right)}$ to be small. The following lemma formalizes this intuition and is proved in Appendix A.

Lemma 1**.**

Suppose $X_{1},\cdots,X_{n}$ are i.i.d. according to Bernoulli($p$). Then, for $\frac{2}{np}<\epsilon<1$,

[TABLE]

[TABLE]

IV-A2 One-shot Results for an Auxiliary Problem

We introduce an auxiliary problem with the help of which we solve the main problem later on. The main rationale for introducing the auxiliary problem is to use a variation of the likelihood encoder [19], which allows us to exploit channel coding tools. This helps us avoid a finite length penalty that would appear if using source coding tools and would dominate the covert throughput. Alice, Bob and Willie have access to $X\in{\mathcal{X}}$, $Y\in{\mathcal{Y}}$ and $Z\in{\mathcal{Z}}$, respectively, with joint distribution $P_{XYZ}$. In addition, Alice and Bob share secret common randomness in the form of a random codebook $\widetilde{\mathbf{Y}}=\{\widetilde{Y}_{w_{1}w_{2}}\}_{w_{1}\in\llbracket{1},{M_{1}}\rrbracket,w_{2}\in\llbracket{1},{M_{2}}\rrbracket}\in{\mathcal{Y}}^{M_{1}M_{2}}$ distributed according to Q_{Y}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}M_{1}M_{2}} for some chosen $Q_{Y}$. Bob generates two messages $W_{1}\in\llbracket{1},{M_{1}}\rrbracket$ and $W_{2}\in\llbracket{1},{M_{2}}\rrbracket$ from $Y$ and $\widetilde{\mathbf{Y}}$ according to the conditional PMF

[TABLE]

This operation induces the joint distribution P_{XYZ{\widetilde{\mathbf{Y}}}W_{1}W_{2}}\triangleq P_{XYZ}Q_{Y}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}M_{1}M_{2}}P_{W_{1}W_{2}|Y\mathbf{\widetilde{Y}}}. Note that $Q_{Y}$ may be different from $P_{Y}$, which will be useful when analyzing universality and constitutes the main deviation from the standard likelihood encoder. The next two lemmas provide bounds showing that $W_{1}$ and $W_{2}$ can be interpreted as a secret key and a public message, respectively.

Lemma 2**.**

Let $\nu:{\mathcal{X}}\times{\mathcal{Y}}\to\mathbb{R}$ be a fixed function and define a universal decoder for estimating $W_{1}$ from $X,\widetilde{\mathbf{Y}},W_{2}$ as

[TABLE]

For all $\gamma>0$, $\mu_{Q}\triangleq\min_{y}Q_{Y}(y)$, and $\frac{2}{(M_{1}M_{2}-1)\mu_{Q}}<\delta<1$, we have

[TABLE]

where $q(x,y)\triangleq\sum_{y^{\prime}}Q_{Y}(y^{\prime})\mathds{1}\!\left\{\nu(x,y^{\prime})\geqslant\nu(x,y)\right\}$.

Proof:

See Appendix B. ∎

Lemma 3**.**

For all $\gamma>0$ and $\frac{2}{(M_{1}M_{2}-1)\mu_{Q}}<\delta<1$, we have

[TABLE]

Proof:

See Appendix C. ∎

IV-A3 Universal Asymptotic Results for the Auxiliary Problem

We now extend the auxiliary problem results of Section IV-A2 by using the channel $n$ times allowing the warden to vary the channel at every channel use. More precisely, we consider an arbitrarily varying DMC $({\mathcal{X}}\times{\mathcal{S}},W_{YZ|XS},{\mathcal{Y}},{\mathcal{Z}})$ with ${\mathcal{X}}={\mathcal{S}}=\{0,1\}$ and $P_{0}^{0}=P_{0}^{1}=P_{0}$. For simplicity, we suppose for now that the weight $\textnormal{wt}(\mathbf{s})$ of Willie’s state sequence is provided to Alice and Bob by some oracle at the end of the transmission. Alice samples the input sequence $\mathbf{X}$ according to Q_{X}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n} where $Q_{X}=\text{Bernoulli}(\alpha_{n})$ and $\alpha_{n}\in\omega\left(\frac{\log n}{{n}}\right)\cap o{\left(\frac{1}{\sqrt{n}}\right)}$, and transmits it over the channel so that Bob and Willie observe $\mathbf{Y}$ and $\mathbf{Z}$, respectively. Alice and Bob are assumed to share a random codebook $\{\widetilde{\mathbf{Y}}_{w_{1},w_{2},w_{3}}\}_{w_{1}\in\llbracket{1},{M_{1}}\rrbracket,w_{2}\in\llbracket{1},{M_{2}}\rrbracket,w_{3}\in\llbracket{1},{M_{3}}\rrbracket}$ distributed i.i.d. according to P_{0}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}. Bob randomly creates an encoder $F$ to generate $W_{1}$ and $W_{2}$ from $\mathbf{y}$ using $\{\tilde{\mathbf{Y}_{w_{1}w_{2}w_{3}}}\}$ as

[TABLE]

if $\sum_{w_{1}^{\prime}w_{2}^{\prime}w_{3}^{\prime}}\mathds{1}\!\left\{\mathbf{y}=\widetilde{\mathbf{Y}}_{w_{1}^{\prime}w_{2}^{\prime}w_{3}^{\prime}}\right\}\neq 0$ and $\frac{1}{M_{1}M_{2}}$ else. Message $W_{2}$ is sent over the public channel and Alice subsequently uses $\mathbf{X}$ and $W_{2}$ to decode $W_{1}$ as $\widehat{W}_{1}$ with the random decoder $\Phi:{\mathcal{X}}^{n}\times\llbracket{1},{M_{2}}\rrbracket\to\llbracket{1},{M_{1}}\rrbracket$ defined as

[TABLE]

For a code $(f,\phi)$ and a sequence of states $\mathbf{s}$, we define

[TABLE]

We shall now prove that the above random code performs well over a class of state sequences specified as follows. For each $\mathbf{s}$, set $\beta\triangleq\frac{\textnormal{wt}(\mathbf{s})}{n}$, $Q_{S}\triangleq\text{Bernoulli}(\beta)$, and define the PMF

[TABLE]

Define ${\mathcal{S}}(M_{1},M_{2},M_{3})$ as the set of state sequences $\mathbf{s}$ such that the corresponding $Q^{\beta}_{SXYZ}(s,x,y,z)$ satisfies

[TABLE]

Note that $W_{1}$ should be interpreted as a secret key and $W_{2}$ should be interpreted as a public message. $W_{3}$ should be interpreted as additional randomization, which plays no role beyond helping us control the specific distribution used by the likelihood encoder. The next lemma shows that the random code described above is universal over the set ${\mathcal{S}}(M_{1},M_{2},M_{3})$. Specifically, we prove that given the choice of $(M_{1},M_{2},M_{3})$, there exists a protocol that performs well for all state sequences $\mathbf{s}\in{\mathcal{S}}(M_{1},M_{2},M_{3})$. In Section IV-A5, where we choose the values of $M_{1}$, $M_{2}$, and $M_{3}$ based on Bob’s observations, we show that with high probability the true state sequence is in ${\mathcal{S}}(M_{1},M_{2},M_{3})$.

Lemma 4**.**

For all $\beta,\zeta>0$, there exists $\xi>0$ such that for large enough $n$ and for all $\mathbf{s}\in{\mathcal{S}}(M_{1},M_{2},M_{3})$, we have

[TABLE]

where the term $\omega(\log n)$ depends on $\zeta$ and the channel.

Proof:

See Appendix D. ∎

IV-A4 Common Randomness Reduction

In the next lemma, we use Ahlswede’s elimination technique [20] to reduce the amount of common randomness in the coding scheme.

Lemma 5**.**

Let $(F,\Phi)$ be any random code and ${\mathcal{S}}_{n}$ be a subset of ${\mathcal{S}}^{n}$. Furthermore, for all $\mathbf{s}\in{\mathcal{S}}_{n}$, assume that ${\mathbb{E}_{F,\Phi}}{\left(P_{e}(F,\Phi|\mathbf{s})\right)}\leqslant\epsilon$ and ${\mathbb{E}_{F,\Phi}}{\left(S(F,\Phi|\mathbf{s})\right)}\leqslant\epsilon$. Then, there exist $L$ realizations $(f_{1},\phi_{1}),\cdots,(f_{L},\phi_{L})$of the random code that satisfy

[TABLE]

for all $\mathbf{s}\in{\mathcal{S}}_{n}$ provided that

[TABLE]

Proof:

Let $(F_{1},\Phi_{1}),\cdots,(F_{L},\Phi_{L})$ be $L$ i.i.d. random codes distributed according to $P_{(F,\Phi)}$. For any $\mathbf{s}\in{\mathcal{S}}_{n}$, we have

[TABLE]

where $(a)$ follows from $2^{x}\leqslant 1+x$ for $x\in[0,1]$. Therefore, the union bound yields that

[TABLE]

which is positive given that (34) holds. ∎

Corollary 2**.**

Under the same assumptions as Lemma 4, for all $\zeta>0$, all large enough $n$, and $L>2n^{4}(1+n)$, there exist codes $(f_{1},\phi_{1}),\cdots,(f_{L},\phi_{L})$ such that for any $\mathbf{s}\in{\mathcal{S}}_{\beta}(M_{1},M_{2},M_{3})$,

[TABLE]

Proof:

We first consider the random code $(F,\Phi)$ introduced in Section IV-A3 for which we have ${\mathbb{E}_{F,\Phi}}{\left(P_{e}(F{,}\Phi|\mathbf{s})\right)}\leqslant 2^{-\omega(\log n)}$ and ${\mathbb{E}_{F,\Phi}}{\left(S(F,\Phi|\mathbf{s})\right)}\leqslant 2^{-\xi\alpha_{n}n}=2^{-\omega(\log n)}$ by Lemma 4 for all $\mathbf{s}\in{\mathcal{S}}(M_{1},M_{2},M_{3})$. Applying Lemma 5 to $(F,\Phi)$ for $L>2n^{4}(1+n)$, we obtain $L$ codes $(f_{1},\phi_{1}),\cdots,(f_{L},\phi_{L})$ such that (41) holds since the two constraints $n^{-4}\geqslant 2\log(1+2^{-\omega(\log n)})$ and $L>\frac{2}{n^{-4}}(1+n)$ in Lemma 5 hold for large $n$. ∎

IV-A5 Estimation of the state sequence weigth

We now construct an estimator for $\textnormal{wt}(\mathbf{s})$ to replace the oracle. This requires running the protocol over $n^{\prime}=n+g$ channel uses, where $g$ is a positive integer to be specified later used to provision for channel estimation. Before transmission, Alice and Bob secretly and independently select every channel use for estimation with probability $\kappa_{n}\in[0,1]$, which requires $n{\mathbb{H}_{b}}\left(\kappa_{n}\right)$ bits of shared secret key. Let $L$ denote the number of positions chosen for the estimation and let $\mathbf{J}=(J_{1},\cdots,J_{L})$ denote the corresponding indices in increasing order. If $n^{\prime}-n\triangleq g<L$, Alice and Bob halt the protocol and do not generate a key. Otherwise, Alice transmits symbol “1” in the positions in $\mathbf{J}$ and operates as in Step 3 in the known $n$ positions not in $\mathbf{J}$. Since $P_{0}^{1}\neq P_{1}^{1}$, there exists $y_{0}\in{\mathcal{Y}}$ such that $P_{0}^{1}(y_{0})\neq P_{1}^{1}(y_{0})$. For $\mu_{0}\triangleq P_{0}^{1}(y_{0})$, $\mu_{1}\triangleq P_{1}^{1}(y_{0})$, and $T_{i}\triangleq\frac{\mathds{1}\!\left\{Y_{j_{i}}=y_{0}\right\}-\mu_{0}}{\mu_{1}-\mu_{0}}$, Bob estimates $\beta=\frac{\textnormal{wt}(\mathbf{s})}{n}$ as $\widehat{\beta}\triangleq\frac{1}{L}\sum_{i=1}^{L}T_{i}$ (for $L=0$, we define $\widehat{\beta}=1$). Note that for a fixed $j_{i}$, ${\mathbb{E}}{\left(T_{i}\right)}=s_{j_{i}}$, and by the results on sampling without replacement, one can expect that $\sum_{i=1}^{L}T_{i}/L\approx\sum_{i=1}^{L}s_{J_{i}}/L\approx\sum_{i=1}^{n}s_{i}/n=\beta$.

We now show that, with high probability, Alice and Bob do not halt the protocol and $\widehat{\beta}$ is close to $\beta$. With $g=(1+\mu)\kappa_{n}n^{\prime}$, application of a Chernoff bound yields that ${\mathbb{P}}{\left(L\geqslant g\right)}\leqslant 2^{-\frac{\mu^{2}\kappa_{n}n^{\prime}}{3}}$. In addition, for all $\lambda>0$ and $\mu\in]0,1[$,

[TABLE]

where $(a)$ follows from a Chernoff bound. Conditioned on $L=\ell$, $\mathbf{J}=(J_{1},\cdots,J_{\ell})$ is distributed uniformly on ${\mathcal{J}}^{\ell}=\{\mathbf{j}=(j_{1},\cdots,j_{\ell}):j_{1}<\cdots<j_{\ell}\}$. Upon defining the event

[TABLE]

we have

[TABLE]

We next express ${\mathbb{P}}{\left({\mathcal{E}}|L=\ell\right)}$ as the Cumulative Distribution Function (CDF) of the hypergeometric distribution. In particular, let $H$ denote the number of successes in $\ell$ draws without replacement from a population of size $n^{\prime}$ with $\textnormal{wt}(\mathbf{s})=\ell\beta$ successes in the population. We then have

[TABLE]

where $(a)$ follows from the standard tail bounds for hypergeometric distribution (e.g., see [21]).

We next fix some $\mathbf{j}\in{\mathcal{J}}^{\ell}\setminus{\mathcal{E}}$. Since ${\mathbb{E}}{\left(T_{i}|J_{i}=j_{i}\right)}=s_{j_{i}}$, and $\frac{-\mu_{0}}{\mu_{1}-\mu_{0}}\leqslant T_{i}\leqslant\frac{1-\mu_{0}}{\mu_{1}-\mu_{0}}$, Hoeffding’s inequality implies that

[TABLE]

where $(a)$ follows from $\mathbf{j}\notin{\mathcal{E}}$. Therefore, we obtain

[TABLE]

which is less than $2^{-\xi\ell}$ for some $\xi>0$ small enough and independent of $\ell$. Combining (56) with (45), we obtain ${\mathbb{P}}{\left(|\widehat{\beta}-\beta|>\lambda\right)}\leqslant 2^{-\xi\kappa_{n}n^{\prime}}$ for some $\xi>0$ small enough.

We next show that for $Q_{\widehat{S}}=$ Bernoulli($\widehat{\beta}$), $Q^{\widehat{\beta}}_{\widehat{S}\widehat{X}\widehat{Y}\widehat{Z}}$ defined as in (27) and $(M_{1},M_{2},M_{3})$ such that

[TABLE]

[TABLE]

[TABLE]

we have $\mathbf{s}\in{\mathcal{S}}(M_{1},M_{2},M_{3})$ with high probability. To do so, we should verify that (28)-(30) hold with high probability. By our definition of $(M_{1},M_{2},M_{3})$, (28) is always true. Additionally, for $Q_{{S}}=$ Bernoulli(${\beta}$), and $Q^{\beta}_{SXYZ}$ defined as in (27), the function

[TABLE]

is continuous in $\beta$. Therefore, there exists $\lambda>0$ such that if $|\beta-\beta^{\prime}|<\lambda$, $|\psi(\beta)-\psi(\beta^{\prime})|\leqslant\zeta-o(1)$. Then,

[TABLE]

Similarly, we can argue that

[TABLE]

so that

[TABLE]

Hence, $\mathbf{s}\in{\mathcal{S}}(M_{1},M_{2},M_{3})$ with probability more than $1-2^{-\xi\kappa_{n}n^{\prime}+1}$.

IV-A6 Proof of Theorem 2

We put together the different pieces developed so far and describe our active covert key generation protocol. Let $\zeta>0$, $n^{\prime}=n+g$ be the block-length, $\kappa_{n}=o(\alpha_{n}/\log n)\cap\omega(\log n/n)$, $g\geqslant(1+\mu)\kappa_{n}n^{\prime}$ for some $\mu\in]0,1[$, $\mathbf{J}=(J_{1},\cdots,J_{L})$ be the positions to be used for the estimation, and $K$ be a shared secret key uniformly distributed over $\llbracket{1},{U}\rrbracket$ for any $U>2n^{4}(n+1)$. For $L>g$, the protocol halts. Otherwise, Alice samples $\mathbf{\widetilde{X}}$ according to Q_{X}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n} for transmission over the channel $W_{YZ|XS}$ at the $n$ positions not included in $\mathbf{J}$, and transmits $1$ in the positions in $\mathbf{J}$. Let $\mathbf{Y}$ and $\mathbf{Z}$ denote Bob’s and Willie’s received sequences, respectively, and $\widetilde{\mathbf{Y}}$ denote the sub-sequence of $\mathbf{Y}$ obtained by removing the components in $\mathbf{J}$. Bob first estimates the type $\widehat{\beta}$ of Willie’s states sequence defined in Section IV-A5 and sets $(M_{1},M_{2},M_{3})$ such that (57)-(59) hold. Subsequently, for $(f_{1},\phi_{1}),\cdots,(f_{U},\phi_{U})$ defined in Corollary 2, Bob generates two messages $(W_{1},W_{2})=f_{K}(\mathbf{\widetilde{Y}})$ and broadcasts $W_{2}$ together with $\widehat{\beta}$ one-time-padded with a shared secret key. Finally, Alice decodes $W_{1}$ as $\widehat{W}_{1}\triangleq\phi_{K}(\mathbf{\widetilde{X}},W_{2})$. We provide the performance analysis of the protocol in four parts.

Reliability analysis

With probability at most $2^{-\xi\kappa_{n}n^{\prime}}\leqslant 2^{-\omega(\log n)}$, the protocol is halted. If $\mathbf{s}\in{\mathcal{S}}(M_{1},M_{2},M_{3})$, then by Corollary 2, the probability of error is less than $\frac{1}{n^{4}}$. Since ${\mathbb{P}}{\left(\mathbf{s}\in{\mathcal{S}}(M_{1},M_{2},M_{3})\right)}\geqslant 1-2^{-\xi\kappa_{n}n^{\prime}+1}\leqslant 2^{-\omega(\log n)}$, the probability of error for the protocol is less than $n^{-4}+2^{-\omega(\log n)}$.

Secrecy and covertness analysis

Let $\widehat{P}_{W_{1}W_{2}\mathbf{Z}}$ be the PMF induced by the protocol and $\chi_{2}(\beta)\triangleq\beta\chi_{2}(Q_{1}^{1}\|Q_{0}^{1})+(1-\beta)\chi_{2}(Q_{1}^{0}\|Q_{0}^{0})$. By definition, we have (69) on the top of next page,

where $(a)$ follows since $\kappa_{n}=o(\alpha_{n})$, $(b)$ follows from [18, Problem 17.1], and $(c)$ follows from ${\mathbb{H}_{b}}\left(x\right)\leqslant x\log\frac{e}{x}$. To upper-bound ${{\mathbb{V}}\!\left(\widehat{P}_{W_{1}W_{3}\mathbf{Z}|\mathbf{s}}{,}{P}_{W_{1}W_{3}}^{\mathrm{unif}}\times\widehat{P}_{\mathbf{Z}|\mathbf{s}}\right)}$, let ${\mathcal{E}}$ be the event $\{\mathbf{s}\notin{\mathcal{S}}(M_{1},M_{2},M_{3})\}$. By convexity of variational distance, we have

[TABLE]

Hence, for large enough $n$, we have $S(\mathcal{C}|\mathbf{s})+C(\mathcal{C}|\mathbf{s})\leqslant n^{-2}+\frac{1}{2}\alpha_{n}^{2}\chi_{2}(\beta)n+o(\alpha_{n}^{2}n)$, which is vanishing.

Rate analysis

The covert rate of the protocol is

[TABLE]

Moreover, by (63), with probability at least $2^{-\omega(\log n)}$, we have (73). Finally, the required amount of secret common randomness for sharing $K$, sharing $\mathbf{J}$, and one-time-padding $\widehat{\beta}$ is $\log U=O(\log n)$, $n^{\prime}{\mathbb{H}_{b}}\left(\kappa_{n}\right)=O(n^{\prime}\kappa_{n}\log\frac{1}{\kappa_{n}})=o(n^{\prime}\alpha_{n})$, and $O(\log n)$, respectively. Since all three terms are $o(n^{\prime}\alpha_{n})$, and the amount of the generated key is $\Omega(n^{\prime}\alpha_{n})$, the amount of secret common randomness is negligible.

Appendix A Proof of Lemma 1

We first use the additivity of probability measures for disjoint events to split the probability into two parts, i.e.,

[TABLE]

where $(a)$ follows since $\epsilon>\frac{2}{np}$, and $(b)$ follows since $\epsilon\in[0,1]$. To upper-bound the above terms, we use known Chernoff bounds [22, Exercise 2.10] stating that for $\mu\in]0,1[$, we have

[TABLE]

Therefore, we obtain

[TABLE]

and

[TABLE]

Combining these two inequalities completes the proof of (17).

To prove (18), we first define the event ${\mathcal{E}}\triangleq\left\{\left|\frac{1}{1+\sum_{i=1}^{n}X_{i}}-\frac{1}{(n+1)p}\right|\geqslant\frac{\epsilon}{(n+1)p}\right\}$. By the law of total probability,

[TABLE]

Appendix B Proof of Lemma 2

By definition of our universal decoder and the construction of messages $W_{1}$ and $W_{2}$, we have

[TABLE]

where $(a)$ follows since Q_{Y}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}M_{1}M_{2}} is i.i.d., $(b)$ follows since the probability that for all $w_{1}^{\prime}$ and $w_{2}^{\prime}$, we have $Y\neq\widetilde{Y}_{w_{1}^{\prime}w_{2}^{\prime}}$ is $\sum_{y}P_{Y}(y)(1-Q_{Y}(y))^{M_{1}M_{2}}$, and $(c)$ follows since we can replace $y$ by $\widetilde{y}_{11}$ because of the term $\mathds{1}\!\left\{y=\widetilde{y}_{11}\right\}$. We upper-bound the first term in (90) in two steps. Using Lemma 1, we first bound the difference between (90) and the same expressions when replacing $\sum_{w_{1}^{\prime}w_{2}^{\prime}}\mathds{1}\!\left\{\widetilde{y}_{11}=\widetilde{y}_{w_{1}^{\prime}w_{2}^{\prime}}\right\}$ by its expected value $M_{1}M_{2}Q_{Y}(y)$. This follows from (91) at the top of next page,

where $(a)$ follows by applying Lemma 1 when $\widetilde{y}_{11}$ is fixed and other components of $\mathbf{\widetilde{Y}}$ are i.i.d. according to $Q_{Y}$. We now upper-bound

[TABLE]

Finally, to simplify our upper-bound on the average probability of error, we bound the second term in (90) as

[TABLE]

which can be combined with (91) to obtain the desired result.

Appendix C Proof of Lemma 3

To simplify our notation, we treat ${P}_{W_{1}Z}$ as a random PMF depending on $\mathbf{\widetilde{Y}}$, i.e.,

[TABLE]

when $\sum_{w_{1}^{\prime}w_{2}^{\prime}}\mathds{1}\!\left\{y=\widetilde{Y}_{w_{1}^{\prime}w_{2}^{\prime}}\right\}\neq 0$ and ${P}_{W_{1}Z}(w_{1},z)\triangleq P_{Z}(z)\frac{1}{M_{1}}$ otherwise. We can then write

[TABLE]

We first define $\overline{P}_{W_{1}Z}$ as

[TABLE]

which is not necessarily a PMF because the sum over all $(w_{1},z)$ may be less than one. Note that

[TABLE]

where $(a)$ follows since Q_{Y}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}M_{1}M_{2}} is i.i.d.. We also have (100) on the top of next page,

where the derivation of $(a)$ is similar to that of (95). We can now use Lemma 1, for a particular $y$ and $\frac{2}{M_{1}M_{2}Q_{Y}(y)}<\delta<1$ to obtain

[TABLE]

Therefore, we obtain

[TABLE]

We next decompose $\overline{P}_{W_{1}Z}$ into two components and define

[TABLE]

[TABLE]

for which we upper-bound ${\mathbb{E}}{\left(\|\overline{P}^{1}_{W_{1}Z}-{\mathbb{E}}{\left(\overline{P}^{1}_{W_{1}Z}\right)}\|_{1}\right)}$ and ${\mathbb{E}}{\left(\|\overline{P}^{2}_{W_{1}Z}-{\mathbb{E}}{\left(\overline{P}^{2}_{W_{1}Z}\right)}\|_{1}\right)}$ as

[TABLE]

and

[TABLE]

Therefore, by the triangle inequality, we obtain

[TABLE]

Combining (101) and (115) and noting that ${\mathbb{E}}{\left(\overline{P}_{W_{1}Z}\right)}=P_{W_{1}}^{\mathrm{unif}}\times{P}_{Z}$ completes the proof.

Appendix D Proof of LEmma 4

Applying Lemma 2 to $(W_{1},W_{3})$ and $W_{2}$ for a fixed $\mathbf{s}$, we obtain

[TABLE]

where

[TABLE]

To upper-bound $q(\mathbf{x},\mathbf{y})$, let $V_{X}$ and $V_{Y|X}$ be the type of $\mathbf{x}$ and the conditional type of $\mathbf{y}$ given $\mathbf{x}$, respectively. Then, we have

[TABLE]

where $(a)$ follows from [18, Lemma 2.6]. Substituting the above upper-bound in the first term of the right hand side of (118) and using Q_{XY|S}^{{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}}({\mathcal{T}}_{V_{XY|S}}(\mathbf{s})|\mathbf{s})\leqslant 2^{-n{{\mathbb{D}}\!\left({V_{XY|S}\|Q_{XY|S}|Q_{S}}\right)}} [18, Equation (2.8)], we have (126) on the top of next page,

where $(a)$ follows because ${{\mathbb{D}}\!\left({{V}_{XY|S}\|Q_{XY|S}|Q_{S}}\right)}\geqslant{{\mathbb{D}}\!\left({{V}_{XY}\|Q_{XY}}\right)}$ by convexity of the KL-divergence, and $(b)$ follows from (29). We next state a result that shows that, for all $V_{XY}$, ${{\mathbb{D}}\!\left({{V}_{XY}\|Q_{XY}}\right)}$ and $[I({V}_{X},{V}_{Y|X})-(1-\zeta)I(Q_{X},Q_{Y|X})]^{+}$ cannot be simultaneously small.

Lemma 6**.**

For a PMF $V_{XY}$ with ${{\mathbb{D}}\!\left({{V}_{XY}\|Q_{XY}}\right)}\leqslant\epsilon$, we have

[TABLE]

where $\alpha\triangleq Q_{X}(1)$, $\mu_{0}\triangleq\min_{y}Q_{Y|X}(y|0)$, and $B$ is a constant that depends only on $\left|{{\mathcal{Y}}}\right|$ and $\mu_{0}$.

Proof:

See Appendix E. ∎

To lower-bound the exponent in (126),

[TABLE]

we consider two cases for $V_{XY}$. For $\{\epsilon_{n}\}_{n\geqslant 1}=\omega{\left(\frac{\log n}{n}\right)}\cap o(\alpha_{n})$ and ${{\mathbb{D}}\!\left({V_{XY}\|Q_{XY}}\right)}\geqslant\epsilon_{n}$, we have

[TABLE]

where $(a)$ follows since $\epsilon_{n}=\omega(\log n/n)$. For the case when ${{\mathbb{D}}\!\left({V_{XY}\|Q_{XY}}\right)}\leqslant\epsilon_{n}$, applying Lemma 6, we obtain

[TABLE]

where $(a)$ follows since $\sqrt{2\epsilon_{n}\alpha_{n}}=o(\alpha_{n})$, $\sqrt{\frac{\epsilon_{n}}{\alpha_{n}-\sqrt{2\epsilon_{n}\alpha_{n}}}}=o(1)$, and ${\left(\alpha_{n}+\sqrt{2\epsilon_{n}}\right)}^{2}=o(\alpha_{n})$, and $(b)$ follows from [7, Lemma 1]. Therefore, we conclude that

[TABLE]

and

[TABLE]

Furthermore, the choice $\delta=2^{-\frac{1}{3}\zeta n\log\frac{1}{\mu_{0}}}$ satisfies $\frac{2}{M_{1}M_{2}M_{3}\mu_{0}^{n}}\leqslant\delta<1$ for large $n$ and we obtain

[TABLE]

which is less than $e^{-\zeta^{\prime}n}$ for large enough $n$ and $\zeta^{\prime}>0$ independent of $n$.

To analyze the secrecy, we fix $\mathbf{s}\in{\mathcal{S}}^{n}$ with $\textnormal{wt}(\mathbf{s})=\beta n$ and define the PMF P_{\mathbf{Y}\mathbf{Z}}(\mathbf{y},\mathbf{z})\triangleq\sum_{\mathbf{x}}Q_{X}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}(\mathbf{x})W_{YZ|XS}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}(\mathbf{y}\mathbf{z}|\mathbf{x}\mathbf{s}), by Lemma 3, we have

[TABLE]

Moreover, for $t\triangleq\gamma-\sum_{i=1}^{n}{\mathbb{E}}{\left(\log\frac{P_{Y_{i}|Z_{i}}(Y_{i}|Z_{i})}{P_{0}(Y_{i})}\right)}\geqslant 0$ and

[TABLE]

Bernstein’s inequality yields that for

[TABLE]

By [15, Lemma 2], we also have ${\mathbb{E}_{P_{Y_{i}Z_{i}}}}{\left(\log\frac{P_{Y_{i}|Z_{i}}(Y_{i}|Z_{i})}{P_{0}(Y_{i})}\right)}={{\mathbb{I}}\!\left(Y_{i};Z_{i}\right)}+{{\mathbb{D}}\!\left({P_{Y_{i}}\|P_{0}}\right)}=\alpha_{n}I^{s_{i}}+O(\alpha_{n}^{2})$, where $I^{s}$ is defined in the statement of Theorem 2. Thus, by choosing $\gamma=(1+\zeta/2)\alpha_{n}{\left(\beta I^{1}+(1-\beta)I^{0}\right)}$, we obtain that ${\mathbb{E}_{F,\Phi}}{\left(S{\left(F,\Phi|\mathbf{s}\right)}\right)}\leqslant 2^{-\xi n}$ for some $\xi>0$ small enough.

Appendix E Proof of Lemma 6

For a fixed $V_{XY}$ and $Q_{XY}$, we first define

[TABLE]

By [7, Lemma 1], we have

[TABLE]

Moreover, by the chain rule for relative entropy, we can write ${{\mathbb{D}}\!\left({V_{XY}\|Q_{XY}}\right)}$ as

[TABLE]

where ${{\mathbb{D}}\!\left({p\|q}\right)}\triangleq p\log(p/q)+(1-p)\log((1-p)/(1-q))$. Since all terms in terms in (150) are positive, our assumption that ${{\mathbb{D}}\!\left({V_{XY}\|Q_{XY}}\right)}\leqslant\epsilon$ implies that

[TABLE]

Using the inequalities ${{\mathbb{D}}\!\left({p\|q}\right)}\geqslant(p-q)^{2}/(2q)$ for $p\leqslant q$ and ${{\mathbb{D}}\!\left({p\|q}\right)}\geqslant(p-q)^{2}/(2p)$ for $q\leqslant p$, we obtain

[TABLE]

Furthermore, Pinsker’s inequality yields that ${{\mathbb{V}}\!\left(\widetilde{P}_{1},P_{1}\right)}\leqslant\sqrt{\frac{\epsilon}{\widetilde{\alpha}}}$ and ${{\mathbb{V}}\!\left(\widetilde{P}_{0},P_{0}\right)}\leqslant\sqrt{\frac{\epsilon}{1-\widetilde{\alpha}}}$. Hence,

[TABLE]

where $B$ depends only on $\mu_{0}$ and $\left|{{\mathcal{Y}}}\right|$. Also because $\chi_{2}(\widetilde{P}_{1}\|\widetilde{P}_{0})\leqslant\left|{{\mathcal{Y}}}\right|\frac{1}{\widetilde{\mu}_{0}}$ and $\widetilde{\mu}_{0}\geqslant\mu_{0}-\sqrt{\frac{\epsilon}{1-\widetilde{\alpha}}}$, we have

[TABLE]