Secure list decoding

TL;DR

This paper introduces secure list decoding, a novel concept ensuring both the receiver's inability to uniquely identify the message and the sender's inability to estimate other list elements, enhancing privacy in applications like anonymous auctions.

Contribution

It defines secure list decoding with new security conditions and discusses its potential for privacy-preserving communication protocols.

Findings

Defines security conditions for secure list decoding

Ensures privacy by preventing message identification and estimation

Applicable to anonymous auction protocols

Abstract

We propose a new concept of secure list decoding. While the conventional list decoding requires that the list contains the transmitted message, secure list decoding requires the following additional security conditions. The first additional security condition is the impossibility of the correct decoding, i.e., the receiver cannot uniquely identify the transmitted message even though the transmitted message is contained in the list. This condition can be trivially satisfied when the transmission rate is larger than the channel capacity. The other additional security condition is the impossibility for the sender to estimate another element of the decoded list except for the transmitted message. This protocol can be used for anonymous auction, which realizes the anonymity for bidding.

Figures

Equations

$$\mathrm{Pr}[m\notin \Psi (Y)|X=\varphi (m)]\le {ϵ}_A.$$

$$\frac{1}{\mathsf{M}}\sum _m\mathrm{Pr}[\psi (Y)=m|X=\varphi (m)]\le {\delta }_B.$$

$$\mathrm{Pr}[m^{\prime }\in \Psi (Y)|X=\varphi (m)]\le {\delta }_C.$$

$$\mathrm{Pr}[m\notin \Psi (Y)|X=x]\le \frac{1}{2},i.e.,\mathrm{Pr}[m\in \Psi (Y)|X=x]>\frac{1}{2},$$

$$\mathrm{Pr}[m^{\prime }\in \Psi (Y)|X=x]\le {\delta }_C.$$

$$I(f(M);Y)\le 2e^{-H_2(M|Y)}\le 2{\delta }_B.$$

$${ϵ}_A(\varphi ,D)$$

$${ϵ}_{A,m}(x,D)$$

$${\delta }_B(\varphi )$$

$${\delta }_{B,x}({\tilde{\mathcal{D}}}_m)$$

$${\delta }_C(\varphi ,D)$$

$${\delta }_{C,m}(x,D)$$

$${\delta }_D(D)$$

$${\delta }_{D,m}(D)$$

$$\sum_{m_{1},\ldots,m_{\mathsf{L}}:\{m_{1},\ldots,m_{\mathsf{L}}\}\ni m}W_{x}({\cal D}_{m_{1},\ldots,m_{\mathsf{L}}})=W_{x}\Big{(}\bigcup_{m_{1},\ldots,m_{\mathsf{L}}:\{m_{1},\ldots,m_{\mathsf{L}}\}\ni m}{\cal D}_{m_{1},\ldots,m_{\mathsf{L}}}\Big{)},$$

$$C(W)$$

$$I(P,W)$$

$$H(P)$$

$$F(x,x^{\prime }|P):={\mathbb{E}}_x(\log W_{x^{\prime }}(Y)-\log W_P(Y))=D(W_x\Vert W_P)-D(W_x\Vert W_{x^{\prime }}).$$

$${\zeta }_2(P)$$

$${\zeta }_1(P)$$

$${\zeta }_1(P)>0$$

$${\zeta }_1(P_0)=\underset{x\ne x^{\prime }}{\min }D(W_{x^{\prime }}\Vert W_x)>0.$$

$$V(W):=\underset{x,x^{\prime }\in \mathcal{X}}{\max }{\mathbb{V}}_x(\log W_{x^{\prime }}(Y)-\log W_P(Y))<\infty .$$

$$H_0$$

$$P_{\max }$$

$$\displaystyle\kappa(R_{1}):=\left\{\begin{array}[]{ll}\max_{P\in{\cal P}({\cal U}\times{\cal X})}\{H(X|Y,U)_{P}|H(X|U)_{P}=R_{1}\}&\hbox{ when }R_{1}>H_{0}\\ {[}R_{1}-C(W)]_{+}&\hbox{ when }R_{1}\leq H_{0}.\end{array}\right.$$

$${\mathcal{P}}_0:=\{P\in \mathcal{P}(\mathcal{X})|\kappa (H(X{)}_P)=H(X|Y{)}_P\}.$$

$$\{P\in {\mathcal{P}}_0|H(X{)}_P\le H_0\}=\{P\in \mathcal{P}(\mathcal{X})|I(X;Y{)}_P=C(W)\}.$$

$$\mathcal{C}:=$$

$$=$$

$$\mathcal{C}\cap \{(R_1,R_2)|H_0\le R_1\le \log |\mathcal{X}|\}$$

$$=$$

$${\mathcal{R}}_{w,d}\subset \overline{\mathcal{C}},{\mathcal{R}}_{s,s}\subset \overline{\mathcal{C}}.$$

$$0<R_1-R_2<I(X;Y{)}_P<R_1<H(X{)}_P.$$

Full text

I Introduction

Relaxing the condition of the decoding process, Elias [2] and Wozencraft [3] independently introduced list decoding as the method to allow more than one element as candidates of the message sent by the encoder at the decoder. When one of these elements coincides with the true message, the decoding is regarded as successful. The paper [19] discussed its algorithmic aspect. In this formulation, Nishimura [4] obtained the channel capacity by showing its strong converse part111The strong converse part is the argument that the average error goes to $1$ if the code has a transmission rate over the capacity.. That is, he showed that the transmission rate is less than the conventional capacity plus the rate of the list size, i.e., the number of list elements. Then, the reliable transmission rate does not increase even when list decoding is allowed if the list size does not increase exponentially. In the non-exponential case, these results were generalized by Ahlswede [5]. Further, the paper [6] showed that the upper bound of capacity by Nishimura can be attained even if the list size increases exponentially. When the number of lists is $\mathsf{L}$, the capacity can be achieved by choosing the same codeword for $\mathsf{L}$ distinct messages.

However, the merit of increase in the list size was not discussed sufficiently. To get a merit of list coding, we need a code construction that is essentially different from the conventional coding. Since the above capacity-achieving code construction does not have an essential difference from the conventional coding, we need to rule out the above type of construction of list coding. That is, to extract a merit of list decoding, we need additional parameters to characterize the difference from the conventional code construction, which can be expected to rule out such a trivial construction.

In this paper, we propose a new concept of secure list decoding by adding several security conditions, which can be considered as additional constraints. To explain this protocol, we consider the following anonymous auction scenario, which realizes the anonymity for bidding. $\mathsf{M}$ players participate in the auction for an item dealt by Bob, and they have their distinct ID from $1$ to $\mathsf{M}$.

(i)

(Bidding) Several players bid with their ID. Each of them sends his/her ID via a noisy channel with his/her price. Then, for each bid, the dealer, Bob outputs $\mathsf{L}$ ID numbers as the list. The list is required to contain the ID of the player making the bid.

(ii)

(Purchasing) Assume that a player, Alice has an ID $M$ and her bidding price is highest. She purchases the item from Bob by showing her ID $M$.

This scenario has the following requirements.

(a)

Bob wants to identify whether the person to purchase the item is the same as the person to bid the highest price. That is, $M$ needs to be one of $\mathsf{L}$ ID numbers $M_{1},\ldots,M_{\mathsf{L}}$ output by Bob in her bid.

(b)

Alice wants to hide her ID $M$ at the bidding step (i). Hence, she will not be identified by Bob when she loses this auction.

(c)

Bob wants to avoid the situation that two players show him the correct ID at purchasing Step (ii). That is, Alice cannot find another element among $\mathsf{L}$ ID numbers $M_{1},\ldots,M_{\mathsf{L}}$ output by Bob in her bid except for $M$.

The requirement (a) is the condition for the requirement for the conventional list decoding while the requirements (b) and (c) are not considered in the conventional list decoding. In this paper, as a new concept to satisfy these conditions, we propose secure list decoding by imposing the following two additional conditions to the list decoding. The first additional security condition is the impossibility of the correct decoding. That is, the receiver cannot uniquely identify the transmitted message even though the transmitted message is contained in the list. This condition can be trivially satisfied when the transmission rate is larger than the channel capacity due to the strong converse property under the asymptotic setting with the discrete memory less channel. The other additional security condition is the impossibility for the sender to estimate another element of the decoded list except for the transmitted message. In fact, we might use an authentication protocol to identify Alice [7]. In this case, if Alice gives the key for the authentication to the third party, the third party can claim to Bob that he is also the winner of this auction. To avoid this type of spoofing, we need to use the ID number. That is, the above anonymous auction scenario realizes a kind of authentication, which satisfies the anonymity and forbids spoofing even when Alice colludes the third party. In this paper, we formulate secure list decoding, and define various types of capacity regions for secure list decoding under the asymptotic setting with the discrete memory less channel. Then, we calculate these capacity regions under several conditions.

This paper is structured as follows. Section II-A gives the formulation of secure list decoding. Section II-B explains the relation with bit commitment. Section IV prepares several information quantities. Section IV states the main result by deriving the capacity regions. Section V shows the converse part, and Section VI proves the direct part.

II Problem setting

II-A Our setting with intuitive description

To realize the requirements (a), (b), and (c) mentioned in Section I, we formulate the mathematical conditions for the protocol for a given channel $W$ from the discrete system ${\cal X}$ to the other system ${\cal Y}$ with integers $\mathsf{L}<\mathsf{M}$ and security parameters $\epsilon_{A},\delta_{B},\delta_{C}$. In the following, we describe the condition in an intuitive form in the first step. Later, we transform it into a coding-theoretic form because the coding-theoretic form matches the theoretical discussion including the proofs of our main results.

Alice sends her ID $M\in{\cal M}:=\{1,\ldots,\mathsf{M}\}$ via a noisy channel with a code $\phi$, which is a map from ${\cal M}$ to ${\cal X}$. Bob outputs the $\mathsf{L}$ messages $M_{1},\ldots M_{\mathsf{L}}$. The decoder is given as the following $\Psi$. For $y\in{\cal Y}$, we choose a subset $\Psi(y)\subset{\cal M}$ with $|\Psi(y)|=\mathsf{L}$.

Then, we impose the following conditions for an encoder $\phi$ and a decoder $\Psi$.

(A)

Verifiable condition. Any element $m\in{\cal M}$ satisfies

[TABLE]

(B)

Non-decodable condition. Any single-element decoder $\psi:{\cal Y}\to{\cal M}$ satisfies

[TABLE]

(C)

Non-cheating condition for honest Alice. Any distinct pair $m^{\prime}\neq m$ satisfies

[TABLE]

Now, we discuss how the code $(\phi,\Psi)$ can be used for the task explained in Section I. Assume that Alice sends her ID $M$ to Bob by using the encoder $\phi$ via noisy channel $W$ and Bob gets the list $M_{1},\ldots,M_{\mathsf{L}}$ by applying the decoder $\Psi$ at Step (i). At Step (ii), Alice shows her ID $M$ to Bob. Verifiable condition (A) guarantees that her ID $M$ belongs to Bob’s list. Hence, the requirement (a) is satisfied. Non-decodable condition (B) forbids Bob to identify Alice’s ID at Step (i), hence it guarantees the requirement (b). In fact, if $m$ is Alice’s ID and there exist another ID $m^{\prime}(\neq m)$ and an element $x_{0}$ that might be different from $\phi(m)$ such that ${\rm Pr}[m\in\Psi(Y)|X=x_{0}]$ and ${\rm Pr}[m^{\prime}\in\Psi(Y)|X=x_{0}]$ are close to $1$, Alice can make the following cheating by sending $x_{0}$ instead of $\phi(m)$. Since Alice knows that $m^{\prime}$ belongs to Bob’s decoded list, she finds the third person whose ID is $m^{\prime}$. Then, she tells the third person this fact. At Step (ii), the third person can make spoofing by showing Bob his/her ID. Since Non-cheating condition (C) forbids Alice such a cheating, it guarantees the requirement (c). Further, Bob is allowed to decode less than $\mathsf{L}$ messages. That is, $\mathsf{L}$ is the maximum number that Bob can list as the candidates of the original message.

However, Condition (C) is the security evaluation for honest Alice who uses the correct encoder $\phi$. Dishonest Alice might send her message by using a different encoder. To cover such a case, we impose the following condition instead of Condition (C).

(D)

Non-cheating condition for dishonest Alice. If a pair of $x$ and $m$ satisfies

[TABLE]

any $m^{\prime}(\neq m)$ satisfies

[TABLE]

In the following, when a code $(\phi,\Psi)$ satisfies conditions (A), (B) and (D), it is called an $(\epsilon_{A},\delta_{B},\delta_{C})$ code.

Now, we observe how to characterize the code constructed to achieve the capacity in the paper [6]. For this characterization, we consider the following code when $\mathsf{M}^{\prime}\mathsf{L}=\mathsf{M}$. We divide the $\mathsf{M}$ messages into $\mathsf{M}^{\prime}$ groups whose group is composed of $\mathsf{L}$ messages. First, we prepare a code $({\phi}^{\prime},{\psi}^{\prime})$ to transmit the message with size $\mathsf{M}^{\prime}$ with decoding error probability $\epsilon_{A}^{\prime}$, where ${\phi}^{\prime}$ is the encoder and ${\psi}^{\prime}$ is the decoder. When the message $M$ belongs to the $i$-th group, Alice sends ${\phi}^{\prime}(i)$. Using the decoder ${\psi}^{\prime}$, Bob recovers $i^{\prime}$. Then, Bob outputs $\mathsf{L}$ elements that belongs to the $i^{\prime}$-th group. In this code, the parameter $\delta_{B}$ is given as $1/\mathsf{L}$. Hence, it satisfies the non-decodable condition with a good parameter. However, the parameter $\delta_{C}$ becomes at least $1-\epsilon_{A}^{\prime}$. Hence, this protocol essentially does not satisfy Non-cheating condition (C) nor (D). In this way, our security parameter rules out the above trivial code construction.

II-B Relation to bit commitment

If our task is realized and ${\cal M}$ is a vector space $\mathbb{F}_{2}^{t}$ over the finite field $\mathbb{F}_{2}$, we can approximately realize bit commitment as follows while it is known that bit commitment can be realized by using noisy channel [8, 9, 10]. To explain this realization, we state the formulation of approximate bit commitment as follows.

(1)

Committing phase: Alice has bit $X=0$ or $1$. She makes a commitment to Bob.

(2)

Revealing phase: Alice announces her bit to Bob. Bob checks whether it is true.

There are two kinds of cheating. One is Bob’s cheating. Bob guesses Alice’s bit only from the result of the committing phase. The other is Alice’s cheating. In the revealing phase, Alice convinces Bob that Alice’s bit is $X\oplus 1$. Then, we impose three conditions.

(B1)

The mutual information between Alice’s bit $X$ and Bob’s result of the committing phase is upper bounded by $\bar{\delta}_{B}$.

(B2)

The successful maximum probability of Alice’s cheating under the following condition (B2-1) is upper bounded by $\bar{\delta}_{A}$.

(B2-1)

When Alice is honest in the revealing phase, the probability that Alice convinces Bob that Alice’s bit is $X$ is at least $1/2$.

(B3)

Another parameter is the error probability. When Alice and Bob are honest, the probability that Bob is convinced that Alice’s bit is lower bounded by $X$ by $1-\bar{\epsilon}_{A}$.

If a protocol satisfies the above property, the protocol is is called a $(\bar{\epsilon}_{A},\bar{\delta}_{A},\bar{\delta}_{B})$ approximate bit commitment. When $\bar{\delta}_{A}=\bar{\delta}_{B}=0$, it is called perfect bit commitment.

Given a $(\epsilon_{A},\delta_{B},\delta_{C})$ code $(\phi,\Psi)$, we construct a protocol for an approximate bit commitment as follows. Assume that the message set of the code $(\phi,\Psi)$ is ${\cal M}=\mathbb{F}_{2}^{t}$. Then, $X$, $M$, and $Y$ are variables given in Section II-A with the code $(\phi,D)$. Hence, $M$ is subject to the uniform distribution. Define the conditional Renyi entropy of order 2 by $H_{2}(M|Y):=-\log\sum_{y,m}P_{Y}(y)P_{M|Y}(m|y)^{2}$. We have $H_{2}(M|Y)\geq-\log\delta_{B}$ [11, Theorem 1][12, Lemma 5.9 and (5.134)]. Due to the universal hashing lemma[13, 15] [16, Theorem 2], there exists a surjective homomorphic222For a surjective homomorphic unversal hash function, see [14, Section II]. hash function $f$ from ${\cal M}$ to $\mathbb{F}_{2}$ such that

[TABLE]

Using the above hash function $f$, we describe our protocol for approximate bit commitment as follows.

(1)

Commiting phase: Alice has bit $X=0$ or $1$. She randomly choose one element $M$ from $f^{-1}(X)$. She sends $M^{\prime}$ by using the encoder $\phi$. Bob output $\mathsf{L}$ elements $M_{1},\ldots,M_{\mathsf{L}}$ from $Y$.

(2)

Revealing phase: To convince Bob that her bit is $X$, Alice announces $M^{\prime}$ to Bob. Bob checks whether $f(M^{\prime})=X$ and $M^{\prime}$ is one element of $M_{1},\ldots,M_{\mathsf{L}}$.

Theorem 1

The above protocol is an $(\epsilon_{A},{\delta}_{C},2{\delta}_{B})$ approximate bit commitment. $\square$

When the parameters $\epsilon_{A},\delta_{B}$, and $\delta_{C}$ are sufficiently small, the above protocol works as bit commitment due to this theorem.

*Proof: * Since the hash function $f$ is surjective homomorphic, $|f^{-1}(0)|=|f^{-1}(1)|=2^{t-1}$. Hence, the random variable $M^{\prime}$ chosen in the committing phase is subject to the uniform distribution. Hence, $M^{\prime}$ can be considered as the variable $M$ because they are subject to the same distribution. Since Bob’s list contains $M^{\prime}$ at least probability $1-\epsilon_{A}$, the condition (B3) holds. Also, (6) implies the condition (B1).

Assume that Bob outputs $\mathsf{L}$ elements $M_{1},\ldots,M_{\mathsf{L}}$. To satisfy the condition (B2-1), Alice needs to prepare the pair of $x$ and $m$ to satisfy the condition (4). That is, Alice needs to send an element $x$ to satisfy the condition (4) with keeping an element $m\in f^{-1}(X)$. To convince Bob that her bit is $X\oplus 1$, in the revealing phase, Alice sends Bob an element in $f^{-1}(X\oplus 1)$ that needs to belong to the set $\{M_{1},\ldots,M_{\mathsf{L}}\}$. However, due to (5), any element in $f^{-1}(X\oplus 1)$ satisfies this condition at most probability $\delta_{C}$. Thus, we obtain the condition (B2).

II-C Our setting with coding-theoretic description

To rewrite the above conditions in a coding-theoretic way, we introduce several notations. For $x\in{\cal X}$ and a distribution on ${\cal X}$, we define the distribution $W_{x}$ and $W_{P}$ on ${\cal Y}$ as $W_{x}(y):=W(y|x)$ and $W_{P}(y):=\sum_{x\in{\cal X}}P(x)W(y|x)$. Alice sends her ID $M\in{\cal M}:=\{1,\ldots,\mathsf{M}\}$ via noisy channel $W$. Bob’ decoder can be described as disjoint subsets $D=\{{\cal D}_{m_{1},\ldots,m_{\mathsf{L}}}\}_{\{m_{1},\ldots,m_{\mathsf{L}}\}\subset{\cal M}}$ such that $\cup_{\{m_{1},\ldots,m_{\mathsf{L}}\}\subset{\cal M}}{\cal D}_{m_{1},\ldots,m_{\mathsf{L}}}={\cal Y}$. That is, we have the relation ${\cal D}_{m_{1},\ldots,m_{\mathsf{L}}}=\{y|\{m_{1},\ldots,m_{\mathsf{L}}\}=\Psi(y)\}$. In the following, we denote our decoder by $D$ instead of $\Psi$.

In particular, when a decoder has only one outcome as an element of ${\cal M}$ it is called a single-element decoder. It is given as disjoint subsets $\tilde{{\cal D}}=\{\tilde{{\cal D}}_{m}\}_{m\in{\cal M}}$ such that $\cup_{m\in{\cal M}}\tilde{{\cal D}}_{m}={\cal Y}$.

Theorem 2

The conditions (A) – (D) for an encoder $\phi$ and a decoder $D=\{{\cal D}_{m_{1},\ldots,m_{\mathsf{L}}}\}_{\{m_{1},\ldots,m_{\mathsf{L}}\}\subset{\cal M}}$ are rewritten in a coding-theoretic way as follows.

(A)

Verifiable condition.

[TABLE]

(B)

Non-decodable condition.

[TABLE]

where the above maximum is taken for a single-element decoder $\tilde{D}=\{\tilde{{\cal D}}_{m}\}_{m\in{\cal M}}$, and $\delta_{B,\phi(m)}(\tilde{{\cal D}}_{m})$ is defined for a single-element decoder $\tilde{D}$ as

[TABLE]

(C)

*Non-cheating condition for honest Alice. *

[TABLE]

(D)

Non-cheating condition for dishonest Alice.

[TABLE]

$\square$

*Proof: * For any $m\in{\cal M}$ and $y\in{\cal Y}$, the condition $m\in\Psi(y)$ is equivalent to the condition $y\in\cup_{m_{1},\ldots,m_{\mathsf{L}}:\{m_{1},\ldots,m_{\mathsf{L}}\}\ni m^{\prime}}{\cal D}_{m_{1},\ldots,m_{\mathsf{L}}}$. Since

[TABLE]

we obtain the equivalence between the conditions (A) and (C) given in Section II-A and those given here. As the condition $m=\psi(y)$ is equivalent to the condition $y\in\tilde{{\cal D}}_{m}$, we obtain the desired equivalence for the condition (B). Also, the condition (4) is equivalent to the condition $\epsilon_{A,m}(x,D)\leq\frac{1}{2}$, which implies the desired equivalence with respect to the condition (D).

In the following, when a code $(\phi,D)$ satisfies conditions (A), (B) and (D), it is called an $(\epsilon_{A},\delta_{B},\delta_{C})$ code. Also, for a code $(\phi,D)$, we denote $\mathsf{M}$ and $\mathsf{L}$ by $|(\phi,D)|_{1}$ and $|(\phi,D)|_{2}$. Also, we allow stochastic encoder, in which $\phi(m)$ is a distribution on ${\cal X}$. In this case, for a function $f$ from ${\cal X}$ to $\mathbb{R}$, $f(\phi(m))$ expresses $\sum_{x}f(x)\phi(m)(x)$.

III Information quantities

III-A Notation based on distribution and conditional distribution

Let ${\cal X}$ be a finite set and denote the set of probability distributions on ${\cal X}$ by ${\cal P}({\cal X})$. Consider the channel written as the transition matrix $W$ from ${\cal X}$ to ${\cal Y}$. For $x\in{\cal X}$ and a distribution $P\in{\cal P}({\cal X})$, we define the distribution $W_{x}$ and $W_{P}$ on ${\cal Y}$ as $W_{x}(y):=W(y|x)$ and $W_{P}(y):=\sum_{x\in{\cal X}}P(x)W(y|x)$. We assume that $W_{x}\neq W_{x^{\prime}}$ for $x\neq x^{\prime}\in{\cal X}$. In the following, $\mathbb{E}_{x}$ expresses the average with respect to a variable over the system ${\cal Y}$ under the distribution $W_{x}$ and $\mathbb{V}_{x}$ expresses the variance with respect to a variable over the system ${\cal Y}$ under the distribution $W_{x}$. This notation is also applied to the $n$-fold extended setting.

We define

[TABLE]

where the base of logarithm is $2$.

For $x,x^{\prime}\in{\cal X}$, we define

[TABLE]

Then, we define

[TABLE]

In this paper, the condition

[TABLE]

plays an important role.

Lemma 1

When $P\in{\cal P}({\cal X})$ satisfies the condition $I(P,W)=C(W)$, the condition (21) holds.

*Proof: * Since $D(W_{x}\|W_{P})=D(W_{x^{\prime}}\|W_{P})$, we have

[TABLE]

Also, we often impose the following condition for our channel $W$;

[TABLE]

III-B Notation based on variables

When we focus on a Markov chain $U-X-Y$ with a variable on a finite set ${\cal U}$, it is intuitive to handle notations based on the variables $U,X,$ and $Y$. In this paper, the conditional distribution on $Y$ conditioned with $X$ is fixed to the channel $W$. It is sufficient to fix a joint distribution $P\in{\cal P}({\cal U}\times{\cal X})$. To clarify this dependence, we add the subscript $~{}_{P}$ as $H(X)_{P},I(X;Y)_{P},$ and $H(X|U)_{P}$, etc. In fact, the notation given in Section III-A will be used for our proof of the direct part, the notation given in this section will be used for the characterization of our rate region and our proof of the converse part. This is because the characterization of our rate region and the converse part mainly discuss Markovian chains while the direct part mainly evaluates the parameters $\epsilon_{A},\delta_{B},$ and $\delta_{D}$.

Then, we define

[TABLE]

and the function $\kappa$ for $R_{1}\geq H_{0}$ as

[TABLE]

In the above definition, the size of the finite set ${\cal U}$ can be chosen to be arbitrarily large. When a maximization $\max$ or a union $\cup$ with respect to $P\in{\cal P}({\cal U}\times{\cal X})$ appears in the remaining part, this rule for the finite set ${\cal U}$ is applied. Then, we define the set ${\cal P}_{0}$ as

[TABLE]

For example, the distribution $P_{\max}$ and the uniform distribution $P_{\mathop{\rm uni}}$ on ${\cal X}$ belong to ${\cal P}_{0}$.

Lemma 2

We have

[TABLE]

*Proof: * When $H(X)_{P}\leq H_{0}$, we have $H(X|Y)_{P}=H(X)_{P}-I(X;Y)_{P}=[H(X)_{P}-I(X;Y)_{P}]_{+}\geq[H(X)_{P}-C(W)]_{+}=\kappa(H(X)_{P})$. Also, the condition $P\in{\cal P}_{0}$ implies the condition $[H(X)_{P}-C(W)]_{+}=H(X|Y)_{P}$. The combination of the above conditions implies the condition $I(X;Y)_{P}=C(W)$.

Conversely, the condition $I(X;Y)_{P}=C(W)$ implies the conditions $H(X)_{P}\leq H_{0}$. and $H(X|Y)_{P}=[H(X)_{P}-C(W)]_{+}=\kappa(H(X)_{P})$. Hence, the desired relation is obtained.

Then, we prepare the following lemmas whose proofs are given in Appendices A and B.

Lemma 3

Given a joint distribution $P\in{\cal P}({\cal U}\times{\cal X})$, we have the Markov chain $U-X-Y$, and focus on the information quantities $I(X;Y|U)_{P}$ and $H(X|U)_{P}$. Then, we have

[TABLE]

$\square$**

Lemma 4

We have

[TABLE]

where $\mathcal{CO}$ expresses the convex full. $\square$

IV Main results

To give the capacity region, we consider $n$-fold discrete memoryless extension $W^{n}$ of the channel $W$. A sequence of codes $\{(\phi_{n},D_{n})\}$ is called strongly secure when $\epsilon_{A}(\phi_{n},D_{n})\to 0$, $\delta_{B}(\phi_{n})\to 0$, $\delta_{D}(D_{n})\to 0$. A sequence of codes $\{(\phi_{n},D_{n})\}$ is called weakly secure when $\epsilon_{A}(\phi_{n},D_{n})\to 0$, $\delta_{B}(\phi_{n})\to 0$, $\delta_{C}(\phi_{n},D_{n})\to 0$. A rate pair $(R_{1},R_{2})$ is strongly deterministically (stochastically) achievable when there exists a strongly secure sequence of deterministic (stochastic) codes $\{(\phi_{n},D_{n})\}$ such that $\frac{1}{n}\log|(\phi_{n},D_{n})|_{1}\to R_{1}$ and $\frac{1}{n}\log|(\phi_{n},D_{n})|_{2}\to R_{2}$333The definitions of $|(\phi_{n},D_{n})|_{1}$ and $|(\phi_{n},D_{n})|_{2}$ are given in the end of Section II.. A rate pair $(R_{1},R_{2})$ is weakly deterministically (stochastically) achievable when there exists a weakly secure sequence of deterministic (stochastic) codes $\{(\phi_{n},D_{n})\}$ such that $\frac{1}{n}\log|(\phi_{n},D_{n})|_{1}\to R_{1}$ and $\frac{1}{n}\log|(\phi_{n},D_{n})|_{2}\to R_{2}$. Then, we denote the set of strongly deterministically (stochastically) achievable rate pair $(R_{1},R_{2})$ by ${\cal R}_{s,d}$ (${\cal R}_{s,s}$). In the same way, we denote the set of weakly deterministically (stochastically) achievable rate pair $(R_{1},R_{2})$ by ${\cal R}_{w,d}$ (${\cal R}_{w,s}$).

Theorem 3

We have the following characterization.

[TABLE]

$\square$

Theorem 4

A rate pair $(R_{1},R_{2})$ is strongly deterministically achievable when the condition (23) holds and there exists a distribution $P\in{\cal P}({\cal X})$ such that $\zeta_{1}(P)>0$ and

[TABLE]

$\square$

In fact, the condition $R_{1}-R_{2}<I(X;Y)_{P}$ corresponds to Verifiable condition (A), the condition $I(X;Y)_{P}<R_{1}$ does to Non-decodable condition (B), and the conditions $R_{1}<H(X)_{P}$ and $\zeta_{1}(P)>0$ do to Non-cheating condition for dishonest Alice (D). Theorems 3 and 4 are shown in Sections V and VI, respectively. We have the following corollaries from Theorems 3 and 4.

Corollary 1

When the condition (23) holds, we have the following relation for $K=(s,s),(s,d),(w,d)$.

[TABLE]

$\square$**

*Proof: * Since $\overline{{\cal R}_{s,d}}\subset\overline{{\cal R}_{s,s}},\overline{{\cal R}_{w,d}}$, Theorem 3 guarantees that

[TABLE]

for $K=(s,s),(s,d),(w,d)$.

Applying Theorem 4 to the case with $P=P_{\max}$ we find that any inner point of $\overline{{\cal C}}\cap\{(R_{1},R_{2})|C(W)\leq R_{1}\leq H_{0}\}$ is achievable. For any point $(R_{1},R_{2})$ of $\overline{{\cal C}}\cap\{(R_{1},R_{2})|0\leq R_{1}\leq C(W)\}$, there exist a real number $p\in[0,1]$ and an inner point $(R_{1}^{\prime},R_{2}^{\prime})$ of $\overline{{\cal C}}\cap\{(R_{1},R_{2})|C(W)\leq R_{1}\leq H_{0}\}$ such that $(R_{1},R_{2})=(pR_{1}^{\prime},pR_{2}^{\prime})$. The rate pair $(R_{1}^{\prime},R_{2}^{\prime})$ is strongly deterministically achievable, For $n$ transmissions, we choose a code for $pn$ transmissions to achieve the rate pair $(R_{1}^{\prime},R_{2}^{\prime})$ strongly deterministically, and we choose a code for $(1-p)n$ transmissions with the rate $(0,0)$. Then, the concatenated code strongly deterministically achieves the rate pair $(R_{1},R_{2})$. Hence, we obtain the relation opposite to (36).

Corollary 2

When the condition (23) holds, and the uniform distribution $P_{\mathop{\rm uni}}$ on ${\cal X}$ satisfies the condition $I(X;Y)_{P_{\mathop{\rm uni}}}=C(W)$, we have the following relations.

[TABLE]

In this case, these capacity regions can be characterized by two real numbers $\log|{\cal X}|$ and $C(W)$ as Fig. 1. $\square$

For example, when the channel $W$ is additive, the assumption of Corollary 2 holds.

*Proof: * The assumption implies that $H_{0}=\log|{\cal X}|=H(X)_{P_{\mathop{\rm uni}}}$. Due to Theorem 3, for $K=(s,s),(s,d),(w,d)$, any rate pair $(R_{1},R_{2})$ in ${\cal R}_{K}$ satisfies the condition $R_{1}\leq\log|{\cal X}|=H(X)_{P_{\mathop{\rm uni}}}=H_{0}$. Hence, the condition (35) is rewritten as (37).

Corollary 3

When the condition (23) holds, and every distribution $P\in{\cal P}_{0}$ satisfies the condition (21), i.e., $\zeta_{1}(P)>0$, we have the relations (37). In this case, these capacity regions can be characterized as Fig. 2. $\square$

*Proof: * Due to Corollary 1, it is sufficient to show

[TABLE]

for $K=(s,s),(s,d),(w,d)$. Since $\overline{{\cal R}_{s,d}}\subset\overline{{\cal R}_{s,s}},\overline{{\cal R}_{w,d}}$, Theorem 3 guarantees the relation $\subset$ in (38) for $K=(s,s),(s,d),(w,d)$. It is sufficient to show the achievability of any rate pair in ${{\cal C}}\cap\{(R_{1},R_{2})|H_{0}\leq R_{1}\leq\log|{\cal X}|\}$.

The combination of the assumption and Theorem 4 guarantees that the region $\cup_{P\in{\cal P}_{0}}\{(R_{1},R_{2})|H_{0}\leq R_{1}\leq H(X)_{P},~{}R_{1}-I(X;Y)_{P}\leq R_{2}\leq R_{1}\})$ is strongly deterministically achievable. Hence, the relation $\supset$ in (38) follows from Lemma 4 if we can show the following statement; Any convex combination of elements of the region $\cup_{P\in{\cal P}_{0}}\{(R_{1},R_{2})|H_{0}<R_{1}<H(X)_{P},~{}R_{1}-I(X;Y)_{P}<R_{2}<R_{1}\})$ is strongly deterministically achievable.

To show the above required statement, we assume that two sequences $\{(\phi_{n},D_{n})\}$ and $\{(\phi_{n}^{\prime},D_{n}^{\prime})\}$ of deterministic codes are strongly secure. Then, we define the concatenation $\{(\phi_{2n}^{\prime\prime},D_{2n}^{\prime\prime})\}$ as follows. When $\phi_{n}$($\phi_{n}^{\prime}$) is given as a map from ${\cal M}$(${\cal M}^{\prime}$) to ${\cal X}^{n}$, the encoder $\phi_{2n}^{\prime\prime}$ is given as a map from $(m,m^{\prime})\in{\cal M}\times{\cal M}^{\prime}$ to $(\phi_{n}(m),\phi_{n}^{\prime}(m^{\prime}))\in{\cal X}^{2n}$. The decoder $D_{2n}^{\prime\prime}$ is given as a map from $(y_{1},\ldots,y_{2n})\in{\cal Y}^{2n}$ to $(D_{n}(y_{1},\ldots,y_{n}),D_{n}^{\prime}(y_{n+1},\ldots,y_{2n}))\in{\cal M}^{\mathsf{L}}\times{{\cal M}^{\prime}}^{\mathsf{L}^{\prime}}$. We have $\epsilon_{A}(\phi_{2n}^{\prime\prime},D_{2n}^{\prime\prime})\leq\epsilon_{A}(\phi_{n},D_{n})+\epsilon_{A}(\phi_{n}^{\prime},D_{n}^{\prime})$ because the code $(\phi_{2n}^{\prime\prime},D_{2n}^{\prime\prime})$ is correctly decoded when both codes $(\phi_{n},D_{n})$ and $(\phi_{n}^{\prime},D_{n}^{\prime})$ are correctly decoded. Since the message encoded by $\phi_{2n}^{\prime\prime}$ is correctly decoded only when both messages encoded by encoders $\phi_{n}$ and $\phi_{n}^{\prime}$ are correctly decoded, we have $\delta_{B}(\phi_{2n}^{\prime\prime})\leq\min(\delta_{B}(\phi_{n}),\delta_{B}(\phi_{n}^{\prime}))$. Alice can cheat the decoder $D_{2n}^{\prime\prime}$ only when Alice cheats one of the decoders $D_{n}$ and $D_{n}^{\prime}$. Hence, $\delta_{D}(D_{2n}^{\prime\prime})\leq\min(\delta_{D}(D_{n}),\delta_{D}(D_{n}^{\prime}))$. Therefore, the concatenation $\{(\phi_{2n}^{\prime\prime},D_{2n}^{\prime\prime})\}$ is also strongly secure. That is, any convex combination of elements of the region $\cup_{P\in{\cal P}_{0}}\{(R_{1},R_{2})|H_{0}\leq R_{1}\leq H(X)_{P},~{}R_{1}-I(X;Y)_{P}\leq R_{2}\leq R_{1}\})$ is strongly deterministically achievable.

V Proof of Converse Theorem

In order to show Theorem 3, we prepare the following lemma.

Lemma 5

For $X^{n}=(X_{1},\ldots,X_{n})$, we choose the joint distribution $P_{X^{n}}$. Let $Y^{n}=(Y_{1},\ldots,Y_{n})$ be the channel output variables of the inputs $X^{n}$ via the channel $W$. Then, we have

[TABLE]

$\square$**

Although this lemma is not so difficult, for readers’ convenience, we give the proof in Appendix C.

Proof of Theorem 3: The proof of Theorem 3 is composed of two parts. The first part is the evaluation of $R_{1}$. The second part is the evaluation of $R_{1}-R_{2}$. The key point of the first part is the use of (39) in Lemma 5. The key point of the second part is the meta converse for list decoding [6, Section III-A].

Step 1: Preparation.

We show Theorem 3 by showing the following relations

[TABLE]

Assume that a sequence of deterministic codes $\{(\phi_{n},D_{n})\}$ is weakly secure. We assume that $R_{i}:=\lim_{n\to\infty}\frac{1}{n}\log|(\phi_{n},D_{n})|_{i}$ converges for $i=1,2$. For the definition of $|(\phi_{n},D_{n})|_{i}$, see the end of Section II-C. Letting $M$ be the random variable of the message, we define the variables $X^{n}=(X_{1},\ldots,X_{n}):=\phi_{n}(M)$. The random variables $Y^{n}=(Y_{1},\ldots,Y_{n})$ are defined as the output of the channel $W^{n}$, which is the $n$ times use of the channel $W$. We define the joint distribution $P_{n}\in{\cal P}({\cal U}\times{\cal X})$ by $P_{n}(x,i):=\frac{1}{n}P_{X_{i}}(x)$ for $i=1,\ldots,n$ and $x\in{\cal X}$ by choosing ${\cal U}=\{1,\ldots,n\}$. Hence, the variable $U$ is subject to the uniform distribution on $\{1,\ldots,n\}$. Under the distribution $P_{n}$, we denote the channel output by $Y$. In this proof, we use the notations $\mathsf{M}_{n}:=|(\phi_{n},D_{n})|_{1}$ and $\mathsf{L}_{n}:=|(\phi_{n},D_{n})|_{2}$. Also, instead of $\epsilon_{A}(\phi_{n},D_{n})$, we employ $\epsilon_{A}^{\prime}(\phi_{n},D_{n}):=\sum_{m=1}^{\mathsf{M}_{n}}\frac{1}{\mathsf{M}_{n}}\epsilon_{A,m}(\phi_{n}(m),D_{n})$, which goes to zero.

Step 2: Evaluation of $R_{1}$.

For a code $(\phi_{n},D_{n})$, we have

[TABLE]

where $(b)$ follows from Lemma 5. Dividing the above by $n$ and taking the limit, we have

[TABLE]

To show $(a)$ in (43), we consider the following protocol. After converting the message $M$ to $X^{n}$ by the encoder $\phi_{n}(M)$, Alice sends the $X^{n}$ to Bob $K$ times. Here, we choose $K$ to be an arbitrary large integer. Applying the decoder $D_{n}$, Bob obtains $K$ lists that contain up to $\mathsf{L}^{K}$ messages. Among these messages, Bob chooses $\hat{M}$ as the element that most frequently appears in the $K$ lists. When $\delta_{C}(\phi_{n},D_{n})<1-\epsilon_{A,M}(\phi_{n}(M),D_{n})$ and $K$ is sufficiently large, Bob can correctly decode $M$ by this method because $1-\epsilon_{A,M}(\phi_{n}(M),D_{n})$ is the probability that the list contains $M$ and $\delta_{C}(\phi_{n},D_{n})$ is the maximum of the probability that the list contains $m^{\prime}\neq M$, i.e., the element $M$ has the highest probability to be contained in the list. Therefore, the failure of decoding is limited to the case when $1-\delta_{C}(\phi_{n},D_{n})\leq\epsilon_{A,M}(\phi_{n}(M),D_{n})$, Since the average of $\epsilon_{A,M}(\phi_{n}(M),D_{n})$ is $\epsilon_{A}^{\prime}(\phi_{n},D_{n})$, Markov inequality guarantees that the error probability of this protocol is bounded by $\epsilon^{\prime}:=\frac{\epsilon_{A}^{\prime}(\phi_{n},D_{n})}{1-\delta_{C}(\phi_{n},D_{n})}$. Fano inequality shows that $H(M|\hat{M})\leq\epsilon^{\prime}\log|(\phi_{n},D_{n})|_{1}+\log 2$. Then, we have

[TABLE]

which implies $(a)$ in (43).

Step 3: Evaluation of $R_{1}-R_{2}$.

Now, we consider the hypothesis testing with two distributions $P(m,y^{n}):=\frac{1}{\mathsf{M}_{n}}W^{n}(y^{n}|\phi_{n}(m))$ and $Q(m,y^{n}):=\frac{1}{\mathsf{M}_{n}}\sum_{m=1}^{\mathsf{M}_{n}}W^{n}(y^{n}|\phi_{n}(m))$ on ${\cal M}_{n}\times{\cal Y}^{n}$, where ${\cal M}_{n}:=\{1,\ldots,\mathsf{M}_{n}\}$. Then, we define the region ${\cal D}_{n}^{*}\subset{\cal M}_{n}\times{\cal Y}^{n}$ as $\cup_{m_{1},\ldots,m_{\mathsf{L}_{n}}}\{m_{1},\ldots,m_{\mathsf{L}_{n}}\}\times{\cal D}_{m_{1},\ldots,m_{\mathsf{L}_{n}}}$. Using the region ${\cal D}_{n}^{*}$ as our test, we define $\epsilon_{Q}$ as the error probability to incorrectly support $P$ while the true is $Q$. Also, we define $\epsilon_{P}$ as the error probability to incorrectly support $Q$ while the true is $P$. When we apply the monotonicity for the KL divergence between $P$ and $Q$, dropping the term $\epsilon_{P}\log(1-\epsilon_{Q})$, we have

[TABLE]

The meta converse for list decoding [6, Section III-A] shows that $\epsilon_{Q}\leq\frac{|(\phi_{n},D_{n})|_{2}}{|(\phi_{n},D_{n})|_{1}}$ and $\epsilon_{P}=\epsilon_{A}^{\prime}(\phi_{n},D_{n})$. Since Lemma 5 guarantees that $D(P\|Q)=I(X^{n};Y^{n})\leq nI(X;Y|U)_{P_{n}}$, the relation (46) is converted to

[TABLE]

Dividing the above by $n$ and taking the limit, we have

[TABLE]

Therefore, combining Eqs. (44) and (48), we obtain Eq. (41).

Step 4: Proof of Eq. (42).

Assume that a sequence of stochastic codes $\{(\phi_{n},D_{n})\}$ is strongly secure. Then, there exists a sequence of deterministic encoders $\{\phi_{n}^{\prime}\}$ such that $\epsilon_{A}(\phi_{n}^{\prime},D_{n})\leq\epsilon_{A}(\phi_{n},D_{n})$ and $\delta_{C}(\phi_{n}^{\prime},D_{n})\leq\delta_{D}(D_{n})$. Since $\epsilon_{A}(\phi_{n}^{\prime},D_{n})\to 0$ and $\delta_{C}(\phi_{n}^{\prime},D_{n})\to 0$, combining Eq. (41), we have Eq. (42).

VI Proof of direct theorem

Here, we prove the direct theorem (Theorem 4). The proof is based on the random coding. In this proof, we prepare three lemmas, Lemmas 6, 7, and 8. Using Lemmas 7, and 8, we extract an encoder $\phi_{n}$ and messages $m$ with small decoding error probability to satisfy two conditions, which will be stated as the conditions (50) and (51). Then, using these two conditions, we show that the code satisfies Non-cheating condition for dishonest Alice (D) and Non-decodable condition (B). In particular, Lemma 6 is used to derive Non-cheating condition for dishonest Alice (D).

VI-A Preparation

To show Theorem 4, we prepare notations and basic facts. Assume that $R_{1}$ and $R_{2}$ satisfies the condition (34). First, given a real number $R_{3}<R_{1}$, we fix the size of message $\mathsf{M}_{n}:=2^{nR_{1}}$, the list size $\mathsf{L}_{n}:=2^{nR_{2}}$, and a number $\mathsf{M}_{n}^{\prime}:=2^{nR_{3}}$, which is smaller than the message size $\mathsf{M}_{n}$. Then, we prepare the decoder used in this proof as follows.

Definition 1** (Decoder $D_{\phi_{n}}$)**

Given a distribution $P$ on ${\cal X}$, we define the decoder $D_{\phi_{n}}$ for a given encoder $\phi_{n}$ (a map from $\{1,\ldots,\mathsf{M}_{n}\}$ to ${\cal X}^{n}$) in the following way. We define the subset ${\cal D}_{x^{n}}:=\{y^{n}|W_{x^{n}}(y^{n})\geq\mathsf{M}_{n}^{\prime}W_{P^{n}}^{n}(y^{n})\}$. Then, for $y^{n}\in{\cal Y}^{n}$, we choose up to $\mathsf{L}_{n}$ elements $i_{1},\ldots,i_{\mathsf{L}_{n}^{\prime}}$ $(\mathsf{L}_{n}^{\prime}\leq\mathsf{L}_{n})$ as the decoded messages such that $y^{n}\in{\cal D}_{\phi_{n}(i_{j})}$ for $j=1,\ldots,\mathsf{L}_{n}^{\prime}$. $\square$

For $x^{n},{x^{n}}^{\prime}\in{\cal X}^{n}$, we define

[TABLE]

and define $d(x^{n},{x^{n}}^{\prime})$ to be the number of $k$ such that $x_{k}\neq{x_{k}}^{\prime}$. In the proof of Theorem 4, we need to extract an encoder $\phi_{n}$ and elements $m\in{\cal M}_{n}$ that satisfies the following two conditions for $R_{3},\epsilon_{1},\epsilon_{2}>0$;

[TABLE]

For this aim, given a code $\phi_{n}$ and real numbers, $R_{3},\epsilon_{1},\epsilon_{2}>0$, we define the functions $\eta_{\phi_{n},\epsilon_{1}}^{A}$ and $\eta_{\phi_{n},\epsilon_{2},R_{3}}^{C}$ from ${\cal M}_{n}$ to $\{0,1\}$ as

[TABLE]

As shown in Section VI-C, we have the following lemma.

Lemma 6

For arbitrary real numbers $\epsilon_{1}>0$ and $R_{3}<I(P,W)$, we choose $\epsilon_{2}:=\epsilon_{1}+\frac{\zeta_{2}(P)}{\zeta_{1}(P)}(I(P,W)-R_{3}+\epsilon_{1})$. When a code $\tilde{\phi}$ defined in the message set $\tilde{{\cal M}}_{n}$ satisfies

[TABLE]

for an element $m\in\tilde{{\cal M}}_{n}$, we have

[TABLE]

$\square$**

VI-B Proof of Theorem 4

Step 1: Lemmas related to random coding.

To show Theorem 4, we assume that the variable $\Phi_{n}(m)$ for $m\in{\cal M}_{n}$ is subject to the distribution $P^{n}$ independently. Then, we have the following two lemmas, which are shown later. In this proof, we treat the code $\Phi_{n}$ as a random variable. Hence, the expectation and the probability for this variable are denoted by ${\rm E}_{\Phi_{n}}$ and ${\rm Pr}_{\Phi_{n}}$, respectively.

Lemma 7

When

[TABLE]

we have the average version of Verifiable condition (A), i.e.,

[TABLE]

$\square$**

Lemma 8

When

[TABLE]

for every real number $\epsilon_{2}>0$, we have

[TABLE]

$\square$**

Step 2: Extraction of an encoder $\phi_{n}$ and messages $m$ with small decoding error probability that satisfies the conditions (50) and (51).

In this proof, we set the parameters $\epsilon_{0}$, $\epsilon_{1}$, $\epsilon_{2}$, $\epsilon_{3}$, and $R_{3}$ in the following way so that the conditions in Lemmas 6, 7, and 8 are satisfied.

[TABLE]

The law of large number guarantees that

[TABLE]

Due to Eq. (70), and Lemmas 7 and 8, there exist a sequence of codes $\phi_{n}$ and a sequence of real numbers $\epsilon_{4,n}>0$ such that $\epsilon_{4,n}\to 0$ and

[TABLE]

Due to Eq. (71), Markov inequality guarantees that there exist $2\mathsf{M}_{n}/3$ elements $\tilde{{\cal M}}_{n}:=\{m_{1},\ldots,m_{2\mathsf{M}_{n}/3}\}$ such that every element $m\in\tilde{{\cal M}}_{n}$ satisfies

[TABLE]

which implies that

[TABLE]

because $\eta_{\phi_{n},\epsilon_{3}}^{A}$ and $\eta_{\phi_{n},\epsilon_{2},R_{3}}^{C}$ take value 0 or 1.

Step 3: Proof of Non-cheating condition for dishonest Alice (D).

Now, we define a code $\tilde{\phi}_{n}$ on $\tilde{{\cal M}}_{n}$ as $\tilde{\phi}_{n}(m):={\phi}_{n}(m)$ for $m\in\tilde{{\cal M}}_{n}$. Thus, for $m\neq m^{\prime}\in\tilde{{\cal M}}_{n}$, we have

[TABLE]

Therefore, Lemma 6 guarantees Non-cheating condition for dishonest Alice (D), i.e.,

[TABLE]

Step 4: Proof of Non-decodable condition (B).

Eq. (77) can be rewritten as

[TABLE]

In the code $\tilde{\phi}_{n}$, Eq. (79) implies that

[TABLE]

where $P_{\tilde{{\cal M}}_{n}}$ is the uniform distribution on $\tilde{{\cal M}}_{n}$. Using the formula given in [17, Theorem 4][18, Lemma 4], we have

[TABLE]

Also, we have

[TABLE]

where $(a)$ follows from Eq. (79) and $(b)$ follows from Chebychev inequality. Since the relation

[TABLE]

implies $\frac{2\cdot 2^{n(I(P,W)+2\epsilon_{3})}}{\mathsf{M}_{n}}\leq\frac{2\cdot 2^{n(R_{1}-\frac{1}{3}(R_{1}-I(P,W)))}}{\mathsf{M}_{n}}=2\cdot 2^{-\frac{n}{3}(R_{1}-I(P,W)))}\to 0$, the combination of (81) and (82) implies that $\delta_{B}(\tilde{\phi}_{n})\to 0$. Since RHSs of (75) and (78) go to zero, we obtain the desired statement.

VI-C Proof of Lemma 6

The following is the outline of the proof of Lemma 6. To show Lemma 6, we need to evaluate $\delta_{D,m}(D_{\tilde{\phi}_{n}})$. For this evaluation, we evaluate $\delta_{C,m}(x^{n},D_{\tilde{\phi}_{n}})$ when an element $x^{n}\in{\cal X}^{n}$ satisfies the condition

[TABLE]

As Step 1, we evaluate $W^{n}_{x^{n}}({\cal D}_{{x^{n}}^{\prime}})$ by using Chebyshev inequality. Then. in Step 2, we evaluate $F^{n}(x^{n},\tilde{\phi}_{n}(m^{\prime})|P)$. Finally, Step 3 evaluate $\delta_{C,m}(x^{n},D_{\tilde{\phi}_{n}})$ under the condition (83) by using the above evaluations.

Step 1: Evaluation of $W^{n}_{x^{n}}({\cal D}_{{x^{n}}^{\prime}})$.

As the preparation, we evaluate $W^{n}_{x^{n}}({\cal D}_{{x^{n}}^{\prime}})$. The definitions of $F^{n}(x^{n},{x^{n}}^{\prime}|P)$ (Eq. (49)) and $V(W)$ (Eq. (23)) imply that

[TABLE]

Hence, applying Chebyshev inequality to the variable $nR_{3}-(\log W_{x^{n}}(Y^{n})-\log W_{P^{n}}^{n}(Y^{n}))$, we have

[TABLE]

where $[x]_{+}:=\max(x,0)$.

Step 2: Evaluation of $F^{n}(x^{n},\tilde{\phi}_{n}(m^{\prime})|P)$.

In this step, we evaluate $F^{n}(x^{n},\tilde{\phi}_{n}(m^{\prime})|P)$. In the following, we assume (83). Then,

[TABLE]

where $(a)$ follows from the definition of $D_{\tilde{\phi}_{n}}$ (Definition 1) and $(b)$ follows from Eq. (86).

Hence, we have

[TABLE]

Thus,

[TABLE]

where $(a)$, $(b)$, and $(c)$ follow from Eq. (88), the combination of the definitions of $\zeta_{1}(P)$ and $d(x^{n},\tilde{\phi}_{n}(m))$, and Eq. (59), respectively.

Hence,

[TABLE]

Thus, for $m^{\prime}\in\tilde{{\cal M}}_{n}$, we have

[TABLE]

where $(a)$, $(b)$, $(c)$ and $(d)$ follow from the combination of the definitions of $\zeta_{1}(P)$ and $d(x^{n},\tilde{\phi}_{n}(m))$, Eq. (58), Eq. (90), the choice of $\epsilon_{2}$ respectively. Eq. (91) is the required evaluation of $F^{n}(x^{n},\tilde{\phi}_{n}(m^{\prime})|P)$.

Step 3: Evaluation of $\delta_{C,m}(x^{n},D_{\tilde{\phi}_{n}})$.

Finally, combining Eqs. (86) and (91), we evaluate $\delta_{C,m}(x^{n},D_{\tilde{\phi}_{n}})$. We have

[TABLE]

where $(a)$, $(b)$, and $(c)$ follow from the definition of $\delta_{C,m}$ (Eq. (12)), Eq. (86), and Eq. (91), respectively. Taking the maximum of $\delta_{C,m}(x^{n},D_{\tilde{\phi}_{n}})$ under the condition (83), we obtain the required inequality.

VI-D Proof of Lemma 7

We show Lemma 7 by employing an idea similar to [17, 18]. First, we show the following lemma.

Lemma 9

We have the following inequality;

[TABLE]

$\square$**

*Proof: * When $i$ is sent, there are two cases for incorrect decoding. The first case is the case that the received element $y$ does not belong to ${\cal D}_{\Phi_{n}(i)}$. The second case is the case that there are more than $\mathsf{L}_{n}$ elements $i^{\prime}$ to satisfy $y\in{\cal D}_{\Phi_{n}(i^{\prime})}$. The error probability of the first case is given in the first term of Eq. (93). The error probability of the second case is given in the second term of Eq. (93).

Taking the average in (93) of Lemma 9 with respect to the variable $\Phi_{n}$, we obtain the following lemma.

Lemma 10

We have the following inequality;

[TABLE]

$\square$**

Applying Lemma 10, we have

[TABLE]

where $(a)$ follows from the relation

[TABLE]

The variable $\frac{1}{n}(\log W^{n}_{X^{n}}(y^{n})-\log W^{n}_{P^{n}}(y^{n}))$ is the mean of $n$ independent variables that are identical to the variable $\log W_{X}(Y)-\log W_{P}(Y)$ whose average is $I(P,W)>R_{3}$. Thus, the law of large number guarantees that the first term in (95) approaches to zero as $n$ goes to infinity. The second term in (95) also approaches to zero due to the assumption (61). Therefore, we obtain Eq. (62).

VI-E Proof of Lemma 8

The outline of the proof of Lemma 8 is the following. To evaluate the value ${\rm E}_{\Phi_{n}}\sum_{m=1}^{\mathsf{M}_{n}}\frac{1}{\mathsf{M}_{n}}\eta_{\Phi_{n},\epsilon_{2},R_{3}}^{C}(m)$, we convert it to the sum of certain probabilities. We evaluate these probabilities by excluding a certain exceptional case. That is, we show that the probability of the exceptional case is small and these probabilities under the condition to exclude the exceptional case is also small. The latter will be shown by evaluating a certain conditional probability. For this aim, we introduce a new function $G(s|P)$ and prepare a new lemma.

Step 1: Preparation.

For $s>0$, we define

[TABLE]

Since the function $s\mapsto G(s,x|P)$ is strictly convex, the function $s\mapsto G(s|P)$ is strictly convex. Hence, we have the following lemma.

Lemma 11

When $W_{x}\neq W_{x^{\prime}}$ for $x\neq x^{\prime}$, The value $sI(P,W)-G(s|P)-H(P)$ is negative and continuous for $s>0$. It converges to zero as $s$ goes to infinity. Also, $\sup_{s>0}-R_{1}+sR-G(s|P)>0$ for $R_{1}<H(P)$. $\square$

*Proof: * Since $F(x,x|P)>F(x,x^{\prime}|P)$ for $x\neq x^{\prime}$, we have

[TABLE]

Hence, the relation $\sum_{x\in{\cal X}}P(x)F(x,x|P)=I(P,W)$ implies that

[TABLE]

When $s\to\infty$, the above value goes to zero.

Since $-R_{1}>-H(P)$, we have $\lim_{s\to 0}-R_{1}+sR-G(s|P)>\lim_{s\to 0}-H(P)+sI(P,W)-G(s|P)=0$. Hence, due to the continuity for $s$, there exists $s>0$ such that $-R_{1}+sR-G(s|P)>0$. Then, the proof is completed.

Step 2: Evaluation of a certain conditional probability

Due to Lemma 11 and Eq. (63), we can choose $s>0$ such that $-R_{1}+s(R_{3}-\epsilon_{2})>G(s|P)$. We set $\epsilon_{5}:=\frac{1}{2}(-R_{1}+s(R_{3}-\epsilon_{2})-G(s|P))>0$. We define two conditions $A_{n,i}$ and $B_{n,i}$ for the encoder $\Phi_{n}$ as

$A_{n,i}$

$G^{n}(s,\Phi_{n}(i)|P)<n(-R_{1}+s(R_{3}-\epsilon_{2})-\epsilon_{5})$.

$B_{n,i}$

$\exists j\neq i,F^{n}(\Phi_{n}(i),\Phi_{n}(j)|P)\geq n(R_{3}-\epsilon_{2})$.

The aim of this step is the evaluation of the conditional probability ${\rm Pr}_{\Phi_{n}}(B_{n,i}|A_{n,i})$ that expresses the probability that the condition $B_{n,i}$ holds under the condition $A_{n,i}$.

We choose $j\neq i$. When the fixed variable $\Phi_{n}(i)$ satisfies the condition $A_{n,i}$, Markov inequality implies that

[TABLE]

where ${\rm Pr}_{\Phi_{n}(j)|\Phi_{n}(i)}$ is the probability for the random variable $\Phi_{n}(j)$ with the fixed variable $\Phi_{n}(i)$. Hence, when the fixed variable $\Phi_{n}(i)$ satisfies the condition $A_{n,i}$,

[TABLE]

where $\Phi_{n,i,c}$ expresses the random variables $\{\Phi_{n}(j)\}_{j\neq i}$. Then, we have

[TABLE]

Step 3: Evaluation of ${\rm E}_{\Phi_{n}}\sum_{m=1}^{\mathsf{M}_{n}}\frac{1}{\mathsf{M}_{n}}\eta_{\Phi_{n},\epsilon_{2},R_{3}}^{C}(m)$.

The quantity ${\rm E}_{\Phi_{n}}\sum_{m=1}^{\mathsf{M}_{n}}\frac{1}{\mathsf{M}_{n}}\eta_{\Phi_{n},\epsilon_{2},R_{3}}^{C}(m)$ can be evaluated as

[TABLE]

where $(a)$ follows from Eq. (102).

The random variable $G^{n}(s,\Phi_{n}(i)|P)$ can be regarded as the $n$-fold i.i.d. extension of the variable $G(s,X|P)$ whose expectation is $G(s,P)$. Since the choice of $\epsilon_{5}$ guarantees that

[TABLE]

we have

[TABLE]

Hence, the combination of Eqs. (103) and (105) implies the desired statement.

VII Conclusion

We have proposed a new concept, secure list decoding, which imposes additional requirements on top of those of conventional list decoding. This scheme has three requirements. Verifiable condition (A), Non-decodable condition (B), and Non-cheating condition. Verifiable condition (A) means that the message sent by Alice (sender) is contained in the list output by Bob (receiver). Non-decodable condition (B) means that Bob cannot uniquely decode Alice’s message. Non-cheating condition has two versions. One is the condition (C) for honest Alice. The other is the condition (D) for dishonest Alice. Since there is a possibility that Alice uses a different code, we need to guarantee the impossibility of cheating even for such a dishonest Alice. In this paper, we have shown the existence of a code to satisfy these three conditions. Also, we have defined the capacity region as the possible rate pair of the rates of the message and the list, and have derived the capacity region under a proper condition. Then, we have clarified the capacity region under several conditions. Fortunately, since additive noise channels satisfy these conditions, the capacity region is determined in this case. In general channels, we have clarified only a part of the capacity region. Therefore, the perfect characterization of the capacity region is an interesting open problem.

As another contribution, we have constructed a protocol for bit commitment from the secure list decoding. However, this conversion protocol is not efficient. That is, in this protocol, the conversion rate from the size of the secure list decoding to the size of bit commitment is quite small. Hence, it is a remaining problem to construct a more efficient conversion protocol. Further, it is not clear whether there is a protocol to convert bit commitment to secure list decoding. The existence of such a protocol is another interesting open problem.

Since the constructed code in this paper is not practical, it is needed to construct practical codes for secure list decoding. Fortunately, the existing study [19] systematically constructed several types of codes for list decoding with their algorithms. While their code construction is practical, in order to use their constructed code for secure list decoding, we need to clarify their security parameters, i.e., the non-decodable parameter $\delta_{B}$ and the non-cheating parameter $\delta_{D}$ in addition to the decoding error probability $\epsilon_{A}$. It is a practical open problem to calculate these security parameters of their codes.

This paper evaluates the non-decodable parameter $\delta_{B}$. Clearly, the mutual information between the message $M$ and Bob’s received information $Y$ is not zero because Bob knows that the message is one element in his obtained list $\{M_{1},\ldots,M_{\mathsf{L}}\}$. Therefore, it is natural to evaluate the amount of leaked information for the message $M$ to Bob, which can be evaluated by the mutual information. Alternatively, as the amount of uncertainty for the message $M$ in Bob’s side, we can discuss the conditional entropy for the message $M$ conditioned with Bob’s received information $Y$. Since this kind of study will clarify how much secrecy can be kept in this protocol, it is another challenging future study.

Acknowledgments

The author is grateful to Dr. Vincent Tan, Dr. Anurag Anshu, and Dr. Naqueeb Warsi for helpful discussions. In particular, Dr. Vincent Tan suggested Lemma 3 and Dr. Anurag Anshu did the relation with bit commitment. The work reported here was supported in part by Fund for the Promotion of Joint International Research (Fostering Joint International Research) Grant No. 15KK0007, the JSPS Grant-in-Aid for Scientific Research (A) No.17H01280, (B) No. 16KT0017, and Kayamori Foundation of Informational Science Advancement.

Appendix A Proof of Lemma 3

The region in the first line is rewritten as

[TABLE]

When $R_{1}\leq H_{0}$, we have

[TABLE]

Since the set $\{(H(X|U)_{P},I(X;Y|U)_{P})\}_{P\in{\cal P}({\cal U}\times{\cal X})}$ is convex, the function $R_{1}\mapsto\max_{P\in{\cal P}({\cal U}\times{\cal X})}\{I(X;Y|U)_{P}|$

$R_{1}\leq H(X|U)_{P}\}$ is monotonically decreasing for $R_{1}>H_{0}$. Hence, when $R_{1}>H_{0}$, we have

[TABLE]

Therefore, combining (106), (107), and (108), we find that the region in the first line equals the region in the second line.

Appendix B Proof of Lemma 4

We state the outline of this proof. First, we show the following statement;

(S1)

Given $R_{1}\in[H_{0},\log|{\cal X}|]$, there exists another distribution $P^{\prime}\in{\cal P}({\cal U}\times{\cal X})$ to satisfy the following conditions. (i) For any $u\in{\cal U}$ with $P_{U}^{\prime}(u)>0$, we have $H(X)_{P_{X|U=u}^{\prime}}\geq H_{0}$. (ii) $\kappa(R_{1})=H(X|YU)_{P^{\prime}}$. (iii) $R_{1}=H(X|U)_{P^{\prime}}$.

Next, we show the following statement for the distribution $P^{\prime}\in{\cal P}({\cal U}\times{\cal X})$ given in (S1);

(S2)

For any $u\in{\cal U}$ with $P_{U}^{\prime}(u)>0$, we have $H(X|Y)_{P_{X|U=u}^{\prime}}=\kappa(H(X)_{P_{X|U=u}^{\prime}})$.

Finally, we show the following statement;

(S3)

For any $R_{1}\in[H_{0},\log|{\cal X}|]$, the point $(R_{1},\kappa(R_{1}))$ can be written as a convex combination of elements of $\{(H(X)_{P},H(X|Y)_{P})\}_{P\in{\cal P}_{0}}$,

which derives the required statement.

Step 1: Proof of (S1).

To show (S1), it is sufficient to show the following statement; Given $R_{1}\in[H_{0},\log|{\cal X}|]$, we choose a distribution $P\in{\cal P}({\cal U}\times{\cal X})$ such that $R_{1}=H(X|U)_{P}$ and $\kappa(R_{1})=H(X|YU)_{P}$. Then, there exists another distribution $P^{\prime}\in{\cal P}({\cal U}\times{\cal X})$ to satisfy the following conditions. (i) For any $u\in{\cal U}$ with $P_{U}^{\prime}(u)>0$, we have $H(X)_{P_{X|U=u}^{\prime}}\geq H_{0}$. (ii) $H(X|YU)_{P}\geq H(X|YU)_{P^{\prime}}$. (iii) $H(X|U)_{P}=H(X|U)_{P^{\prime}}$. Notice that the combination of (ii) and $\kappa(R_{1})=H(X|YU)_{P}$ implies that $\kappa(R_{1})=H(X|YU)_{P^{\prime}}$ due to the definition of the function $\kappa$.

In the following, we show the existence of $P^{\prime}$ to satisfy the above condition. Due to the choice of $P_{XU}$, we have

[TABLE]

where $P_{U}$ is the marginal distribution of $P$ with respect to $U$, and $P_{X|U=u}$ is the conditional distribution on $X$ with condition $U=u$. Also, $P_{X|U\neq u}$ expresses the conditional distribution on $X$ with condition $U\neq u$.

Assume that there exists an element $u_{0}\in{\cal U}$ such that $\lambda:=P_{U}(u_{0})>0$ and $H(X)_{P_{X|U=u_{0}}}<H_{0}$. Hence, we have

[TABLE]

We choose $\lambda^{\prime}\in[0,1]$ such that

[TABLE]

Since the relation $C(W)=I(X;Y)_{P_{\max}}$ yields

[TABLE]

we have the relations

[TABLE]

which imply that

[TABLE]

The combination of (112) and (116) implies that

[TABLE]

Therefore, we obtain

[TABLE]

where the steps $(a),(b),(c),$ and $(d)$ follow from (111), (110), (117), and (113), respectively.

This discussion shows that a component $P_{X|U=u^{\prime}}$ with $H(X)_{P_{X|U=u_{0}}}<H_{0}$ in the convex combination (109) can be replaced by $P_{\max}$. Hence, we repeat the above procedure for all the elements $u\in{\cal U}$ such that $P_{U}(u)>0$ and $H(X)_{P_{X|U=u}}\geq H_{0}$. Then, we find another distribution $P^{\prime}\in{\cal P}({\cal U}\times{\cal X})$ to satisfy the three required conditions.

Step 2: Proof of (S2).

Next, we show (S2) by contradiction. If there exists $u_{1}\in{\cal U}$ such that $P_{U}^{\prime}(u_{1})>0$ and $H(X|Y)_{P_{X|U=u_{1}}^{\prime}}>\kappa(H(X)_{P_{X|U=u_{1}}^{\prime}})$, there exists another distribution $P^{\prime\prime}\in{\cal P}({\cal U^{\prime}}\times{\cal X})$ such that $H(X|Y)_{P_{X|U=u_{1}}^{\prime}}>H(X|YU^{\prime})_{P^{\prime\prime}}$ and $H(X)_{P_{X|U=u_{1}}^{\prime}}=H(X|U^{\prime})_{P^{\prime\prime}}$. Define the set ${\cal U^{\prime\prime}}:=({\cal U}\setminus\{u_{1}\})\cup{\cal U^{\prime}}$ and the distribution $P_{XU^{\prime\prime}}$ as

[TABLE]

Hence, we have $H(X)_{P^{\prime}}=\sum_{u\neq u_{1}}P_{U}^{\prime}(u)H(X)_{P_{X|U=u}^{\prime}}+P_{U}^{\prime}(u_{1})H(X|U)_{P^{\prime\prime}}=H(X|U^{\prime\prime})_{P_{XU^{\prime\prime}}}$ and $H(X|Y)_{P^{\prime}}>\sum_{u\neq u_{1}}P_{U}^{\prime}(u)H(X|Y)_{P_{X|U=u_{1}}^{\prime}}+P_{U}^{\prime}(u_{1})H(X|YU)_{P^{\prime\prime}}=H(X|YU^{\prime\prime})_{P_{XU^{\prime\prime}}}$. Thus, we obtain the contradiction.

Step 3: Proof of (S3).

We choose $P^{\prime}\in{\cal P}({\cal U}\times{\cal X})$ given in (S1). The statement (S2) implies the relations $H(X|YU)_{P^{\prime}}=\sum_{u\in{\cal U}}P_{U}^{\prime}(u)H(X|Y)_{P_{X|U=u}^{\prime}}$ and $H(X|U)_{P^{\prime}}=\sum_{u\in{\cal U}}P_{U}^{\prime}(u)H(X)_{P_{X|U=u}^{\prime}}$. Thus, the point $(R_{1},\kappa(R_{1}))=(H(X|U)_{P^{\prime}},H(X|YU)_{P^{\prime}})$ is written as a convex combination of elements of

$\{(H(X)_{P},H(X|Y)_{P})\}_{P\in{\cal P}_{0}}$. Hence, the desired statement is obtained.

Appendix C Proof of Lemma 5

The relation (40) follows from

[TABLE]

Eq. (39) follows from the relations;

[TABLE]