One-Shot Perfect Secret Key Agreement for Finite Linear Sources

TL;DR

This paper characterizes the minimum public discussion needed for all terminals to agree on a maximum-length secret key in a finite linear source model, using linear functions and non-interactive protocols.

Contribution

It provides a non-asymptotic, one-shot characterization of communication complexity for secret key agreement in finite linear sources, introducing a linear, non-interactive protocol approach.

Findings

Minimum discussion is achieved by a linear, non-interactive protocol.

The protocol involves linear processing of private observations before discussion.

Secret key is a linear function of all observations.

Abstract

We consider a non-asymptotic (one-shot) version of the multiterminal secret key agreement problem on a finite linear source model. In this model, the observation of each terminal is a linear function of an underlying random vector composed of finitely many i.i.d. uniform random variables. Restricting the public discussion to be a linear function of the terminals' observations, we obtain a characterization of the communication complexity (minimum number of symbols of public discussion) of generating a secret key of maximum length. The minimum discussion is achieved by a non-interactive protocol in which each terminal first does a linear processing of its own private observations, following which the terminals all execute a discussion-optimal communication-for-omniscience protocol. The secret key is finally obtained as a linear function of the vector of all observations.

Equations

$$\mathsf{x}\in \text{llangle}{\mathsf{y}}_B\text{rrangle}\text{ or }\text{llangle}{\mathsf{y}}_{i_1},\dots ,{\mathsf{y}}_{i_{|B|}}\text{rrangle}$$

$$\displaystyle\boldsymbol{\mathsf{z}}_{i}\in\left\llangle\boldsymbol{\mathsf{x}}\right\rrangle\quad\forall i\in V$$

$$P_{{\mathsf{u}}_V|{\mathsf{z}}_V}=\prod _{i\in V}{P}_{{\mathsf{u}}_i}.$$

$$\displaystyle\boldsymbol{\mathsf{f}}_{i}\in\left\llangle\boldsymbol{\mathsf{u}}_{i},\boldsymbol{\mathsf{z}}_{i}\right\rrangle.$$

$$H(\mathsf{K}|{\mathsf{u}}_i,{\mathsf{z}}_i,{\mathsf{f}}_V)$$

$$\log |K|-H(\mathsf{K}|{\mathsf{f}}_V)$$

$$c_{\text{operator@font}S}(r):=c_{\text{operator@font}S}({\mathsf{z}}_V,r):=\max \{\log |K|\mid \ell ({\mathsf{f}}_V)\le r\},$$

$$c_{\text{operator@font}S}:=c_{\text{operator@font}S}({\mathsf{z}}_V):=\max \{c_{\text{operator@font}S}(r)\mid r\ge 0\},$$

$$r_{\text{operator@font}S}:=r_{\text{operator@font}S}({\mathsf{z}}_V):=\inf \left\{r\ge 0\mid c_{\text{operator@font}S}({\mathsf{z}}_V,r)=c_{\text{operator@font}S}({\mathsf{z}}_V)\right\}$$

$$H({\mathsf{z}}_V|{\mathsf{u}}_i,{\mathsf{z}}_i,{\mathsf{f}}_V)=0\forall i\in V.$$

$$r_{\text{operator@font}CO}:=r_{\text{operator@font}CO}(\mathsf{z}):=\min \ell ({\mathsf{f}}_V),$$

$$\begin{array}{rl}{\mathsf{z}}_1& :=\left[\begin{array}{cc}{\mathsf{x}}_1& {\mathsf{x}}_2\oplus {\mathsf{x}}_3\end{array}\right]\\ {\mathsf{z}}_2& :=\left[\begin{array}{cc}{\mathsf{x}}_1& {\mathsf{x}}_2\oplus {\mathsf{x}}_4\end{array}\right]\\ {\mathsf{z}}_3& :=\left[\begin{array}{cc}{\mathsf{x}}_1\oplus {\mathsf{x}}_2& {\mathsf{x}}_3\end{array}\right]\\ {\mathsf{z}}_4& :=\left[\begin{array}{c}{\mathsf{x}}_1\oplus {\mathsf{x}}_3\oplus {\mathsf{x}}_4\end{array}\right].\end{array}$$

$$\mathsf{K}={\mathsf{x}}_1,{\mathsf{f}}_1=\left[\begin{array}{c}{\mathsf{x}}_2\oplus {\mathsf{x}}_3\end{array}\right],\text{ and }{\mathsf{f}}_2=\left[\begin{array}{c}{\mathsf{x}}_2\oplus {\mathsf{x}}_4\end{array}\right],$$

$${\mathsf{x}}_1$$

$$\underset{{\mathsf{z}}_3}{\underbrace{}}\underset{{\mathsf{f}}_1}{\underbrace{}}$$

$$=\left[\begin{array}{ccc}{\mathsf{x}}_1\oplus {\mathsf{x}}_3\oplus {\mathsf{x}}_4& {\mathsf{x}}_2\oplus {\mathsf{x}}_3& {\mathsf{x}}_2\oplus {\mathsf{x}}_4\end{array}\right]\left[\begin{array}{c}1\\ 1\\ 1\end{array}\right].$$

$$\underset{{\mathsf{z}}_4}{\underbrace{}}\underset{{\mathsf{f}}_1}{\underbrace{}}\underset{{\mathsf{f}}_2}{\underbrace{}}$$

$$c_{\text{operator@font}S}(r_{\text{operator@font}CO})\ge \{\begin{array}{ll}1& r\ge 2\\ 0& r<2\end{array},\text{ and }‘1\{\begin{array}{rl}{c}_{\text{operator@font}S}& \ge 1\\ r_{\text{operator@font}S}& \le 2\\ r_{\text{operator@font}CO}& \le 3\end{array}‘2.$$

$$\ell ({\mathsf{u}}_i)$$

$$\mathsf{K}$$

$$c_{\text{operator@font}S}(0)$$

$$c_{\text{operator@font}S}$$

$$r_{\text{operator@font}CO}$$

$${\mathsf{z}}_i^{\prime }$$

$$r_{\text{operator@font}S}({\mathsf{z}}_V^{\prime })$$

$$r_{\text{operator@font}CO}({\mathsf{z}}_V^{\prime })$$

$$c_{\text{operator@font}S}({\mathsf{z}}_V^{\prime })$$

$$r_{\text{operator@font}S}=\min \left\{r_{\text{operator@font}CO}({\mathsf{z}}_V^{\prime })\mid {\mathsf{z}}_i^{\prime }\in \text{llangle}{\mathsf{z}}_i\text{rrangle},c_{\text{operator@font}S}({\mathsf{z}}_V^{\prime })=c_{\text{operator@font}S}({\mathsf{z}}_V)\right\},$$

$$\displaystyle\boldsymbol{\mathsf{z}}^{\prime}_{3}=\boldsymbol{\mathsf{z}}_{3}\begin{bmatrix}1\\ 1\end{bmatrix}=\mathsf{x}_{1}\oplus\mathsf{x}_{2}\oplus\mathsf{x}_{3}\in\left\llangle\boldsymbol{\mathsf{z}}_{3}\right\rrangle$$

$$C_{\text{operator@font}S}(R):=\max \left\{‘1.\frac{\log |K|}{n}‘2|\frac{\ell ({\mathsf{f}}_V)}{n}\le R\right\}.$$

$$\frac{1}{n}\log |K|-H(\mathsf{K}|{\mathsf{f}}_V)\le ‘d_n$$

$$\mathrm{Pr}‘1(\exists i\in V,\mathsf{K}\ne ‘f_i(\mathsf{u},{\mathsf{z}}_i^n,{\mathsf{f}}_V)‘2)\le ‘e_n$$

$${\mathsf{y}}_i:=\left[\begin{array}{ccc}{\mathsf{u}}_i& {\mathsf{z}}_i& {\mathsf{f}}_V\end{array}\right].$$

$$H(\mathsf{K},{\mathsf{f}}_V|\mathsf{g})=0.$$

$$\mathsf{g}$$

Full text

I Introduction

The problem of secret key agreement via public discussion was first formulated for two terminals by Maurer [1] and Ahlswede and Csiszár [2], and subsequently extended to multiple terminals by Csiszár and Narayan [3]. In the set-up of this problem, the terminals involved must agree upon a secret key based on correlated observations from a source, using interactive public discussion. The key must be kept information-theoretically secure from an eavesdropper having access to the public discussion. The conventional setting allows unlimited public discussion, and the aim is to agree upon a secret key of largest possible length. The problem formulation is in fact asymptotic in nature: the terminals observe an infinite sequence of i.i.d. realizations of the correlated source random variables, and the asymptotic secret key rate (number of symbols of secret key generated per source realization) must be as large as possible. The largest possible asymptotic key rate, termed the secrecy capacity, is by now quite well understood [3, 4].

A more difficult problem is to determine the secrecy capacity under a constraint on the amount or rate of public discussion allowed. Specifically, when the (asymptotic) rate of public discussion is bounded above by $R$, the problem is to determine the maximum achievable secret key rate $C_{\mathop{\operator@font S}}(R)$, which we term the rate-constrained secrecy capacity. This problem was considered in the case of two terminals by Tyagi [5] and Liu et al. [6]. The primary focus of Tyagi [5] was on the related problem of characterizing what we will call the communication complexity $R_{\mathop{\operator@font S}}$, which is the least discussion rate needed to achieve the (unconstrained) secrecy capacity; he left open the rate-constrained secrecy capacity problem. Liu et al. [6] gave a characterization of the achievable region of key and discussion rate pairs using a notion of $XY$-concave envelopes that they develop. They used their methods to give a precise description of the ratio $\frac{C_{\mathop{\operator@font S}}(R)}{R}$ in the regime of $R\to 0$.

The multiterminal $C_{\mathop{\operator@font S}}(R)$ and $R_{\mathop{\operator@font S}}$ problems were considered in our prior works [7, 8, 9, 10]. Among our contributions there were some general outer bounds on the achievable rate region, and upper and lower bounds on $R_{\mathop{\operator@font S}}$; in the special case of the hypergraphical source model, we derived tighter upper bounds on $R_{\mathop{\operator@font S}}$ and the ratio $\frac{C_{\mathop{\operator@font S}}(R)}{R}$ valid for all $R>0$. In the important special case of the pairwise independent network (PIN) model (see e.g. [11]), our bounds were good enough to precisely characterize $R_{\mathop{\operator@font S}}$ and $C_{\mathop{\operator@font S}}(R)$.

In this paper, we make further progress on these problems by focusing on the (multiterminal) finite linear source model [12], which generalizes the hypergraphical source and PIN models. In the finite linear model, the observation of each terminal is a linear function of an underlying random vector composed of finitely many i.i.d. uniform random variables. Furthermore, we consider a non-asymptotic, single-shot version of the secret key agreement problem as opposed to the asymptotic version in [12]. In this version, the terminals observe only one realization of the source, and after some public discussion, must agree (with probability $1$) upon a secret key that is statistically independent of the public communication. Single-shot analogues of the $R_{\mathop{\operator@font S}}$ and $C_{\mathop{\operator@font S}}(R)$ problems can be formulated in this setting — see Section II. We study these problems with a view towards extending the results obtained for the single-shot setting to the asymptotic model.

Courtade and Halford [13] formulated and analyzed the single-shot secret key generation problem for hypergraphical sources. They made a key assumption to facilitate their analysis, namely, that the communication from each terminal is a linear function of its observations. Under this restriction, they effectively resolved the single-shot $R_{\mathop{\operator@font S}}$ and $C_{\mathop{\operator@font S}}(R)$ problems for hypergraphical sources. Note that linear discussion was also considered in [12, 14] for finite linear sources, but the objective was to achieve the unconstrained secrecy capacity of the asymptotic model perfectly with a finite block length, so as to avoid excessive delay in generating the secret key.

Taking inspiration from [13], we too restrict the public discussion to be a linear function of the terminals’ observations. Under the linear discussion model, for finite linear sources, we obtain a characterization (Corollary 2 in Section IV) of the communication complexity of generating a secret key of maximum length. The minimum discussion is achieved by a non-interactive protocol in which each terminal first does a linear processing of its own private observations, following which the terminals all execute a (single-shot) discussion-optimal communication-for-omniscience protocol on their linearly processed observations. At the end of this, each terminal is able to recover the observations of all the other terminals (omniscience), and it then applies a linear function to the entire vector of observations to obtain a maximum-length secret key.

The rest of the paper is organized as follows. Section II contains the formal problem formulation, Section III presents an illustrative example, and Section IV contains statements of the main results, complete proofs of which can be found in the appendices. The paper ends in Section V with a discussion of the possible ways in which the results could be extended to settings beyond that of our problem formulation.

II Problem formulation

We use the sans serif font $\mathsf{K}$ to represent a random variable with distribution $P_{\mathsf{K}}$ and taking values from a set $K$. We use the boldface uppercase $\boldsymbol{M}$ for matrices and boldface lowercase san serif font for random row vectors $\boldsymbol{\mathsf{x}}:=\begin{bmatrix}\mathsf{x}_{1}&\dots&\mathsf{x}_{\ell(\boldsymbol{\mathsf{x}})}\end{bmatrix}$ where $\ell(\boldsymbol{\mathsf{x}})$ denotes the length of the vector. We assume all the entries take values from the same finite field $\mathbb{F}_{q}$ of order $q$. We take logarithm $\log$ to base $q$ and so all the information quantities are in the units of $\log q$ bits. For a finite set $B$, we use $\boldsymbol{\mathsf{y}}_{B}:=\begin{bmatrix}\boldsymbol{\mathsf{y}}_{i_{1}}&\dots&\boldsymbol{\mathsf{y}}_{i_{\lvert B\rvert}}\end{bmatrix}$ to denote a row vector obtained by concatenating the row vectors $\boldsymbol{\mathsf{y}}_{i}$’s for some enumeration $i_{1},\dots,i_{\lvert B\rvert}$ of the set $B$. We use the notation

[TABLE]

to mean that there exists a deterministic matrix $\boldsymbol{M}$ such that $\boldsymbol{\mathsf{x}}=\boldsymbol{\mathsf{y}}_{B}\boldsymbol{M}$.

As in [3], the multiterminal secret key agreement problem consists of a finite set $V=\{1,2,\ldots,m\}$ of $m\geq 2$ users who want to share a secret key after some public discussion that can be eavesdropped by a wiretapper. The one-shot perfect linear secret key agreement (SKA) scheme consists of the following phases.

One-shot private observation: Each user $i\in V$ observes the component $\boldsymbol{\mathsf{z}}_{i}$ of a given finite linear source $\boldsymbol{\mathsf{z}}_{V}$ defined in [4] with the requirement that

[TABLE]

for some uniformly random vector $\boldsymbol{\mathsf{x}}$ over $\mathbb{F}_{q}$. $\boldsymbol{\mathsf{x}}$ is referred to as the base of $\boldsymbol{\mathsf{z}}_{V}$. In the special case when $\boldsymbol{\mathsf{z}}_{i}$ is a subvector of $\boldsymbol{\mathsf{x}}$, $\boldsymbol{\mathsf{z}}_{V}$ is called the hypergraphical source [4], which is the source model considered in [13]. Unlike the model in [3] and [12] where each user observes $n$ i.i.d. samples of the source, we consider the one-shot model as in [13, 15] where each user only observes one sample.

Private randomization: Each user $i\in V$ privately generates a random vector $\boldsymbol{\mathsf{u}}_{i}$ over $\mathbb{F}_{q}$ independent of the source $\boldsymbol{\mathsf{z}}_{V}$, i.e.,

[TABLE]

Note that there is no restriction on the length nor the distribution of $\boldsymbol{\mathsf{u}}_{i}$, and so the requirement that it must be a vector over $\mathbb{F}_{q}$ does not lose generality. Note also that such a randomization was not explicitly considered in the formulations of [3, 12, 13].

Linear public discussion: Each user $i\in V$ publicly reveals the message

[TABLE]

Hence, everyone including the wiretapper observes $\boldsymbol{\mathsf{f}}_{V}$. Unlike [3], the discussion above is non-interactive as interaction is unnecessary for linear discussion as explained in [16].111Suppose the discussion is interactive, i.e., a message, say $\mathsf{f}$, revealed in public by some user $i\in V$ is a linear function $\psi(\boldsymbol{\mathsf{u}}_{i},\boldsymbol{\mathsf{z}}_{i},\tilde{\boldsymbol{\mathsf{f}}})$ of the private observations of user $i$ as well as all the previously discussed messages denoted by $\tilde{\boldsymbol{\mathsf{f}}}$. By linearity, we can rewrite $\mathsf{f}$ as $\psi(\boldsymbol{\mathsf{u}}_{i},\boldsymbol{\mathsf{z}}_{i},\boldsymbol{0})+\psi(\boldsymbol{0},\boldsymbol{0},\tilde{\boldsymbol{\mathsf{f}}})$ where $\boldsymbol{0}$ denotes an all-zero vector of an appropriate length. Note that, given $\tilde{\boldsymbol{\mathsf{f}}}$, there is a bijection between $\mathsf{f}$ and $\mathsf{f}^{\prime}:=\psi(\boldsymbol{\mathsf{u}}_{i},\boldsymbol{\mathsf{z}}_{i},\boldsymbol{0})$, and so user $i$ can reveal $\mathsf{f}^{\prime}$ instead of $\mathsf{f}$ in public without loss of generality, since $\mathsf{f}$ can be recovered from $\mathsf{f}^{\prime}$ and other discussion messages $\tilde{\boldsymbol{\mathsf{f}}}$. As $\mathsf{f}^{\prime}$ does not depend on $\tilde{\boldsymbol{\mathsf{f}}}$, we can convert any interactive discussion to a non-interactive discussion by replacing every discussion message $\mathsf{f}$ by the corresponding $\mathsf{f}^{\prime}$.

Secret key agreement After the public discussion, each user $i\in V$ attempts to agree on a secret key $\mathsf{K}$ satisfying

[TABLE]

where (4) is the recoverability constraint that requires the secret key to be perfectly recoverable by every user and (5) is the secrecy constraint that requires the key to be uniformly random and perfectly independent of the entire public discussion. Note that we do not assume apriori that $\mathsf{K}$ is a linear function of the private source, and so the key length $\log\lvert K\rvert$ is not required to be an integer.222Nevertheless, it will follow from Theorem 1 that $\mathsf{K}$ can be chosen to be a linear function of the private source without loss of optimality, and so the key length must be an integer.

The objective is to characterize the set of achievable key lengths and discussion lengths. In particular, a quantity of interest is the constrained secrecy capacity defined as

[TABLE]

where the maximization is over all possible secret key agreement schemes subject to a constraint on the total public discussion length, $r$. (Note that we omit the argument $\boldsymbol{\mathsf{z}}_{V}$ if there is no ambiguity.) Characterizing the entire curve of $c_{\mathop{\operator@font S}}(r)$ is difficult even in the case of linear discussion, but some points on the curve can be characterized, such as $c_{\mathop{\operator@font S}}(0)$ considered in [17]. As in [3, 12, 13], we also consider the unconstrained secrecy capacity defined as

[TABLE]

which is the secrecy capacity without the constraint on the discussion length. The smallest discussion length required to achieve $c_{\mathop{\operator@font S}}$ is denoted by

[TABLE]

and referred to as the communication complexity. As in [3, 13], we will characterize $c_{\mathop{\operator@font S}}$ and $r_{\mathop{\operator@font S}}$ using the closely related problem of communication for omniscience defined as follows. The problem under the one-shot model for hypergraphical and finite linear sources is proposed in [18, 15] and referred to as the cooperative data exchange.

Omniscience: We say that the public discussion achieves omniscience of $\boldsymbol{\mathsf{z}}_{V}$ if

[TABLE]

The smallest length of communication for omniscience is defined as

[TABLE]

where the minimization is over all public discussion schemes subject to (9) in place of (5) and (4). In [3], the secret key agreement scheme that achieves the capacity is by first achieving omniscience of $\boldsymbol{\mathsf{z}}_{V}$ and then extracting the secret key as a function of $\boldsymbol{\mathsf{z}}_{V}$, implying that the rate of communication for omniscience is no smaller than the communication complexity. We say that $c_{\mathop{\operator@font S}}$ can be achieved via omniscience of $\boldsymbol{\mathsf{z}}_{V}$.

III Motivating Example

We will use the following example to illustrate the problem formulation and motivate our main results. Consider $V=\{1,2,3,4\}$ and a finite linear source $\boldsymbol{\mathsf{z}}_{V}$ (see (1)) over the binary field $\mathbb{F}_{2}$ with a base $\boldsymbol{\mathsf{x}}$ of length $\ell(\boldsymbol{\mathsf{x}})=4$ as follows:

[TABLE]

A feasible secret key agreement scheme is to choose

[TABLE]

but without any private randomizations $\boldsymbol{\mathsf{u}}_{V}$ and discussions $\boldsymbol{\mathsf{f}}_{3}$ and $\boldsymbol{\mathsf{f}}_{4}$ by users $3$ and $4$. The secret key $\mathsf{K}$ is perfectly recoverable by every user, i.e., satisfying (4), since users $1$ and $2$ directly observes the key bit $\mathsf{x}_{1}$, which can also be computed by users $3$ and $4$ using their private sources and public discussion as follows

[TABLE]

The secrecy constraint (5) also holds because $\log\lvert K\rvert=1=H(\mathsf{K}|\boldsymbol{\mathsf{f}}_{V})$, which follows from the definition of the base $\boldsymbol{\mathsf{x}}$ that $\mathsf{x}_{1}$ is uniformly random and independent of $\mathsf{x}_{2}$, $\mathsf{x}_{3}$, and $\mathsf{x}_{4}$.

Note that the above scheme does not achieve the omniscience condition in (9) because users $1$, $2$ and $4$ cannot recover $\mathsf{x}_{3}$ after the discussion. However, it is easy to show that omniscience can be achieved if we further set $\boldsymbol{\mathsf{f}}_{3}=\begin{bmatrix}\mathsf{x}_{3}\end{bmatrix}$, i.e., with an additional bit of discussion by user $3$. Since $1$ bit of secret key can be achieved with $2$ bits of public discussion and omniscience can be further achieved with an additional bit of discussion, we have

[TABLE]

by the definitions (6), (7), (8) and (10). The challenge is to show the reverse inequalities and therefore establish the optimality of the achieving schemes.

IV Main results

We start with some rather general admissible conditions that simplify the secret key agreement scheme significantly without loss of optimality.

Theorem 1

$c_{\mathop{\operator@font S}}(r)$* remains unchanged even if we set*

[TABLE]

which mean respectively that private randomizations are not needed and that the secret key can be chosen to be linear function of the private source. □

Corollary 1

$c_{\mathop{\operator@font S}}(r)$* must be integer, non-decreasing and right continuous in $r$. □*

Proof

For the corollary, the fact that $c_{\mathop{\operator@font S}}(r)$ must be an integer follows from (14b) that the key can be linear and therefore a uniformly random vector by the secrecy constraint (5). Monontonicity and continuity follows directly from the definition (6). The proof of the theorem is more involved and given in Appendix A-A. ■

For instance, the example in Section III considers such a secret key agreement scheme without private randomization. The secret key $\mathsf{x}_{1}$ is also linear in the private source trivially because it is directly observed by users $1$ and $2$. Note that our formulation allows the private randomizations to have arbitrary length and distribution, and the key to be arbitrary random variables that need not be linear in the private source. The above admissible constraints (14) makes the problem tractable as it significantly reduces the space of secret key agreement schemes we need to consider to characterize $c_{\mathop{\operator@font S}}(r)$. Indeed, since there is only a finite number of linear functions of $\boldsymbol{\mathsf{z}}_{V}$, there is only a finite number of admissible secret key agreement scheme. It is worth noting that the constraints (14) were assumed in the formulation of [13] for the hypergraphical source model, and our result implies that such constraints are admissible since hypergraphical sources are special case of the finite linear sources.

For the general source model in [3], the admissible constraint (14a) that private randomization does not help improve $c_{\mathop{\operator@font S}}(r)$ remains a plausible conjecture. However, it is clear that the constraint (14b) is not admissible for some sources that are not finite linear. Nevertheless, this constraint is essential in bringing the existing characterizations of the capacity from the general source model to the one-shot finite linear source model as follows.

Theorem 2

$c_{\mathop{\operator@font S}}(r)$* in the extreme cases with [math] and respectively unbounded discussion lengths are*

[TABLE]

where the maximization is over the choices of random vector $\boldsymbol{\mathsf{g}}$, and the minimization is over the collection $\Pi^{\prime}(V)$ of partitions of $V$ into at least two non-empty disjoint sets. Furthermore, $c_{\mathop{\operator@font S}}$ can be achieved via communication for omniscience of $\boldsymbol{\mathsf{z}}_{V}$ at the smallest length

[TABLE]

which implies the upper bound $r_{\mathop{\operator@font S}}\leq r_{\mathop{\operator@font CO}}$ on $r_{\mathop{\operator@font S}}$. □

Proof

See Appendix A-B. ■

For the running example given in Section III, it is straightforward to evaluate the above expressions (15), (16) and (17) to yield $c_{\mathop{\operator@font S}}(0)=0$, $c_{\mathop{\operator@font S}}=1$ and $r_{\mathop{\operator@font CO}}=3$. In particular, an optimal solution to (16) can be shown to be $\mathcal{P}=\{\{1,2,3\},\{4\}\}$. This implies the optimality of the omniscience scheme in Section III in achieving both $c_{\mathop{\operator@font S}}$ and $r_{\mathop{\operator@font CO}}$.

The above result follows quite directly from existing works for the asymptotic model. For instance, the r.h.s. of (15) is the multivariate Gács-Körner common information evaluated for the finite linear source model. $\boldsymbol{\mathsf{g}}$ is called the maximum common function of $\boldsymbol{\mathsf{z}}_{i}$ for $i\in V$. $c_{\mathop{\operator@font S}}(0)=J_{\mathop{\operator@font GK}}(\boldsymbol{\mathsf{z}}_{V})$ was shown in [17] but for the asymptotic model instead. It is straightforward to extend this result to the current one-shot model.

The duality (17) between secret key agreement and communication for omniscience also follows directly from the asymptotic model in [3], which is specialized to the asymptotic finite linear source model in [12]. The characterization (16) of $c_{\mathop{\operator@font S}}$ is the same as that of the asymptotic model [3, 4] except for the floor operation, since the minimization in (16) may not be integer but $c_{\mathop{\operator@font S}}$ must be integer by Corollary 1. The characterization of $r_{\mathop{\operator@font CO}}$ for the one-shot finite linear source model is given in [15, 19], which focus primarily on the omniscience problem instead of the secret key agreement problem.

Note that one can summarize the theorem by saying that $c_{\mathop{\operator@font S}}(0)$, $c_{\mathop{\operator@font S}}$ and $r_{\mathop{\operator@font CO}}$ for the one-shot model is the same as those of the asymptotic model for finite linear source but with an additional integer constraint: $C_{\mathop{\operator@font S}}(0)$ is already an integer for the asymptotic model while we can take the floor and the ceiling respectively for $C_{\mathop{\operator@font S}}$ and $R_{\mathop{\operator@font CO}}$ to turn them into integer achievable lengths. It therefore appears reasonable to conjecture that $c_{\mathop{\operator@font S}}(r)$ for the one-shot model is the same as the $C_{\mathop{\operator@font S}}(R)$ for the asymptotic model for finite linear source but with an additional floor operation as in (16) to satisfy the integer constraint in Corollary 1. The following result resolves this partially at the communication complexity $r_{\mathop{\operator@font S}}$.

Theorem 3

If $r_{\mathop{\operator@font S}}<r_{\mathop{\operator@font CO}}$, then there exists $\boldsymbol{\mathsf{z}}^{\prime}_{V}$ with

[TABLE]

such that

[TABLE]

$\boldsymbol{\mathsf{z}}^{\prime}_{V}$* is said to be reduced source of $\boldsymbol{\mathsf{z}}_{V}$ (by linear processing), since the above implies $H(\boldsymbol{\mathsf{z}}^{\prime}_{V})<H(\boldsymbol{\mathsf{z}}_{V})$. □*

Corollary 2

The communication complexity is

[TABLE]

achieved via omniscience of the linearly reduced source $\boldsymbol{\mathsf{z}}^{\prime}_{V}$. □

Proof

The corollary follows immediately from theorem by repeatedly linearly reducing the source until $r_{\mathop{\operator@font S}}=r_{\mathop{\operator@font CO}}$. This is possible since the theorem guarantees linear processing of the source exists that can reduce $r_{\mathop{\operator@font CO}}$ without changing $(c_{\mathop{\operator@font S}},r_{\mathop{\operator@font S}})$ whenever $r_{\mathop{\operator@font S}}<r_{\mathop{\operator@font CO}}$. For the proof of the theorem, see Appendix A-C. ■

For the running example in Section III, the omniscience scheme does not achieve $r_{\mathop{\operator@font S}}$ as $r_{\mathop{\operator@font S}}\leq 2$ by the secret key agreement scheme without omniscience described in Section III. As $r_{\mathop{\operator@font S}}<r_{\mathop{\operator@font CO}}$, the theorem above guarantees a linear processing of the source that reduces $r_{\mathop{\operator@font CO}}$ without changing $(c_{\mathop{\operator@font S}},r_{\mathop{\operator@font S}})$. Such a linearly reduced source can be obtained with

[TABLE]

and $\boldsymbol{\mathsf{z}}^{\prime}_{i}=\boldsymbol{\mathsf{z}}_{i}$ for $i\in{1,2,4}$. It is straightforward to show that $c_{\mathop{\operator@font S}}(\boldsymbol{\mathsf{z}}^{\prime}_{V})=1$ by (16) and $r_{\mathop{\operator@font CO}}(\boldsymbol{\mathsf{z}}^{\prime}_{V})=2$ by (17). Note the source is reduced in the sense that $H(\boldsymbol{\mathsf{z}}^{\prime}_{V})=3<H(\boldsymbol{\mathsf{z}}_{V})$. By going through all possible independent linear processings of $\boldsymbol{\mathsf{z}}_{i}$’s, which is possible as there is only a finite number of possibilities, one can show that the above defined $\boldsymbol{\mathsf{z}}^{\prime}_{V}$ is optimal to (22) achieving the minimum $r_{\mathop{\operator@font CO}}$, and so $r_{\mathop{\operator@font S}}=2$ as desired by the above corollary.

Note that the characterization of $R_{\mathop{\operator@font S}}$ remains open for the asymptotic model [3] but we believe that it can be resolved for finite linear source model by extending the above result to the asymptotic case. This means in particular that $r_{\mathop{\operator@font S}}$ for the one-shot model is the ceiling of the $R_{\mathop{\operator@font S}}$ for the asymptotic model. In Section V, we outline the challenges involved in such extension.

V Extensions

In this work, we considered the one-shot secret key agreement problem under a finite linear source model with linear public discussion, perfect secrecy and recoverability. However, we believe that all the results can be extended without assuming the discussion is linear. In particular, extending Theorem 2 is straightforward as the converse parts follow from those of the asymptotic model without requiring the discussion to be linear. Extending Theorem 1 and Theorem 3 appears challenging. The current proofs rely on the linearity of discussion.

Another possible extension of the current results is to the asymptotic model where users observe $n\geq 1$ i.i.d. samples $\boldsymbol{\mathsf{z}}_{V}^{n}:=\begin{bmatrix}\boldsymbol{\mathsf{z}}_{V1}&\dots&\boldsymbol{\mathsf{z}}_{Vn}\end{bmatrix}$ of the private source, and the constrained secrecy capacity and discussion rate is per sample of the observation, i.e.,

[TABLE]

The recoverability (4) and secrecy (5) constraints can also be relaxed to the asymptotic versions in [3], i.e., for some positive $`d_{n},`e_{n}\to 0$ as $n\to`8$,

[TABLE]

for a sequence in $n$ of secret key agreement schemes and some functions $`f_{i}$ for $i\in V$ that user $i$ uses to recover the secret key. As mentioned below Theorem 2, the characterizations of $C_{\mathop{\operator@font S}}(0)$, $C_{\mathop{\operator@font S}}$ and $R_{\mathop{\operator@font CO}}$ are already known for the asymptotic model and they are indeed used to derive the corresponding characterizations for the one-shot model. We believe that the other results in Theorem 1 and Theorem 3 can be extended. The current proofs can be directly extended if we impose perfect recoverability instead, i.e., with $`e_{n}=0$ for sufficiently large $n$. However, the proofs without assuming perfect recoverability remain elusive. What we desire is a proof that perfect recoverability is admissible and can therefore be be assumed without loss of optimality. In the similar vein, we also desire a proof that $R_{\mathop{\operator@font S}}$ can be achieved exactly, i.e., for sufficiently large $n$, there exists a secret key agreement scheme with $\frac{1}{n}\log\lvert K\rvert=C_{\mathop{\operator@font S}}$ and $\frac{\ell(\boldsymbol{\mathsf{f}}_{V})}{n}=R_{\mathop{\operator@font S}}$, and that linear public discussion is admissible.

Appendix A Proofs

A-A Proof of Theorem 1

First we will show the admission constraint (14b), i.e., $c_{\mathop{\operator@font S}}(r)$ remains unchanged when the secret key is chosen to be linear function of the private source. Consider any optimal SKA scheme with a fixed discussion length $r$, i.e., with secret key $\mathsf{K}$ having length $c_{\mathop{\operator@font S}}(r)$ and discussion $\boldsymbol{\mathsf{f}}_{V}$ having length $r$. Define

[TABLE]

By the recoverability constraint (4) of the secret key, $\mathsf{K}$ is a common function of $\boldsymbol{\mathsf{y}}_{i}$ for $i\in V$. Trivially, $\boldsymbol{\mathsf{f}}_{V}$ is also a common function of $\boldsymbol{\mathsf{y}}_{i}$. Let $\boldsymbol{\mathsf{g}}$ be a maximum common function, as defined for Theorem 2, of $\boldsymbol{\mathsf{y}}_{i}$’s instead of $\boldsymbol{\mathsf{z}}_{i}$’s. From [20], we know that any common function of $\boldsymbol{\mathsf{y}}_{i}$ is a function of $\boldsymbol{\mathsf{g}}$. Hence $(\mathsf{K},\boldsymbol{\mathsf{f}}_{V})$ is a function of $\boldsymbol{\mathsf{g}}$ i.e.,

[TABLE]

It was shown in [17] that $\boldsymbol{\mathsf{g}}$ is a linear function for a finite linear source, i.e., \boldsymbol{\mathsf{g}}\in\left\llangle\boldsymbol{\mathsf{y}}_{i}\right\rrangle\text{ or }\left\llangle\boldsymbol{\mathsf{u}}_{i},\boldsymbol{\mathsf{z}}_{i},\boldsymbol{\mathsf{f}}_{V}\right\rrangle,\forall i\in V. Therefore,

[TABLE]

In fact, $\boldsymbol{\mathsf{f}}_{V}$ is a linear function of $\boldsymbol{\mathsf{g}}$ because of the linearity of the communication, \boldsymbol{\mathsf{f}}_{V}\in\left\llangle\boldsymbol{\mathsf{u}}_{V},\boldsymbol{\mathsf{z}}_{V}\right\rrangle, and the linearity of the maximal common function $\boldsymbol{\mathsf{g}}$ . We can therefore write, \boldsymbol{\mathsf{f}}_{V}\in\left\llangle\boldsymbol{\mathsf{g}}\right\rrangle.

We will show that the secret key rate remains unchanged if we choose the secret key to be the linear function \mathsf{K}^{\prime}=\boldsymbol{\mathsf{k}}^{\prime}\in\left\llangle\boldsymbol{\mathsf{g}}\right\rrangle such that

[TABLE]

Note that the above choice of $\mathsf{K}^{\prime}$, if exists, is a feasible choice of secret key because (25) implies the secrecy constraint (5) while the recoverability constraint (4) follows from the fact that $\boldsymbol{\mathsf{k}}^{\prime}$ is a function of the maximum common function $\boldsymbol{\mathsf{g}}$.

To show that $\mathsf{K}^{\prime}$ exists, consider $\boldsymbol{\mathsf{f}}_{V}=\boldsymbol{\mathsf{g}}\boldsymbol{W}$ for some matrix $\boldsymbol{W}$ and set $\boldsymbol{\mathsf{k}}^{\prime}=\boldsymbol{\mathsf{g}}\boldsymbol{N}$ where $\boldsymbol{N}$ is a matrix whose column space is the left null space of $\boldsymbol{W}$. (24) then follows from the fact that $\boldsymbol{\mathsf{g}}\begin{bmatrix}\boldsymbol{W}&\boldsymbol{N}\end{bmatrix}=\begin{bmatrix}\boldsymbol{\mathsf{f}}_{V}&\boldsymbol{\mathsf{k}}^{\prime}\end{bmatrix}$ is a bijection as $\begin{bmatrix}\boldsymbol{W}&\boldsymbol{N}\end{bmatrix}$ has full column rank. To show (25), note that the columns of $\boldsymbol{N}$ cannot be spanned by the columns of $\boldsymbol{W}$, and so $\boldsymbol{\mathsf{k}}^{\prime}$ is independent of $\boldsymbol{\mathsf{f}}_{V}$, i.e.,

[TABLE]

It remains to show that $\boldsymbol{\mathsf{k}}^{\prime}$ is uniformly distributed, i.e.,

[TABLE]

Notice we can choose $\boldsymbol{N}$ to have full column rank, in which case $\boldsymbol{\mathsf{k}}^{\prime}=\boldsymbol{\mathsf{g}}\boldsymbol{N}$ is uniformly distributed if $\boldsymbol{\mathsf{g}}$ is. Since $\boldsymbol{\mathsf{y}}_{V}\in\llangle\boldsymbol{\mathsf{x}}\rrangle$, we can write $\boldsymbol{\mathsf{g}}$ as $\boldsymbol{\mathsf{g}}=\boldsymbol{\mathsf{x}}\boldsymbol{M}$ for some matrix $\boldsymbol{M}$. We can choose $\boldsymbol{M}$ to have full column rank, which then implies that $\boldsymbol{\mathsf{g}}$ is uniformly distributed as desired because $\boldsymbol{\mathsf{x}}$ is.

Finally, we argue as follows that the secret key rate is not diminished if $\mathsf{K}^{\prime}$ is used as the secret key instead.

[TABLE]

where (a) is from (25), (b) is due to the fact that $\boldsymbol{\mathsf{g}}$ is a linear function of $\mathsf{K}^{\prime}$ and $\boldsymbol{\mathsf{f}}_{V}$ (24), (c) is from (23) and (d) follows from the perfect secrecy (5) of $\mathsf{K}$.

Next, we impose the linearity (14b) of the key and show that that the other constraint (14a) is admissible, i.e., private randomization is not needed. Consider any user $j\in V$, and rewrite $\begin{bmatrix}\boldsymbol{\mathsf{u}}_{j}&\boldsymbol{\mathsf{z}}_{j}\end{bmatrix}$ as $\begin{bmatrix}\mathsf{u}&\boldsymbol{\mathsf{v}}\end{bmatrix}$ by reordering the components such that $\mathsf{u}$ is a component of $\boldsymbol{\mathsf{u}}_{j}$ and $\boldsymbol{\mathsf{v}}$ contains the rest of the components of $\boldsymbol{\mathsf{u}}_{j}$ and $\boldsymbol{\mathsf{z}}_{j}$. We will argue that $\mathsf{u}$ can be removed without affecting the secret key rate or the discussion rate. Consider the case where $\boldsymbol{\mathsf{f}}_{j}$ does not depend on $\mathsf{u}$. Then, $\boldsymbol{\mathsf{k}}$ also cannot depend on $\mathsf{u}$, or the recoverability constraint (4) fails. Hence $\mathsf{u}$ can be removed as desired. Consider the non-trivial case where there is a component $\mathsf{w}$ of $\boldsymbol{\mathsf{f}}_{j}$ such that

[TABLE]

for some $\alpha\in\mathbb{F}_{q}\backslash\{0\}$ and linear function $\beta$. We can also write

[TABLE]

for some linear functions $\alpha^{\prime},\alpha^{\prime\prime},\beta^{\prime},\beta^{\prime\prime}\text{ and }\gamma^{\prime}$. Define for $i\in V$,

[TABLE]

Note that both $\boldsymbol{\mathsf{k}}^{\prime}$ and $\boldsymbol{\mathsf{f}}^{\prime}_{V}$ are independent of $\mathsf{u}$. Furthermore,

[TABLE]

where (a) follows from the fact that $\mathsf{w}$ is a component of $\boldsymbol{\mathsf{f}}_{i}$ and (b) is because $H(\boldsymbol{\mathsf{f}}^{\prime}_{i}|\boldsymbol{\mathsf{f}}_{i})=0$ for all $i\in V$. Hence $(\boldsymbol{\mathsf{k}}^{\prime},\boldsymbol{\mathsf{f}}^{\prime}_{V})$ is an optimal SKA scheme which does not depend on $\mathsf{u}$, i.e., $\mathsf{u}$ can be removed.

A-B Proof of Theorem 2

With no public discussion, i.e., $\boldsymbol{\mathsf{f}}_{V}=\emptyset$, by the recoverability constrain (4), the secret key must be a function of the Gács–Körner common information [20] of $\boldsymbol{\mathsf{z}}_{V}$. For finite linear source, [17, Theorem 4.2] showed that the latter quantity equals to the r.h.s. of (15), thereby establishing $\leq$ for (15). To prove the reverse inequality, note that, we can write the solution to (15) as $\boldsymbol{\mathsf{g}}=\boldsymbol{x}\boldsymbol{M}$ for some matrix $\boldsymbol{M}$ because $\boldsymbol{\mathsf{z}}_{V}\in\llangle\boldsymbol{\mathsf{x}}\rrangle$. Furthermore, $\boldsymbol{M}$ can be chosen to have have full column rank without loss of optimality, and so $\boldsymbol{\mathsf{g}}$ can be uniformly distributed. Then, the desired secrecy capacity can be achieved with $\mathsf{K}=\boldsymbol{\mathsf{g}}$, where the uniformity of $\boldsymbol{\mathsf{g}}$ implies the secrecy constraint (5) and the recoverability constraint (4) also follows trivially from the fact that $\boldsymbol{\mathsf{g}}$ is a common function.

Converse Part. By Thorem 1, we can assume $\ell(\boldsymbol{\mathsf{u}}_{i})=0,\forall i\in V$ and \mathsf{K}=\boldsymbol{\mathsf{k}}\in\left\llangle\boldsymbol{\mathsf{z}}_{V}\right\rrangle without loss of optimality. Now, since $\boldsymbol{\mathsf{k}}$ and $\boldsymbol{\mathsf{f}}_{V}$ are functions of $\boldsymbol{\mathsf{z}}_{V}$,

[TABLE]

Setting

[TABLE]

the previous equality yields

[TABLE]

Next, we show that $r_{V}=(r_{1},\dots,r_{m})\in\mathscr{R}(\boldsymbol{\mathsf{z}}_{V})$, where

[TABLE]

To that end,

[TABLE]

where the last inequality is because

[TABLE]

and $H(\boldsymbol{\mathsf{k}}|\boldsymbol{\mathsf{z}}_{V\setminus B},\boldsymbol{\mathsf{f}}_{V})=0$ by perfect recoverability. Now, since $H(\boldsymbol{\mathsf{k}})$ is an integer, for $r_{V}\in\mathscr{R}(\boldsymbol{\mathsf{z}}_{V})$,

[TABLE]

Achievability Part. For any vector $r_{V}\in\mathscr{R}(\boldsymbol{\mathsf{z}}_{V})\cap\mathbb{Z}^{m}$, it was shown by [15, Theorem 1] that there exists a corresponding linear noninteractive discussion scheme which renders omniscience. Further, it was shown by [19, Corollary 6] that

[TABLE]

Consider any optimal solution $r_{V}^{*}$ to the l.h.s. of (27). Denote the corresponding linear noninteractive discuss that attains omniscience by $\boldsymbol{\mathsf{f}}_{V}=\boldsymbol{\mathsf{z}}_{V}\boldsymbol{L}=\boldsymbol{\mathsf{x}}\begin{bmatrix}\boldsymbol{M}_{1}&\boldsymbol{M}_{2}&\cdots&\boldsymbol{M}_{m}\end{bmatrix}\boldsymbol{L}=\boldsymbol{\mathsf{x}}\boldsymbol{T}$.

Now, it remains to extract a perfect secret key from the omniscience obtained above. For each realization $\boldsymbol{f}_{V}$ of $\boldsymbol{\mathsf{f}}_{V}$, let $\mathcal{P}_{\boldsymbol{f}_{V}}=\{\boldsymbol{x}\mid\boldsymbol{x}\boldsymbol{T}=\boldsymbol{f}_{V}\}$ be the set of all $\boldsymbol{x}$ which generate $\boldsymbol{f}_{V}$. By the definition of the finite linear source, observe that each entry $\mathsf{x}_{i}$ of $\boldsymbol{\mathsf{x}}$ is i.i.d. uniform from $\mathbb{F}_{q}$, i.e., $\Pr(\boldsymbol{\mathsf{x}}=\boldsymbol{x})=q^{-\ell(\boldsymbol{\mathsf{x}})},\forall\boldsymbol{x}$. By the linearity of the discussion above, it is easy to see that $|\mathcal{P}_{\boldsymbol{f}_{V}}|$ is the same for all realizations of $\boldsymbol{\mathsf{f}}_{V}$. Since $\boldsymbol{\mathsf{f}}_{V}$ has dimension $r^{*}(V)$, $|\mathcal{P}_{\boldsymbol{f}_{V}}|=q^{\ell(\boldsymbol{\mathsf{x}})-r^{*}(V)},\forall\boldsymbol{f}_{V}$. Set $K=\mathbb{F}_{q}^{\ell(\boldsymbol{\mathsf{x}})-r^{*}(V)}$. For each $\boldsymbol{f}_{V}$, label each $\boldsymbol{x}\in\mathcal{P}_{\boldsymbol{f}_{V}}$ with a unique element in $K$. Then, upon observing $\boldsymbol{f}_{V}$, every user which knows $\boldsymbol{x}$ by omniscience picks the label of $\boldsymbol{x}$ as the secret key. Since $\boldsymbol{\mathsf{x}}$ is uniformly distributed and $|\mathcal{P}_{\boldsymbol{f}_{V}}|$ has the same size, it follows that this random label is uniformly distributed over $K$ and independent of $\boldsymbol{\mathsf{f}}_{V}$, thereby constituting a perfect secret key. Therefore,

[TABLE]

This completes the proof.

A-C Proof of Theorem 3

To prove this theorem, we will need the following lemma. We say that $\boldsymbol{\mathsf{z}}_{V}^{\prime}$ can be simulated by the source $\boldsymbol{\mathsf{z}}_{V}$ if \boldsymbol{\mathsf{z}}^{\prime}_{i}\in\left\llangle\boldsymbol{\mathsf{z}}_{i}\right\rrangle\text{ for all }i\in V.

Lemma 1

If $\boldsymbol{\mathsf{z}}_{V}^{\prime}$ can be simulated by $\boldsymbol{\mathsf{z}}_{V}$, then $r_{\mathop{\operator@font S}}(\boldsymbol{\mathsf{z}}^{\prime}_{V})\geq r_{\mathop{\operator@font S}}(\boldsymbol{\mathsf{z}}_{V})$. □

Proof

Any secret key generation protocol for $\boldsymbol{\mathsf{z}}^{\prime}_{V}$ can be simulated by $\boldsymbol{\mathsf{z}}_{V}$. ■

Now consider the finite linear source $\boldsymbol{\mathsf{z}}_{V}=\begin{bmatrix}\boldsymbol{\mathsf{z}}_{1}&\ldots&\boldsymbol{\mathsf{z}}_{m}\end{bmatrix}$ on the set of users $V$, defined by \boldsymbol{\mathsf{z}}_{i}\in\left\llangle\boldsymbol{\mathsf{x}}\right\rrangle or equivalently, $\boldsymbol{\mathsf{z}}_{i}=\boldsymbol{\mathsf{x}}\boldsymbol{M}_{i}$ for each $i\in V$, where $\boldsymbol{M}_{i}$ is a $\ell\times t_{i}$ matrix over $\mathbb{F}_{q}$. Set $\boldsymbol{M}:=\begin{bmatrix}\boldsymbol{M}_{1}&\boldsymbol{M}_{2}&\cdots&\boldsymbol{M}_{m}\end{bmatrix}$, so that

[TABLE]

We assume, without loss of generality, that $\boldsymbol{M}$ has full row rank, so that $H(\boldsymbol{\mathsf{z}}_{V})=H(\boldsymbol{\mathsf{x}})=\ell$. We will let $Z_{i}$ (resp. $Z_{V}$) denote the row-space of $\boldsymbol{M}_{i}$ (resp. $\boldsymbol{M}$). Since $\text{rank}_{\mathbb{F}_{q}}(\boldsymbol{M})=\ell$, we have $\dim_{\mathbb{F}_{q}}(Z_{V})=\ell$, so that $Z_{V}\cong\mathbb{F}_{q}^{\ell}$.

Let $\boldsymbol{\mathsf{f}}_{V}$ be a (non-interactive) linear communication protocol, i.e., \boldsymbol{\mathsf{f}}_{V}\in\left\llangle\boldsymbol{\mathsf{z}}_{V}\right\rrangle, that generates a secret key $\mathsf{K}$ using $r_{\mathop{\operator@font S}}(\boldsymbol{\mathsf{z}}_{V})$ symbols from $\mathbb{F}_{q}$ as public communication. Since $r_{\mathop{\operator@font S}}(\boldsymbol{\mathsf{z}}_{V})<r_{\mathop{\operator@font CO}}(\boldsymbol{\mathsf{z}}_{V})$, the communication $\boldsymbol{\mathsf{f}}_{V}$ is insufficient for omniscience. Assume that user $1$ cannot recover all of $\boldsymbol{\mathsf{z}}_{V}$ from $(\boldsymbol{\mathsf{z}}_{1},\boldsymbol{\mathsf{f}}_{V})$. Then, via linearity of the source and the communication, there exists an observation

[TABLE]

such that $\begin{bmatrix}\boldsymbol{z}_{1}&\boldsymbol{z}_{V}\boldsymbol{A}\end{bmatrix}=\boldsymbol{0}$.

Fix a basis $\boldsymbol{b}_{1},\boldsymbol{b}_{2},\ldots,\boldsymbol{b}_{\ell}$ for $Z_{V}$, with $\boldsymbol{b}_{\ell}=\boldsymbol{z}_{V}$ as above. Let $\widetilde{\boldsymbol{M}}$ be the matrix having $\boldsymbol{b}_{1},\boldsymbol{b}_{2},\ldots,\boldsymbol{b}_{\ell}$, in that order, as its $\ell$ rows. Thus, $\text{row-space}(\widetilde{\boldsymbol{M}})=\text{row-space}(\boldsymbol{M})=Z_{V}$. There is then an invertible (change-of-basis) matrix $\boldsymbol{B}$ such that $\boldsymbol{M}=\boldsymbol{B}\widetilde{\boldsymbol{M}}$. We can now write

[TABLE]

where $\boldsymbol{\mathsf{y}}:=\boldsymbol{\mathsf{x}}\boldsymbol{B}$. Since $\mathsf{x}_{1},\ldots,\mathsf{x}_{\ell}$ are i.i.d. $\text{Unif}(\mathbb{F}_{q})$ rvs, and $\boldsymbol{B}$ is invertible, $\boldsymbol{\mathsf{y}}=\begin{bmatrix}\mathsf{y}_{1}&\mathsf{y}_{2}&\ldots&\mathsf{y}_{\ell}\end{bmatrix}$ is also composed of i.i.d. rvs $\mathsf{y}_{i}$ uniformly distributed over $\mathbb{F}_{q}$. Note that the relation $\boldsymbol{\mathsf{y}}=\boldsymbol{\mathsf{x}}\boldsymbol{B}$ allows each $\mathsf{y}_{j}$ to be expressed as a linear combination of the $\mathsf{x}_{i}$s, and vice versa. Thus,

[TABLE]

provides an alternative description of the finite linear source $\boldsymbol{\mathsf{z}}_{V}$.

Since $\boldsymbol{b}_{\ell}=\boldsymbol{z}_{V}$, we have

[TABLE]

Since $\boldsymbol{z}_{1}=\boldsymbol{0}$ (by choice of $\boldsymbol{z}_{V}$), we see that $\boldsymbol{\mathsf{z}}_{1}$ consists of linear combinations of $\mathsf{y}_{1},\ldots,\mathsf{y}_{\ell-1}$ alone. Also, since $\boldsymbol{z}_{V}\boldsymbol{A}=\boldsymbol{0}$, the communication

[TABLE]

consists of linear combinations of $\mathsf{y}_{1},\ldots,\mathsf{y}_{\ell-1}$ alone. Consequently, the secret key $\mathsf{K}$, which must be generated by user $1$ from $(\boldsymbol{\mathsf{z}}_{1},\boldsymbol{\mathsf{f}}_{V})$, is a function of $\begin{bmatrix}\mathsf{y}_{1}&\ldots&\mathsf{y}_{\ell-1}\end{bmatrix}$ alone.

Now, for each $i\in V$, we have

[TABLE]

with $\widetilde{\boldsymbol{M}}_{i}:=\boldsymbol{B}^{-1}\boldsymbol{M}_{i}$ again being a $\ell\times t_{i}$ matrix. Define

[TABLE]

For each $i\in V_{0}$, $\boldsymbol{\mathsf{z}}_{i}$ is a function of $\begin{bmatrix}\mathsf{y}_{1}&\ldots&\mathsf{y}_{\ell-1}\end{bmatrix}$ alone; in this case, set $\boldsymbol{M}^{\prime}_{i}=\widetilde{\boldsymbol{M}}_{i}$. On the other hand, for each $i\notin V_{0}$, use elementary column operations to convert $\widetilde{\boldsymbol{M}}_{i}$ into an $\ell\times t_{i}$ matrix $\boldsymbol{M}^{\prime}_{i}$, in which the last row has a single nonzero entry, occurring in the last column:

[TABLE]

Note that for each $i\in V$, we can express$\boldsymbol{M}^{\prime}_{i}$ as $\widetilde{\boldsymbol{M}}_{i}\boldsymbol{C}_{i}$ for some invertible $t_{i}\times t_{i}$ matrix $\boldsymbol{C}_{i}$. (For $i\in V_{0}$, $\boldsymbol{C}_{i}$ is the identity matrix.) Set $\boldsymbol{\mathsf{z}}^{\prime}_{i}:=\boldsymbol{\mathsf{y}}\boldsymbol{M}_{i}^{\prime}$, so that $\boldsymbol{\mathsf{z}}^{\prime}_{i}=\boldsymbol{\mathsf{y}}\widetilde{\boldsymbol{M}}_{i}\boldsymbol{C}_{i}=\boldsymbol{\mathsf{z}}_{i}\boldsymbol{C}_{i}$. If we write $\boldsymbol{\mathsf{z}}^{\prime}_{i}$ as $\begin{bmatrix}\mathsf{z}^{\prime}_{i,1}&\ldots&\mathsf{z}^{\prime}_{i,t_{i}}\end{bmatrix}$, then $\boldsymbol{\mathsf{z}}^{\prime}_{i}:=\boldsymbol{\mathsf{y}}\boldsymbol{M}_{i}^{\prime}$ implies that

for $i\in V_{0}$, $\boldsymbol{\mathsf{z}}_{i}^{\prime}$ is a function of $\begin{bmatrix}\mathsf{y}_{1}&\ldots&\mathsf{y}_{\ell-1}\end{bmatrix}$ alone; and

• -

for $i\notin V_{0}$, only $\mathsf{z}^{\prime}_{i,t_{i}}$ is of the form $\sum_{j=1}^{\ell}\alpha_{j}\mathsf{y}_{j}$, with $\alpha_{\ell}\neq 0$; all other components $\mathsf{z}^{\prime}_{i,j}$, $j=1,\ldots,t_{i}-1$, are functions of $\begin{bmatrix}\mathsf{y}_{1}&\ldots&\mathsf{y}_{\ell-1}\end{bmatrix}$ alone.

For each $i\notin V_{0}$, consider the communication $\boldsymbol{\mathsf{f}}_{i}$ from user $i$: write $\boldsymbol{\mathsf{f}}_{i}$ as $\boldsymbol{\mathsf{z}}_{i}\boldsymbol{A}_{i}$ for a suitable matrix $A_{i}$. We then have

[TABLE]

with $\boldsymbol{A}_{i}^{\prime}:=\boldsymbol{C}_{i}^{-1}\boldsymbol{A}_{i}$. Since the overall communication $\boldsymbol{\mathsf{f}}_{V}$ consists of linear combinations of $\mathsf{y}_{1},\ldots,\mathsf{y}_{\ell-1}$ alone, it must be the case that the last row of $\boldsymbol{A}_{i}^{\prime}$ is zero. Hence, $\boldsymbol{\mathsf{f}}_{i}=\boldsymbol{\mathsf{z}}_{i}^{\#}\boldsymbol{A}_{i}^{\#}$, where $\boldsymbol{\mathsf{z}}_{i}^{\#}:=\begin{bmatrix}\mathsf{z}^{\prime}_{i,1}&\ldots&\mathsf{z}^{\prime}_{i,t_{i}-1}\end{bmatrix}$, and $\boldsymbol{A}_{i}^{\#}$ is $\boldsymbol{A}_{i}^{\prime}$ with the last row deleted. For $i\in V_{0}$, we simply set $\boldsymbol{\mathsf{z}}_{i}^{\#}=\boldsymbol{\mathsf{z}}_{i}^{\prime}$ and $\boldsymbol{A}_{i}^{\#}=\boldsymbol{A}_{i}^{\prime}$, so that we again have $\boldsymbol{\mathsf{f}}_{i}=\boldsymbol{\mathsf{z}}_{i}^{\#}\boldsymbol{A}_{i}^{\#}$.

For each $i\in V$, $\boldsymbol{\mathsf{z}}_{i}^{\#}$ is a function only of $\begin{bmatrix}\mathsf{y}_{1}&\ldots&\mathsf{y}_{\ell-1}\end{bmatrix}$, so that for $\boldsymbol{\mathsf{z}}_{V}^{\#}:=\begin{bmatrix}\boldsymbol{\mathsf{z}}_{1}^{\#}&\ldots&\boldsymbol{\mathsf{z}}_{m}^{\#}\end{bmatrix}$, we have

[TABLE]

Note that $\boldsymbol{\mathsf{z}}_{V}^{\#}$ is a finite linear source, since $\boldsymbol{\mathsf{z}}_{i}^{\#}=\boldsymbol{\mathsf{y}}\boldsymbol{M}_{i}^{\#}$, where $\boldsymbol{M}_{i}^{\#}$ is either equal to $\boldsymbol{M}_{i}^{\prime}$ (for $i\in V_{0}$) or is equal to$\boldsymbol{M}_{i}^{\prime}$ with its last row deleted (for $i\notin V_{0}$). Moreover, $\boldsymbol{\mathsf{z}}_{V}^{\#}$ can be simulated by $\boldsymbol{\mathsf{z}}_{V}$. Explicitly, for each $i\in V_{0}$, $\boldsymbol{\mathsf{z}}_{i}^{\#}$ is equal to $\boldsymbol{\mathsf{z}}_{i}\boldsymbol{C}_{i}$ ($=\boldsymbol{\mathsf{z}}_{i}^{\prime}$), and for each $i\notin V_{0}$, $\boldsymbol{\mathsf{z}}_{i}^{\#}$ is equal to $\boldsymbol{\mathsf{z}}_{i}\boldsymbol{C}_{i}$ ($=\boldsymbol{\mathsf{z}}_{i}^{\prime}$) with its last component deleted. Our arguments above show that the communication $\boldsymbol{\mathsf{f}}_{V}=\boldsymbol{\mathsf{z}}_{V}\boldsymbol{A}$ is a non-interactive linear communication for $\boldsymbol{\mathsf{z}}_{V}^{\#}$ as well. Finally, we argue below that the secret key $\mathsf{K}$ can be generated from $(\boldsymbol{\mathsf{z}}_{i}^{\#},\boldsymbol{\mathsf{f}}_{V})$ for each $i\in V$. Hence, $r_{\mathop{\operator@font S}}(\boldsymbol{\mathsf{z}}_{V}^{\#})\leq r_{\mathop{\operator@font S}}(\boldsymbol{\mathsf{z}}_{V})$, which along with Lemma 1 proves the theorem.

For user $i$ to generate $\mathsf{K}$, it must be a function of $(\boldsymbol{\mathsf{z}}_{i},\boldsymbol{\mathsf{f}}_{V})$. Equivalently, $\mathsf{K}$ is a function of $(\boldsymbol{\mathsf{z}}^{\prime}_{i},\boldsymbol{\mathsf{f}}_{V})$, since $\boldsymbol{\mathsf{z}}^{\prime}_{i}$ is an invertible function of $\boldsymbol{\mathsf{z}}_{i}$. We claim that $\mathsf{K}$ is in fact a function of $(\boldsymbol{\mathsf{z}}_{i}^{\#},\boldsymbol{\mathsf{f}}_{V})$. This is trivially true for $i\in V_{0}$, so assume $i\notin V_{0}$. We say that a function $f(y_{1},\ldots,y_{n})$ is functionally dependent on the variable $y_{n}$ if there exist $y_{1}^{\prime},\ldots,y_{n}^{\prime}$, and $y_{n}^{\prime\prime}\neq y_{n}^{\prime}$ such that $f(y_{1}^{\prime},\ldots,y_{n-1}^{\prime},y_{n}^{\prime})\neq f(y_{1}^{\prime},\ldots,y_{n-1}^{\prime},y_{n}^{\prime\prime})$. Note that $f(y_{1},\ldots,y_{n})$ is in fact a function of $y_{1},\ldots,y_{n-1}$ alone iff it is not functionally dependent on $y_{n}$. We will argue that for $i\notin V_{0}$, $\mathsf{K}$ is not functionally dependent on $\mathsf{z}^{\prime}_{i,t_{i}}$.

Suppose, to the contrary, that $\mathsf{K}$ is functionally dependent on $\mathsf{z}^{\prime}_{i,t_{i}}$ for some $i\notin V_{0}$. Then there exist two distinct realizations, say, $\boldsymbol{u}$ and $\boldsymbol{v}$, of $(\boldsymbol{\mathsf{z}}_{i}^{\prime},\boldsymbol{\mathsf{f}}_{V})$ that differ only in the component $\mathsf{z}^{\prime}_{i,t_{i}}$, which result in two distinct values of $\mathsf{K}$: $\mathsf{K}(\boldsymbol{u})\neq\mathsf{K}(\boldsymbol{v})$. The realizations $\boldsymbol{u}$ and $\boldsymbol{v}$ share a common value of $(\boldsymbol{\mathsf{z}}_{i}^{\#},\boldsymbol{\mathsf{f}}_{V})$, which is a function of $\begin{bmatrix}\mathsf{y}_{1}&\ldots&\mathsf{y}_{\ell-1}\end{bmatrix}$ alone. Hence, there exists a realization of $\begin{bmatrix}\mathsf{y}_{1}&\ldots&\mathsf{y}_{\ell-1}\end{bmatrix}$ that determines the realization of $(\boldsymbol{\mathsf{z}}_{i}^{\#},\boldsymbol{\mathsf{f}}_{V})$ common to $\mathsf{u}$ and $\mathsf{v}$. Now, $Z^{\prime}_{i,t_{i}}=\sum_{j=1}^{\ell}\alpha_{j}\mathsf{y}_{j}$ with $\alpha_{\ell}\neq 0$, so a given realization of $\begin{bmatrix}\mathsf{y}_{1}&\ldots&\mathsf{y}_{\ell-1}\end{bmatrix}$ only suffices to determine the term $\sum_{j=1}^{\ell-1}\alpha_{j}\mathsf{y}_{j}$. Thus, we need two distinct realizations of $\mathsf{y}_{\ell}$, say, $\mathsf{y}^{\prime}$ and $\mathsf{y}^{\prime\prime}$, to determine the values of the component $Z^{\prime}_{i,t_{i}}$ in which $\mathsf{u}$ and $\mathsf{v}$ differ. In other words, $\mathsf{u}$ and $\mathsf{v}$ are determined, respectively, by $\begin{bmatrix}\mathsf{y}_{1}&\ldots&\mathsf{y}_{\ell-1}&\mathsf{y}_{\ell}=\mathsf{y}^{\prime}\end{bmatrix}$ and $\begin{bmatrix}\mathsf{y}_{1}&\ldots&\mathsf{y}_{\ell-1}&\mathsf{y}_{\ell}=\mathsf{y}^{\prime\prime}\end{bmatrix}$ for some $\mathsf{y}^{\prime}\neq\mathsf{y}^{\prime\prime}$. This makes $\mathsf{K}$ functionally dependent on $\mathsf{y}_{\ell}$, which is impossible since, as seen earlier, $\mathsf{K}$ is a function only of $\begin{bmatrix}\mathsf{y}_{1}&\ldots&\mathsf{y}_{\ell-1}\end{bmatrix}$.This proves that $\mathsf{K}$ cannot be functionally dependent on $\mathsf{z}^{\prime}_{i,t_{i}}$, and hence, $\mathsf{K}$ is a function of $(\boldsymbol{\mathsf{z}}_{i}^{\#},\boldsymbol{\mathsf{f}}_{V})$, as desired.

This proves that there exists a reduced source, $\boldsymbol{\mathsf{z}}^{\#}_{V}$, of $\boldsymbol{\mathsf{z}}_{V}$ obtained by linear processing with $r_{\mathop{\operator@font S}}(\boldsymbol{\mathsf{z}}^{\#}_{V})=r_{\mathop{\operator@font S}}(\boldsymbol{\mathsf{z}}_{V})$.