Fundamental Limits of Private User Authentication

TL;DR

This paper investigates the fundamental limits of private user authentication in cyber-physical systems using an information-theoretic approach, proposing schemes for single and multi-server scenarios in finite and asymptotic regimes.

Contribution

It introduces a general interactive model for private authentication, providing achievable schemes and optimality results in finite size and asymptotic regimes.

Findings

Proposed secret sharing scheme for finite size regime.

Achieved optimality in multi-server finite size scenario.

Used random binning for asymptotic regime authentication.

Abstract

Most of the security services in the connected world of cyber-physical systems necessitate authenticating a large number of nodes privately. In this paper, the private authentication problem is considered which consists of a certificate authority, a verifier (or some verifiers), many legitimate users (provers), and an arbitrary number of attackers. Each legitimate user wants to be authenticated (using his personal key) by the verifier(s), while simultaneously staying completely anonymous (even to the verifier). On the other hand, an attacker must fail to be authenticated. We analyze this problem from an information-theoretical perspective and propose a general interactive information-theoretic model for the problem. As a metric to measure the reliability, we consider the normalized total key rate whose maximization has a trade-off with establishing privacy. The problem is considered in two different scenarios: single-server scenario (only one verifier is considered, which all the provers are connected to) and multi-server scenario ($N$ verifiers are assumed, where each verifier is connected to a subset of users). For both scenarios, two regimes are considered: finite size regime (i.e., the variables are elements of a finite field) and asymptotic regime (i.e., the variables are considered to have large enough length). We propose achievable schemes that satisfy the completeness, soundness, and privacy properties in both single-server and multi-server scenarios in all cases. In the finite size regime, the main idea is to generate the authentication keys according to a secret sharing scheme. We show that the proposed scheme in the special case of multi-server authentication in the finite size regime is optimal. In the asymptotic regime, we use a random binning based scheme that relies on the joint typicality to generate the authentication keys.

Equations

$$P_{e1}\text{-completeness:}\mathbb{P}[\hat{\mathcal{H}}=1|\mathcal{H}=0]\le P_{e1}.$$

$$P_{e2}\text{-soundness:}\mathbb{P}[\hat{\mathcal{H}}=0|\mathcal{H}=1]\le P_{e2}.$$

$$(V,Q^{[1]},S^{[1]},M^{[1]},{\hat{S}}^{[1]})\sim (V,Q^{[k]},S^{[k]},M^{[k]},{\hat{S}}^{[k]}),\forall k\in [K].$$

$$P_p$$

$$(V,Q^{[k]},S^{[k]},M^{[k]},{\hat{S}}^{[k]}),\forall k\in [K]]\ge 1-P_p.$$

$$R=\frac{H(C_1,C_2,\cdots ,C_K)}{K\text{length}(C)}.$$

$$R_c=\frac{1}{l_c}.$$

$${\mathfrak{C}}^{\text{asy}}\triangleq \sup \{R:R$$

$$\text{ for a PA protocol in asymptotic regime}\}.$$

$$P_p\text{-privacy:}\mathbb{P}[(V_n,Q_n^{[k_1]},S_n^{[k_1]},M_n^{[k_1]},{\hat{S}}_n^{[k_1]})\sim$$

$$(V_n,Q_n^{[k]},S_n^{[k]},M_n^{[k]},{\hat{S}}_n^{[k]}),\forall k,k_1\in {\mathcal{N}}_n]\ge 1-P_p.$$

$$\left\{\!\!\begin{array}[]{ll}(R,R_{c}):\\ R_{c}=1;&R\leq\frac{1}{K}\\ R_{c}=\frac{1}{i},i\geq 2;&R\leq 1-R_{c}+\frac{R_{c}\log_{q}P(q^{L}-1,K)}{KL}\end{array}\right\}.$$

$$\left\{\begin{array}[]{ll}(R,R_{c}):\\ R_{c}=\frac{1}{i},i\geq 1;&R\leq 1\end{array}\right\}.$$

$$\mathbb{P}[\hat{\mathcal{H}}=1|\mathcal{H}=0]=\mathbb{P}[{\hat{S}}^{[k]}\ne S^{[k]}]=0.$$

$$\mathbb{P}[\hat{\mathcal{H}}=0|\mathcal{H}=1]=\mathbb{P}[\hat{S}=S]=\frac{1}{q^L}.$$

$$R$$

$$\mathbb{P}[\hat{\mathcal{H}}=1|\mathcal{H}=0]=\mathbb{P}[{\hat{S}}^{[k]}\ne S^{[k]}]=0.$$

$$\mathbb{P}[\hat{\mathcal{H}}=0|\mathcal{H}=1]=\mathbb{P}[\hat{S}=S]=\frac{1}{q^L}.$$

$$R$$

$$\stackrel{(a)}{=}\frac{H(X_1,\cdots ,X_K)+{\sum }_{i=1}^{K}H(Y_i)+{\sum }_{i=1}^{K}H(Z_i)}{K{l}_{c}L}$$

$$\stackrel{(b)}{=}\frac{{\log }_{q}P(q^L-1,K)+K(l_c-1)L}{K{l}_{c}L},$$

$$\biggl{\{}R_{c}\leq 1,\quad R\leq 1\biggr{\}}.$$

$$R$$

$$\ge \frac{H(Y_1^l,\cdots ,Y_K^l|X^l)}{Kl}\stackrel{(a)}{=}\frac{1}{Kl}\sum _{i=1}^{K}H(Y_i^l|X^l)\stackrel{(b)}{=}H(Y|X),$$

$$H(A_n|Q_n,Y_1,\cdots ,Y_K,R)=0$$

$$(Q_n^{[k_1]},A_n^{[k_1]},Y_{1:K},R)\sim (Q_n^{[k]},A_n^{[k]},Y_{1:K},R),\forall k_1,k\in [K]$$

$$I(Y_{-k};Q_{1:N}^{[k]},A_{1:N}^{[k]},\mathcal{F})=0,\forall k\in [K].$$

$$\mathbb{P}[\hat{\mathcal{H}}=1|\mathcal{H}=0]=\mathbb{P}[{\hat{S}}_{n^{\ast }}^{[k]}\ne S_{n^{\ast }}^{[k]}]=0.$$

$$\mathbb{P}[\hat{\mathcal{H}}=0|\mathcal{H}=1]=\mathbb{P}[{\hat{S}}_{n^{\ast }}=S]=\frac{1}{q^L}.$$

$$(V_n,Q_n^{[k_1]},S_n^{[k_1]},M_n^{[k_1]},{\hat{S}}_n^{[k_1]})\sim (V_n,Q_n^{[k]},S_n^{[k]},M_n^{[k]},{\hat{S}}_n^{[k]}),$$

$$R$$

$$\stackrel{(a)}{=}\frac{H(X_1)+\cdots +H(X_K)}{KL}=\frac{KH(X_1)}{KL}\stackrel{(b)}{=}1,$$

$$R=\frac{H(C_1,\cdots ,C_K)}{Kl}=\frac{H(Y_1^l,\cdots ,Y_K^l)}{Kl}$$

$$\ge \frac{H(Y_1^l,\dots ,Y_K^l|X_{1:N}^l)}{Kl}=\frac{{\sum }_{i=1}^{K}H(Y_i^l|X_{1:N}^l)}{Kl}=H(Y|X_{1:N}).$$

Full text

1 Introduction

With the growth of cyber-physical systems, authentication is an essential security feature in communication systems. Based on the application, authentication protocols may authenticate the user and/or the message. In fact, an authentication protocol seeks the answer to who sends the data is the user authorized to access the service, or whether the message received is unaltered. The traditional cryptography-based methods for user authentication are mostly based on key validation, e.g., public key or password based authentication; while the signed hash of the message is traditionally used for the message authentication.

The nature of user authentication requires revealing the user’s identity, at least partly. However, nowadays, by increasing privacy concerns, users wish to stay anonymous when sending authentication requests. Anonymity ensures that a user may access a resource or service without disclosing his identity. In other words, anonymity of a user means that the user is not identifiable (not uniquely characterized) within a specific set of users [2]. This has many emerging applications such as vehicular networks [3], cloud computing, distributed servers [4], crypto-currencies and services on blockchain [5]. In this paper, we study the inherent contradiction between authentication and privacy, referred to as the private authentication (PA) problem, where a legitimate user while passing the authentication, does not reveal his identity even to the server (by hiding in a group of users), but an illegitimate user (attacker) fails to be authenticated. In practice, the PA problem is encountered when the server should not distinguish the one who requests the service with which key is authenticated [3]. There are cryptographic methods such as algorithms based on zero-knowledge proof [6], using tokens for private authentication [7], and other cryptographic protocols, known as privacy-aware or anonymous authentication [8, 9]. However, to the best of our knowledge, the fundamental limits of the PA problem have not been studied.

With no privacy concern, the authentication problem has been studied fundamentally in works such as [10, 11, 12, 13, 14]. In [10], Simmons considers message authentication over a noiseless channel with a shared key between peers of authentication, where the lower bounds on the success probability of impersonation attack and substitution attack are established. In [11], the results of [10] have been extended to noisy channels. In [12], hypothesis testing is proposed to derive generalized lower bounds on the success probability of impersonation and substitution attacks. The idea of using characteristics of the wireless channel for authentication, instead of shared key, has been analyzed in works such as [13, 14].

Privacy constraints from an information theory perspective have been studied in some problems[15, 16, 17, 18, 19]. With no connection to the authentication problem, [15] derives the capacity of private information retrieval, and [16] studies privacy in database systems. The privacy leakage rate is studied in works such as [17, 18, 19] (biometric security systems). In biometric security systems, a user wishes to authenticate himself by some biometric characteristics, such as fingerprint, called enrollment sequence. The privacy constraint is to avoid leakage of information about the enrollment sequence. [17, 18, 19] derive the trade-off between the secret key rate, the secret key is generated from the enrollment sequence, and the privacy leakage.

Our contributions. In this paper, we propose an information-theoretic interactive setup for the user-authentication problem with privacy constraint. We consider a PA problem consisting of a certificate authority (CA), a single verifier or multiple verifiers (e.g., servers), many legitimate users, and an arbitrary number of attackers. A legitimate user wishes to be authenticated to the verifier to gain access to a service, while he wants to stay anonymous to anyone observing the authentication process (in particular the verifier). An attacker wants to impersonate himself as a legitimate user and gain unauthorized access to the service. The verifier(s) wants to understand that the user, who requests authentication (prover), either is legitimate or an attacker. We assume semi-honest verifiers; they follow the protocol but they are curious about the identity of the provers. CA is an entity that shares correlated randomness between the verifier(s) and the legitimate users. This randomness can be used by the verifier(s) in the process of authentication to distinguish an attacker from a legitimate user. The case of multiple verifiers models the scenarios where a user wishes to access different services from different servers using only one single key [20].

In an authentication protocol, two conditions should be considered: the legitimate user who follows the protocol must pass the authentication (completeness condition), and an attacker must fail to authenticate (soundness condition). In a private authentication protocol, the privacy condition must also be satisfied meaning that the legitimate user stays anonymous, i.e., the verifier(s) cannot distinguish the legitimate users’ identities. In addition, it is desirable that the exposure of the key of a legitimate user releases as little information about the other keys as possible. Thus, we consider a reliability metric defined as the normalized total key rate of the users. The higher the normalized total key rate, the more reliable the private authentication protocol.

As a solution to the above problem, we propose general interactive information-theoretic protocols. Our proposed PA protocols are considered in two scenarios: single-server and multi-server scenarios. In the single-server scenario, only one verifier is assumed, connected to all users. In the multi-server scenario, $N$ verifiers are assumed, such that a subset of the users are connected to each verifier. For this scenario, we study two cases: (i) Individual authentication, where each verifier privately authenticates the users who are connected to him (same as the single-server scenario). (ii) Distributed authentication, where the process of privately authenticating the user is done distributively by the verifiers that are connected to the user, by collaboratively sending the helper data.

Both single-server and multi-server scenarios are analyzed in two regimes: finite size and asymptotic regimes. In the finite size regime, the variables used in the PA protocol are elements of a finite field. So, the inverse of the length of the key vector of each user is considered as the metric, in addition to the normalized key rate. In the asymptotic regime, the variables of the protocol are sequences of the length of order $l$, for arbitrary large $l$, where $l$ is the length of the key available at the legitimate user, required for authentication.

In the single-server scenario, for both the finite size and asymptotic regimes, we propose an achievable PA protocol, that satisfies the completeness, soundness, and privacy conditions. In the asymptotic regime, the proposed scheme achieves capacity, proving its optimality. The privacy condition is guaranteed by generating and extracting correlation between the information distributed among the users, which enables us to generate correlated keys such that checking the availability of the keys at the users does not need the identity of the user. Our finite size scheme mainly uses the idea that the keys of the legitimate users should lie on a specific polynomial. Checking that this polynomial passes through the key of the prover without knowing the exact value of the key, satisfies privacy constraint. Here, the achievable region (normalized total key rate and inverse of the length of the key vector) is provided. For the asymptotic regime, we propose an optimal scheme, where the main idea is to use the random binning and joint typicality between the keys of the legitimate users and the data available at the verifier to generate the required correlation. Using this correlation enables us to guarantee privacy.

In the multi-server scenario, for the individual authentication case, in both the finite size and asymptotic regimes, we propose achievable protocols. Both these protocols are the generalization of the protocols proposed in the single-server scenario, and thus have their properties. The proposed protocol in the asymptotic regime is optimal. For the distributed authentication case, assuming that all the verifiers are connected to all the provers, we propose an optimal scheme in the finite size regime. This protocol uses symmetric private information retrieval (SPIR) [21] at the verifiers to send the desired data by the prover privately, and simultaneously the prover cannot gain information about other users’ keys. In this protocol, the authentication process is done distributively by the verifiers.

Organization. Section 2 presents the system framework. Section 3 describes the results. Section 4 proposes the achievable schemes. Section 5 concludes the paper and provides a comparison of proposed authentication protocols.

Notations: Capital letters are used to show random variables and small letters are their realizations. The mutual information between $X$ and $Y$ is shown with $I(X;Y)$, $H(X)$ shows the entropy of discrete random variable $X$. $\mathcal{T}_{\xi}^{(l)}(X,Y)$ is the set of strong jointly typical sequences $(X^{l},Y^{l})$. $[K]=\{1,2,\cdots,K\}$, $X_{1:N}=\{X_{1},\cdots,X_{N}\}$ and $X\sim Y$ means that $X$ and $Y$ are identically distributed. $P\left(n,k\right)=\frac{n!}{(n-k)!}$ shows $k$ permutations of $n$. For stating asymptotic results (Landau notation), $f(x)=\Theta(g(x))$ if $\lim_{x\to\infty}\frac{f(x)}{g(x)}<\infty$.

2 Problem statement

The PA framework consists of a CA, single or multiple verifiers, $K$ legitimate users, and an attacker111Arbitrary number of attackers may exists, but considering one of them is enough.. Each legitimate user wants to be authenticated without revealing his identity to the verifier(s). Two scenarios are considered: Single-server scenario (one verifier) and multi-server scenario ($N$ verifiers). We first introduce the single-server scenario.

2.1 Single-server (verifier)

A single-server PA protocol consists of a CA, a verifier, $K$ legitimate users, and an attacker. Each legitimate user wishes to authenticate himself to the verifier without revealing his identity. The PA protocol, shown in Fig. 1, has two phases:

1. Key distribution phase: In this phase, the CA having access to $\mathcal{W}$, generates $C_{k}\in\mathcal{C}$ as the personal key of user $k$ using function $h^{[k]}:\mathcal{W}\to\mathcal{C}$, where $\mathcal{W}$ is an authentication space, and sets $C=\left(C_{1},\cdots,C_{K}\right)\in\mathcal{C}^{K}$. CA sends $C_{k}$ to the legitimate user $k$, which will be used later by the verifier to authenticate user $k$. This phase runs only once at the setup of the protocol to provide the users with their personal keys.

2. Authentication phase: Here, the user $k\in[K]$ wants to prove knowledge of $C_{k}\in C$ without revealing index $k$ to the verifier. The decoding and encoding functions of the protocol must be designed to specify the verification process. The set of variables for a PA protocol is shown as $\mathcal{P}^{\text{Single}}=\left(V,Q^{[k]},M^{[k]},S^{[k]},\hat{S}^{[k]}\right)$. These parameters will be defined in the following. Any time that a prover requests authentication from the verifier, this phase runs. A prover is a user who sends the authentication request to the verifier. We have two cases: Case I: $\mathcal{H}=0$, the prover is a legitimate user, Case II: $\mathcal{H}=1$, the prover is an attacker. When the prover claims that he has some $\bar{C}\in C$, the verifier decides on $\hat{\mathcal{H}}$, where $\hat{\mathcal{H}}=0$ means that the verifier accepts the prover as a legitimate user, and $\hat{\mathcal{H}}=1$ means that the verifier rejects the prover. The authentication phase, as shown in Fig. 1, consists of five steps:

Case I: $\mathcal{H}=0$

S1: The prover (user $k$) sends authentication query $Q^{[k]}\in\mathcal{Q}$ to the verifier, a request for authentication.

S2: CA generates $V\in\mathcal{V}$ using encoding function $f^{c}:\mathcal{W}\to\mathcal{V}$ and sends $V$ to the verifier.

S3: The verifier, knowing $V$ and receiving $Q^{[k]}$, uses encoding function $f^{[k]}:\mathcal{V}\times\mathcal{Q}\to\mathcal{S}\times\mathcal{M}$ to generate $S^{[k]}$ and $M^{[k]}$, i.e., $(S^{[k]},M^{[k]})=f^{[k]}(V,Q^{[k]})$. The output of the encoding function has two parts. The first part, $S^{[k]}$, is used as a secret in the process of authentication in the following steps and the second part, $M^{[k]}$, is used as helper data for the prover. Then, the verifier keeps $S^{[k]}$ and sends $M^{[k]}$ to the prover.

S4: The prover (legitimate user $k$) computes $\hat{S}^{[k]}=g^{[k]}(M^{[k]},C_{k},Q^{[k]})$, where $g^{[k]}:\mathcal{M}\times\mathcal{C}\times\mathcal{Q}\to\mathcal{S}$ is a decoding function, and sends $\hat{S}^{[k]}$ to the verifier.

S5: If $\hat{S}^{[k]}=S^{[k]}$, the verifier accepts the prover and announces $\hat{\mathcal{H}}=0$. Otherwise, he rejects the prover and announces $\hat{\mathcal{H}}=1$.

Case II: $\mathcal{H}=1$

Since neither the verifier nor the CA has knowledge of $\mathcal{H}$ at the beginning of the authentication phase, the steps of the authentication phase are similar to that of case I, except in Step 4. In Step 4, the prover (an attacker) computes $\hat{S}=g(M,Q)$, since the only information available at the attacker is $M$ and $Q$. Function $g$ can be any arbitrary decoding function such that $g:\mathcal{M}\times\mathcal{Q}\to\mathcal{S}$. The prover sends $\hat{S}$ to the verifier.

The PA protocol should satisfy three constraints: completeness, soundness, and privacy.

The completeness property assures that a legitimate user is accepted. We define the $P_{e1}$-completeness constraint as if the prover is the legitimate user, then the verifier announces $\hat{\mathcal{H}}=0$ with probability more than $1-P_{e1}$. Thus,

[TABLE]

The soundness property guarantees that an attacker is rejected. The $P_{e2}$-soundness constraint is defined as if the prover is an attacker, then the verifier announces $\hat{\mathcal{H}}=1$ with probability more than $1-P_{e2}$. Thus,

[TABLE]

To make user identity private, all provers’ requests should be indistinguishable from the verifier’s perspective, i.e., knowing the variables available at the verifier, all requests must be identically distributed. Thus, perfect privacy is defined as:

[TABLE]

In the proposed model, we use the $P_{p}$-privacy property as:

[TABLE]

Considering $\text{length}(C)$ as the length of the keys, we define a reliability metric, $R$, as the normalized total key rate:

[TABLE]

Since $C_{k}$ is the personal key of user $k$, it is desirable that $(C_{1},C_{2},\cdots,C_{K})$ has the maximum entropy, so that exposure of a user’s key reveals minimum information about other users’ keys. In other words, users wish that others gain as little information as possible about their keys. On the other hand, for preserving privacy, it is desired that the personal keys of the users have correlated information. This correlated information is used for authentication without revealing the identity of the user. Thus, there is a trade-off between maximizing the entropy of $(C_{1},C_{2},\cdots,C_{K})$ and establishing privacy.

The goal is to design a PA protocol that satisfies completeness, soundness, and privacy constraints while achieving maximum $R$. Two regimes are considered: finite size and asymptotic regimes222Both finite size and asymptotic regimes are considered in terms of size of the variable and both of them are single round., defined in the following.

Finite size regime: In the finite size regime, the variables of the protocol are chosen as elements of a finite field. More precisely, $\mathcal{W}=GF(q^{L})$, $\mathcal{S}=GF(q^{L})$, $\mathcal{C}=(GF(q^{L}))^{l_{c}}$, $\mathcal{V}=(GF(q^{L}))^{l_{v}}$ and $\mathcal{M}=(GF(q^{L}))^{l_{m}}$, where $q$ is a prime number and $L$, $l_{c}$, $l_{v}$, and $l_{m}$ are integers333$\mathcal{S}=GF(q^{L})^{l_{s}}$ is feasible, but to avoid complexity, we set $l_{s}=1$.. For example, for a variable $X$ used in the protocol, $X\in\left(GF(q^{L})\right)^{l_{x}}$, meaning that $X$ is a $l_{x}$-tuple where each element is of length $L$ in a $q$-ary unit. $l_{x}$ will be chosen properly according to the protocol. Thus, $\text{length}(X)=l_{x}L$. All operations in this regime are done in the finite field $GF(q^{L})$. Thus, $C_{k}\in(GF(q^{L}))^{l_{c}}$ for $k\in[K]$. We also define the inverse of the length of the key vector as:

[TABLE]

Definition 1**.**

The pair $(R,R_{c})$ is achievable for a PA protocol in the finite size regime, if there exist encoding functions $f^{c}$ and $f^{[k]}$, decoding functions $g^{[k]}$ and functions $h^{[k]}$ for $k\in[K]$, such that $P_{e1}=0$, $P_{e2}=\frac{1}{|\mathcal{S}|}$ and $P_{p}=0$. It must be noted that since $l_{c}\in\mathbb{Z}^{+}$, the achievable region is countable.

Remark 1**.**

It is worth noting that, since an attacker can guess the key, the lowest possible $P_{e2}$ is equal to $\frac{1}{|\mathcal{S}|}$.

Definition 2**.**

*The capacity region $\mathfrak{C}^{\text{fin}}$ for a PA protocol is the union of all achievable pairs. *

Asymptotic regime: In the asymptotic regime, the elements of the protocol are sequences of arbitrary large length. More exactly, each variable of the protocol, e.g., $X^{l_{x}}$ is a sequence of length $l_{x}$ with each component chosen from $\mathcal{X}$. Thus, $\text{length}(X^{l_{x}})=l_{x}$, where $l_{x}$ approaches infinity. In particular, considering $\mathcal{C}=\mathcal{Y}^{l}$, we define the $l$-length key $C_{k}=Y_{k}^{l}=\left({Y_{k}}_{1},\cdots,{Y_{k}}_{l}\right)$ where ${Y_{k}}_{i}$ is a random variable from alphabet $\mathcal{Y}$, $k\in[K]$ and $i\in\{1,2,\cdots,l\}$.

Definition 3**.**

The normalized total key rate $R$ is achievable for a PA protocol in the asymptotic regime, if there exist encoding functions $f^{c}$ and $f^{[k]}$, decoding functions $g^{[k]}$ and functions $h^{[k]}$ for $k\in[K]$, such that $P_{e1}$, $P_{e2}$ and $P_{p}$ tend to zero as the length of the variables goes to infinity.

Definition 4**.**

The key capacity for a PA protocol in the asymptotic regime is:

[TABLE]

2.2 Multi-server (verifiers)

In this section, a multi-server version of the PA framework is introduced. The multi-server PA protocol, shown in Fig. 2, consists of a CA, $N$ verifiers, $K$ legitimate users, and an attacker. Each legitimate user wants to gain access to a subset of verifiers using only one personal key. Verifier $n$ ($n\in[N]$) must authenticate any legitimate user in the set $\mathcal{N}_{n}\subseteq[K]$. $\mathcal{N}_{n}$ can be any arbitrary subset of $[K]$ and shows the users that are allowed to connect to the verifier $n$. However, for privacy reasons, the user wants to be anonymous in the set $\mathcal{N}_{n}$, that is, the verifier $n$ should not understand which user in the set $\mathcal{N}_{n}$ requests accessing the service.

Definition 5**.**

$(k,n)$* forms a feasible pair if $k\in\mathcal{N}_{n}$. This means that the user $k$ has the right to gain access to the verifier $n$.*

The same as the single-server scenario, the multi-server PA protocol has two phases:

1. Key distribution phase: Similar to the single-server case, CA sends the personal key of user $k$, $C_{k}$, to each legitimate user.

2. Authentication phase: The user $k$ wants to prove knowledge of $C_{k}\in C$ without revealing index $k$ to the verifier $n^{\ast}$. Any time that a prover wants to be authenticated, this phase runs. In this phase, the verification process is specified, which includes the variables $\mathcal{P}^{\text{Multi}}=\left(V_{n},Q_{n}^{[k]},M_{n}^{[k]},S_{n}^{[k]},\hat{S}_{n}^{[k]},\,n\in[N]\right)$. These parameters will be defined in the following. It must be noted that the flow of the PA protocol for the single-server and the multi-server is similar, this means that the one who takes action in each step of the authentication phase is the same. However, considering the type of authentication in multi-server scenarios, two situations are studied: 1) Individual authentication, 2) distributed authentication. In these two situations, when helper data is sent, interactions between the parties of the protocol are different. The details are presented in the following in Step 3. Because of the similarities between the overall functionality of Case I (the prover is a legitimate user) and Case II (the prover is an attacker), only Case I is described. Denoting $\mathcal{N}^{[k]}$ as the set of verifiers that user $k$ forms a feasible pair with, the authentication phase is in Case I is as follows.

S1: The legitimate user $k$ sends authentication query $Q_{n}^{[k]}\in\mathcal{Q}$ to the verifier $n$, where $n\in\mathcal{N}^{[k]}$. This query consists of the request for authentication.

S2: CA generates $V_{n}\in\mathcal{V}$, $n\in[N]$ using the encoding function $f_{n}^{c}:\mathcal{W}\to\mathcal{V}$, where $\mathcal{W}$ is an authentication space. CA sets $V=\{V_{1},V_{2},\cdots,V_{N}\}$ and sends $V_{n}$ to the $n$-th verifier.

S3: Two situations are considered:

• •

Individual authentication: only verifier $n^{\ast}$ sends helper data. In the individual authentication, the $n^{\ast}$-th verifier, knowing $V_{n^{\ast}}$, uses the encoding function $f_{n^{\ast}}^{[k]}$ to generate $S_{n^{\ast}}^{[k]}$ and $M_{n^{\ast}}^{[k]}$, i.e., $(S_{n^{\ast}}^{[k]},M_{n^{\ast}}^{[k]})=f_{n^{\ast}}^{[k]}(V_{n^{\ast}},Q_{n^{\ast}}^{[k]})$ and $f_{n^{\ast}}^{[k]}:\mathcal{V}\times\mathcal{Q}\to\mathcal{S}\times\mathcal{M}$. The verifier keeps $S_{n^{\ast}}^{[k]}$ and sends $M_{n^{\ast}}^{[k]}$ to the prover.

• •

Distributed authentication444It must be mentioned that distributed authentication is the general case of multi-server authentication and individual authentication is a special case of distributed authentication where only verifier $n^{\ast}$ sends helper data.: all the verifiers in $\mathcal{N}^{[k]}$ can send helper data to the user $k$. In the distributed authentication, for each $n\in\mathcal{N}^{[k]}\backslash\{n^{\ast}\}$, the $n$-th verifier uses the encoding function $f_{n}^{[k]}$ to generate $M_{n}^{[k]}$, i.e., $M_{n}^{[k]}=f_{n}^{[k]}(V_{n},Q_{n}^{[k]})$ and $f_{n}^{[k]}:\mathcal{V}\times\mathcal{Q}\to\mathcal{M}$. Also, the verifier $n^{\ast}$ generates $S_{n^{\ast}}^{[k]}$ and $M_{n^{\ast}}^{[k]}$, i.e., $(S_{n^{\ast}}^{[k]},M_{n^{\ast}}^{[k]})=f_{n^{\ast}}^{[k]}(V_{n^{\ast}},Q_{n^{\ast}}^{[k]})$. For $n\in\mathcal{N}^{[k]}$, each verifier $n$ sends $M_{n}^{[k]}$ to the prover, and verifier $n^{\ast}$ keeps $S_{n^{\ast}}^{[k]}$ to be used in the following steps for checking the legality of the prover.

S4: The prover (legitimate user $k$) computes $\hat{S}_{n^{\ast}}^{[k]}=g_{n^{\ast}}^{[k]}(C_{k},M_{1:N}^{[k]},Q_{1:N}^{[k]})$, where $g_{n^{\ast}}^{[k]}$ is a decoding function and $g_{n^{\ast}}^{[k]}:\mathcal{M}\times\mathcal{C}\times\mathcal{Q}\to\mathcal{S}$. It must be emphasized that the prover can use the queries he sent to the verifiers he forms feasible pair with and the helper data he received from these verifiers to estimate the secret generated by a specific verifier. The prover sends $\hat{S}_{n^{\ast}}^{[k]}$ to the verifier $n^{\ast}$.

S5: If $\hat{S}_{n^{\ast}}^{[k]}=S_{n^{\ast}}^{[k]}$, the verifier accepts the prover and announces $\hat{\mathcal{H}}=0$; Otherwise, he rejects the prover and announces $\hat{\mathcal{H}}=1$.

For each feasible pair, $P_{e1}$-completeness constraint is defined as (1), and for each verifier $P_{e2}$-soundness constraint is defined as (2). For verifier $n$, the privacy constraint is:

[TABLE]

Also, the normalized total key rate is defined as (4).

By designing the verification process for multi-server scenario, $\mathcal{P}^{\text{Multi}}$, the definitions of the achievable pair and the capacity region in the finite size regime and the definitions of the achievable rate and the capacity in the asymptotic regime are the same as Definitions 1-4, respectively, considering appropriate encoding and decoding functions.

Remark 2**.**

In Subsection 3.3, these two different situations of individual authentication and distributed authentication are considered.

3 Results

3.1 Single-server, finite size regime

Theorem 1**.**

The achievable region $(R,R_{C})$ ($R$ in $q$-ary unit) for a single-server PA protocol in the finite size regime is

[TABLE]

Remark 3**.**

The achievable scheme is provided in Subsection 4.1. The achievability proof consists of two schemes, scheme 1 for $R_{c}=1$ and scheme 2 for $R_{c}=\frac{1}{i},i\geq 2$. The idea for the first scheme is to share a common key between all legitimate users. The design of scheme 2 is depending on two facts: 1) a $k$ degree polynomial can cover $k+1$ randomly chosen points from $GF(q^{L})$, 2) $k+1$ points can uniquely determine a $k$ degree polynomial In this scheme, the CA generates $K$ random points (as the keys of the legitimate users) and computes the unique polynomial of degree $K$ passing through these points. The prover wishes to prove that his key is a valid point on the polynomial $f(.)$ to confirm his legitimacy (inspired by the idea of Shamir’s secret sharing (SSS) [22]). It must be emphasized that even though we use polynomial interpolation similar to SSS; however, we do not need to combine the shares (keys of the provers), and the setup is different.

Remark 4**.**

The normalized total key rate in (6) tends to its upper bound ,$1$, as $q^{L}\to\infty$ for $l_{c}\geq 2$.

3.2 Single-server, asymptotic regime

In the asymptotic regime, all the variables of the protocol are sequences of length $\Theta(l)$ for arbitrary large $l$.

Theorem 2**.**

The capacity of the single-server PA protocol in the asymptotic regime is equal to $\max_{p(y)}H(Y)$, where $Y$ is an arbitrary random variable chosen from $\mathcal{Y}$.

Remark 5**.**

The achievable scheme is provided in Subsection 4.2. The idea of the proposed scheme is to provide the verifier and the legitimate provers with correlated data (done by CA) using Wyner-Ziv coding [23], and then verify the existence of this correlation. This verification is based on a random binning technique and is done in an interactive protocol. It must be noted that applying Wyner-Ziv coding should fit the framework of the problem, and we cannot use Wyner-Ziv coding, lonely.

Remark 6**.**

The proposed achievable scheme in Subsection 4.2 is optimal. This means, we show that the normalized total key rate of the protocol achieves capacity.

3.3 Multi-server, finite size regime

The results provided in this subsection consider two different viewpoints of the problem of multi-server private authentication. First, the individual authentication, where similar to the single-server case, each server tries to authenticate a group of users that it forms feasible pair with, by considering privacy constraint. In other words, in each verification process, the legitimate user is connected to only one verifier, and that verifier privately authenticates the user with the corresponding key. The second viewpoint is to use the multi-server structure to perform the verification process in a distributed manner. More precisely, unlike the individual authentication, all (or a subset) of the servers contribute in the process of privately authenticating the users.

Theorem 3**.**

The achievable region $(R,R_{C})$ ($R$ in $q$-ary unit) for a multi-server PA protocol in the finite size regime is equal to (6).

Remark 7**.**

The achievable scheme is proposed in Subsection 4.3, and is for the individual authentication case. The proposed protocol consists of two schemes that are generalizations of the schemes proposed in the single-server case, Theorem 1. Each verifier tries to privately authenticate the groups of users that it forms feasible pair with. In scheme 1, a common key is shared between all users and verifiers. Each prover proves his legitimacy by providing this common key to the appropriate verifier. In scheme 2, each verifier computes the unique polynomial that passes through the keys of the users that he forms a feasible pair with. By proving that his key lies on the polynomial constructed by the desired verifier, the prover convinces the verifier of his legitimacy.

Theorem 4**.**

When $\mathcal{N}_{1}=\mathcal{N}_{2}=\cdots=\mathcal{N}_{n}=[K]$, the capacity region of the multi-server PA protocol in finite size regime in $q$-ary unit is:

[TABLE]

Remark 8**.**

The achievable scheme is provided in Subsection 4.4, and is for the distributed authentication case. In the proposed protocol, the prover asks for required data that fits his index, from all verifiers. The queries are sent according to the SPIR protocol, and the verifiers sends answers according to the SPIR protocol. Using the SPIR protocol enables the prover to protect his privacy. The prover uses his own personal key and the retrieved data to estimate the secret.

Remark 9**.**

The proposed achievable scheme for the distributed authentication is optimal and achieved capacity region. However, unlike the individual authentication, this scheme is provided for a special case where $\mathcal{N}_{1}=\mathcal{N}_{2}=\cdots=\mathcal{N}_{n}=[K]$.

Remark 10**.**

The proposed scheme for the distributed authentication provides some extra features compared with the individual authentication, that are discussed in Subsection 5.2.

3.4 Multi-server, asymptotic regime

Considering $C_{k}=Y_{k}^{l}$, we have the following theorem.

Theorem 5**.**

The capacity of the multi-server PA protocol in the asymptotic regime is equal to $\max_{p(y)}H(Y)$, where $Y$ is an arbitrary random variable chosen from $\mathcal{Y}$.

Remark 11**.**

The proposed achievable scheme is provided in Subsection 4.5, and is the generalization of the scheme proposed in Subsection 4.2. However, in the multi-server scenario each personal key must have the correlation properties with information available at all the verifiers he forms feasible pair with.

4 Proofs

4.1 Proof of Theorem 1 (single server, finite size regime)

The achievability proof consists of two schemes, scheme 1 for $R_{c}=1$ and scheme 2 for $R_{c}=\frac{1}{i},i\!\!\geq\!\!2$. The achievable region, shown in Fig. 3, for the proposed protocol is the union of the achievable pairs results from these two schemes.

Scheme 1 for single-server, finite size regime (SS-FR1) protocol ($R_{c}=1,R\leq\frac{1}{K}$):

1. Key distribution phase: first, CA chooses $\tilde{C}\in GF(q^{L})$ uniformly at random and sets $C_{k}=\tilde{C}$, $\forall k\in[K]$.

2. Authentication phase: Considering user $k$ as the prover, the encoding and decoding functions follow:

S1: The prover (user $k$) sends the authentication query $Q^{[k]}$ to the verifier. It is worth noting that this query only consists of a request for authentication and does not ask for specific helper data.

S2: CA sets $V\!=\!\{\tilde{C}\}$, and sends it to the verifier. It is to be noted since $V$ does not change in any verification process, $V$ can be sent to the verifier at the key distribution phase.

S3: The verifier sets $S^{[k]}=\tilde{C}$. It is obvious that since all the users have the secret as their own personal key, there is no need to helper data. Thus $M^{[k]}$ is Null.

S4: Having access to $C_{k}=\tilde{C}$, the prover sets $\hat{S}^{[k]}=\tilde{C}$ and sends it to the verifier.

S5: The verifier checks if $\hat{S}^{[k]}=S^{[k]}$, to pass or reject the prover.

These steps determine the variables of the verification process $\mathcal{P}^{\text{Single}}$. Now we analyze the completeness, soundness, and privacy properties of this scheme.

$\mathit{0}$-completeness: Each legitimate user has access to $\tilde{C}$. Thus, user $k$ can estimate $\hat{S}^{[k]}=S^{[k]}=\tilde{C}$ for all $k\in[K]$ and thus:

[TABLE]

This proves the [math]-completeness property of the scheme.

$\mathit{\frac{1}{|\mathcal{S}|}}$-soundness: Since the helper data is null in this scheme, we have, $I(S;M^{[k]})=0$. This means that if the prover is an attacker, he obtains no information about the secret. This means that, the best possible attack strategy is to guess the secret. Considering that $S$ is uniformly distributed):

[TABLE]

Thus, the maximum success probability of the attacker is equal to $\frac{1}{q^{L}}$, showing that the larger the size of the finite field, the lower the probability of attack. This completes the proof of $\frac{1}{|\mathcal{S}|}$-soundness property.

$\mathit{0}$-privacy: As stated above, every legitimate user has access to $\tilde{C}$. Thus, $\hat{S}^{[1]}=\hat{S}^{[k]}=\tilde{C}$, and $(V,Q^{[1]},S^{[1]},M^{[1]},\hat{S}^{[1]})\sim(V,Q^{[k]},S^{[k]},M^{[k]},\hat{S}^{[k]})$ for all $k\in[K]$, and [math]-privacy is satisfied. Intuitively, since every legitimate prover always sends $\tilde{C}$ and authentication query is only a request for authentication (no difference between the legitimate users), the verifier cannot distinguish the identity of the prover.

Now, we compute the normalized total key rate of the proposed protocol as,

[TABLE]

where (a) follows due to $l_{c}=1$.

This scheme achieves the pair $(\frac{1}{K},1)$, shown in Fig. 3. We remark that, trivially, when $R=\frac{1}{K}$ is achievable, all rates less than $\frac{1}{K}$ can be achieved, by changing the distribution of $\tilde{C}$ and thus reducing its randomness. This concept will be used in other schemes in the finite size regime, too.

Scheme 2 for single-server, finite size regime (SS-FR2) protocol ($R_{c}=\frac{1}{i}(i\geq 2),R\leq 1-R_{c}+\frac{R_{c}}{KL}\log_{q}P(q^{L}-1,K)$):

1. Key distribution phase: CA chooses $X_{1},\cdots,X_{K}$ ($K$ distinct random numbers) from the finite field $GF(q^{L})\backslash\{0\}$, and chooses $K$ variables from the field $\mathcal{W}=GF(q^{L})$, independently and uniformly at random and sets them as $Y_{1},\cdots,Y_{K}$. Moreover, CA chooses independently and uniformly at random $K$ variables from $\left(GF(q^{L})\right)^{l_{c}-2}$ and sets them as $Z_{1},\cdots,Z_{K}$. CA sets $C_{k}=(X_{k},Y_{k},Z_{k})$ and send $C_{k}$ to user $k$, $\forall k\in[K]$.

2. Authentication phase: Each user wishes to prove that his key ($(X_{k},Y_{k})$) fits the polynomial.

S1: The prover sends authentication query $Q^{[k]}$ to the verifier. It is worth noting that this query only consists of a request for authentication.

S2: CA chooses $a_{0}$ from $GF(q^{L})$ independently and uniformly at random, sets $V=\left\{a_{0},C_{k}|\,k\in[K]\right\}$ and sends $V$ to the verifier.

S3: Having access to $V$, the verifier sets $S^{[k]}=a_{0}$. Since $K+1$ points can uniquely determine a $K$ degree polynomial, the verifier computes the unique polynomial $f(.)$ of degree $K$ that passes through $\left\{(0,a_{0}),(X_{1},Y_{1}),\cdots,(X_{K},Y_{K})\right\}$. Then, the verifier chooses $K$ new points on the polynomial $f(.)$, i.e., the verifier chooses at random $K$ distinct elements $M_{1},\cdots,M_{K}$ of $GF(q^{L})\backslash\{0,X_{k}|\,k\in[K]\}$. The verifier sets $M^{[k]}=\left\{(M_{i},f(M_{i})),\,\forall i\in[K]\right\}$ and sends $M^{[k]}$ to user $k$.

S4: Knowing $M^{[k]}$ and $C_{k}$, the prover has access to $K+1$ distinct points of the polynomial $f(.)$ (of degree $K$), thus, he can derive the polynomial $f(.)$ and compute $\hat{S}^{[k]}\!\!=\!\!f(0)\!\!=\!\!a_{0}$. The prover sends $\hat{S}^{[k]}$ to the verifier.

S5: The verifier checks if $\hat{S}^{[k]}=S^{[k]}$, to pass or reject the prover.

The above steps determine the variables of $\mathcal{P}^{\text{Single}}$ of SS-FR2.

Remark 12**.**

It is to be emphasized that, $a_{0}$, selected in Step 2 of the authentication phase, must not be changed in different verification processes. Changing $a_{0}$ results in changing the polynomial $f(.)$, and the intersection points of the old and the new polynomials consist of the keys of the users. This violates security and reveals the keys of the users to other legitimate users. Also, any time the verifier receives an authentication request, he must send exactly the same helper data to the prover. More precisely, if the prover is an attacker and the helper sets sent to him in two requests differ in one point, then he has $K+1$ points that fit the polynomial, and he can compute the secret. In Subsection 4.4, we propose a solution which does not need the mentioned conditions.

Remark 13**.**

The attacker only knows the helper data, $M$. He can use any arbitrary decoding function $g(.)$ to estimate the secret, $\hat{S}$. His success probability is derived in the analysis of the soundness property in the following.

Now, we show the [math]-completeness, $\frac{1}{|\mathcal{S}|}$-soundness and [math]-privacy properties of the proposed SS-FR2 protocol.

$\mathit{0}$-completeness: The user $k$, having $(X_{k},Y_{k})$ and $M^{[k]}=\left\{(M_{1},f(M_{1})),\cdots,(M_{K},f(M_{K}))\right\}$, has access to $K+1$ points of the polynomial, and thus he derives the polynomial with Lagrange interpolation and computes $a_{0}$ [22]. So, $\hat{S}^{[k]}=S^{[k]}=a_{0}$ for all $k\in[K]$ and thus:

[TABLE]

This proves the [math]-completeness property of the scheme.

$\mathit{\frac{1}{|\mathcal{S}|}}$-soundness: Due to the information-theoretic secrecy of Shamir secret sharing, $M$ does not give any information about $S$ [22, 24], i.e., $I(S;M)=0$. This means that if the prover is an attacker, by observing $M$ ($K$ points of the polynomial), the attacker obtains no information about the secret. Considering that $S$ is uniformly distributed, we have:

[TABLE]

This proves $\frac{1}{|\mathcal{S}|}$-soundness property and means that the best possible attack strategy is to guess the secret.

$\mathit{0}$-privacy: Every legitimate user can compute $S^{[k]}$ correctly. So, $\hat{S}^{[1]}=\hat{S}^{[k]}$ for all $k\in[K]$. Further, the authentication query is the same for all users. Thus, $(\hat{S}^{[1]},S^{[1]},M^{[1]},V,Q^{[1]})\sim(\hat{S}^{[k]},S^{[k]},M^{[k]},V,Q^{[k]})$ for all $k\in[K]$, and [math]-privacy is satisfied.

Now, we compute the normalized total key rate of the proposed SS-FR2 protocol as,

[TABLE]

where (a) follows from the fact that $Y_{i}$ and $Z_{i}$, for $i\in[K]$, are chosen independently and uniformly at random, and (b) is obtained by considering that $X_{1},\cdots,X_{K}$ are chosen uniformly at random from all subsets of cardinality $K$ of the field $GF(q^{L})$. $\square$

Lemma 1**.**

The outer bound for $(R,R_{c})$ pair ($R$ in $q$-ary unit) is equal to:

[TABLE]

Proof:

Noting (4), we have:

[TABLE]

Indicating $R_{c}=\frac{1}{l_{c}}\leq 1$, the outer bound for $(R,R_{c})$ is shown in Fig. 3. $\square$

4.2 Proof of Theorem 2 (single-server, asymptotic regime)

We present the optimal single-server PA protocol for the asymptotic regime.

Converse: Noting $C_{k}\!=\!Y_{k}^{l}$, it is obvious that $R\!\leq\!\max_{p(y)}H(Y)$.

Achivability: The proof is based on the strong typicality [25]. We propose the achievable scheme for the single-server asymptotic regime (SS-AR) PA protocol, by defining the functions at CA, the verifier, and the legitimate users.

1. Key distribution phase: First, we describe the codebook generation at CA. Considering auxiliary random variables $X\in\mathcal{X}$ and $U\in\mathcal{U}$, fix a joint distribution $P_{UXY}(u,x,y)=P_{X}(x)P_{Y|X}(y|x)$ $P_{U|X}(u|x)$, i.e., $U\to X\to Y$ forms a Markov chain, such that $0<I(U;Y)\leq I(X;Y)=\mu$. Obtaining $P_{U}(u)=\sum_{x}P_{UX}(u,x)$ and fixing $\xi$ and $\xi^{\prime}$ such that $\xi>\xi^{\prime}>0$, form the set $\mathcal{J}$ by randomly and independently generating $2^{l\tilde{R}}$ sequences of $U^{l}$, each according to $\prod_{i=1}^{l}P_{U}(u_{i})$. Randomly partition the set $\mathcal{J}$ to $2^{lR^{\prime}}$ equal size subsets (bins). So, each bin contains $2^{l(\tilde{R}-R^{\prime})}$ sequences. Each sequence $U^{l}\in\mathcal{J}$ can be shown as $U^{l}(m,s)$, where $m$ is the bin index and $s$ is the index of sequence in the bin. The sequences $U^{l}(m,s)$ constitutes the codebook, which is revealed to every participant of the protocol (the verifier and both the legitimate users and attackers).

CA generates an i.i.d sequence $X^{l}$, from marginal distribution $P_{X}(x)$. Conditioned on $X^{l}$, randomly and conditionally independently, CA generates $K$ sequences $Y_{1}^{l},Y_{2}^{l},\cdots,Y_{K}^{l}$, each according to the conditional distribution $P_{Y|X}(y|x)$, i.e., $Y_{k}^{l}|X^{l}\sim\prod_{i=1}^{l}P_{Y|X}(y_{i}|x_{i})$ for $k\in[K]$. CA sets $C_{k}=Y_{k}^{l}$ and sends it to the user $k$.

2. Authentication phase: considering user $k$ as the prover:

S1: The prover asks for authentication from the verifier.

S2: CA sets $V=\{X^{l},Y_{1:K}^{l}\}$ and sends it to the verifier.

S3: The verifier finds a sequence $U^{l}(m,s)\in\mathcal{J}$ that is jointly typical with $X^{l}$, i.e., $(X^{l},U^{l}(m,s))\in\mathcal{T}^{l}_{\xi^{\prime}}(X,U)$. If no such sequence exists, the verifier chooses a sequence from $\mathcal{J}$ randomly. If there is more than one sequence, the verifier chooses one of them randomly. Then, the verifier sets $M^{[k]}=m$ and $S^{[k]}=s$. He sends $M^{[k]}$ to the prover.

S4: Having access to $Y_{k}^{l}$ and the bin index $M^{[k]}$, the prover looks for a sequence $\hat{U}^{l}$ in bin $M^{[k]}$ that is jointly typical with $Y_{k}^{l}$, i.e., $(\hat{U}^{l}(M^{[k]},\hat{s}),Y^{l})\in\mathcal{T}_{\xi}^{(l)}(U,Y)$. One of the following cases occur:

$\bullet$ There is only one sequence in bin $M^{[k]}$ that is jointly typical with $Y^{l}$ $\longmapsto$ the prover takes this sequence as $\hat{U}^{l}$.

$\bullet$ There is more than one sequence in bin $M^{[k]}$ that are jointly typical with $Y^{l}$ $\longmapsto$ the prover chooses one of these sequences randomly and sets the selected sequence as $\hat{U}^{l}$.

$\bullet$ There is no sequence in bin $M^{[k]}$ that is jointly typical with $Y^{l}$ $\longmapsto$ the prover chooses $\hat{U}^{l}$ at random from bin $M^{[k]}$.

The index $\hat{s}$ of $\hat{U}^{l}$ in bin $M^{[k]}$ is the output of the decoding function, i.e., $\hat{S}^{[k]}=\hat{s}$. The prover sends $\hat{S}^{[k]}$ to the verifier.

S5: The verifier checks if $\hat{S}^{[k]}=S^{[k]}$, to pass or reject the prover.

The above steps determine the variables of the verification process $\mathcal{P}^{\text{single}}$ in the SS-AR protocol.

An outline of the analysis of the constraints follows. The detailed analysis is provided in Appendix B.

For completeness, error occurs if $\hat{S}^{[k]}\neq S^{[k]}$. By setting $\tilde{R}>I(U;X)$, there are more than $2^{lI(U;X)}$ sequences in $\mathcal{J}$. Using covering lemma [26], with high probability the verifier finds a sequence $U^{l}$ that is jointly typical with $X^{l}$. On the other hand, by the law of large number (LLN), the prover finds a sequence $\hat{U}^{l}$ that is jointly typical with $Y_{k}^{l}$. By setting $\tilde{R}-R^{\prime}<I(U;Y)$ and due to packing lemma, with high probability the prover finds a unique sequence. This proves that $\lim_{l\to\infty}P_{e1}=0$.

The soundness property is derived by showing that as $l\!\!\to\!\!\infty$, we have $\frac{1}{l}I(S;M)\!\!\to\!\!0$ and using Lemma 2 in Appendix A.

If $\{\hat{S}^{[1]}=\hat{S}^{[k]}\}$, privacy is guaranteed. Thus, $\mathbb{P}[\hat{S}^{[k]}\neq\hat{S}^{[k]}]$ is an upper bound on the probability of the event that privacy is violated. Utilizing a similar technique used in the proof of completeness property, we show that the probability of $\{\hat{S}^{[1]}\neq\hat{S}^{[k]}\}$ tends to zero. Since the number of legitimate provers is finite, $K$, the probability of $\{\hat{S}^{[1]}\neq\hat{S}^{[k]}\}$ for $\forall k\in[K]$ tends to zero.

Now, we analyze the normalized total key rate:

[TABLE]

where (a) follows from the fact that $Y_{1}^{l},Y_{2}^{l},\cdots,Y_{K}^{l}$ are mutually independent conditioned on $X^{l}$ and (b) is derived by $Y_{k}^{l}|X^{l}\sim\prod_{i=1}^{l}P_{Y|X}(y_{i}|x_{i})$ for $k\in[K]$.

In the converse, we have shown that $R\leq\max_{p(y)}H(Y)$. The difference of $H(Y)$ and $H(Y|X)$ is equal to $I(X;Y)=\mu$. If $\mu\to 0$ and by fixing $p(y)$ such that $H(Y)$ equals its maximum, then $\mathfrak{C}^{\text{asy}}=H(Y)$ is achievable. $\mu\to 0$ means negligible correlation between $X$ and $Y$, which results in vanishing correlation between the keys of the users. $\square$

4.3 *Proof of Theorem 3 (multi-server, individual authentication, finite size regime) *

Here we consider the case of individual authentication, where the prover is connected to only one verifier and wants to be authenticated individually to that single verifier, who sends the helper data to the prover. Other verifiers do not contribute in the process of authentication. It must be emphasized that the prover has only one key, and uses this single key for authentication to any of the verifiers that he forms a feasible pair with.

Considering the feasible pair $(k,n^{\ast})$, the decoding and encoding functions follow:

scheme 1 of multi-server, finite size regime (MS-FR1) protocol ($R_{c}=1,R\leq\frac{1}{K}$):

1. Key distribution phase: CA chooses $\tilde{C}\in\mathcal{W}=GF(q)^{L}$ uniformly at random and sets $C_{k}=\tilde{C}$, $\forall k\in[K]$. The CA sends $C_{k}$ to user $k$.

2. Authentication phase: For each feasible pair, the authentication phase is similar to the authentication phase in scheme 1 (SS-FR1 protocol) in proof of Theorem 1. More precisely, CA sets $V_{n}=\tilde{C}$, the verifier $n^{\ast}$ sets $S_{n^{\ast}}^{[k]}=\tilde{C}$, and the prover (user $k$) sets $\hat{S}_{n^{\ast}}^{[k]}=C_{k}=\tilde{C}$. The steps of the authentication phase specify the variables of $\mathcal{P}^{\text{Multi}}$. It is worth emphasizing that, $V_{n}$, $Q_{n}^{[k]}$,$S_{n}^{[k]}$ and $\hat{S}_{n}^{[k]}$ are null for $n\in[n]\backslash\{n^{\ast}\}$. $M_{n}^{[k]}$ is null $\forall n\in[N]$.

The analysis of completeness and soundness properties is similar to SS-FR1, equations (8) and (9), respectively. Since every legitimate user sends exactly the same secret, $\tilde{C}$, privacy is preserved. The normalized total key rate can be computed according to (10).

scheme 2 of multi-server, finite size regime (MS-FR2) protocol ($R_{c}=\frac{1}{2}(i\geq 2),R\leq 1-R_{c}+\frac{R_{c}}{KL}\log_{q}P(q^{L}-1,K)$):

1. Key distribution phase: CA acts exactly the same as the key distribution phase in protocol SS-FR2, and sets the variables $X_{1:K},Y_{1:K},Z_{1:K}$. He sets $C_{k}=(X_{k},Y_{k},Z_{k})$ and send $C_{k}$ to user $k$, $\forall k\in[K]$.

2. Authentication phase:

S1: The prover sends authentication query $Q^{[k]}$ to the verifier $n^{\ast}$.

S2: CA chooses independently and uniformly at random $N$ variables $a_{0}^{(1)},a_{0}^{(2)},\cdots,a_{0}^{(N)}$ from the field $GF(q^{L})$. He sets $V_{n}=\left\{a_{0}^{(n)},C_{k}|k\in[K]\right\}$ and sends $V_{n}$ to the verifier $n$, $\forall n\in[N]$. As stated in Remark 12, $a_{0}^{(1)},\cdots,a_{0}^{(N)}$ cannot be changed in different verification processes. Thus, the CA can send $V_{1:N}$ to the verifiers once at the key distribution phase.

S3: The verifier $n^{\ast}$ sets $S^{[k]}_{n^{\ast}}=a_{0}^{(n^{\ast})}$. The verifier $n^{\ast}$ computes unique polynomial $f_{n^{\ast}}(.)$ of degree $d_{n^{\ast}}=|\mathcal{N}_{n^{\ast}}|$ that passes through $\left\{(0,a_{0}^{(n^{\ast})}),(X_{k},Y_{k})|k\in\mathcal{N}_{n^{\ast}}\right\}$. Then, he selects $d_{n^{\ast}}$ new points from $GF(q^{L})$, that is the verifier chooses at random $d_{n^{\ast}}$ distinct elements $M_{1}^{(n^{\ast})},M_{2}^{(n^{\ast})},\cdots,M_{d_{n^{\ast}}}^{(n^{\ast})}$ of $GF(q^{L})\backslash\{0,X_{k}|\,k\in\mathcal{N}_{n^{\ast}}\}$. The verifier computes the value of the polynomial at the new points and sets $M_{n^{\ast}}^{[k]}=\left\{(M_{1}^{(n^{\ast})},f_{n^{\ast}}(M_{1}^{(n^{\ast})})),\cdots,\right.$ $\left.(M_{d_{n^{\ast}}}^{(n^{\ast})},f_{n^{\ast}}(M_{d_{n^{\ast}}}^{(n^{\ast})}))\right\}$ and sends $M_{n^{\ast}}^{[k]}$ to user $k$.

S4: Knowing $M_{n^{\ast}}^{[k]}$ and $C_{k}$, the prover has access to $d_{n^{\ast}}\!+\!1$ distinct points of the polynomial $f_{n^{\ast}}(.)$ (of degree $d_{n^{\ast}}$), so he derives the polynomial, computes $\hat{S}_{n^{\ast}}^{[k]}=a_{0}^{(n^{\ast})}$, and sends it to the verifier.

S5: The verifier checks if $\hat{S}_{n^{\ast}}^{[k]}=S_{n^{\ast}}^{[k]}$.

These steps determine the variables of the verification process $\mathcal{P}^{\text{Multi}}$. Remarks 12 and 13 also apply here.

Considering (11) and (12), 0-completeness and $\frac{1}{|\mathcal{S}|}$-soundness are provided. Since every legitimate user can compute the secret correctly, (5) is satisfied with $P_{P}=0$ and 0-privacy is provided. $R=1-R_{c}+\frac{R_{c}}{KL}\log_{q}P(q^{L}-1,K)$ can be computed according to (13). $\square$

Remark 14**.**

Consider the case that user $k_{1}$ and user $k_{2}$ form feasible pairs with both verifier $n_{1}$ and verifier $n_{2}$. Assume that user $k_{1}$ requests authentication to both verifier $n_{1}$ and verifier $n_{2}$. After the execution of the protocol MS-FR2, user $k_{1}$ computes polynomials $f_{n_{1}}$ and $f_{n_{2}}$. User $k_{1}$ knows that the keys of the users that are both in the $\mathcal{N}_{n_{1}}$ and $\mathcal{N}_{n_{2}}$ (e.g., user $k_{2}$) are parts of the intersection of the polynomials $f_{n_{1}}$ and $f_{n_{2}}$. This violates the security of the keys of users if the space of this intersection is small. This problem can be solved if the polynomial and the secret change in each execution of the authentication protocol. However, changing the secrets and as a result, the polynomials can lead to security violation (the detailed discussion is provided in Subsection 5.2). The proposed protocol for the distributed version of the multi-server protocol in Subsection 4.4 solves this problem.

4.4 Proof of Theorem 4 (multi-server, distributed authentication, finite size regime)

Here, we consider the case of the multi-server scenario in which all the verifiers contribute in the process of authentication, and so authentication is done in a distributed manner, i.e., all the verifiers contribute in sending helper data to the prover. For this case, we propose an optimal interactive protocol, the distributed multi-server protocol in the finite size regime (DMS-FR), between the CA, the verifiers, and the prover that uses symmetric private information retrieval (SPIR) [21], to deliver the prover the desired data, without realizing the identity of the prover. DMS-FR is applicable in the condition that all the users are connecting to all the verifiers, i.e., $(k,n)$ forms a feasible pair $\forall k\in[K]$, $\forall n\in[N]$. For better understanding, first we present an example.

Example 1**.**

*Consider the case of two verifiers and three users ($N=2$, $K=3$), and $\mathcal{S}=\mathcal{C}=GF(23)$, i.e, $q=23$ and $L=1$. User $2$ wants to gain access to verifier $1$, and the following protocol is executed:

1. Key distribution phase: CA chooses uniformly at random from $GF(23)$ the variables $C_{1}=X_{1}=14$, $C_{2}=X_{2}=19$ and $C_{3}=X_{3}=6$. These are the keys of the users that can be used in any verification process.

2. Authentication phase:*

$\bullet$* User $2$ sends an authentication query to all verifiers. In addition to authentication request to verifier $1$, user $2$ sends queries to each verifier according to queries of SPIR (Appendix C) to retrieve his helper data.*

$\bullet$* CA chooses randomly from $GF(23)$, $S=5$ as secret, $R=1$ as common randomness (for SPIR algorithm) and $\tilde{Y}=1$. He also chooses randomly $\tilde{X}=15$ from $GF(23)\backslash\{0,X_{1},X_{2},X_{3}\}$. CA sends $X_{1}$, $X_{2}$, $X_{3}$, $S$, $R$, and $(\tilde{X},\tilde{Y})$ to both verifiers.*

$\bullet$* Both verifiers compute the unique polynomial of degree one that passes through $(0,S)$ and $(\tilde{X},\tilde{Y})$, which is equal to $f(X)=12X+5$. Then, both compute $Y_{k}=f(X_{k})$ for $k\in\{1,2,3\}$. Thus, $Y_{1}=12$, $Y_{2}=3$ and $Y_{3}=8$. The verifiers store these variables. Then according to the requests that user $2$ has sent to each verifier and the SPIR algorithm, using common variable $R$, the verifiers send answers to the user such that he can retrieve $Y_{2}=3$ privately without gaining any information about $Y_{1}$ and $Y_{3}$. Verifier 1, also, sends $(\tilde{X},\tilde{Y})=(15,1)$ to user $2$.*

$\bullet$* User $2$ computes the unique polynomial that passes through $(X_{2},Y_{2})=(19,3)$ and $(\tilde{X},\tilde{Y})=(15,1)$, that is equal to $f(X)=12X+5$. Thus user $2$ can compute $S=f(0)=5$. He sends $S=5$ to verifier $1$.*

Converse: According to Lemma 1, $R\leq 1$ in $q$-ary unit and $R_{c}=\frac{1}{l_{c}}\leq 1$.

Achievability: We describe DMS-FR for $l_{c}=1$, but any $l_{c}$ is achievable by enlarging the space of variables $l_{c}$ times.

Proof outline: In one hand, the verifiers must not gain any information about the identity of the user by observing the requests for helper data (privacy constraint), and on the other hand, it is desired that the users cannot compute the keys of other users observing the helper data. Thus, the proposed DMS-FR protocol uses SPIR to privately deliver the desired data to the prover. Here, the verifiers have the role of the servers with replicated data ($X_{1},X_{2},\cdots,X_{K})$. In each verification process, the verifiers compute $Y_{k}=f(X_{k}),\,\forall k\in[K]$, where $f(.)$ is a degree one polynomial specified by the CA. So, $(Y_{1},Y_{2},\cdots,Y_{K})$ are stored in all the verifiers. SPIR is run between user $k$ and the verifiers, such that the user can attain $Y_{k}$ privately, without gaining any information about $Y_{-k}$, where $Y_{-k}=(Y_{1},Y_{2},\cdots,Y_{k-1},Y_{k+1},\cdots,Y_{K})$. In addition to $Y_{k}$, another point on $f(.)$ is sent to the user as helper data. Using this point, $Y_{k}$, and $X_{k}$, known to the user as his personal key, the user can compute $f(.)$, and thus he can compute the secret. The detailed steps of the protocol are as follows:

1. Key distribution phase: The CA chooses $X_{1},\cdots,X_{K}$ from the field $\mathcal{C}=GF(q^{L})$, independently and uniformly at random. It is worth noting that in this protocol, the condition that $X_{k}$’s must be distinct is not necessary. Then, CA sends $X_{k}$ to the $k$-th legitimate user, $C_{k}=X_{k}$.

2. Authentication phase: in each verification process:

S1: User $k$ privately generates a random variable $\mathcal{F}$. This variable is not available to the verifiers and represents the randomness in the strategies followed by the user in the SPIR protocol [21, Theorem 3] (described in Appendix C). For $n\in[N]$, user $k$ sends authentication query $Q_{n}^{[k]}$ to verifier $n$ according to SPIR, to ask the verifiers to send $M_{n}^{[k]}$ for him in a manner to retrieve his specified data without revealing his identity555Considering the equivalence between $GF(q^{L})$ and $\mathbb{F}_{q}^{L}$ SPIR can be executed.. More precisely, user $k$ sends queries in a way that he can retrieve the desired data with index $k$, without revealing $k$ to any of the verifiers. His query to verifier $n^{\ast}$ also includes a request for authentication.

S2: The CA chooses $S$, randomly from the field $GF(q^{L})$ as secret, and the point $(\tilde{X},\tilde{Y})$ where $\tilde{X}\in GF(q^{L})\backslash\{0,X_{k}|\,k\in[K]\}$ and $\tilde{Y}\in GF(q^{L})$ are chosen independently and uniformly at random. Also CA generates a common random variable $R\in\mathbb{F}_{q}$. CA sends $\left\{X_{1:K},S,R,(\tilde{X},\tilde{Y})\right\}$ to all the verifiers.

S3: Each verifier generates the unique polynomial $f(.)$ of degree one that passes through $\{(0,S),(\tilde{X},\tilde{Y})\}$ and computes $Y_{k}=f(X_{k})$ for $k\in[K]$. $Y_{1}\!,\!\cdots\!,\!Y_{K}$ are the replicated data stored in all the verifiers, $R$ is the common shared randomness between the verifiers and the prover wants to retrieve $Y_{k}$ privately. According to $Q_{n}^{[k]}$ and $R$, using SPIR [21, Theorem 3], verifier $n$ generates answers $A_{n}^{[k]}$. The queries and the answers have the following properties:

[TABLE]

The verifier $n^{\ast}$ sets $S_{n^{\ast}}^{[k]}=S$, and sends $(\tilde{X},\tilde{Y})$ in addition to $A_{n^{\ast}}^{[k]}$ as helper data. More precisely, $M_{n}^{[k]}=A_{n}^{[k]}$ for $n\in[N]\backslash\{n^{\ast}\}$ and $M_{n^{\ast}}^{[k]}=\{A_{n^{\ast}}^{[k]},(\tilde{X},\tilde{Y})\}$.

S4: According to equation (32), user $k$ can compute $Y_{k}$ using $A_{1:n}^{[k]}$ correctly. Thus, user $k$ knows $(\tilde{X},\tilde{Y})$ and $(X_{k},Y_{k})$. So, he can compute the polynomial $f(.)$ and thus he can find the secret. The prover sends the estimated secret $\hat{S}_{n^{\ast}}^{[k]}$ to the verifier $n^{\ast}$.

S5: If $\hat{S}_{n^{\ast}}^{[k]}=S_{n^{\ast}}^{[k]}$ the verifier accepts the prover as a legitimate user.

These steps determine the variables of $\mathcal{P}^{\text{Multi}}$. Now we analyze completeness, soundness, and privacy conditions.

$\mathit{0}$-Completeness: User $k$ has $X_{k}$ as his own personal key. In each verification process, he obtains $Y_{k}$ performing SPIR and $(\tilde{X},\tilde{Y})$ as a helper data. Thus, he has two points of a polynomial of degree one, and he can compute the polynomial and also the secret. So regardless of the verifier $\hat{S}_{n^{\ast}}^{[k]}=S_{n^{\ast}}^{[k]}$ for $k\in[K]$ and each legitimate user can compute the secret correctly. Thus:

[TABLE]

This proves the [math]-completeness property of the scheme.

$\mathit{\frac{1}{|\mathcal{S}|}}$-Soundness: In each verification process, the attacker can obtain $(\tilde{X},\tilde{Y})$ and $Y_{k}$, where $k$ is the index he masquerades with. But, since he has no information about $X_{k}$ (can be any element of the field $GF(q^{L})$), he cannot gain any information about the secret, i.e., $I(S;M)=0$. Considering that $S$ is uniformly distributed), we have:

[TABLE]

This proves the $\frac{1}{|\mathcal{S}|}$-soundness property and means that the best possible attack strategy is guessing the secret.

$\mathit{0}$-Privacy: Every legitimate user can compute the secret correctly and since SPIR protocol is performed (equation (16)) the verifiers cannot detect the index of the prover through queries they received, Thus $\forall k,k_{1}\in[K]$ and $\forall n\in[N]$:

[TABLE]

and [math]-Privacy is satisfied.

Now we can compute the normalized total key rate of the proposed protocol in $q$-ary unit as:

[TABLE]

where (a) and (b) are obtained by considering $X_{1},\cdots,X_{K}$ are chosen uniformly at random from the field $GF(q^{L})$. $\square$

Remark 15**.**

In the DMS-FR protocol, any number (more than two) of the verifiers can participate (in the SPIR algorithm), but the larger the number of the verifiers the lower the total data rate between the verifiers and the prover [21]. On the other hand, the smaller the number of the verifiers the lower the total data rate between the CA and the verifiers (because the CA sends $V_{n}$ to the smaller set of the verifiers).

4.5 Proof of Theorem 5 (multi-server, individual authentication, asymptotic regime)

Here, the multi-server asymptotic version of the PA protocol is considered, i.e., all the variables of the protocol are sequences of length $\Theta(l)$ for arbitrary large $l$.

Converse: For converse, it is obvious that $R\leq\max_{p(y)}H(Y)$.

Achivability: The proof is mostly similar to the proof of Theorem 2. The main difference is that the key of the user $k$ must be correlated to the data available at all the verifiers that he forms feasible pair with. The proposed achievable scheme in the multi-server in the asymptotic regime, (MS-AR) PA protocol, is as follows:

1. Key distribution phase: Considering auxiliary random variables $X_{1},X_{2},\cdots,X_{N}\in\mathcal{X}$ and $U_{1},...,U_{N}\in\mathcal{U}$, fix a joint distribution $P_{U_{1:N}X_{1:N}Y}(u_{1:N},x_{1:N},y)=$ $\prod_{n=1}^{N}\left(P_{X_{n}}(x_{n})P_{U_{n}|X_{n}}(u_{n}|x_{n})\right)P_{Y|X_{1:N}}(y|x_{1:N})$, such that $0<I(U_{n};Y)\leq I(X_{1:N};Y)=\mu,\,\forall n\in[N]$. Fixing $\xi$ and $\xi^{\prime}$ such that $\xi>\xi^{\prime}>0$ and for each $n\in[N]$, obtaining marginal distributions $P_{U_{n}}(u_{n})$, form the sets $\mathcal{J}_{n}$ by randomly and independently generating $2^{l\tilde{R}_{n}}$ sequences of $U_{n}^{l}$, each according to $\prod_{i=1}^{l}P_{U_{n}}(u_{n_{i}})$. Randomly partition each set $\mathcal{J}_{n}$ to $2^{lR^{\prime}_{n}}$ equal size subsets (bins). So, each bin contains $2^{l(\tilde{R}_{n}-R^{\prime}_{n})}$ sequences. Each sequence $U_{n}^{l}\in\mathcal{J}_{n}$ can be shown as $U_{n}^{l}(m_{n},s_{n})$, where $m_{n}$ is the bin index and $s_{n}$ is the index of sequence in the bin $m_{n}$. The sequences $U_{n}^{l}(m_{n},s_{n})$ constitutes the codebooks, and are revealed to every participant of the protocol. From each marginal distribution $P_{X_{n}}(x_{n})$, CA generates i.i.d sequence $X_{n}^{l}$. Denoting $X_{\mathcal{N}^{[k]}}^{l}=\{X_{n}^{l}|n\in\mathcal{N}^{[k]}\}$. For each $k\in[K]$, generate the sequence $Y_{k}^{l}$ according to the conditional distribution $P_{Y|X_{\mathcal{N}^{[k]}}}$, i.e., $Y_{k}^{l}|X_{\mathcal{N}^{[k]}}^{l}\sim\prod_{i=1}^{l}P_{Y|X_{\mathcal{N}^{[k]}}}(y_{i}|x_{\mathcal{N}^{[k]}_{i}})$. CA sends $C_{k}=Y_{k}^{n}$ to the user $k$ for $k\in[K]$.

2. Authentication phase: Verifier $n$ acts similar to SS-AR using $U_{n}^{l}(m_{n},s_{n})$ as codebook. The prover proves that his key, $Y_{k}^{l}$, is correlated to the $n$-th verifier’s sequence $X^{l}_{n}$ using codebook $U_{n}^{l}(m_{n},s_{n})$ and helper data $m_{n}$ that the verifier $n$ sends to him the same as SS-AR.

The analysis of probabilities of error is the same as SS-AR protocol, and for completeness the conditions $\tilde{R}_{n}>I(U_{n};X_{n})$ and $\tilde{R}_{n}-R^{\prime}_{n}<I(U_{n};Y)$ must be satisfied.

The normalized total key rate of the proposed scheme is:

[TABLE]

In the converse we showed that $R\leq\max_{p(y)}H(Y)$. The difference of $H(Y)$ and $H(Y\!|\!X_{1:N})$ is equal to $I(X_{1:N}\!;\!Y)\!=\!\mu$. Thus, if $\mu\!\to\!0$ and by fixing $p(y)$ such that $H(Y)$ reaches its maximum, the optimal rate $\mathfrak{C}^{\text{asy}}\!=\!H(Y)$ is achievable. $\square$

5 Comparison and concluding remarks

In this section, we first compare the proposed protocols and then we introduce some notable remarks.

5.1 Comparison

In this subsection, first, we compare the protocols in the finite size and asymptotic regimes. Then, the differences and properties of individual authentication and distributed authentication are discussed.

**Finite size vs asymptotic

**In the finite size regime, the variables are elements of finite fields, but the variables in the asymptotic regime are sequences of length $\Theta(l)$, for arbitrary large $l$. Although, all the protocols proposed for the finite size regime are practical, the SS-FR and MS-FR protocols are not optimal. Thus, the SS-AR and MS-AR protocols (in asymptotic regime) are proposed to show that optimal protocols are achievable. Individual vs distributed

The main difference between these two authentication methods is how the CA and the verifiers cooperate jointly to privately authenticate the prover. In the individual case in each verification process, the prover is connected to only one verifier and that one verifier sends the helper data to the prover. Also, except the only time that the CA sends the keys of users (in the MS-FR1), the secret and the keys of the users (in the MS-FR2) and $X_{n}^{l}$ and the keys of the users (in the MS-AR) to the verifiers, there is no need for data exchange between the CA and the verifiers in any verification process. In the distributed case, the prover is connected to all (or some) of the verifiers and these verifiers send helper data to the prover. In the DMS-FR protocol, there is a permanent interaction between the CA and the verifiers in the process of authentication. In the following some other differences between MS-FR/MS-AR and DMS-FR are stated:

$\bullet$ DMS-FR is proposed for the case that all the users are making feasible pairs with all the verifiers, however MS-FR and MS-AR protocols are feasible for any connection structure.

$\bullet$ As stated in Remark 14, in the MS-FR2 protocol, the users can gain information about other users’ keys (the space of the estimated keys may be small). Thus, security of the keys is not provided. However, in the DMS-FR, because of the changes of the polynomial and the secret in each verification process, the users cannot gain any information about other users’ keys. This happens because if a user wants to gain information about other users’ keys, he acts exactly the same as an attacker, which his functionality is analyzed in soundness property in Theorem 4.

$\bullet$ The size of the keys are smaller in the DMS-FR compared with the MS-FR2 protocol for a fixed $P_{e2}$-soundness constraint. For example for $P_{e2}=\frac{1}{q^{L}}$, in DMS-FR $C_{k}\in GF(q^{L})$, but in MS-FR2, $C_{k}\in GF(q^{L})^{2}$.

$\bullet$ The complexity of computing secret in the DMS-FR protocol is far less than the MS-FR2 protocol. Since in the DMS-FR protocol, the participants compute a polynomial of degree one, but in the MS-FR2 protocol, the polynomial of verifier $n$ is of degree equal to $|\mathcal{N}_{n}|$.

Remark 16**.**

Some extra services are available in DMS-FR; however, none of the MS-FR1, MS-FR2, and MS-AR can provide these services. The detailed discussion is stated in Subsection 5.2.

5.2 Extra Services

Some extra services can be considered in PA protocol, which we describe in the following. While these services are not central to the protocol, they can strengthen the performance of the protocol. We discuss which of the proposed protocols in Section 4 provide each extra service.

Auditing: This service enables the CA to recognize the prover. There are systems and services that the CA is required to recognize the prover, e.g., to identify the malicious behavior. More precisely, auditing means while the verifier (verifiers) cannot distinguish the index of the prover (i.e., legitimate user), the CA can distinguish the index of the legitimate user by observation of the verification process. Noting that the CA observes the entire process and $C,Q_{1:N}^{[\theta]},S_{1:N}^{[\theta]},M_{1:N}^{[\theta]},\hat{S}_{1:N}^{[\theta]},V$ variables, this means,

[TABLE]

where $\theta$ is uniformly and randomly chosen from $[K]$.

$\bullet$ SS-FR1, SS-FR2, SS-AR, MS-FR1, MS-FR2 and MS-AR: In these protocols, each legitimate prover sends the same secret key in any verification process. Moreover, the authentication query is just a request for authentication and thus, there is no difference between the users. So, neither the verifier nor the CA can detect the ID of the legitimate prover. Thus auditing is not provided.

$\bullet$ DMS-FR: Since CA has access to all of the verifiers, he has access to $Q_{1:N}^{[k]}$, considering the prover is user $k$. More precisely, in SPIR, if one has access to all the queries sent from the prover he can recognize the index of the data the prover asks for. Thus, the CA can recognize the index $"k"$ and (21) is satisfied.

Addition and deletion of users: This service means that the set of users, $[K]$, and its partitioning in the multi-server scenario can be changed in each verification process. In general, this service enables the CA to update the list of users (add or delete a user) and its partitioning in each verification process without information leakage (to the attackers or other users) of secret variables of the protocol.

$\bullet$ SS-FR1 and MS-FR1: It is possible to add a new user, by sending the common key, $\tilde{C}$, to him. Deleting a user is only possible by re-running the key distribution phase and generating a new $\tilde{C}$, such that the deleted user does not have access to it.

$\bullet$ SS-FR2 and MS-FR2: This property cannot be provided. Adding and deleting a user change the unique polynomial that passes through the keys of the legitimate users. The intersection points of the polynomial before deleting or adding a user and the new polynomial are the keys $(X_{k},Y_{k})$ of the other users. Thus, this can reveal the keys. Of course, only legitimate users can compute the polynomials, and as a result the keys of other users.

$\bullet$ SS-AR and MS-AR: It is possible to add a new legitimate user, user $K+1$, by generating $Y_{K+1}^{n}$ using appropriate conditional distribution the same as the process of generating other keys (key distribution phase in the proof of Theorems 2 and 5). But for the deletion of a user, the entire key distribution phase must be re-run to generate new $X^{n}$ and new keys for other users. As a result, the key of the deleted user is not jointly typical with new $X^{n}$ (with high probability), and thus the deleted user cannot compute the new secret.

$\bullet$ DMS-FR: Both addition and deletion of users can be provided in this protocol. Since the degree one polynomial function, $f(.)$, in each verification process does not depend on the keys of users, addition and deletion of the keys do not leak any information. In other words, if CA wants to add a user to the protocol, he should select a key randomly, update the list of the keys, and announce this update to all the verifiers. On the other hand, if the CA wants to delete a user, he declares to the verifiers to delete that user’s key.

Expiring secret: This condition implies that the secret must be changed in each verification process. The reason behind this is that the legitimate user might be intended to reveal the secret since their own personal keys are immune. In addition, in the verification process or secret storing, the secret might be exposed. Thus, if in each verification process, the secret changes, the security of the protocol is enhanced.

$\bullet$ SS-FR1 and MS-FR1: Since the secret is equal to $\tilde{C}$, key of all users, it is not possible to change the secret in each verification process.

$\bullet$ SS-FR2 and MS-FR2: Changing the secret in each verification process means changing the unique polynomial, similar to the condition in addition and deletion service, and by detecting the intersection points of these polynomials the users can get $(X_{k},Y_{k})$ of other users. So this property is not provided.

$\bullet$ SS-AR and MS-AR: In this protocol changing the secret in each verification process means changing $X^{n}$ and as a result changing the keys of the users. So, the expiring secret feature is not provided.

$\bullet$ DMS-FR: As stated in the protocol in each verification process the CA chooses a secret at random. So, the secret changes in every verification process and this feature is available.

5.3 Additional Attacks

We consider the following attacks in addition to two attacks that are considered in the system framework, 1) the (semi-honest) verifier wants to violate privacy, 2) an attacker wants to be authenticated illegally. We analyze the resistance of our proposed protocols against these attacks.

Colluding legitimate users: Legitimate users collude to gain information about other users’ keys.

$\bullet$ SS-FR1 and MS-FR1: Since the keys of all users are the same, this attack is not valid.

$\bullet$ SS-FR2 and MS-FR2: Colluding legitimate users cannot get any information beyond the unique polynomial. So they cannot get additional information about other users’ keys by colluding, and the protocol is resistant against this attack.

$\bullet$ SS-AR and MS-AR: Since the keys of the legitimate users have some common information, colluding users can gain some information about other users’ keys.

$\bullet$ DMS-FR: Each authentication request means a new verification process and as a result, a new secret and a new polynomial. Thus colluding legitimate users have access to secret and polynomials that are independent from each other, so they cannot get any additional information by colluding. If a legitimate user wants to attack the protocol to violate secrecy, his performance is like an attacker, that his success probability is computed in (19).

Malicious Verifier: We have considered semi-honest verifiers, who follow the protocol. But, in a stronger attack scenario, it is possible that the verifiers do not follow the protocol and send helper data in a way to violate the privacy of the prover or disrupt the process of authentication. In this situation, the verifier may send incorrect helper data to distinguish the identity of the legitimate prover or disrupt the authentication process.

$\bullet$ SS-FR1 and MS-FR1: No helper data is sent in these schemes, thus, this attack is not valid and cannot be occurred.

$\bullet$ SS-FR2, and MS-FR2: There are two possibilities for the malicious verifier action:

The malicious verifier can include the key of one or some of the users in the helper data. More precisely, $C_{k_{1}},C_{k_{2}},\cdots,C_{K_{j}}\subset C$ can be part of helper data. In this case, if the prover is one of $K_{1},K_{2},\cdots,K_{j}$, he has $K$ points of the polynomial, so he cannot compute the polynomial and cannot be authenticated as a legitimate user. However, from the viewpoint of the verifier, there is no difference between this user and an attacker. So, the verifier cannot violate the privacy of the user. Of course, the user realized that the verifier does not follow the protocol and can report. On the other hand, if the prover is not any of $K_{1},K_{2},\cdots,K_{j}$, authentication continues and the verifier realizes that the prover is one of the $[K]\backslash\{K_{1},K_{2},\cdots,K_{j}\}$. 2. 2.

The malicious verifier can send completely wrong helper data. In this case, the verifier can check that with which key the estimated secret is computed and detect the user.

These protocols cannot overcome this attack, unless CA himself produces helper data, sends the helper data to the verifier and forces the verifier to send this helper data.

$\bullet$ SS-AR and MS-AR: This means that the verifier sends the wrong bin index. These protocols cannot overcome this attack, unless CA himself produces helper data, sends the helper data to the verifier and forces the verifier to send the correct helper data.

$\bullet$ DMS-FR: If the malicious verifier is any verifier except $n^{\ast}$, since the estimated secret is not sent to him, he cannot detect the index of the user and violate privacy. However, the prover cannot estimate the secret correctly. If the malicious verifier is $n^{\ast}$, he can send $\bar{X}$ and $\bar{Y}$ in such a way to distinguish the index of user and privacy is violated. The protocol cannot overcome any of these situations.

Colluding verifiers: Verifiers collude to detect the prover’s identity and violate privacy. It is worth mentioning that this attack is possible in the multi-server scenario.

$\bullet$ MS-FR1, MS-FR2, and MS-AR: In these protocols, in each verification process only one verifier is participating. Thus, this attack is not feasible.

$\bullet$ DMS-FR: Colluding verifier can get some information about the index of the data requested by the prover and thus, they may gain some information about the prover’s identity. To overcome this attack a $T$-collude SPIR algorithm according to [27] can be performed, which is resistant against colluding of $T$ verifiers.

5.4 Distributed Authentication for any Structure

The proposed DMS-FR PA protocol is feasible for the cases that all the verifiers are connected to all the provers. Solving the distributed authentication problem in the multi-server PA protocol scenario for any desired connection structure between the provers and the verifiers is of interest. Of course, in the case that for each prover, there exist at least two verifiers such that the prover forms feasible pair with them, $\mathcal{N}^{[k]}$, and $\forall k\in[K]$, we have $A^{[k]}=\{\bigcap_{n\in\mathcal{N}^{[k]}}\mathcal{N}_{n}\}\backslash\{k\}\neq\emptyset$, similar protocol to DMS-FR can be used as a solution. In the solution, when user $k$ requests authentication, only the verifiers in $\mathcal{N}^{[k]}$ collaborate in the process of authentication (especially the SPIR algorithm). In this case, considering user $k$, privacy is satisfied between $k$ and provers in $A^{[k]}$.

5.5 Key-sharing

In the finite size regime, by repeating the verification process $t$ times to improve security (soundness), then the achievable region can be defined in a real-valued alphabet. Then asymptotically using key-sharing, the lower convex of the achievable points can be achieved. Inspired by time-sharing, we propose key-sharing scheme, where if any two points $(R_{1},{R_{c}}_{1})$ and $(R_{2},{R_{c}}_{2})$ are achievable, then the line connecting them is achievable, too.

Appendix A

Lemma 2**.**

If $I(U;J)\leq\alpha$, where $U\in\mathcal{U}$ and $J\in\mathcal{J}$, then $\mathbb{P}[U=g(J)]\leq\frac{1+\alpha+\log|\mathcal{U}|-H(U)}{\log|\mathcal{U}|}$, with $g:\mathcal{J}\to\mathcal{U}$ be any arbitrary function.

Proof:

Let $\hat{U}=g(J)$. Using Fano’s inequality, we have

[TABLE]

On the other hand, since $U\to J\to\hat{U}$ forms a Markov chain and $I(U;J)\leq\alpha$, we obtain $I(U;\hat{U})\leq\alpha$, and thus:

[TABLE]

Combining (22) and (23), we have:

[TABLE]

and noting that $1-\mathbb{P}[U\neq\hat{U}]=\mathbb{P}[U=\hat{U}]$, we obtain:

[TABLE]

$\square$

Appendix B Probability of error analysis of Theorem 2

To complete the proof, here we have to show that in the proposed SS-AR protocol $P_{e1}$, $P_{e2}$, and $P_{P}$ tends to zero as $l$ goes to infinity.

Completeness: The verifier rejects ($\hat{\mathcal{H}}=1$) the legitimate prover (user $k$, $\mathcal{H}=1$) if $\hat{S}^{[k]}\neq S^{[k]}$, and this may happen if either of the following events occurs:

$E_{1}$: The verifier does not find a sequence $U^{l}$ that is jointly typical with $X^{l}$. 2. 2.

$E_{2}$: User $k$ does not find a sequence $\hat{U}^{l}$ that is jointly typical with $Y_{k}^{l}$. 3. 3.

$E_{3}$: User $k$ finds more than one sequence $\hat{U}^{l}$ in bin $M^{[k]}$ that is jointly typical with $Y_{k}^{l}$.

Using the union bound, we obtain:

[TABLE]

By covering lemma [26], if $\tilde{R}\geq I(X;U)+\varphi(\xi^{\prime})$ (there are more than $2^{lI(U;X)}$ sequences in $\mathcal{J}$), $\mathbb{P}[E_{1}]\to 0$ when $l\to\infty$. Also, using LLN and the fact that $\xi>\xi^{\prime}$, $\mathbb{P}[E_{2}\cap E_{1}^{c}]\to 0$ as $l\to\infty$. And if $\tilde{R}-R^{\prime}\leq I(U;Y)-\varphi(\xi)$ (there exist less than $2^{lI(U;Y)}$ sequences in bin $M^{[k]}$), according to packing lemma [26], $\mathbb{P}[E_{3}\cap E_{1}^{c}]\to 0$ for large enough $l$. $\varphi(\xi)$ and $\varphi(\xi^{\prime})$ are functions of $\xi$ and $\xi^{\prime}$, respectively, that goes to [math] as $\xi,\xi^{\prime}\to 0$. So, by setting $\tilde{R}=I(X;U)+\varphi(\xi^{\prime})$ and $R^{\prime}=I(X;U)-I(U;Y)+\varphi(\xi)+\varphi(\xi^{\prime})$, we obtain:

[TABLE]

This proves the completeness property of the proposed scheme.

Soundness: From [17, (31)], we have $I(S;M)\leq l(\varphi(\xi^{\prime})+\zeta)$, where $\zeta$ is a function of $\xi^{\prime}$ and goes to [math] as $l\to\infty$. This means that the data the verifier sends to the prover contains negligible information about the secret on average. Substituting $\alpha=l(\varphi(\xi^{\prime})+\zeta)$ in Lemma 2, we conclude that $\mathbb{P}[S=\hat{S}]\leq\frac{1+l(\varphi(\xi^{\prime})+\zeta+\log|\mathcal{S}|-H(S))}{\log|\mathcal{S}|}$. Since $S$ ranges from $1$ to $2^{l(I(U;Y)-\varphi(\xi))}$, we have $\log|\mathcal{S}|=l(I(U;Y)-\varphi(\xi))$ and using [17, (30)], $H(S)\geq l\left(I(U;Y)-\varphi(\xi)-\varphi(\xi^{\prime})-\zeta\right)$. Thus:

[TABLE]

Since $\xi,\xi^{\prime}\to 0$, we have $\lim_{l\to\infty}\frac{(2\zeta+2\varphi(\xi^{\prime}))}{(I(U;Y)-\varphi(\xi))}\to 0$, and the soundness property is proved.

Privacy: Now we analyze $P_{p}$-privacy property of the suggested protocol. First, we define the event $E$ as:

[TABLE]

If event $E$ occurs with probability $1$, we have perfect privacy. Now we consider the case that $E$ does not occur.

[TABLE]

where (a) follows from the fact that if $(V,Q^{[1]},S^{[1]},M^{[1]},\hat{S}^{[1]})\nsim(V,Q^{[k]},S^{[k]},M^{[k]},\hat{S}^{[k]})$, then $\hat{S}^{[1]}\neq\hat{S}^{[k]}$ (while there may exist situations that $\hat{S}^{[1]}\neq\hat{S}^{[k]}$ but $(V,Q^{[1]},S^{[1]},M^{[1]},\hat{S}^{[1]})\sim(V,Q^{[k]},S^{[k]},M^{[k]},\hat{S}^{[k]})$), and (b) is obtained using union bound. Now, for a fixed $k$ we compute $\mathbb{P}[\hat{S}^{[1]}\neq\hat{S}^{[k]}]$. $\{\hat{S}^{[1]}\neq\hat{S}^{[k]}\}$ may happen in the following cases:

• •

$P_{1}$: The verifier does not find a sequence $U^{l}$ that is jointly typical with $X^{l}$.

• •

$P_{2}$: Both user $1$ and user $k$ do not find a sequence $\hat{U}^{l}$ that is jointly typical with $Y_{1}^{l}$ and $Y_{k}^{l}$, respectively.

• •

$P_{3}$: User $1$ finds a unique $\hat{U}^{l}$ that is jointly typical with $Y_{1}^{l}$, but user $k$ does not find a sequence $\hat{U}^{l}$ that is jointly typical with $Y_{k}^{l}$.

• •

$P_{4}$: User $k$ finds a unique $\hat{U}^{l}$ that is jointly typical with $Y_{k}^{l}$, but user $1$ cannot find a sequence $\hat{U}^{l}$ that is jointly typical with $Y_{1}^{l}$.

• •

$P_{5}$: User $1$ finds a unique $\hat{U}^{l}$ that is jointly typical with $Y_{1}^{l}$, but user $k$ finds more than one sequence $\hat{U}^{l}$ that is jointly typical with $Y_{k}^{l}$.

• •

$P_{6}$: User $1$ does not find a sequence $\hat{U}^{l}$ that is jointly typical with $Y_{1}^{l}$, but user $k$ finds more than one sequence $\hat{U}^{l}$ that is jointly typical with $Y_{k}^{l}$.

• •

$P_{7}$: User $k$ finds a unique $\hat{U}^{l}$ that is jointly typical with $Y_{k}^{l}$, but user $1$ finds more than one sequence $\hat{U}^{l}$ that is jointly typical with $Y_{1}^{l}$.

• •

$P_{8}$: User $k$ does not find a sequence $\hat{U}^{l}$ that is jointly typical with $Y_{k}^{l}$, but user $1$ finds more than one sequence $\hat{U}^{l}$ that is jointly typical with $Y_{1}^{l}$.

• •

$P_{9}$: Both user $1$ and user $k$ find more than one sequence $\hat{U}^{l}$ that is jointly typical with $Y_{1}^{l}$ and $Y_{k}^{l}$, respectively.

Using union bound, we have:

[TABLE]

It should be considered that there are $2^{l(I(U;X)+\varphi(\xi^{\prime}))}$ of $U^{l}$ sequences in $\mathcal{J}$ and there are $2^{l(I(U;Y)-\varphi(\xi))}$ of $U^{l}$ sequences in each bin. As a result, by covering lemma, $\mathbb{P}[P_{1}]\to 0$. By LLN, $\mathbb{P}[P_{2}]$, $\mathbb{P}[P_{3}]$, and $\mathbb{P}[P_{4}]$ go to zero when $l$ is sufficiently large. By packing lemma and LLN, $\mathbb{P}[P_{i}]$ for $i\in\{5,6,7,8,9\}$ tends to zero as $l\to\infty$. So, we conclude:

[TABLE]

and since $K$ is fixed:

[TABLE]

and

[TABLE]

This completes privacy property. $\square$

Appendix C Symmetric Private Information Retrieval

Here, we describe the SPIR protocol presented in [21] and is used in our proposed DMS-FR protocol.

Consider $K$ independent messages, $Y_{1},Y_{2},\cdots,Y_{K}$, and $N$ servers that each stores all the messages. The user $\theta$ wishes to retrieve $Y_{\theta}$ privately, and the servers do not want the user to get any information beyond the desired message, $Y_{\theta}$ (database privacy). The user generates a random variable $\mathcal{F}$ privately. This random variable represents the randomness in the strategies followed by the user, and its realization is not available to the servers. The servers share a common random variable $R$ that is unknown to the user, to achieve database privacy. An example of the SPIR problem is illustrated in Fig. 4.

In order to retrieve message $Y_{k},\,k\in[K]$ privately, the user privately generates $N$ queries $Q_{1}^{[k]},\cdots,Q_{N}^{[k]}$,

[TABLE]

The user sends $Q_{n}^{[k]}$ to the $n$-th server, $n\in[N]$. Upon receiving $Q_{n}^{[k]}$, the $n$-th server generates an answer sequence $A_{n}^{[k]}$, which is a function of $Q_{n}^{[k]}$, all messages $Y_{1},\cdots,Y_{K}$, and the common randomness $R$,

[TABLE]

The $n$-th server returns $A_{n}^{[k]}$ to the user. The user decodes $Y_{k}$ using the information available to him, $A_{1:N}^{[k]},Q_{1:N}^{[k]},\mathcal{F}$, according to a decoding rule specified by the SPIR scheme, that is:

[TABLE]

where $H(Y_{k})=Ll_{k},\,k\in[K]$.

To protect the users’ privacy, K strategies must be indistinguishable from the perspective of any individual server:

[TABLE]

To protect the privacy of database, the user must not get any information beyond his desired message, thus:

[TABLE]

where $Y_{-k}=Y_{1},\cdots,Y_{k-1},Y_{k+1},\cdots,Y_{K}$.

For detailed description of the SPIR problem and its scheme, please refer to [21].