Information Theoretic Security for Broadcasting of Two Encrypted Sources under Side-Channel Attacks

TL;DR

This paper investigates the security of broadcasting two encrypted sources against side-channel attacks, providing conditions for exponential decay of information leakage using information-theoretic methods.

Contribution

It introduces a post encryption coding framework and explicit conditions to ensure security against side-channel attacks in broadcast encryption.

Findings

Explicit sufficient condition for exponential decay of information leakage

Framework for secure broadcasting of two encrypted sources

Analysis of side-channel attack resilience

Abstract

We consider the secure communication problem for broadcasting of two encrypted sources. The sender wishes to broadcast two secret messages via two common key cryptosystems. We assume that the adversary can use the side-channel, where the side information on common keys can be obtained via the rate constraint noiseless channel. To solve this problem we formulate the post encryption coding system. On the information leakage on two secrete messages to the adversary, we provide an explicit sufficient condition to attain the exponential decay of this quantity for large block lengths of encrypted sources.

Equations

$$p_{K_1{K}_2}=\{p_{K_1{K}_2}(k_1,k_2){\}}_{(k_1,k_2)\in {\mathcal{X}}_1\times {\mathcal{X}}_2}.$$

$$p_{X_1^n{X}_2^n}(x_1^n,x_2^n)=\prod _{t=1}^n{p}_{X_1{X}_2}(x_{1,t},x_{2,t}).$$

$$C_i^n:={\mathsf{Enc}}_i(X_i^n)=X_i^n\oplus K_i^n.$$

$$W^n={\left\{W^n(z^n|k_1^n,k_2^n)\right\}}_{(k_1^n,k_2^n,z^n)\in {\mathcal{X}}_1^n\times {\mathcal{X}}_2^n\times {\mathcal{Z}}^n}.$$

$$W^n(z^n|k_1^n,k_2^n)=\prod _{t=1}^{n}W(z_t|k_{1,t},k_{2,t}).$$

$$R_{\mathcal{A}}^{(n)}:=\frac{1}{n}\log ||{\phi }_{\mathcal{A}}||=\frac{1}{n}\log |{\mathcal{M}}_{\mathcal{A}}^{(n)}|$$

$${\mathcal{F}}_{\mathcal{A}}^{(n)}(R_{\mathcal{A}}):=\{{\phi }_{\mathcal{A}}^{(n)}:R_{\mathcal{A}}^{(n)}\le R_{\mathcal{A}}\}.$$

$$p_{\mathrm{e},i}=$$

$${\Delta }^{(n)}={\Delta }^{(n)}({\phi }_1^{(n)},{\phi }_2^{(n)},{\phi }_{\mathcal{A}}^{(n)}|p_{X_1{X}_2}^n,p_{Z{K}_1{K}_2}^n)$$

$$:=I(X_1^n{X}_2^n;{\tilde{C}}_1^{m_2},{\tilde{C}}_2^{m_2},M_{\mathcal{A}}^{(n)}).$$

$$\frac{1}{n}\log |{\mathcal{X}}_i^{m_i}|=\frac{m_i}{n}\log |{\mathcal{X}}_i|\le R_i,$$

$$p_{\mathrm{e}}({\phi }_i^{(n)},{\Psi }_i^{(n)}|p_{X_i}^n)\le ϵ,$$

$${\Delta }^{(n)}({\phi }_1^{(n)},{\phi }_2^{(n)},{\phi }_{\mathcal{A}}^{(n)}|p_{X_1{X}_2}^n,p_{Z{K}_1{K}_2}^n)\le ϵ.$$

$$\frac{1}{n}\log |{\mathcal{X}}_i^{m_i}|=\frac{m_i}{n}\log |{\mathcal{X}}_i|\le R_i,$$

$$p_{\mathrm{e}}({\phi }_i^{(n)},{\psi }_i^{(n)}|p_{X_i}^n)\le {\mathrm{e}}^{-n(E_i-ϵ)},$$

$${\Delta }^{(n)}({\phi }_1^{(n)},{\phi }_2^{(n)},{\phi }_{\mathcal{A}}^{(n)}|p_{X_1{X}_2}^n,p_{Z{K}_1{K}_2}^n)\le {\mathrm{e}}^{-n(F-ϵ)}.$$

$${\varphi }_i^{(n)}(x_i^n)=x_i^n{A}_i\text{mbox}for{x}_i^n\in {\mathcal{X}}_i^n,$$

$${\phi }_i^{(n)}(k_i^n):=$$

$$=$$

$${\phi }_i^{(n)}(x_i^n\oplus k_i^n)(x_i^n\oplus k_i^n)A_i\oplus b_i^{m_i}=x_i^n{A}_i\oplus (k_i^n{A}_i\oplus b_i^{m_i})$$

$$={\varphi }_i^{(n)}(x_i^n)\oplus {\phi }_i^{(n)}(k_i^n),\text{mbox}for{x}_i^n,k_i^n\in {\mathcal{X}}_i^n.$$

$${\tilde{C}}_i^{m_i}={\phi }_i^{(n)}(X_i^n\oplus K_i^n)$$

$$={\varphi }_i^{(n)}(X_i^n)\oplus {\phi }_i^{(n)}(K_i^n)={\tilde{X}}_i^{m_i}\oplus {\tilde{K}}_i^{m_i},$$

$${\hat{X}}_i^n$$

$$p_{UZ{K}_1{K}_2}(u,z,k_1,k_2)=p_U(u)p_{Z|U}(z|u)p_{K_1{K}_2|Z}(k_1,k_2|z).$$

$$R_3:=R_1+R_2,{\mathcal{X}}_3:={\mathcal{X}}_1\times {\mathcal{X}}_2,$$

$$k_3:=(k_1,k_2),K_3:=(K_1,K_2).$$

$$\mathcal{P}(p_{Z{K}_i}):=$$

$$i=1,2,3.$$

$$\displaystyle{\cal R}_{i}(p_{i}):=\begin{array}[t]{l}\{(R_{\cal A},R_{i}):R_{\cal A},R_{i}\geq 0,\vspace{0.3mm}\\ \>R_{\cal A}\geq I({Z};{U}),R_{i}\geq H({K}_{i}|{U})\},\end{array}$$

$${\mathcal{R}}_i(p_{Z{K}_i}):=\bigcup _{p_i\in \mathcal{P}(p_{Z{K}_i})}{\mathcal{R}}_i(p_i).$$

$$\tilde{\mathcal{P}}(p_{Z{K}_i}):=$$

$$i=1,2,3.$$

$$R^{(\mu )}(p_{Z{K}_i}):=\underset{p\in \tilde{\mathcal{P}}(p_{Z{K}_i})}{\min }\left\{\mu I_p(Z;U)+\bar{\mu }{H}_p(K_i|U)\right\},$$

$$\displaystyle{\cal R}_{{\rm sh},i}(p_{ZK_{i}}):=\bigcap_{\mu\in[0,1]}\{(R_{\cal A},R_{i}):\begin{array}[t]{l}\mu R_{\cal A}+\bar{\mu}R_{i}\\ \geq R^{(\mu)}(p_{ZK_{i}})\}.\end{array}$$

Full text

I Introduction

In this paper, we consider the problem of strengthening the security of broadcasting secret sources encripted by common key criptsystems under the situation where the running criptsystems have some potential problems. More precisely, we consider two cryptosystems described as follows: two sources $X_{1}$ and $X_{2}$, respectively, are encrypted in a node to $C_{1}$ and $C_{2}$ using secret key $K_{1}$ and $K_{2}$. The cipher texts $C_{1}$ and $C_{2}$, respectively, are sent through public communication channels to the sink nodes 1 and 2. For each $i$, at the sink node $i$, $X_{i}$ is decrypted from $C_{i}$ using $K_{i}$. In this paper we assume we have two potentical problems in the above two cryptsystems. One is that the two common keys used in the above systems may have correlation. The other is that the adversary can use the side-channel, where the side information on two common keys can be obtained via the rate constraint noiseless channel. To solve this problem we formulate the post encryption coding system. In this communication system, we evaluate the information leakage on two secrete messages to the adversary. We provide an explicit sufficient condition for the information leakage to decay exponentially as the block length of encrypted source tends to infinity.

II Problem Formulation

II-A Preliminaries

In this subsection, we show the basic notations and related consensus used in this paper.

*Random Source of Information and Key:  * For each $i=1,2$, let $X_{i}$ be a random variable from a finite set $\mathcal{X}_{i}$. For each $i=1,2$, let $\{X_{i,t}\}_{t=1}^{\infty}$ be two stationary discrete memoryless sources(DMS) such that for each $t=1,2,\ldots$, $X_{i,t}$ take values in finite set $\mathcal{X}_{i}$ and has the same distribution as that of $X_{i}$ denoted by ${p}_{X_{i}}=\{{p}_{X_{i}}(x_{i})\}_{x_{i}\in\mathcal{X}_{i}}$. The stationary DMS $\{X_{i,t}\}_{t=1}^{\infty},$ are specified with $p_{X_{i}}$.

We next define the two keys used in the two common cryptosystems. For each $i=1,2$, let $(K_{1},K_{2})$ be a pair of two correlated random variables taken from the same finite set $\mathcal{X}_{1}\times\mathcal{X}_{2}$. Let $\{(K_{1,t},K_{2,t}\}_{t=1}^{\infty}$ be a stationary discrete memoryless source such that for each $t=1,2,\ldots$, $(K_{1,t},K_{2,t})$ takes values in $\mathcal{X}_{1}\times$ $\mathcal{X}_{2}$ and has the same distribution as that of $(K_{1},K_{2})$ denoted by

[TABLE]

The stationary DMS $\{(K_{1,t},K_{2,t}\}_{t=1}^{\infty}$ is specified with ${p}_{K_{1}K_{2}}$. In this paper we assume that for each $i=1,2$, the marginal distribution $p_{K_{i}}$ is the uniform distribution over ${\cal X}_{i}$.

*Random Variables and Sequences:  * We write the sequence of random variables with length $n$ from the information sources as follows: $X_{i}^{n}:=X_{i,1}X_{i,2}\cdots X_{i,n},i=1,2$. Similarly, the strings with length $n$ of $\mathcal{X}_{i}^{n}$ are written as ${{x}_{i}^{n}}:=x_{i,1}x_{i,2}\cdots x_{i,n}\in\mathcal{X}_{i}^{n}$. For $({{x}^{n}},{{x}_{2}^{n}})\in\mathcal{X}_{1}^{n}\times\mathcal{X}_{2}^{n}$, ${p}_{X_{1}^{n}X_{2}^{n}}({{x}^{n}},{{x}_{2}^{n}})$ stands for the probability of the occurrence of $({{x}^{n}},{{x}_{2}^{n}})$. When the information source is memoryless specified with ${p}_{X_{1}X_{2}}$, we have the following equation holds:

[TABLE]

In this case we write ${p}_{X_{1}^{n}X_{2}^{n}}(x_{1}^{n},x_{2}^{n})$ as ${p}_{X_{1}X_{2}}^{n}(x_{1}^{n},x_{2}^{n})$. Similar notations are used for other random variables and sequences.

*Consensus and Notations: * Without loss of generality, throughout this paper, we assume that $X_{1}$ and $X_{2}$ are finite fields. The notation $\oplus$ is used to denote the field addition operation, while the notation $\ominus$ is used to denote the field subtraction operation, i.e., $a\ominus b=a\oplus(-b)$ for any elements $a,b$ from the same finite field. All discussions and theorems in this paper still hold although$X_{1}$ and $X_{2}$ are different finite fields. However, for the sake of simplicity, we use the same notation for field addition and subtraction for both $X_{1}$ and $X_{2}$. Throughout this paper all logarithms are taken to the base natural.

II-B Basic System Description

In this subsection we explain the basic system setting and basic adversarial model we consider in this paper. First, let the information source and the key be generated independently by three different parties $\mathcal{S}_{\mathsf{gen,1}}$, $\mathcal{S}_{\mathsf{gen,2}}$ and $\mathcal{K}_{\mathsf{gen}}$ respectively. In our setting, we assume the followings.

• •

The random keys ${{K}_{1}^{n}}$ and ${{K}_{2}^{n}}$ are generated by $\mathcal{K}_{\mathsf{gen}}$ from uniform distribution.

• •

The key ${{K}_{1}^{n}}$ is correlated to ${{K}_{2}^{n}}$.

• •

The sources ${{X}_{1}^{n}}$ and ${{X}_{2}^{n}}$ are generated by $\mathcal{S}_{\mathsf{gen}}$ and are correlated to each other.

• •

The sources are independent to the keys.

Next, let the two correlated random sources ${{X}_{1}^{n}}$ and ${{X}_{2}^{n}}$, respectively from $\mathcal{S}_{\mathsf{gen,1}}$ and $\mathcal{S}_{\mathsf{gen,2}}$ be sent to two separated nodes $\mathsf{L}_{1}$ and $\mathsf{L}_{2}$. And let two random key (sources) ${{K}_{1}^{n}}$ and ${{K}_{2}^{n}}$ from $\mathcal{K}_{\mathsf{gen}}$ be also sent separately to $\mathsf{L}_{1}$ and $\mathsf{L}_{2}$. Further settings of our system are described as follows. Those are also shown in Fig. 1.

Separate Sources Processing:  For each $i=1,2$, at the node $\mathsf{L}_{i}$, $X_{i}^{n}$ is encrypted with the key $K_{i}^{n}$ using the encryption function $\mathsf{Enc}_{i}$. The ciphertext ${{C}_{i}^{n}}$ of ${{X}_{i}^{n}}$ is given by

[TABLE] 2. 2.

Transmission:  Next, the ciphertexts ${{C}_{1}^{n}}$ and ${{C}_{2}^{n}}$, respectively are sent to the information processing center $\mathsf{D}_{1}$ and $\mathsf{D}_{2}$ through two public communication channels. Meanwhile, the keys ${{K}_{1}^{n}}$ and ${{K}_{2}^{n}}$, respectively are sent to $\mathsf{D}_{1}$ and $\mathsf{D}_{2}$ through two private communication channels. 3. 3.

Sink Nodes Processing:  For each $i=1,2$, in $\mathsf{D}_{i}$, we decrypt the ciphertext ${{C}_{i}^{n}}$ using the key ${{K}_{i}^{n}}$ through the corresponding decryption procedure $\mathsf{Dec}_{i}$ defined by $\mathsf{Dec}_{i}({{C}_{i}^{n}})={{C}_{i}^{n}}\ominus{{K}_{i}^{n}}$. It is obvious that we can correctly reproduce the source output ${X}^{n}$ from ${C}_{i}^{n}$ and ${K}_{i}^{n}$ by the decryption function $\mathsf{Dec}_{i}$.

Side-Channel Attacks by Eavesdropper Adversary:* An adversary $\mathcal{A}$ eavesdrops the public communication channel in the system. The adversary $\mathcal{A}$ also uses a side information obtained by side-channel attacks. Let ${\cal Z}$ be a finite set and let $W:$ ${\cal X}_{1}\times{\cal X}_{2}\to{\cal Z}$ be a noisy channel. Let $Z$ be a channel output from $W$ for the input random variable $K$. We consider the discrete memoryless channel specified with $W$. Let ${Z}^{n}\in{\cal Z}^{n}$ be a random variable obtained as the channel output by connecting $({K}_{1}^{n},{K}_{2}^{n})\in{\cal X}_{1}^{n}\times{\cal X}_{2}^{n}$ to the input of channel. We write a conditional distribution on ${Z}^{n}$ given $({K}_{1}^{n},{K}_{2}^{n})$ as*

[TABLE]

Since the channel is memoryless, we have

[TABLE]

On the above output ${Z}^{n}$ of $W^{n}$ for the input $({K}_{1}^{n},{K}_{2}^{n})$, we assume the followings.

• •

The two random pairs $(X_{1},X_{2})$, $(K_{1},K_{2})$ and the random variable $Z$, satisfy $(X_{1},X_{2})\perp(K_{1},K_{2},Z)$, which implies that $(X_{1}^{n},X_{2}^{n})\perp(K_{1}^{n},K_{2}^{n},Z^{n})$.

• •

$W$* is given in the system and the adversary ${\cal A}$ can not control $W$.*

• •

By side-channel attacks, the adversary ${\cal A}$ can access $Z^{n}$.

We next formulate side information the adversary ${\cal A}$ obtains by side-channel attacks. For each $n=1,2,\cdots$, let $\varphi_{\cal A}^{(n)}:{\cal Z}^{n}\to{\cal M}_{\cal A}^{(n)}$ be an encoder function. Set $\varphi_{\cal A}:=\{\varphi_{\cal A}^{(n)}\}_{n=1,2,\cdots}.$ Let

[TABLE]

be a rate of the encoder function $\varphi_{\cal A}^{(n)}$. For $R_{\cal A}>0$, we set

[TABLE]

On encoded side information the adversary ${\cal A}$ obtains we assume the following.

• •

The adversary ${\cal A}$, having accessed $Z^{n}$, obtains the encoded additional information $\varphi_{\cal A}^{(n)}({Z}^{n})$. For each $n=1,2,\cdots$, the adversary ${\cal A}$ can design $\varphi_{\cal A}^{(n)}$.

• •

The sequence $\{R_{\cal A}^{(n)}\}_{n=1}^{\infty}$ must be upper bounded by a prescribed value. In other words, the adversary ${\cal A}$ must use $\varphi_{\cal A}^{(n)}$ such that for some $R_{\cal A}$ and for any sufficiently large $n$, $\varphi_{\cal A}^{(n)}\in{\cal F}_{\cal A}^{(n)}(R_{\cal A})$.

As a soultion to the side channel attacks, we consider the post-encryption coding system. This system is shown in Fig. 2.

Encoding at Source node $\mathsf{L}_{i},i=1,2$:*   For each $i=1,2$, we first use $\varphi_{i}^{(n)}$ to encode the ciphertext $C_{i}^{n}=X_{i}^{n}\oplus K_{i}^{n}$. Formal definition of $\varphi_{i}^{(n)}$ is $\varphi_{i}^{(n)}:$ {\cal X}_{i}^{n}\to$${\cal X}_{i}^{m_{i}}. Let $\widetilde{C}_{i}^{m_{i}}=\varphi_{i}^{(n)}({{C}_{i}^{n}})$. Instead of sending ${{C}_{i}^{n}}$, we send $\tilde{C}_{i}^{m_{i}}$ to the public communication channel.* 2. 2.

Decoding at Sink Nodes $\mathsf{D}_{i},i=1,2$:  ** For each $i=1,2$, $\mathsf{D}_{i}$ receives $\widetilde{C}_{i}^{m_{i}}$ from public communication channel. Using common key ${K}_{i}^{n}$ and the decoder function $\Psi_{i}^{(n)}:{\cal X}_{i}^{m}\times{\cal X}_{i}^{n}\to{\cal X}_{i}^{n}$, $\mathsf{D}_{i}$ outputs an estimation $\hat{X}_{i}^{n}=\Psi_{i}^{(n)}(\tilde{C}_{i}^{m_{i}},{K}_{i}^{n})$ of ${X}_{i}^{n}$.

On Reliability and Security:* From the description of our system in the previous section, the decoding process in our system above is successful if $\widehat{X}^{n}=X^{n}$ holds. Combining this and (6), it is clear that the decoding error probabilities $p_{{\rm e},i},i=1,2,$ are as follows:*

[TABLE]

Set $M_{\cal A}^{(n)}=\varphi_{\cal A}^{(n)}(Z^{n})$. The information leakage $\Delta^{(n)}$ on $(X_{1}^{n},X_{2}^{n})$ from $(\widetilde{C}_{1}^{m_{1}},\widetilde{C}_{2}^{m_{2}},M_{\cal A}^{(n)})$ is measured by the mutual information between $(X_{1}^{n},X_{2}^{n})$ and $(\widetilde{C}_{1}^{m_{1}},\widetilde{C}_{2}^{m_{2}},$ $M_{\cal A}^{(n)})$. This quantity is formally defined by

[TABLE]

Reliable and Secure Framework:**

Definition 1

A pair $(R_{1},R_{2})$ is achievable under $R_{\cal A}$ $>0$ for the system $\mathsf{Sys}$ if there exists two sequences $\{(\varphi_{i}^{(n)},$ $\Psi_{i}^{(n)})\}_{n\geq 1},i=1,2,$ such that $\forall\epsilon>0$, $\exists n_{0}=n_{0}(\epsilon)\in\mathbb{N}_{0}$, $\forall n\geq n_{0}$, we have for $i=1,2,$

[TABLE]

and for any eavesdropper $\mathcal{A}$ with $\varphi_{\mathcal{A}}$ satisfying $\varphi_{\cal A}^{(n)}\in{\cal F}_{\cal A}^{(n)}(R_{\cal A})$, we have

[TABLE]

Definition 2

(Reliable and Secure Rate Region)* Let $\mathcal{R}_{\mathsf{Sys}}({p}_{X_{1}X_{2}},$ ${p}_{K_{1}K_{2}},W)$ denote the set of all $(R_{\cal A},R)$ such that $R$ is achievable under $R_{\cal A}$. We call $\mathcal{R}_{\mathsf{Sys}}({p}_{X_{1}X_{2}},{p}_{K_{1}K_{2}},$ $W)$ the reliable and secure rate region.*

Definition 3

*A five tuple $(R_{1},R_{2},E_{1},E_{2},F)$ is achievable under

$R_{\cal A}>0$ for the system $\mathsf{Sys}$ if there exists a sequence $\{(\varphi_{i}^{(n)},$ $\Psi_{i}^{(n)})\}_{n\geq 1}$, $i=1,2$, such that $\forall\epsilon>0$, $\exists n_{0}=n_{0}(\epsilon)\in\mathbb{N}_{0}$, $\forall n$ $\geq n_{0}$, we have for $i=1,2,$*

[TABLE]

and for any eavesdropper $\mathcal{A}$ with $\varphi_{\mathcal{A}}$ satisfying $\varphi_{\cal A}^{(n)}\in{\cal F}_{\cal A}^{(n)}(R_{\cal A})$, we have

[TABLE]

Definition 4

(Rate, Reliability, and Security Region)* Let $\mathcal{D}_{\mathsf{Sys}}({p}_{X_{1}X_{2}},$ ${p}_{K_{1}K_{2}},W)$ denote the set of all $(R_{\cal A},R,E,F)$ such that $(R_{1},R_{2},E_{1},E_{2},F)$ is achievable under $R_{\cal A}$. We call $\mathcal{D}_{\mathsf{Sys}}({p}_{X_{1}X_{2}},$ ${p}_{K_{1}K_{2}},W)$ the rate, reliability, and security region.*

III Proposed Idea: Affine Encoder as Privacy Amplifier

For each $n=1,2,\cdots$, let $\phi_{i}^{(n)}:{\cal X}_{i}^{n}\to{\cal X}_{i}^{m_{i}}$ be a linear mapping. We define the mapping $\phi_{i}^{(n)}$ by

[TABLE]

where $A_{i}$ is a matrix with $n$ rows and $m_{i}$ columns. Entries of $A_{i}$ are from ${\cal X}_{i}$. We fix $b_{i}^{m_{i}}\in\mathcal{X}_{i}^{m_{i}}$. Define the mapping $\varphi_{i}^{(n)}:{\cal X}_{i}^{n}\to{\cal X}_{i}^{m_{i}}$ by

[TABLE]

The mapping $\varphi_{i}^{(n)}$ is called the affine mapping induced by the linear mapping $\phi_{i}^{(n)}$ and constant vector $b_{i}^{m_{i}}$ $\in{\cal X}_{i}^{m_{i}}$. By the definition (3) of $\varphi_{i}^{(n)}$, those satisfy the following affine structure:

[TABLE]

Next, let $\psi_{i}^{(n)}$ be the corresponding decoder for $\phi_{i}^{(n)}$ such that $\psi_{i}^{(n)}:\mathcal{X}_{i}^{m_{i}}\rightarrow\mathcal{X}_{i}^{n}.$ Note that $\psi_{i}^{(n)}$ does not have a linear structure in general.

Description of Proposed Procedure:* We describe the procedure of our privacy amplified system as follows.*

Encoding at Source node $\mathsf{L}_{i},i=1,2$:*  First, we use $\varphi_{i}^{(n)}$ to encode the ciphertext $C_{i}^{n}=X_{i}^{n}\oplus K_{i}^{n}$ Let $\widetilde{C}_{i}^{m_{i}}=\varphi_{i}^{(n)}({{C}_{i}^{n}})$. Then, instead of sending ${{C}^{n}}$, we send $\tilde{C}_{i}^{m_{i}}$ to the public communication channel. By the affine structure (4) of encoder we have that*

[TABLE]

where we set $\widetilde{X}_{i}^{m_{i}}:=\phi_{i}^{(n)}({{X}_{i}^{n}}),\widetilde{K}_{i}^{m_{i}}:=\varphi_{i}^{(n)}({{K}_{i}^{n}}).$ 2. 2.

Decoding at Sink Node $\mathsf{D}_{i},i=1,2$:  ** First, using the linear encoder $\varphi_{i}^{(n)}$, $\mathsf{D}_{i}$ encodes the key ${K}_{i}^{n}$ received through private channel into \widetilde{K}_{i}^{m_{i}}=$$\varphi_{i}^{(n)}({{K}_{i}^{n}}). Receiving $\widetilde{C}_{i}^{m_{i}}$ from public communication channel, $\mathsf{D}_{i}$ computes $\widetilde{X}_{i}^{m_{i}}$ in the following way. From (5), we have that the decoder $\mathsf{D}_{i}$ can obtain $\widetilde{X}_{i}^{m_{i}}$ $=\phi_{i}^{(n)}({{X}_{i}^{n}})$ by subtracting $\widetilde{K}_{i}^{m_{i}}=\varphi_{i}^{(n)}({{K}_{i}^{n}})$ from $\widetilde{C}_{i}^{m_{i}}$. Finally, $\mathsf{D}_{i}$ outputs $\widehat{X}_{i}^{n}$ by applying the decoder $\psi_{i}^{(n)}$ to $\widetilde{X}_{i}^{m_{i}}$ as follows:

[TABLE]

Our privacy amplified system described above is illustrated in Fig. 3.

IV Main Results

In this section we state our main results. To describe our results we define several functions and sets. Let $U$ be an auxiliary random variable taking values in a finite set ${\cal U}$. We assume that the joint distribution of $(U,Z,K_{1},K_{2})$ is

[TABLE]

The above condition is equivalent to $U\leftrightarrow Z\leftrightarrow(K_{1},K_{2})$. In the following argument for convenience of descriptions of definitions we use the following notations:

[TABLE]

For each $i=1,2,3$, we simply write $p_{i}=p_{UZK_{i}}$. Specifically, for $i=3$, we have $p_{3}=p_{UZK_{1}K_{2}}=p$. Define the three sets of probability distribution $p=p_{UZK_{1}K_{2}}$ by

[TABLE]

For $i=1,2,3$, set

[TABLE]

The two regions ${\cal R}_{i}(p_{ZK_{i}}),i=1,2$ have the same form as the region appearing as the admissible rate region in the one-helper source coding problem posed and investigated by Ahlswede and Körner **[1]**.

We can show that the region ${\cal R}_{i}(p_{ZK_{i}}),i=1,2,$ and ${\cal R}_{3}({p_{ZK_{1}K_{2}}})$ satisfy the following property.

Property 1

**

• a)

*The region ${\cal R}(p_{ZK_{i}}),i=1,2$, is a closed convex subset of $\mathbb{R}_{+}^{2}$. The region ${\cal R}_{3}({p_{ZK_{1}K_{2}}})$ is a closed convex subset of $\mathbb{R}_{+}^{3}$. *

• b)

The bound $|{\cal U}|\leq|{\cal Z}|+1$ is sufficient to describe ${\cal R}_{i}(p_{ZK_{i}}),i=1,2,3$.

We next explain that the region ${\cal R}_{i}(p_{ZK_{i}}),i=1,2,$ and ${\cal R}_{3}({p_{ZK_{1}K_{2}}})$ can be expressed with a family of supporting hyperplanes. To describe this result we define three sets of probability distributions on ${\cal U}$ $\times{\cal Z}$ \times{\cal X}_{1}$$\times{\cal X}_{2} by

[TABLE]

For $i=1,2,3$, and $\mu\in[0,1]$, define

[TABLE]

Furthermore, for $i=1,2,3$, define

[TABLE]

Then we have the following property.

Property 2

**

• a)

The bound $|{\cal U}|\leq|{\cal Z}|$ is sufficient to describe $R_{i}^{(\mu)}($ $p_{ZK_{i}}),i=1,2$, and $R_{3}^{(\mu)}({p_{ZK_{1}K_{2}}})$.

• b)

For every $\mu\in[0,1]$, we have

[TABLE]

• c)

For any ${p_{ZK_{1}K_{2}}}$ we have

[TABLE]

We define several quantities to state a result on $\mathcal{D}_{\mathsf{Sys}}($ ${p}_{X_{1}X_{2}},{p}_{K_{1}K_{2}},W)$. Let $i\in\{1,2\}$. We first define a function related to an exponential upper bound of $p_{{\rm e}}(\phi_{i}^{(n)},\psi_{i}^{(n)}|{p}_{X_{i}}^{n})$. Let $\overline{X}_{i}$ be an arbitrary random variable over $\mathcal{X}_{i}$ and has a probability distribution $p_{\overline{X}_{i}}$. Let $\mathcal{P}(\mathcal{\cal X}_{i})$ denote the set of all probability distributions on $\mathcal{X}_{i}$. For $R_{i}\geq 0$ and $p_{{X}_{i}}\in$ $\mathcal{P}(\mathcal{\cal X}_{i})$, we define the following function:

[TABLE]

We next define a function related to an exponential upper bound of $\Delta^{(n)}(\varphi_{1}^{(n)},\varphi_{2}^{(n)},\varphi_{\mathcal{A}}^{(n)}|{p}_{X_{1}X_{2}}^{n},{p^{n}_{ZK_{1}K_{2}}})$. For each $i=1,2,3$, we define a set of probability distributions on ${\cal U}$ $\times{\cal Z}$ $\times{\cal X}_{i}$ by

[TABLE]

For each $i=1,2,3$, for $(\mu,\alpha)\in[0,1]^{2}$, and for $q_{i}=q_{UZK_{i}}\in{\cal Q}(p_{K_{i}|Z})$, define

[TABLE]

We next define a function serving as a lower bound of $F(R_{\cal A},R_{i}|p_{ZK_{i}}),i=1,2,3$. For each $i=1,2,3,$ and for each $p_{i}\in\tilde{\cal P}(p_{ZK_{i}})$, define

[TABLE]

Furthermore, set

[TABLE]

We can show that the above functions satisfy the following property.

Property 1

**

• a)

For each $i=1,2,3$, the cardinality bound $|{\cal U}|\leq|{\cal{Z}}|$ in ${\cal Q}(p_{K_{i}|{Z}})$ is sufficient to describe the quantity $\Omega^{(\mu,\alpha)}(p_{ZK_{i}})$. Furthermore, the cardinality bound $|{\cal U}|\leq|{\cal{Z}}|$ in ${\cal P}_{\rm sh}(p_{ZK_{1}K_{2}})$ is sufficient to describe the quantity $\tilde{\Omega}^{(\mu,\lambda)}(p_{ZK_{1}K_{2}})$.

• b)

For $i=1,2,3$ and for any $R_{\cal A},R_{i}\geq 0$, we have

[TABLE]

• c)

For $i=1,2,3$ and for any $p_{i}\in{\cal P}_{\rm sh}(p_{ZK_{i}})$ and any $(\mu,\lambda)\in[0,$ $1]^{2}$, we have

[TABLE]

• d)

Fix any $p=p_{U{Z}K}\in{\cal P}_{\rm sh}(p_{K},W)$ and $\mu\in[0,1]$. For $\lambda\in[0,1]$, we define a probability distribution $p_{i}^{(\lambda)}=p_{UZK_{i}}^{(\lambda)}$ by

[TABLE]

Then for each $i=1,2,3$ and for $\lambda\in[0,1/2]$, $\tilde{\Omega}^{(\mu,\lambda)}(p_{i})$ is twice differentiable. Furthermore, for $\lambda\in[0,1/2]$, we have

[TABLE]

The second equality implies that $\tilde{\Omega}^{(\mu,\lambda)}(p_{i}|p_{ZK_{i}})$ is a concave function of $\lambda\geq 0$.

• e)

For $(\mu,\lambda)\in[0,1]\times[0,1/2]$, define

[TABLE]

and set

[TABLE]

Then we have $\rho(p_{ZK_{i}})<\infty$. Furthermore, for any $(\mu,\lambda)\in[0,1]\times[0,1/2]$, we have

[TABLE]

• f)

For every $\tau\in(0,(1/2)\rho(p_{ZK_{i}})$, the condition $(R_{\cal A},$ $R+\tau)\notin{\cal R}(p_{ZK_{i}})$ implies

[TABLE]

where $g$ is the inverse function of $\vartheta(a):=a+(5/4)a^{2},a\geq 0$.

Proof of this property is found in Oohama **[2]**(extended version). We set

[TABLE]

Our main result is as follows.

Theorem 1

For any $R_{\cal A},R_{1},R_{2}>0$ and any ${p_{ZK_{1}K_{2}}}$, there exists two sequence of mappings $\{(\varphi_{i}^{(n)},\psi_{i}^{(n)})\}_{n=1}^{\infty},i=1,2$ such that for any $p_{X_{i}},i=1,2,$ and any $n\geq(R_{1}+R_{2})^{-1}$, we have

[TABLE]

and for any eavesdropper $\mathcal{A}$ with $\varphi_{\mathcal{A}}$ satisfying $\varphi_{\mathcal{A}}^{(n)}\in{\cal F}_{\mathcal{A}}^{(n)}(R_{\mathcal{A}})$, we have

[TABLE]

where $\delta_{i,n},i=1,2,3$ are defined by

[TABLE]

Note that for $i=1,2,3$, $\delta_{i,n}\to 0$ as $n\to\infty$. **

This theorem is proved by a coupling of two techniques. One is a technique Oohama **[3]** developed for deriving approximation error exponents for the intrinsic randomness problem in the framework of distributed random number extraction, which was posed by the author. This technique is used in the security analysis for the privacy amplification of distributed encrypted sources with correlated keys posed and investigated by Santoso and Oohama **[4]**, **[5]**. The other is a technique Oohama **[2]** developed for establishing exponential strong converse theorem for the one helper source coding problem. This technique is used in the security analysis for the side channel attacks to the Shannon cipher system posed and investigated by Oohama and Santoso **[6]**, **[7]**.

The functions $E(R_{i}|p_{X_{i}})$ and $F(R_{\mathcal{A}},R_{1},R_{2}|{p_{ZK_{1}K_{2}}})$ take positive values if $(R_{\mathcal{A}},R_{1},R_{2})$ belongs to the set

[TABLE]

Thus, by Theorem 1, under

[TABLE]

we have the followings:

• •

On the reliability, for $i=1,2$, $p_{\rm e}(\phi_{i}^{(n)},\psi_{i}^{(n)}|p_{X_{i}}^{n})$ goes to zero exponentially as $n$ tends to infinity, and its exponent is lower bounded by the function $E(R_{i}|p_{X_{i}})$.

• •

On the security, for any $\varphi_{\cal A}$ satisfying $\varphi_{\cal A}^{(n)}\in{\cal F}_{\cal A}^{(n)}(R_{\cal A}$ $)$, the information leakage $\Delta^{(n)}(\varphi_{1}^{(n)},\varphi_{2}^{(n)},\varphi_{\mathcal{A}}^{(n)}|p_{X_{1}X_{2}}^{n},$ ${p^{n}_{ZK_{1}K_{2}}})$ on $X_{1}^{n},X_{2}^{n}$ goes to zero exponentially as $n$ tends to infinity, and its exponent is lower bounded by the function $F_{\min}(R_{\mathcal{A}},R_{1},R_{2}|p_{ZK_{1}K_{2}})$.

• •

For each $i=1,2$, the code $(\phi_{i}^{(n)},\psi_{i}^{(n)})$ that attains the exponent function E($$R_{i}|p_{X_{i}}) is a universal code that depends only on $R_{i}$ not on the value of the distribution $p_{X_{i}}$.

Define

[TABLE]

From Theorem 1, we immediately obtain the following corollary.

Corollary 1

[TABLE]

In the remaining part of this section, we give two simple examples of ${\cal R}_{\rm Sys}^{\rm(in)}(p_{X_{1}X_{1}},{p_{ZK_{1}K_{2}}})$. Those correspond two extrimal cases on the correlation of $(K_{1},K_{2},Z)$. In those two examples, we assume that ${\cal X}_{1}={\cal X}_{2}=\{0,1\}$ and $p_{X_{1}}(1)=s_{1},p_{X_{2}}(1)=s_{2}$. We further assume that $p_{K_{1},K_{2}}$ has the binary symmetric distribution given by

[TABLE]

where $\rho\in[0,0.5]$ is a parameter indicating the correlation level of $(K_{1},K_{2})$.

Example 1

We consider the case where $W=p_{Z|K_{1}K_{2}}$ is given by

[TABLE]

In this case we have $K_{2}\leftrightarrow K_{1}\leftrightarrow Z$. This corresponds to the case where the adversary ${\cal A}$ attacks only node ${\rm L}_{1}$. Let $N_{\cal A}$ be a binary random variable with $p_{N_{\cal A}}(1)=\rho_{\cal A}$. We assume that $N_{\cal A}$ is independent of $(X_{1},X_{2})$ and $(K_{1},K_{2})$. Using $N_{\cal A}$, $Z$ can be written as $Z=K_{1}\oplus N_{\cal A}.$ The inner bound for this example denoted by ${\cal R}_{\rm Sys,{\rm ex1}}^{\rm(in)}(p_{X_{1}X_{2}},{p_{ZK_{1}K_{2}}})$ is the following.

[TABLE]

where $h(\cdot)$ denotes the binary entropy function and $a*b:=a\bar{b}+\bar{a}b$.

Example 2

We consider the case of $\rho=0.5$. In this case $K_{1}$ and $K_{2}$ is independent. In this case we have no information leakage if $R_{\cal A}=0$. We assume that $W=p_{Z|K_{1}K_{2}}$ is given by

[TABLE]

Let $N_{\cal A}$ be the same random variable as the previous example. Using $N_{\cal A}$, $Z$ can be written as $Z=K_{1}\oplus K_{2}\oplus N_{\cal A}.$ The inner bound in this example denoted by ${\cal R}_{\rm Sys,{\rm ex2}}^{\rm(in)}($ $p_{X_{1}X_{2}},{p_{ZK_{1}K_{2}}})$ is the following:

[TABLE]

For the above two examples, we show the section of the regions ${\cal R}_{{\rm Sys,ex}i}^{\rm(in)}($ $p_{X_{1}X_{2}},{p_{ZK_{1}K_{2}}})$ $i=,1,2$ by the plane $\{R_{\cal A}=1-h(\theta)\}$ is shown in Fig. 4.

V Proofs of the Results

In this section we prove Theorem 1.

V-A Types of Sequences and Their Properties

In this subsection we prepare basic results on the types. Those results are basic tools for our analysis of several bounds related to error provability of decoding or security.

Definition 5

For each $i=1,2$ and for any $n$-sequence ${{x}_{i}^{n}}=x_{i,1}x_{i,2}\cdots$ $x_{i,n}\in{{\cal X}}^{n}$, $n(x_{i}|{{x}_{i}^{n}})$ denotes the number of $t$ such that $x_{i,t}=x_{i}$. The relative frequency $\left\{n(x_{i}|{x}_{i}^{n})/n\right\}_{x_{i}\in{\cal X}_{i}}$ of the components of ${{x}_{i}^{n}}$ is called the type of ${{x}^{n}}$ denoted by $P_{{x}^{n}}$. The set that consists of all the types on ${\cal X}$ is denoted by ${\cal P}_{n}({\cal X})$. Let $\overline{X}_{i}$ denote an arbitrary random variable whose distribution $P_{\overline{X}_{i}}$ belongs to ${\cal P}_{n}({\cal X}_{i})$. For $p_{\overline{X}_{i}}\in{\cal P}_{n}({\cal X}_{i})$, set

[TABLE]

For set of types and joint types the following lemma holds. For the detail of the proof see Csiszár and Körner **[8*]**. *

Lemma 1

• a)

\begin{array}[t]{l}|{\cal P}_{n}({\cal X}_{i})|\leq(n+1)^{|{\cal X}_{i}|}.\end{array}

• b)

For $P_{\overline{X}_{i}}\in{\cal P}_{n}({\cal X}_{i})$,

[TABLE]

• c)

For ${{x}_{i}^{n}}\in T^{n}_{\overline{X}_{i}}$,

[TABLE]

By Lemma 1 parts b) and c), we immediately obtain the following lemma:

Lemma 2

For $p_{\overline{X}_{i}}\in{\cal P}_{n}({\cal X}_{i})$,

[TABLE]

V-B Upper Bounds on Reliablity and Security

In this subsection we evaluate upper bounds of $p_{\rm e}(\phi_{i}^{(n)},$ $\psi_{i}^{(n)}|p_{X_{i}}^{n}),$ $i=1,2,$ and $\Delta_{n}(\varphi_{1}^{(n)},\varphi_{2}^{(n)},\varphi^{(n)}_{\cal A}|p_{X_{1}X_{2}}^{n},p_{ZK_{1}}$ ${}_{K_{2}Un})$. For $p_{\rm e}(\phi_{i}^{(n)}$, $\psi_{i}^{(n)}|p_{X_{i}}^{n})$, we derive an upper bound which can be characterized with a quantity depending on $(\phi_{i}^{(n)},\psi_{i}^{(n)})$ and type $P_{{x}_{i}^{n}}$ of sequences $x_{i}^{n}\in{\cal X}_{i}^{n}$. We first evaluate $p_{\rm e}(\phi_{i}^{(n)},\psi_{i}^{(n)}|p_{X_{i}}^{n}),i=1,2$. For ${{x}_{i}^{n}}\in{\cal X}_{i}^{n}$ and $p_{\overline{X}}\in{\cal P}_{n}({\cal X}_{i})$ we define the following functions.

[TABLE]

Then we have the following lemma.

Lemma 3

In the proposed system, for $i=1,2$ and for any pair of $(\phi_{i}^{(n)},$ $\psi_{i}^{(n)})$, we have

[TABLE]

Proof of this lemma is found in **[6]**. We omit the proof. ∎

We next discuss upper bounds of

[TABLE]

On an upper bound of $I(\widetilde{C}_{1}^{m_{1}}\widetilde{C}_{2}^{m_{2}},M_{\cal A}^{(n)};X_{1}^{n}X_{2}^{n})$, we have the following lemma.

Lemma 4

[TABLE]

where $p_{V_{1}^{m_{1}}V_{2}^{m_{2}}}$ represents the uniform distribution over $\mathcal{X}_{1}^{m_{1}}\times$ $\mathcal{X}_{2}^{m_{2}}$.

Proof:

We have the following chain of inequalities:

[TABLE]

Step (a) follows from $({{X}_{1}^{n}},{{X}_{2}^{n}})\perp M_{\cal A}^{(n)}$. Step (b) follows from that for $i=1,2$, $\widetilde{C}_{i}^{m_{i}}=\widetilde{K}_{i}^{m_{i}}\oplus\widetilde{X}_{i}^{m_{i}}$ and $\widetilde{X}_{i}^{m_{i}}=\phi_{i}^{(n)}({{X}_{i}^{n}})$. Step (c) follows from $(\widetilde{K}_{1}^{m_{1}},\widetilde{K}_{2}^{m_{2}},$ $M_{\cal A}^{(n)})\perp({{X}_{1}^{n}},$ ${{X}_{2}^{n}})$. ∎

V-C Random Coding Arguments

We construct a pair of affine encoders $(\varphi_{1}^{(n)},\varphi_{2}^{(n)})$ using the random coding method. For the two decoders $\psi_{i}^{(n)},i=1,2$, we propose the minimum entropy decoder used in Csiszár **[9]** and Oohama and Han **[10]**.

Random Construction of Affine Encoders:*  For each $i=1,2$, we first choose $m_{i}$ such that*

[TABLE]

where $\lfloor a\rfloor$ stands for the integer part of $a$. It is obvious that for $i=1,2$,

[TABLE]

By the definition (2) of $\phi_{i}^{(n)}$, we have that for ${{x}_{i}^{n}}\in{\cal X}_{i}^{n}$,

[TABLE]

where $A_{i}$ is a matrix with $n$ rows and $m_{i}$ columns. By the definition (3) of $\varphi_{i}^{(n)}$, we have that for ${{k}_{i}^{n}}\in{\cal X}_{i}^{n}$,

[TABLE]

*where for each $i=1,2$, $b_{i}^{m_{i}}$ is a vector with $m_{i}$ columns. Entries of $A_{i}$ and $b_{i}^{m_{i}}$ are from the field of ${\cal X}_{i}$. Those entries are selected at random, independently of each other and with uniform distribution. Randomly constructed linear encoder $\phi_{i}^{(n)}$ and affine encoder $\varphi_{i}^{(n)}$ have three properties shown in the following lemma.

Lemma 5** (Properties of Linear/Affine Encoders)**

For each $i=1,2$, we have the following:

• a)

For any ${{x}_{i}^{n}},{{v}_{i}^{n}}\in{\cal X}_{i}^{n}$ with ${{x}_{i}^{n}}\neq{{v}_{i}^{n}}$, we have

[TABLE]

• b)

For any ${{s}_{i}^{n}}\in{\cal X}_{i}^{n}$, and for any $\widetilde{s}_{i}^{m_{i}}\in{\cal X}^{m_{i}}$, we have

[TABLE]

• c)

For any ${{s}_{i}^{n}},{{t}_{i}^{n}}\in{\cal X}_{i}^{n}$ with ${{s}_{i}^{n}}\neq{{t}_{i}^{n}}$, and for any $\widetilde{s}_{i}^{m_{i}}\in{\cal X}_{i}^{m_{i}}$, we have

[TABLE]

Proof of this lemma is found in **[6]**. We omit the proof.

We next define the decoder function $\psi_{i}^{(n)}:{\cal X}_{i}^{m_{i}}\to{\cal X}_{i}^{n},i=1,2.$ To this end we define the following quantities.

Definition 6

For ${{x}_{i}^{n}}\in{\cal X}_{i}^{n}$, we denote the entropy calculated from the type $P_{{{x}_{i}^{n}}}$ by $H({{x}_{i}^{n}})$. In other words, for a type $P_{\overline{X}_{i}}\in{\cal P}_{n}({\cal X}_{i})$ such that $P_{\overline{X}_{i}}=P_{{{x}_{i}^{n}}}$, we define $H({{x}_{i}^{n}})=H(\overline{X}_{i})$. **

Minimum Entropy Decoder:*  For each $i=1,2$, and for $\phi_{i}^{(n)}(x_{i}^{n})=\widetilde{x}_{i}^{m_{i}}$, we define the decoder function $\psi_{i}^{(n)}:{\cal X}_{i}^{m_{i}}\to{\cal X}_{i}^{n}$ as follows:*

[TABLE]

Error Probability Bound:*  In the following arguments we let expectations based on the random choice of the affine encoders $\varphi_{i}^{(n)}i=1,2$ be denoted by {\bf E}$$[$$\cdot]. For, $i=1,2$, define*

[TABLE]

*Then we have the following lemma. *

Lemma 6

For each $i=1,2$, for any $n$ and for any $P_{\overline{X}_{i}}\in{\cal P}_{n}({\cal X}_{i})$,

[TABLE]

Proof of this lemma is found in **[6]**. We omit the proof.

Estimation of Approximation Error:*  Define*

[TABLE]

*Then, we have the following lemma. *

Lemma 7

For $i=1,2$ and for any $n,m_{i}$ satisfying $(m_{i}/n)\log|{\cal X}_{i}|$ $\leq R_{i}$, we have

[TABLE]

Proof of this lemma is given in Appendix -E. From the bound (19) in Lemma (7), we know that the quantity $\Theta(R_{1},$ $R_{2},\varphi_{\cal A}^{(n)}|{p^{n}_{ZK_{1}K_{2}}})$ serves as an upper bound of the ensemble average of the conditional divergence $D(p_{\tilde{K}_{1}^{m_{1}}\tilde{K}_{2}^{m_{2}}|M_{{\cal A}}^{(n)}}$ $||p_{V_{1}^{m_{1}}V_{2}^{m_{2}}}|p_{M_{\cal A}^{(n)}}).$

From Lemmas 4 and 7, we have the following corollary.

Corollary 2

[TABLE]

Existence of Universal Code $\{(\varphi_{i}^{(n)},\psi_{i}^{(n)})\}_{i=1,2}$:**

From Lemma 6 and Corollary 2, we have the following lemma stating an existence of universal code $\{(\varphi_{i}^{(n)},\psi_{i}^{(n)})\}_{i=1,2}$.

Lemma 8

There exists at least one deterministic code $\{(\varphi_{i}^{(n)},\psi_{i}^{(n)})\}_{i=1,2}$ satisfying $(m_{i}/n)\log|{\cal X}_{i}|\leq R_{i},i=1,2$, such that for $i=1,2$ and for any $p_{\overline{X}_{i}}$ $\in{\cal P}_{n}({\cal X}_{i})$,

[TABLE]

Furthermore, for any $\varphi_{\cal A}^{(n)}\in{\cal F}_{\cal A}^{(n)}(R_{\cal A})$, we have

[TABLE]

Proof:

We have the following chain of inequalities:

[TABLE]

Step (a) follows from Lemma 6 and Corollary 2. Step (b) follows from Lemma 1 part a). Hence there exists at least one deterministic code $\{(\varphi_{i}^{(n)},\psi_{i}^{(n)})\}_{i=1,2}$ such that

[TABLE]

from which we have that for $i=1,2$ and for any $p_{\overline{X}_{i}}\in{\cal P}_{n}({\cal X}_{i})$,

[TABLE]

Furthermore, we have that for any $\varphi_{\cal A}^{(n)}\in{\cal F}_{\cal A}^{(n)}(R_{\cal A})$,

[TABLE]

completing the proof. ∎

Proposition 1

For any $R_{\cal A},R_{1},R_{2}>0$, and any $p_{ZK_{1}K_{2}}$, there exist two sequences of mappings $\{(\varphi_{i}^{(n)},\psi_{i}^{(n)})\}_{n=1}^{\infty},i=1,2$ such that for $i=1,2$ and for any $p_{X_{i}}\in{\cal P}({\cal X}_{i})$, we have

[TABLE]

and for any eavesdropper $\mathcal{A}$ with $\varphi_{\mathcal{A}}$ satisfying $\varphi_{\mathcal{A}}^{(n)}\in{\cal F}_{\mathcal{A}}^{(n)}(R_{\mathcal{A}})$, we have

[TABLE]

Proof:

By Lemma 8, there exists $(\varphi_{i}^{(n)},$ $\psi_{i}^{(n)}),i=1,2,$ satisfying $(m_{i}/n)\log|{\cal X}_{i}|\leq R_{i}$, such that for $i=1,2$ and for any $p_{\overline{X}_{i}}$ $\in{\cal P}_{n}({\cal X}_{i})$,

[TABLE]

Furthermore for any $\varphi_{\cal A}^{(n)}\in{\cal F}_{\cal A}^{(n)}(R_{\cal A})$,

[TABLE]

The bound (25) in Proposition 1 has already been proved in (27). Hence it suffices to prove the bound (24) in Proposition 1 to complete the proof. On an upper bound of $p_{\rm e}(\phi_{i}^{(n)},\psi_{i}^{(n)}|p_{X_{i}}^{n}),i=1,2$, we have the following chain of inequalities:

[TABLE]

Step (a) follows from Lemma 3 and (26). Step (b) follows from Lemma 1 part a). ∎

V-D Explicit Upper Bound of

$\Theta(R_{1},R_{2},\varphi_{\cal A}^{(n)}|{p^{n}_{ZK_{1}K_{2}}})$

In this subsection we derive an explicit upper bound of $\Theta(R_{1},R_{2},\varphi_{\cal A}^{(n)}|{p^{n}_{ZK_{1}K_{2}}})$ which holds for any eavesdropper $\mathcal{A}$ with $\varphi_{\mathcal{A}}$ satisfying $\varphi_{\mathcal{A}}^{(n)}\in{\cal F}_{\mathcal{A}}^{(n)}(R_{\mathcal{A}})$. Define

[TABLE]

For $i=1,2$, define

[TABLE]

Furthermore, define

[TABLE]

By definition it is obvious that

[TABLE]

We have the following lemma.

Lemma 9

For any $\eta_{i}>0,i=1,2,3$ and for any eavesdropper $\mathcal{A}$ with $\varphi_{\mathcal{A}}$ satisfying $\varphi_{\mathcal{A}}^{(n)}\in{\cal F}_{\mathcal{A}}^{(n)}(R_{\mathcal{A}})$, we have the following:

[TABLE]

Specifically, if $n\geq[R_{1}+R_{2}]^{-1}$, we have

[TABLE]

Proof:

By (28), it sufficies to show (29) to prove Lemma 9. We set

[TABLE]

Then we have

[TABLE]

We further observe the following:

[TABLE]

Step (a) follows from $\log(1+a)\leq a$. We also note that

[TABLE]

From (32), (37), (38), we have the bound (29). ∎

On upper bound of $\wp_{i},i=1,2,3$, we have the following lemma:

Lemma 10

For any $\eta>0$ and for any eavesdropper $\mathcal{A}$ with $\varphi_{\mathcal{A}}$ satisfying $\varphi_{\mathcal{A}}^{(n)}\in{\cal F}_{\mathcal{A}}^{(n)}(R_{\mathcal{A}})$, we have that for each $i=1,2$, we have $\wp_{i}\leq\tilde{\wp}_{i}$, where

[TABLE]

and that for $i=3$, we have $\wp_{3}\leq\tilde{\wp}_{3}$, where

[TABLE]

The probability distributions appearing in the three inequalities (39), (40), and (41) in the right members of (42) have a property that we can select them arbitrary. In (39), we can choose any probability distribution $\hat{q}_{i,M_{\cal A}^{(n)}Z^{n}K_{i}^{n}}$ on ${\cal M}_{\cal A}^{(n)}$ $\times{\cal Z}^{n}$ $\times{\cal X}_{i}^{n}$. In (40), we can choose any distribution $Q_{i,Z^{n}}$ on ${\cal Z}^{n}$. In (41), we can choose any stochastic matrix $\tilde{Q}_{i,Z^{n}|M_{\cal A}^{(n)}}$: ${\cal M}_{\cal A}^{(n)}$ $\to{\cal Z}^{n}$. The probability distributions appearing in the three inequalities (43), (44), and (45) in the right members of (46) have a property that we can select them arbitrary. In (43), we can choose any probability distribution $\hat{q}_{3,M_{\cal A}^{(n)}Z^{n}K_{1}^{n}K_{2}^{n}}$ on ${\cal M}_{\cal A}^{(n)}$ $\times{\cal Z}^{n}$ $\times{\cal X}_{1}^{n}$ $\times{\cal X}_{2}^{n}$. In (44), we can choose any distribution ${Q}_{3,Z^{n}}$ on ${\cal Z}^{n}$. In (45), we can choose any stochastic matrix $\tilde{Q}_{3,Z^{n}|M_{\cal A}^{(n)}}$: ${\cal M}_{\cal A}^{(n)}$ $\to{\cal Z}^{n}$.

The above lemma is the same as Lemma 10 in the previous work **[6]**. Since the proof of the lemma is in **[6]**, we omit the proof of Lemma 10 in the present paper. We have the following proposition.

Proposition 2

For any $\varphi_{\cal A}^{(n)}\in{\cal F}_{\cal A}^{(n)}(R_{\cal A})$ and any $n\geq[R_{1}+R_{2}]^{-1}$, we have

[TABLE]

Proof: By Lemmas 9 and 10, we have for any

[TABLE]

The quantity $\tilde{\wp}_{i}+{\rm e}^{-n\eta_{i}},i=1,2,3$. is the same as the upper bound on the correct probability of decoding for one helper source coding problem in Lemma 1 in Oohama **[2]**(extended version). In a manner similar to the derivation of the exponential upper bound of the correct probability of decoding for one helper source coding problem, we can prove that for any $\varphi_{\cal A}^{(n)}\in{\cal F}_{\cal A}^{(n)}(R_{\cal A})$ there exist $\eta_{i}^{*},i=1,2,3$ such that for $i=1,2,3$, we have

[TABLE]

From (48) and (49), we have that for any $\varphi_{\cal A}^{(n)}\in{\cal F}_{\cal A}^{(n)}(R_{\cal A})$ and any $n\geq[R_{1}+R_{2}]^{-1}$,

[TABLE]

completing the proof. ∎

-E Proof of Lemma 7

In this appendix we prove Lemma 7. This lemma immediately follows from the following lemma:

Lemma 11

For $i=1,2$ and for any $n,m_{i}$ satisfying $(m_{i}/n)\log|{\cal X}_{i}|$ $\leq R_{i},$ we have

[TABLE]

*In fact, from $|{\cal X}_{i}^{m_{i}}|\leq{\rm e}^{nR_{i}}$ and (50) in Lemma 11, we have the bound (19) in Lemma 7. In this appendix we prove Lemma 11. In the following arguments, we use the following simplified notations: *

[TABLE]

We define

[TABLE]

Then, the conditional distribution of the random pair $(L_{1},L_{2})$ for given $M=a\in{\cal M}$ is

[TABLE]

Set

[TABLE]

Then the conditional divergence between $p_{L_{1}L_{2}|M}$ and $p_{V_{1}V_{2}}$ for given $M$ is given by

[TABLE]

The quantity $\Upsilon_{(\varphi_{1}(k_{1}),l_{1}),(\varphi_{2}(k_{2}),l_{2})}$ has the following form:

[TABLE]

The above form is useful for computing $\mbox{\bf E}[\Upsilon_{(\varphi_{1}(k_{1}),l_{1})}$ ${}_{,(\varphi_{2}(k_{2}),l_{2})}]$.

Proof:

Taking expectation of both side of (65) with respect to the random choice of the entry of the matrix $A_{i}$ and the vector $b_{i}$ representing the affine encoder $\varphi$, we have

[TABLE]

To compute the expectation $\mbox{\bf E}\left[\Upsilon_{(\varphi_{1}(k_{1}),l_{1}),(\varphi_{2}(k_{2}),l_{2})}\right]$, we introduce an expectation operator useful for the computation. Let $\mbox{\bf E}_{\varphi_{1}(k_{1})=l_{k_{1}},\varphi_{2}(k_{2})=l_{k_{2}}}[\cdot]$ be an expectation operator based on the conditional probability measures ${\rm Pr}\left(\cdot|\varphi_{1}(k_{1})=l_{k_{1}},\varphi_{2}(k_{2})=l_{k_{2}}\right)$. Using this expectation operator, the quantity $\mbox{\bf E}\left[\Upsilon_{(\varphi_{1}(k_{1}),l_{1}),(\varphi_{2}(k_{2}),l_{2})}\right]$ can be written as

[TABLE]

Note that

[TABLE]

From (67) and (68), we have

[TABLE]

Using (65), the expectation $\mbox{\bf E}_{\varphi_{1}(k_{1})=l_{1},\varphi_{2}(k_{2})=l_{2}}\left[\Upsilon_{(l_{1},l_{1}),(l_{2},}\right.$ $\left.{}_{l_{2})}\right]$ can be written as

[TABLE]

Applying Jensen’s inequality to the right member of (89), we obtain the following upper bound of $\mbox{\bf E}_{\varphi_{1}(k_{1})=l_{1},\varphi_{2}(}$ ${}_{k_{2})=l_{2}}\left[\Upsilon_{(l_{1},l_{1}),(l_{2},l_{2})}\right]$

[TABLE]

where we set

[TABLE]

Computing $\mbox{\bf E}_{1}$, we have

[TABLE]

Step (a) follows from that the random constructions of $\varphi_{1}$ and $\varphi_{2}$ are independent. Step (b) follows from Lemma 5 parts b) and c). In a similar manner we compute $\mbox{\bf E}_{2}$ to obtain

[TABLE]

We further compute $\mbox{\bf E}_{12}$ to obtain

[TABLE]

Step (a) follows from that the random constructuions of $\varphi_{1}$ and $\varphi_{2}$ are independent. Step (b) follows from Lemma 5 parts b) and c), From (103)-(106), we have

[TABLE]

From (66), (69), and (121), we have the bound (50) in Lemma 11. ∎