Semantic Security on Wiretap Channels using Universal Hashing with Fading Applications

TL;DR

This paper introduces a universal hashing-based method to convert error-correcting codes into semantically secure wiretap codes applicable to any channel, with bounds on information leakage valid for any message distribution.

Contribution

It presents a polynomial-time procedure using universal hash families to achieve semantic security from any error-correcting code, with new leakage bounds applicable to all message distributions.

Findings

Achieves semantic security with universal hashing on any channel

Provides bounds on information leakage valid for any message distribution

Establishes new secure rate bounds for various wiretap channels

Abstract

We furnish a procedure based on universal hash families (UHFs) that can convert an error correcting coding scheme (ECC) of rate $R$ into a semantically secure wiretap coding scheme of rate $R - \xi$ where $\xi$ is a parameter derived from the eavesdropper's point-to-point channel. This conversion is shown to be polynomial time efficient with block length and is applicable to any channel. When an ECC is chosen, our procedure induces a wiretap coding scheme that is concrete and efficient as long as the ECC is also such. To prove this induced wiretap coding scheme is semantically secure, we have constructed bounds on the information leaked to the eavesdropper. Our construction is an upgrade of bounds from recent literature: the novelty here being that our leakage bounds hold for any message distribution. Indeed, our wiretap procedure using UHFs and our characterization of its semantic leakage is the first main contribution of this work. The other main contribution of this work is as follows. We apply the aforementioned procedure to a variety of wiretap channels in order to show the procedure's efficacy, and as a result of such applications, our results establish new achievable semantically secure rates.

Equations

$$\frac{1}{n}I(M\wedge Z^n),M\sim \text{unif}(\mathcal{M}).$$

$$I(M\wedge Z^n),M\sim \text{unif}(\mathcal{M}).$$

$$\underset{P_M}{\max }I(M\wedge Z^n).$$

$$C_{\mathit{s}}\bigr{|}_{\text{weak}}=C_{\mathit{s}}\bigr{|}_{\text{semantic}}.$$

$$\mathcal{F}=\{f_s:{\mathcal{M}}^{\prime }\to \mathcal{M}|s\in \mathcal{S}\}.$$

$$|\{s\in \mathcal{S}|f_s(m_1^{\prime })=f_s(m_2^{\prime })\}|\le \frac{|\mathcal{S}|}{2^k}.$$

$$|\{s\in \mathcal{S}|f_s(m^{\prime })=m\}|=\frac{|\mathcal{S}|}{2^k}.$$

$$|\{m^{\prime }\in {\mathcal{M}}^{\prime }|f_s(m^{\prime })=m\}|=2^b.$$

$$H_{\alpha }(M^{\prime }|Z^{\ast })$$

$$=\frac{\alpha }{1-\alpha }\log {\int }_{{\mathcal{Z}}^{\ast }}\omega (z^{\ast }){\left(\sum _{m^{\prime }}\omega (m^{\prime }|z^{\ast }{)}^{\alpha }\right)}^{\frac{1}{\alpha }}\mu (d{z}^{\ast }).$$

$$H_{\infty }(M^{\prime }|Z^{\ast })=-\log {\int }_{{\mathcal{Z}}^{\ast }}\omega (z^{\ast })\underset{m^{\prime }}{\max }\omega (m^{\prime }|z^{\ast })\mu (d{z}^{\ast }),$$

$$H_2(M^{\prime }|Z^{\ast })=-2\log {\int }_{{\mathcal{Z}}^{\ast }}\omega (z^{\ast }){\left(\sum _{m^{\prime }}\omega (m^{\prime }|z^n{)}^2\right)}^{\frac{1}{2}}\mu (d{z}^{\ast }),$$

$$I_{\alpha }(M^{\prime }\wedge Z^{\ast })=\log |{\mathcal{M}}^{\prime }|-H_{\alpha }(M^{\prime }|Z^{\ast }).$$

$$\mathbb{P}\left[(M^{\prime },Z^{\ast })\in \mathcal{T}|M^{\prime }=m^{\prime }\right]\ge 1-ϵ,\forall m^{\prime }\in {\mathcal{M}}^{\prime }.$$

$$H_{\alpha }^{\mathcal{T}}(M^{\prime }|Z^{\ast })$$

$$=\frac{\alpha }{1-\alpha }\log {\int }_{{\mathcal{Z}}^{\ast }}\omega (z^{\ast }){\left(\sum _{m^{\prime }}{\omega }_{\mathcal{T}}(m^{\prime }|z^{\ast }{)}^{\alpha }\right)}^{\frac{1}{\alpha }}\mu (d{z}^{\ast }).$$

$$I_{\alpha }^{ϵ}(M^{\prime }\wedge Z^{\ast })=\underset{\mathcal{T}\in {\mathcal{T}}_{ϵ}}{\inf }{I}_{\alpha }^{\mathcal{T}}(M^{\prime }\wedge Z^{\ast }),$$

$$I_{\alpha }^{\mathcal{T}}(M^{\prime }\wedge Z^{\ast })=\log |{\mathcal{M}}^{\prime }|-H_{\alpha }^{\mathcal{T}}(M^{\prime }|Z^{\ast }).$$

$${\mathcal{F}}^{\ast }=\{f_{s,t}:{\mathcal{M}}^{\prime }\to \mathcal{M}|s\in \{0,1{\}}^l\setminus 0^l,t\in \{0,1{\}}^l\}$$

$${\varphi }_{s,t,R}(m)=s^{-1}\odot \left((m||R)\oplus t\right).$$

$$\underset{P_M}{\max }I(M\wedge Z^n)$$

$$\le \frac{1}{\ln 2}{2}^{\frac{1}{2}\left(-b+I_{\infty }^{ϵ}(M^{\prime }\wedge Z^n)\right)}+ϵk.$$

$$\underset{P_M}{\max }I(M\wedge Z^n)\le \frac{1}{\ln 2}{2}^{-\frac{n}{2}\left(R_{{\mathcal{C}}_n}-R_n-\frac{1}{n}{I}_{\infty }^{ϵ}(X^n\wedge Z^n)\right)}+ϵn{R}_n.$$

$$R_s<{\left(R_{\mathcal{C}}-\underset{n\to \infty }{\lim }\frac{1}{n}{I}_{\infty }^{ϵ}(X^n\wedge Z^n)\right)}^{+}$$

$$R_{\mathit{s}}<\big{(}R_{\mathcal{C}}-\xi\big{)}^{+}$$

$$R_s<{\left(C_T-C_E\right)}^{+}$$

$$\underset{n\to \infty }{\lim }\frac{1}{n}{I}_{\infty }^{ϵ}(X^n\wedge Z^n)\le \xi .$$

$$\log \underset{{\mathcal{Z}}^n}{\int }\underset{x^n\in {\mathcal{C}}_n}{\max }{\omega }_{\mathcal{T}}(z^n|x^n)\mu (d{z}^n)$$

$$C=\underset{P_X}{\max }I(X\wedge Y).$$

$$\underset{n\to \infty }{\lim }\frac{I_{\infty }^{ϵ}(X^n\wedge Z^n)}{n}\le C_E,$$

$$\frac{1}{n}{I}_{\infty }^{ϵ}(X^n\wedge Z^n)\le \frac{1}{n}\log \sum _{z^n}\underset{x^n\in {\mathcal{C}}_n}{\max }{\omega }_{\mathcal{T}}(z^n|x^n),$$

$$\frac{1}{n}{I}_{\infty }^{ϵ}(X^n\wedge Z^n)\le C_E+\frac{1}{n}o(n)$$

Full text

The other main contribution of this work is as follows. We apply the aforementioned procedure to a variety of wiretap channels in order to show the procedure’s efficacy, and as a result of such applications, we mirror existing results from literature regarding achievable semantically secure rates. More notably, in some cases our results establish new achievable semantically secure rates. For DMC wiretap channels and No-CSIT (instantaneous channel state information at the transmitter) fast fading wiretap channels, we show how our wiretap scheme can achieve the secrecy capacity in certain cases, but more generally, can always achieve a non-negative rate of $R-C_{E}$ under semantic security where $R$ is the rate of the ECC on the main channel and $C_{E}$ is the capacity of the eavesdropper’s point-to-point channel. On partial CSIT fast fading wiretap channels, we show that our wiretap coding scheme can achieve the best known secure achievable rates from literature, even under semantic security. On full CSIT fast fading wiretap channels, we show that our wiretap coding scheme can achieve the secrecy capacity. On AWGN wiretap channels, using a recent ECC from literature, we provide an end-to-end wiretap coding scheme that is concrete, polynomial time efficient in block length, semantically secure, and has both its probability of error and semantic leakage exponentially diminishing with block length. In fact, we prove that the semantic leakage in each of the previous cases is exponentially decreasing with block length.

I Introduction

Physical layer security exploits the inherent randomness in a communication environment to derive security; this form of security makes no assumptions on the eavesdropper’s capabilities. This is in direct contrast to computational based security which derives security based on the assumption that the eavesdropper has bounded computational resources.

Computational based security has been the de facto security for communication systems since its inception due especially to its ease of implementation; however, the main assumption of computational boundedness has been scrutinized in recent years more than ever. One of the primary reasons for this scrutiny is the potential advent of practical quantum computers in the near future. On the other hand, physical layer security is impervious to advances in computing, in particular quantum computing, because it makes no underlying assumptions on computational resources. Thus, regardless of the technology the eavesdropper possesses, physical layer security maintains its integrity. In this way, physical layer security is inherent security.

Given this clear advantage of physical layer security, it is still underutilized in modern communication systems. This is primarily because most proposed schemes to implement physical layer security are too impractical. The schemes are most often only theorized to exist with a tangible construction unknown, i.e., proofs are by existence and not by construction. Moreover, even when a construction is given, it is rarely efficient in block length.

Overcoming these hurdles has been one of the primary aims of the physical layer community for quite some time. But there is yet another reason physical layer security has not found common use in new communication systems; this reason is significantly more subtle. The measure of security provided by most physical layer security schemes is insufficient to be used in a practical setting.

There is no direct analog of this problem that arises from computational based security because in that case the underlying assumption that certain decision problems are computationally hard is unproven anyway. Here, in physical layer security where security is rigorously proven, the choice of how security is measured needs to be consistent with reality if the proof of security is to hold any merit.

If a physical layer scheme could be created that is tangible, efficient, utilizes the most realistic measure of security, and achieves an input/output rate near the theoretical maximum, then physical layer security could potentially rival computational based security as the de facto security of modern communication systems, or at the very least could be an indispensable component. Motivated by this, herein we develop a physical layer coding scheme that aims to satisfy all of these properties and in some cases even does.

I-A Background - Security Metrics

Physical layer security is often modeled by a wiretap channel which was introduced in the 1970’s by Wyner [1] and later generalized by Csiszár and Körner [2]. The metric used to measure security in these works is now colloquially referred to as the weak security metric. For years, this was the primary metric used to measure security on wiretap channels, however, it was asserted in the 1990’s in [3] that the weak metric provided an inadequate measure of security to be deemed practical. This led to the creation of the strong security metric, the unnormalized version of the weak metric.

This metric sufficed for awhile, but in 2012, this metric was again shown to be an inadequate measure of security for realistic communication systems by Bellare, Tessaro, and Vardy [4]. In addition to showing this, they created three new security metrics provably stronger than the strong security metric and proved them asymptotically equivalent. For the purposes of this paper, due to their equivalence, we will refer to all three of these metrics collectively as the semantic security metric, the name given in [4]. This metric is now held to be the gold standard of security metrics for the wiretap channel. Moreover, it is argued that a stronger security metric than the semantic security metric does not exist. For these reasons, it is the only measure of security that should be utilized in practice. Admittedly, proving results with this metric tend to be more arduous, therefore many results in literature still use the strong security metric and even the weak security metric, but in this work we will exclusively use the semantic metric to prove security.

I-B Background - Fading Channels

In addition to focusing on physical layer security schemes that are tangible, efficient, and utilize semantic security, we will be primarily concerned with the most realistic of wiretap channel models: the fading wiretap channel. Fading wiretap channels are commonly used to model security of wireless communications. It assumes the input signal is attenuated/amplified then corrupted by some additive noise. The amount of attenuation/amplification is called the channel state. When the channel state changes frequently and independently, we are in the so called fast fading regime. This is one of the most practical fading wiretap channel models and is the main focus of our applications.

Due to the nature of wireless systems, fading wiretap channels sometimes assume that the current channel state is fed back from the receiver to the transmitter (this is abbreviated by CSIT - instantaneous channel state information at the transmitter). However, since there are actually two point-to-point channels within a wiretap channel, the transmitter potentially receives both of these channel states, a channel state corresponding to the intended receiver’s channel and a channel state corresponding to the eavesdropper’s channel.

We denote the case when the transmitter knows neither of these channel states by No-CSIT, although we do assume the transmitter knows the statistics of the channel states as random variables. We denote the case when the transmitter knows the intended receiver’s current channel state but not the eavesdropper’s current channel state (only the statistics) by partial CSIT. Lastly, we denote the case when the transmitter knows both current channel states by full CSIT.

The level of CSIT drastically changes which secure rates are achievable. For this reason, we will treat No-CSIT, partial CSIT, and full CSIT as separate wiretap channels entirely.

I-C Related Work

In [4] and also in [5], a tangible (concrete) and efficient wiretap coding scheme was given that could achieve positive secrecy rates on discrete memoryless wiretap channels under semantic security. In certain cases, this wiretap scheme could also achieve the semantic secrecy capacity [6]. In [7], this scheme was extended for use on the AWGN wiretap channel and was shown to achieve the secrecy capacity, however, the wiretap scheme therein was only able to achieve positive secrecy rates under the strong security metric. In [8], however, this wiretap scheme was shown to achieve the strong secrecy capacity for both continuous and discrete wiretap channels. Their proof is a direct bound on the strong leakage and admits a nice characterization of the secure achievable rates. In [9], a wiretap scheme was shown to achieve the semantic secrecy capacity of AWGN wiretap channels, albeit in a completely different manner than the previously mentioned five papers. To date, there is currently no universal wiretap scheme that achieves the semantic secrecy capacity for both discrete memoryless and AWGN wiretap channels.

Physical layer security for fast fading wiretap channels was arguably started with Liang, Poor, and Shamai in [10] where they found the weak secrecy capacity of the fast fading wiretap channel with the assumption of full CSIT. This was later improved by Bloch and Laneman in [11] where they determined the secrecy capacity of this channel under the strong secrecy metric. In a different direction, Bloch and Laneman [12] considered the case of fast fading wiretap channels with partial CSIT; they gave a set of achievable secrecy rates under the strong secrecy metric for this channel. Their solution relies on an optimization problem that has no closed form solution and thus it represents the best known secrecy rate on the fast fading channel with partial CSIT. In the case of fast fading channels with No-CSIT, it was only recently shown in [13], [14], [15] that positive rates are actually achievable and an upper bound for the secrecy capacity is also derived. For a special class of fast fading No-CSIT channels, [14] actually finds the secrecy capacity of these channels under the weak secrecy constraint. In [16], a positive semantically secure achievable rate is obtained for fast fading channels with No-CSIT. To date, there are few results involving semantic security on fast fading wiretap channels. In particular, no one has constructed a wiretap scheme that achieves the best possible semantically secure rates for each case of CSIT. Moreover, hardly any wiretap schemes exist for fast fading channels that are tangle/efficient and come close to the best possible rates, even in the lesser weak and strong cases.

I-D Summary of Results

The main purpose of this paper is to amplify results of physical layer security into a more practical setting. We prove all of our results using the semantic security metric, the most demanding security metric in this field. Our wiretap coding scheme developed is modular in the sense that it can immediately be adapted to any existing channel to provide semantic security; furthermore, it is shown to be concrete and efficient111As will be made clear in Section III, we only prove the preprocessor is concrete and efficient; however, if the error correcting code is also such, then so is the entire wiretap coding scheme..

To prove our wiretap coding scheme is semantically secure, we bound the semantic leakage asymptotically (1). We do this by upgrading the strong leakage bounds found in [8]. In particular, we optimize over all message distributions. As in [7, 8], our wiretap scheme is a modular scheme consisting of a preprocessor based on UHFs. However, in order to guarantee that our scheme is semantically secure, we require the UHF to also have additional properties (we dub UHFs with these additional properties as semantically secure universal hash families - SS-UHFs). The additional properties are non-restrictive in general and we provide a particular implementation of an SS-UHF based on finite field arithmetic that is concrete and quadratic time efficient. In effect, our SS-UHF based preprocessor is a converter that takes in an off-the-shelf ECC and converts it to a semantically secure wiretap coding scheme (2).

In 1 below, we outline the necessary steps for using our wiretap scheme on an arbitrary wiretap channel. Use of this procedure attains semantic security for any wiretap channel contingent on certain conditions being satisfied which are derived from the wiretap channel. We show that these conditions are indeed satisfied for the DMC, AWGN, and fast fading wiretap channels where we examine the fading channels with various levels of instantaneous channel state information at the transmitter. In other words, we demonstrate this procedure, in effect, proving that our wiretap coding scheme can achieve semantically secure rates on these channels.

The following are our specific contributions on each of the aforementioned channels.

• •

DMC - In 3, we reestablish the result given by Tal and Vardy’s upgrade [6] of Bellare, Tessaro, and Vardy’s original result [4, 5]; that is, we show our wiretap coding scheme achieves the semantic secrecy capacity of any symmetric, degraded, discrete memoryless wiretap channel. However, we allow any ECC for the main point-to-point channel in our construction. This is in contrast to the previous results that impose certain restrictions on the ECC in order to achieve secrecy capacity.

• •

AWGN - In 4, we reestablish [9] by constructing a concrete, end-to-end efficient wiretap scheme and prove that it can achieve the secrecy capacity on the AWGN wiretap channel under semantic security. However, we prefer our wiretap scheme in the fact that it is modular: the same preprocessor used here can be used on any channel without modification.

• •

No-CSIT - In 5, we prove that our wiretap scheme achieves the semantic secrecy capacity here for the case when the eavesdropper’s channel is stochastically degraded (cf. [14]) with respect to the main channel. Furthermore, in other cases, we provide a set of semantically secure achievable rates.

• •

Partial CSIT - In 6, we prove that our wiretap scheme achieves the best known achievable secrecy rates to date (cf. [17]) with semantic security.

• •

Full CSIT - In 7, we prove that our scheme can actually achieve the strong secrecy capacity in this setting with semantic security thereby proving that semantic secrecy capacity is equivalent to the strong secrecy capacity and hence also the weak secrecy capacity.

All of the achievable semantically secure rates on these channels can be attained concretely and efficiently (1 and 2) - since our preprocessor is already such, one only needs to concentrate on finding an error correcting code that is concrete and efficient. Once this is done, the entire wiretap coding scheme is concrete and efficient! In other words, we have converted the problem of finding good wiretap coding schemes into a problem of finding good error correcting coding schemes where good here means concrete and efficient.

To recap, we give in this paper a procedure for attaining semantically secure rates in a concrete and efficient way for arbitrary wiretap channels. We apply this procedure in particular to the five aforementioned channels. Therefore, if the reader desires to attain semantically secure rates on one of these channels, all that remains is to find an error correcting code. As a special case, we have pointed the reader to an ideal error correcting code for the AWGN wiretap channel, thereby completing the procedure in this case in full. If the reader wants to attain semantic security on a wiretap channel not listed above, then the reader must apply 1 in its entirety. Specifically, the reader must check that the hypothesis of 2 is satisfied for that channel.

I-E Outline

The remainder of the paper is organized as follows. Section II introduces notation and gives the preliminary mathematical background necessary to proceed through the rest of the paper. Section III presents our modular wiretap coding scheme and gives a concrete and efficient implementation of the preprocessor based on finite field arithmetic. Section IV analyzes both the security and achievable rates of our proposed wiretap scheme and gives a procedure for how to utilize our main results on an arbitrary (discrete or continuous) wiretap channel. In Section V, we apply this procedure to the DMC and AWGN wiretap channels as a first application and show how our wiretap scheme replicates the best results from literature. Section VI considers fast fading wiretap channels with various levels of CSIT (No-CSIT, partial CSIT, and full CSIT) and gives semantically secure achievable rates for each of these. Moreover, we show how our wiretap scheme in these cases exceeds the best results from literature.

In an attempt to give a more polished presentation, we have assigned nearly all of the proofs to the appendices.

II Preliminaries

II-A Notation and Conventions

We shall write $a^{n}$ to denote an $n$-dimensional vector where $a_{i}$ denotes the $i$-th component, i.e., $a^{n}=(a_{1},\dots,a_{n})$. We use the usual notation $\left\lVert a^{n}\right\rVert$ to denote the Euclidean norm. We shall denote the indicator (or characteristic) function by $\mathbbm{1}_{\mathcal{A}}(x)$ or $\mathbbm{1}\left(x\in\mathcal{A}\right)$ and will take all logarithms in this paper to be base $2$ unless we write $\ln$, for which we mean the logarithm of base $e$. We will write $\mathbb{N}$, $\mathbb{R}$ and $\mathbb{C}$ to denote the set of natural, real, and complex numbers respectively. With a slight abuse of notation, we will write $\mathbb{R}_{+}$ to denote the set of non-negative reals. We will write $|\mathcal{A}|$ to denote the cardinality of set $\mathcal{A}$.

We will denote random variables by capital letters and will denote the spaces for which a random variable is defined by a respective scripted letter, e.g., $A$ is a random variable with values in $\mathcal{A}$. As usual we write $X\in\textnormal{unif}{\left(\mathcal{X}\right)}$ to denote that $X$ is a uniform random variable over some discrete set $\mathcal{X}$; we write $Y\in\mathcal{N}\left(a,b\right)$ to denote that $Y$ is a real Gaussian random variable with mean $a$ and standard deviation $b$; we write $Z\in\mathcal{CN}\left(a,b\right)$ to denote that $Z$ is a circularly symmetric complex Gaussian random variable with mean $a$ and standard deviation $b$.

We shall use the notation of [2, 8] and let $I(A\wedge B)$ denote the usual mutual information between random variables $A$ and $B$. We write $A\bot B$ when random variable $A$ is independent of $B$. We write $\mathbb{P}\left[\mathcal{A}\right]$ to denote the probability of event $\mathcal{A}$ and $\mathbb{E}\left[A\right]$ to denote the expected value of random variable $A$. When we want to be explicit about which random variable we are taking the probability (resp. expected value) with respect to, we shall denote the random variable by a subscript.

We denote all probability densities222Sometimes when we have a probability mass function, instead we will use the notation $P(\cdot)$ with appropriate subscripts as necessary. by $\omega(\,\cdot\,)$ defined by the Radon-Nykodym derivative with respect to some implicit reference measure; we will almost always denote this reference measure by $\mu$. We denote the conditional probability density in an analogous way as $\omega(\,\cdot\,|\,\cdot\,)$. As an example of our notation, if $A$ and $B$ are random variables on $\mathcal{A}$ and $\mathcal{B}$ respectively, then $\omega(a)$ denotes the probability density of $A$ and $\omega(b|a)$ denotes the conditional probability density of $B$ given $A=a$.

When algorithms are completed in polynomial time (in the worst case) then we take up the standard convention and call such algorithms efficient.

II-B Channels

Let $\mathcal{X}$ and $\mathcal{Y}$ be sets. We shall denote a stochastic map by $T:\mathcal{X}\leadsto\mathcal{Y}$. Given $x\in\mathcal{X}$, a stochastic map assigns a likelihood that $x$ will map to a certain $y\in\mathcal{Y}$. For each $x\in\mathcal{X}$, this induces the random variable $T(x)$. The support of this random variable, $\text{supp}(T(x))\subset\mathcal{Y}$, is the elements in $\mathcal{Y}$ that $T$ can map $x$ to with non-zero likelihood.

Let $T:\mathcal{X}\leadsto\mathcal{Y}$ be some stochastic map, $X$ a random variable on $\mathcal{X}$, $\mu$ some reference measure on $\mathcal{Y}$, and $Y=T\circ X=T(X)$. We will call the conditional density $\omega(y|x)$ the transition density of the stochastic map $T$ and we will call the tuple $(\mathcal{X},\omega(y|x),\mathcal{Y})$ a channel. We will often abuse language/notation and call $T$ itself a channel. The transition density probabilistically tells us how the channel is mapping $\mathcal{X}$ to $\mathcal{Y}$. Given that some symbol $x\in\mathcal{X}$ was sent across the channel, the probability that $Y$ is in some subset $\mathcal{U}\subset\mathcal{Y}$ is given by $\int_{\mathcal{U}}\omega(y|x)\mu(dy)$.

For the rest of this paper, we will be considering subnormalized channels: channels with transition densities such that $\int_{\mathcal{Y}}\omega(y|x)\mu(dy)\leq 1$. This is a technical condition that allows us to define the following. Given a channel $T=(\mathcal{X},\omega(y|x),\mathcal{Y})$ and subset $\mathcal{T}\subset\mathcal{X}\times\mathcal{Y}$ denote $\omega_{\mathcal{T}}(y|x)=\omega(y|x)\mathbbm{1}\left((x,y)\in\mathcal{T}\right)$. This induces a restricted channel as follows. Given that $x\in\mathcal{X}$ was sent across the restricted channel, the probability that $Y$ is in some subset $\mathcal{U}\subset\mathcal{Y}$ is given by $\int_{\mathcal{U}}\omega_{\mathcal{T}}(y|x)\mu(dy)=\int_{\mathcal{U}}\omega(y|x)\mathbbm{1}\left((x,y)\in\mathcal{T}\right)\mu(dy)$.

II-C Error Correcting Codes

We will always refer to the number of channel uses333Note that we are only considering discrete-time channels in this work. as the block length (of the code) and denote it by $n$. As usual, we will mainly be considering the $n$-letter extension of channel $T$ notated by $T^{n}=(\mathcal{X}^{n},\omega(y^{n}|x^{n}),\mathcal{Y}^{n})$.

Let $\mathcal{M}^{\prime}$ be some finite message set. An $n$-length encoder for $T^{n}$ is an injective function $e_{n}:\mathcal{M}^{\prime}\to\mathcal{X}^{n}$. The image $e_{n}(\mathcal{M}^{\prime})\subset\mathcal{X}^{n}$ is called the codebook and is denoted $\mathscr{C}_{n}$. Elements of the codebook are referred to as codewords. An $n$-length decoder for $T^{n}$ is a function $d_{n}:\mathcal{Y}^{n}\to\mathcal{M}^{\prime}$ and an $n$-length code is a tuple $\mathcal{C}_{n}=(e_{n},d_{n})$. The rate of the code is given by $R_{\mathcal{C}_{n}}=\frac{1}{n}\log|\mathcal{M}^{\prime}|$. Lastly, a family of codes $\{\mathcal{C}_{n}\}_{n\in\mathbb{N}}$ is called a coding scheme $\mathcal{C}$ with rate given by $R_{\mathcal{C}}=\lim_{n\to\infty}R_{\mathcal{C}_{n}}$, where we assume this limit exists.

The maximum probability of error for code $\mathcal{C}_{n}$ is given by $\mathbb{P}_{e}(\mathcal{C}_{n})=\max_{M^{\prime}\in\mathcal{M}^{\prime}}\mathbb{P}[(d_{n}\circ T^{n}\circ e_{n})(M^{\prime})\neq M^{\prime}]$. If $\mathbb{P}_{e}(\mathcal{C}_{n})$ is sufficiently small then $\mathcal{C}_{n}$ is called an error correcting code (ECC). If every code in scheme $\mathcal{C}$ is an ECC, we call $\mathcal{C}$ an ECC scheme. If $\mathbb{P}_{e}(\mathcal{C}_{n})\to 0$ as $n\to\infty$ then we say the scheme $\mathcal{C}$ is reliable. In particular, if $\log(\mathbb{P}_{e}(\mathcal{C}_{n}))\leq-an^{b}$ for some constants $a,b>0$ and for every $n$, then we call the ECC scheme $\mathcal{C}$ exceptionally reliable.

Remark .

It was noted in [4] that “good” error correcting coding schemes in practice should satisfy the reliability condition exponentially fast; they called such ECC schemes “strongly reliable.” Due to the plethora of definitions containing the wording “strong” in the literature, we have instead called such ECC schemes here “exceptionally reliable.”

For continuous channels (i.e. $\mathcal{X}=\mathcal{Y}=\mathbb{R}$) we shall always impose the average power constraint as usual. In more detail, for some fixed constant $P$, we shall require the code to satisfy $\frac{1}{n}||x^{n}||^{2}\leq P$ for every $x^{n}\in\mathscr{C}_{n}$.

The supremum of reliable achievable rates over all ECC schemes is known as the (point-to-point) channel capacity. We shall denote the channel capacity of a channel $T$ by $C_{T}$.

II-D Wiretap Codes

Let $T=(\mathcal{X},\omega(y|x),\mathcal{Y})$ be a channel that models the communication between a transmitter Alice and intended receiver Bob. Let $E=(\mathcal{X},\omega(z|x),\mathcal{Z})$ be a channel modeling the unintended communication between Alice and a passive eavesdropper Eve. We call the pair of channels $W=(T,E)$ the wiretap channel.

Note that we have chosen the letters $T$, $E$, and $W$ so as to denote the Transmission channel, Eavesdropper’s channel, and Wiretap channel. We also note that the $n$-letter wiretap channel is given by $W^{n}=(T^{n},E^{n})$.

The goal of physical layer security as modeled by a wiretap channel is for Alice to communicate information reliably to Bob while keeping that same information hidden from Eve. Let $M\in\mathcal{M}$ be the random variable representing the message Alice wants to impart to Bob yet keep secret from Eve. Let $Z^{n}\in\mathcal{Z}^{n}$ be the $n$-letter random variable representing Eve’s output. To measure security, we recall the most common security metrics.

• •

[1] Weak:

[TABLE]

• •

[18] Strong444Strong security is sometimes referred to as MIS-R, cf. [4].:

[TABLE]

• •

[4] Semantic:

[TABLE]

We refer to each of these quantities as leakage and we say that a coding scheme is secure under a given metric if its respective leakage goes to 0 as $n\rightarrow\infty$. In a similar fashion to exceptional reliability, we say that a coding scheme is exceptionally secure if the leakage is vanishing exponentially fast with $n$.

Remark .

The expression for semantic security above is technically called mutual information security (MIS) as originally defined in [4]. Semantic security (in the wiretap context) is actually defined using guessing probabilities. However, therein it was shown for discrete channels (and in [19] for continuous channels) that MIS was equivalent to semantic security asymptotically. Thus, in the asymptotic regime there is no need to differentiate between the two metrics because each implies the other. Hence, our choice of name is technically justified.

However, one may still ask why we call the definition above “semantic security” when it is actually the definition of MIS; the reasoning is as follows. The definition of semantic security in [4] is named such to allude to the gold standard definition from computational based security [20]. However, the definition of semantic security is considerably less tractable than the definition of MIS. In order to get the best of both worlds, we have chosen our naming convention. We note that it is a convention already followed by other works.

Let $\mathcal{W}=\{\mathcal{W}_{n}\}_{n\in\mathbb{N}}$ be a coding scheme for channel $T$ (and inherently channel $E$) using message set $\mathcal{M}$. We say $\mathcal{W}$ is a $\mathfrak{X}$-wiretap coding scheme, where $\mathfrak{X}\in\{\text{weak},\text{strong},\text{semantic}\}$, if it satisfies each of the following.

• •

Reliability: $\mathcal{W}$ is a reliable ECC scheme for $T$.

• •

Security: $\mathcal{W}$ is secure (relative to $E$) using the $\mathfrak{X}$-metric.

If these two conditions are satisfied exceptionally, then we say that $\mathcal{W}$ is an outstanding $\mathfrak{X}$-wiretap coding scheme.

If $R_{\mathit{s}}=\lim_{n\to\infty}\frac{1}{n}\log|\mathcal{M}|$ is the rate of an $\mathfrak{X}$ wiretap coding scheme, then we say $R_{\mathit{s}}$ is an $\mathfrak{X}$** achievable secrecy rate.** We call the supremum of all $\mathfrak{X}$ achievable secrecy rates the $\mathfrak{X}$** secrecy capacity** denoted by C_{\mathit{s}}\bigr{|}_{\mathfrak{X}} or simply $C_{\mathit{s}}$ when the metric is clear from context.

Fact 1**.**

If all secure rates $R_{\mathit{s}}$ achievable under the weak secrecy metric are also achievable under the semantic secrecy metric, then:

[TABLE]

II-E Universal Hashing

Let $\mathcal{M}=\{0,1\}^{k}$ be the set of binary strings of length $k$, $\mathcal{M}^{\prime}$ and $\mathcal{S}$ be finite sets, and $S$ a uniform random variable on $\mathcal{S}$. Consider now a family of a finite number of functions indexed by $\mathcal{S}$:

[TABLE]

1. (i)

$\mathcal{F}$ is called a universal hash family (UHF) if for every $m^{\prime}_{1}\neq m^{\prime}_{2}\in\mathcal{M}^{\prime}$,

[TABLE] 2. (ii)

$\mathcal{F}$ is called uniform if for every $m^{\prime}\in\mathcal{M}^{\prime}$ and for every $m\in\mathcal{M}$,

[TABLE] 3. (iii)

$\mathcal{F}$ is called $b$-regular if for every $s\in\mathcal{S}$ and for every $m\in\mathcal{M}$,

[TABLE] 4. (iv)

$\mathcal{F}$ is called invertible if for each $s\in\mathcal{S}$ there exists some stochastic mapping $\phi_{s}:\mathcal{M}\leadsto\mathcal{M}^{\prime}$ such that for all $m\in\mathcal{M}$ and $y\in\text{supp}(\phi_{s}(m))$, $f_{s}(y)=m$. If $\phi_{s}(m)$ is a uniform random variable for every $s\in\mathcal{S}$ and $m\in\mathcal{M}$ then we call $\mathcal{F}$ evenly invertible. 5. (v)

Lastly, we call $\mathcal{F}$ a semantically secure universal hash family (SS-UHF) if it is: (i) universal, (ii) uniform, (iii) $b$-regular, and (iv) evenly invertible.

Many of the definitions here coincide with those found in computer science literature. The conditions of being a universal hash family (as introduced in [21]) and uniform are found in most textbooks on hash families. The condition of being $b$-regular and invertible can be found in [5] and [8]. That being said, we have invented some terminology. We have dubbed hash families that are universal, uniform, $b$-regular, and evenly invertible as semantically secure universal hash families to emphasize that hash families with these four properties are the proper ones for inducing semantic security (see Section IV).

II-F $\epsilon$-smooth $\alpha$-Mutual Information

In order to measure the amount of information leaked to the eavesdropper using our wiretap scheme, we will need to employ the use of a different measure of information, known as $\alpha$-mutual information. $\alpha$-mutual information is defined using Rényi entropy and is actually a generalization of the usual mutual information defined by Shannon.

For a discrete random variable $M^{\prime}$ over $\mathcal{M}^{\prime}$, the following generalizes Shannon’s entropy and is called Rényi entropy of order $\alpha\in(1,\infty)$ [22]: $H_{\alpha}(M^{\prime})=\frac{1}{1-\alpha}\log\left(\sum_{m^{\prime}}\omega(m^{\prime})^{\alpha}\right)$. This can be extended by continuity to the cases of $\alpha=1$ and $\alpha=\infty$ where $H_{1}(M^{\prime})$ is the usual Shannon entropy and $H_{\infty}(M^{\prime})$ is the usual min-entropy. In particular, when $M^{\prime}$ is uniform, for any $\alpha\in[1,\infty]$ we have $H_{\alpha}(M^{\prime})=\log(|\mathcal{M}^{\prime}|)$, a fact we will use frequently.

In a similar way, one can define conditional Rényi entropy, however, there is no universal notion of such a definition in literature as different definitions can be employed based on the specific properties one desires (cf. [23, 24]). We will be using Arimoto’s definition [25, 26] given as follows.

Let $Z^{*}$ be an arbitrary random variable over $\mathcal{Z}^{*}$ (with measure $\mu$ on $\mathcal{Z}^{*}$) and $M^{\prime}$ a discrete random variable over $\mathcal{M}^{\prime}$. Then conditional Rényi entropy of order $\alpha\in(1,\infty)$ is given by:

[TABLE]

Just as in the case of (unconditioned) Rényi entropy, this definition can be extended to the cases of $\alpha=1$ and $\alpha=\infty$ by continuity. For $\alpha\to 1$, one easily checks using L’Hospitals rule that $H_{\alpha}(M^{\prime}|Z^{*})$ becomes $H(M^{\prime}|Z^{*})$, the conditional Shannon entropy. For $\alpha\to\infty$, the definition becomes

[TABLE]

and is often referred to as conditional min-entropy. Another important case for which we would like to emphasize is when $\alpha=2$:

[TABLE]

which is often referred to as conditional collision entropy.

Now let us finally define $\alpha$-mutual information: the Rényi extension to Shannon’s mutual information. Again, there is no universal definition in literature but we will be using the definition put forth in [26] for the special case when $M^{\prime}$ is a uniform random variable.

Let $M^{\prime}$ and $Z^{*}$ be random variables as before except now we require $M^{\prime}$ to be uniform over $\mathcal{M}^{\prime}$. For $\alpha\in[1,\infty]$ we define the $\alpha$-mutual information between $M^{\prime}$ and $Z^{*}$ by

[TABLE]

Notice that $I_{1}(M^{\prime}\wedge Z^{*})$ is exactly Shannon’s mutual information $I(M^{\prime}\wedge Z^{*})$ so in this case we will drop the subscript. Moreover, for the case of $\alpha=2$, we will often call $I_{2}(M^{\prime}\wedge Z^{*})$ collision-information and for the case of $\alpha=\infty$, we will often call $I_{\infty}(M^{\prime}\wedge Z^{*})$ max-information.

Fact 2**.**

[26, 27]** For any $\alpha\in[1,\infty]$, $I_{\alpha}(M^{\prime}\wedge Z^{*})$ is monotonically increasing in $\alpha$.

Note that this fact justifies the name of $I_{\infty}(M^{\prime}\wedge Z^{*})$ as max-information because it measure the most amount of information of all of the $\alpha$-mutual informations.

The $\alpha$-mutual information also admits several other desirable properties of an “information measure” which can be found in [27]. Note however that this definition of $\alpha$-mutual information is not symmetric in its arguments and does not satisfy the chain rule in general. This of course is in contrast to Shannon’s mutual information.

To facilitate our proofs later on we will also need a concept called $\epsilon$-smooth $\alpha$-mutual information. Basically, we will define $\alpha$-mutual information on a portion of the entire space that probabilistically contains enough content up to some $\epsilon$. To make this rigorous we first introduce the concept of a typical set.

For $\epsilon\geq 0$, we call a subset $\mathcal{T}\subset\mathcal{M}^{\prime}\times\mathcal{Z}^{*}$ a $(1-\epsilon)$-typical set if

[TABLE]

Furthermore, we will denote the set of all $(1-\epsilon)$-typical sets by $\mathscr{T}_{\epsilon}$. Typical sets intuitively contain almost all that there is to know about our space up to some $\epsilon$, hence the name typical.

For some typical set $\mathcal{T}$, we first define the conditional Rényi entropy of order $\alpha$ restricted to $\mathcal{T}$. This is simply given by

[TABLE]

Given $\epsilon\geq 0$ define $\epsilon$-smooth $\alpha$-mutual information for $M^{\prime}$ uniform over $\mathcal{M}^{\prime}$ by

[TABLE]

where $\alpha$-mutual information evaluated on $\mathcal{T}$ is given by

[TABLE]

Given some threshold $\epsilon$, we find the smallest value that $\alpha$-mutual information could possibly be when defined on the subnormalized channels corresponding to those sets that contain enough probability with respect to our threshold. Later, we will bound the leakage between the transmitter and eavesdropper as an increasing function of this metric; thus, defining $\epsilon$-smooth $\alpha$-mutual information using the infimum provides the tightest bound we should expect when $\epsilon$ is our threshold.

Note that when $\epsilon=0$, $\mathscr{T}_{\epsilon}$ contains only sets equal to the entire space less a set of measure zero and hence $I_{\alpha}^{0}(M^{\prime}\wedge Z^{*})=I_{\alpha}(M^{\prime}\wedge Z^{*})$.

Analogous to 2 we have the following ordering for $\epsilon$-smooth $\alpha$-mutual information, a result we will use in proving our wiretap scheme is secure.

Lemma 1**.**

For any $\mathcal{T}\subset\mathcal{M}^{\prime}\times\mathcal{Z}^{*}$ and $\alpha\in[1,\infty]$, $I_{\alpha}^{\mathcal{T}}(M^{\prime}\wedge Z^{*})$ is monotonically increasing in $\alpha$.

Proof.

This follows easily from the proof given for [26, Proposition 1] replacing the densities $\omega(m^{\prime}|z^{*})$ by $\omega_{\mathcal{T}}(m^{\prime}|z^{*})$ and noting that all inequalities still hold. ∎

III A Wiretap Coding Scheme

In this section we will furnish a wiretap coding scheme $\mathcal{W}$ for an arbitrary555Here arbitrary indeed means any discrete-time wiretap channel; however, a positive secrecy rate may not be attainable on some wiretap channels. wiretap channel which is based on a wiretap scheme put forth in [5], [7], and [8]. We will first define each step of this scheme and show that it is reliable (we will show security in the next section). Then we will give a particular implementation and show that this implementation is efficient with respect to the block length $n$.

Over an arbitrary wiretap channel $W=(T,E)$ our wiretap coding scheme $\mathcal{W}$ involves combining an SS-UHF with a reliable ECC already in use over the main point-to-point channel. This modular wiretap scheme is precisely the scheme put forth in [5, 7, 8] except there the UHF was only required to be $b$-regular and evenly invertible. Here, we are also demanding that our UHF be uniform. The necessity of this extra property will be elucidated in the next section when we prove that our scheme is semantically secure.

Consider Figure 1; this describes our wiretap scheme overall. We will now describe in detail each layer.

III-A Preprocessing Layer

Consider the finite sets $\mathcal{M}=\{0,1\}^{k}$ and $\mathcal{M}^{\prime}=\{0,1\}^{l}$ with $l>k$. We shall refer to $M\in\mathcal{M}$ as the actual message and $M^{\prime}\in\mathcal{M}^{\prime}$ as the pseudo-message because $M$ represents the information the transmitter actually wishes to impart to the intended receiver securely, whereas $M^{\prime}$ is some random variation of the actual message necessary for security. We will not assume which distribution the message $M$ takes.

Over a fixed arbitrary finite set $\mathcal{S}$, the transmitter will first draw a seed $S\sim\textnormal{unif}(\mathcal{S})$ to be used for the remainder of transmission. We assume the seed is independent of the message $M$ and that the realized seed is publicly available to all parties. All communication must take place over the wiretap channel; however, we show in Appendix C that the transmitter can send the seed before the transmission of an actual message with no asymptotic loss in rate or security.

The transmitter now chooses an SS-UHF $\mathcal{F}=\{f_{s}:\mathcal{M^{\prime}}\to\mathcal{M}\,|\,s\in\mathcal{S}\}$. Suppose each function $f_{s}$ in the SS-UHF has its invertible stochastic mapping given by $\phi_{s}$. Choosing our message as $M=m$ and seed as $S=s$, we will choose our pseudo-message to be $M^{\prime}=\phi_{s}(m)$. Since $\mathcal{F}$ is evenly invertible and $b$-regular, $M^{\prime}$ is a uniform random variable on $2^{b}$ elements of $\mathcal{M}^{\prime}$. In particular, $\omega(m^{\prime}|m,s)=2^{-b}\mathbbm{1}\left(m^{\prime}\in\text{supp}(\phi_{s}(m))\right)=2^{-b}\mathbbm{1}\left(f_{s}(m^{\prime})=m\right)$.

III-B Coding Layer

The transmitter chooses some reliable ECC scheme666We always assume that the scheme satisfies the power constraint for the channel if there is one. $\mathcal{C}=\{\mathcal{C}_{n}\}_{n\in\mathbb{N}}.$ We will assume (as per standard) that each party has full knowledge of $\mathcal{C}$. Thus, for a given blocklength $n$, each party knows $\mathscr{C}_{n}$ is the codebook and we have inherently induced new channels: $T^{n}:\mathscr{C}_{n}\to\mathcal{Y}^{n}$ and $E^{n}:\mathscr{C}_{n}\to\mathcal{Z}^{n}$. We will henceforth be considering these as the main transmission channel and eavesdropper’s channel respectively for the remainder of this work. At this point the transmitter encodes the pseudo-message $M^{\prime}$ using $e_{n}$, this will be a random variable $X^{n}=e_{n}(M^{\prime})$ over $\mathscr{C}_{n}$. Now the transmitter sends $X^{n}$ over the wiretap channel $W=(T,E)$; that is, the channel input $X^{n}$ is sent across $T^{n}$ but also across $E^{n}$ inherently.

III-C Intended Receiver’s Decoding Layer

The intended receiver will receive a noisy version of the channel input $Y^{n}=T^{n}(e_{n}(M^{\prime}))$. The goal of the intended receiver is to correctly guess which realization of the random variable $M^{\prime}$ was sent given the realization of the random variable $Y^{n}$. This is accomplished using the estimate $\widehat{M}^{\prime}=d_{n}(Y^{n})$. Since we have assumed $\mathcal{C}$ to be reliable, each $\mathcal{C}_{n}$ is an ECC and thus the probability of error $\mathbb{P}_{e}(\mathcal{C}_{n})$ is considerably low. In particular, for some finite $n$ this means there is a high probability that $\widehat{M}^{\prime}$ will equal $M^{\prime}$; this equality happens almost surely asymptotically with $n$. In short, the intended receiver will be able to undo the coding layer entirely.

Next, the intended receiver shall post-process $\widehat{M^{\prime}}$ to an estimate of the actual message $\widehat{M}$ using the hash function corresponding to the public seed $S$. That is, given that $S=s$ the intended receiver’s estimate is given as $\widehat{M}=f_{s}(\widehat{M}^{\prime})$. Since we assumed our SS-UHF to be invertible, if $\widehat{M}^{\prime}$ is equal to $M^{\prime}$ then the UHF is guaranteed to map $\widehat{M}^{\prime}$ to $M$ (the original message); however, we showed that this happens almost surely asymptotically with $n$. In this sense, the pre/post processing layers do not subtract anything from our reliability. In more detail, if $\mathcal{C}$ is reliable to begin with then our entire wiretap scheme will also satisfy reliability. Furthermore, if $\mathcal{C}$ is exceptionally reliable, then our wiretap scheme is exceptionally reliable as well.

III-D Eavesdropper’s Decoding Layer

Once the eavesdropper receives her channel output $Z^{n}=E^{n}(e_{n}(M^{\prime}))$ she will attempt to decode it in a similar fashion to that of the intended receiver; however, we will not assume how she decodes her output since that could affect our measure of security. As a side note, in contrast to computational based security methods, we also do not assume the boundedness of resources at the eavesdropper.

III-E Discussion

As in [8], we call the preceding scheme modular since the pre/post processing layers are not intrusive to the main channel in any way in terms of either reliability or constructibility. That is, our preprocessing layer could be added to any already existing communication system without changing any core components of the original system.

III-F Explicit Construction

Does such a wiretap scheme exist? By extensions of Shannon’s channel coding theorem we know that if $R_{\mathcal{C}}<C_{T}$ then a reliable ECC scheme $\mathcal{C}$ exists. Since our wiretap scheme is a concatenation of a pre/post processing layer with a reliable ECC, we now only need to be concerned if such a pre/post processing scheme exists; in particular, if an SS-UHF exists.

In this subsection we give an explicit construction of an SS-UHF. Our construction is inspired by those given in [5, 7, 8]; however, there, the UHF’s can be shown to not satisfy uniformity which is essential to our proof showing our wiretap scheme is semantically secure in the next section.

Consider the following family of functions

[TABLE]

where $f_{s,t}(m^{\prime})=\left[\left(s\odot m^{\prime}\right)\oplus t\right]_{k}$ and $\mathcal{M}=\{0,1\}^{k}$ and $\mathcal{M}^{\prime}=\{0,1\}^{l}$ as before. Here, all $l$-length bit strings correspond to their respective elements in the finite field $GF(2^{l},\oplus,\odot)$ (where $\oplus$ and $\odot$ denote addition and multiplication in the field respectively), $[\cdot]_{k}$ selects the $k$ most significant bits, and $0^{l}$ denotes the all-[math] bit string of length $l$ (which is correspondent to the additive identity in $GF(2^{l})$). As a remark, we note that $\oplus$ here is equivalent to modulo-2/bitwise/XOR addition and $\mathcal{S}=\{0,1\}^{l}\setminus 0^{l}\times\{0,1\}^{l}$ where $|\mathcal{S}|=(2^{l}-1)2^{l}$.

For some random variable $R\sim\textnormal{unif}(\{0,1\}^{l-k})$ and $(s,t)\in\mathcal{S}$ consider the inverses of $f_{s,t}$ given by

[TABLE]

Here $s^{-1}$ is the inverse element of $s$ in $GF(2^{l})$ (which always exists because $s$ is non-zero) and $(\cdot||\cdot)$ represents usual bit-string concatenation.

Proposition 1**.**

The family of functions $\mathcal{F}^{*}$ is an SS-UHF.

Proof.

See Appendix A. ∎

With this we have constructed a concrete (algorithmic) implementation of an SS-UHF: this means that our wiretap coding scheme $\mathcal{W}$ of the previous subsection always exists. Specifically, our pre/post processing layers are given concretely so that if the reliable ECC $\mathcal{C}$ is also given concretely, then so is the entire wiretap scheme. Let us emphasize again that this is in contrast to much of the literature wherein wiretap schemes are implicitly defined through proofs by existence.

The fact that our wiretap scheme is explicitly given is necessary for realistic wiretap schemes but not quite enough in terms of practicality. We would also like our scheme to be efficient with block length $n$. Fortunately, our pre/post processing scheme is efficient as proven in the next proposition. In other words, when the reliable ECC scheme $\mathcal{C}$ is efficient, so is the entire wiretap scheme.

Proposition 2**.**

Given $m\in\mathcal{M}$, $(s,t)\in\mathcal{S}$, and $r\in\{0,1\}^{l-k}$, the inverse $\phi_{s,t,r}(m)$ can be computed in quadratic-time with respect to $n$. 2. 2.

Given $(s,t)\in\mathcal{S}$ and $m^{\prime}\in\mathcal{M}^{\prime}$, the function $f_{s,t}(m^{\prime})$ can be computed in quadratic time with respect to $n$.

Proof.

See Appendix A. ∎

In conclusion of this section, we have constructed a concrete and efficient wiretap scheme that is polynomially time computable with block length $n$. We note that the construction given here is by no means unique and one could use any concrete and efficient SS-UHF as the pre/post processing layers of our wiretap scheme $\mathcal{W}$.

IV Achievable Semantically Secure Rates

We have already seen that the wiretap scheme we constructed in Section III satisfies the reliability property of a wiretap scheme as long as the ECC $\mathcal{C}$ is reliable (and does so exceptionally when $\mathcal{C}$ is chosen to be exceptionally reliable). Now we need to show that the scheme satisfies the security property of a wiretap scheme as well. In this section we will do just that by constructing leakage bounds for the semantic metric. It will turn out that under certain conditions our leakage bounds asymptotically go to 0 implying that our scheme is a semantically secure wiretap scheme. In particular, under further restrictions, our wiretap scheme is shown to be outstanding.

It is noted that leakage bounds for arbitrary wiretap channels using evenly invertible, $b$-regular UHFs are already given in [8]; however, the leakage there assumes the secret message $M$ follows a uniform distribution and hence will only lead to strong security at best. As a reminder, strong security is not a sufficient measure of security in real world applications because often times messages are not uniformly distributed. We therefore need to generalize the leftover hash lemma (channel version) in [8] to overcome this obstacle. What becomes obvious upon proof is that considering UHF’s that are only evenly invertible and $b$-regular is not quite restrictive enough to lead to semantic security; this explains why in our wiretap coding scheme of Section III we chose our UHF to also be uniform.

For the remainder of this section, we will write $\mathcal{W}=\{\mathcal{W}_{n}\}$ to be the modular wiretap coding scheme described in Section III.

IV-A Semantic Leakage Bounds

Theorem 1**.**

Using $\mathcal{W}$ on any wiretap channel $W=(T,E)$, for $\epsilon\geq 0$ we have

[TABLE]

Proof.

See Appendix B. ∎

Note the striking resemblance of our first inequality to [28, Theorem 3] for secret key agreements. There, they also used universal hashing to amplify privacy. Also note that our bounds generalize those provided in [8]. Therein, the message was assumed to be uniform, whereas here we make no a priori assumptions on $P_{M}$. Admittedly, we require an SS-UHF for the pre/post processors whereas they require an SS-UHF less the uniform requirement for the pre/post processors. However, we have provided in Section III-F an efficient and concrete construction, thereby alleviating any doubts that such a hash family exists. Lastly, we note that an attempt to generalize the bounds of [8] to the ones given here has already been given in literature but was redacted due to an error. Our approach is noticeably different allowing our proof to overcome said error.

We will only be concerned with the second inequality of 1 for the remainder of this paper. It is considerably more tractable computationally and has already been studied in [8].

Recall the wiretap scheme $\mathcal{W}$ consists of a pre/post processor and an ECC scheme $\mathcal{C}$. 1 makes no a priori assumptions on what that ECC scheme is. Once we actually pick the ECC, however, we can characterize 1 more appropriately. In particular, suppose we choose a reliable ECC $\mathcal{C}=\{\mathcal{C}_{n}\}$ with each $\mathcal{C}_{n}$ having rate $R_{\mathcal{C}_{n}}=\frac{l}{n}$ and with the overall rate of each $\mathcal{W}_{n}$ given by $R_{n}=\frac{k}{n}$. Now since the ECC has been chosen, there is a deterministic bijective mapping between $\mathcal{M}^{\prime}$ and $\mathscr{C}_{n}=e_{n}(\mathcal{M}^{\prime})$. Thus if $M^{\prime}$ is a random variable on $\mathcal{M}^{\prime}$ then $e_{n}(M^{\prime})$ is a random variable on $\mathscr{C}_{n}$ with the same distribution as $M^{\prime}$. For convenience, define the random variable $X^{n}=e_{n}(M^{\prime})$ and note that it is defined only over $\mathscr{C}_{n}$ not $\mathcal{X}^{n}$. With these observations in mind, we can reformulate 1 as follows.

Corollary 1**.**

Using $\mathcal{W}$ with reliable deterministic ECC $\mathcal{C}$ on any wiretap channel $W=(T,E)$, for $\epsilon\geq 0$ we have

[TABLE]

IV-B Semantically Secure Rates

With the previous two bounds on the semantic leakage in mind, we would like to know under what conditions they asymptotically (with respect to $n$) approach 0. In this way, those conditions will tell us precisely when our wiretap coding scheme $\mathcal{W}$ is semantically secure. It is fortunate that these conditions can be described in terms of $R_{\mathit{s}}$ (the asymptotic achievable secrecy rate), $R_{\mathcal{C}}$ (the rate of the ECC scheme), and $\frac{1}{n}I_{\infty}^{\epsilon}(X^{n}\wedge Z^{n})$ ($\epsilon$-smooth max-information per channel symbol).

Let $(\cdot)^{+}=\max(\,\cdot\,,0)$. The following theorem characterizes which secure rates are achievable under semantic security and we will be using its conclusions frequently throughout the rest of this paper.

Theorem 2**.**

Using $\mathcal{W}$ with a reliable deterministic ECC $\mathcal{C}$ on any wiretap channel $W=(T,E)$, if $\epsilon$ is chosen such that $\epsilon n\to 0$ as $n\to\infty$ then we have the following.

1. (1)

[TABLE]

using semantic security. 2. (2)

If $\lim_{n\to\infty}\frac{1}{n}I_{\infty}^{\epsilon}(X^{n}\wedge Z^{n})\leq\xi$ then

[TABLE]

using semantic security. 3. (3)

If $\epsilon$ is exponentially diminishing to 0 with $n$, then for any secure rates as in (1) and (2), $\mathcal{W}$ is exceptionally semantically secure. Moreover, if $\mathcal{C}$ is exceptionally reliable, then $\mathcal{W}$ is an outstanding semantically secure wiretap scheme.

Proof.

See Appendix B. ∎

Remark .

In Section VI, we will apply this theorem to channels with side information (extra information available to Alice that may help her deduce better security or reliability, of which fading channels are a special case). In that case, we will restate this theorem in a more suitable form (see 3).

Given any wiretap channel, 2.1 says all one needs to do is calculate $\lim_{n\to\infty}\frac{1}{n}I_{\infty}^{\epsilon}(X^{n}\wedge Z^{n})$, then use of the wiretap scheme $\mathcal{W}$ will guarantee that rates $R_{s}$ are achievable with semantic security. However, finding this limit is probably not feasible. For fixed $n$, the $\epsilon$-smooth max-information is basically an $n$-dimensional integral where each point of the integral is a maximization over a set with roughly $2^{n}$ elements. This problem is exponentially hard unless one can exactly characterize the “regions” of the integrand that have the same maximum. Characterization of these regions is an interesting line of future work but we do not explore that any further here.

Luckily, we do not need to calculate $\lim_{n\to\infty}\frac{1}{n}I_{\infty}^{\epsilon}(X^{n}\wedge Z^{n})$ exactly. 2.2 says an upper bound to this limit suffices. We will primarily be using this result for the remainder of this paper due to its tractability. In forthcoming sections we will see that this still yields surprisingly favorable results.

The leakage bound, $\xi$, in 2.2 can be thought of as a parameter of the eavesdropper’s channel. Moreover, it can be thought of as the loss we incur when converting an ECC into a semantically secure wiretap code by our procedure. That is, given an ECC of rate $R_{\mathcal{C}}$, our procedure converts that ECC into a semantically secure wiretap code of rate $R_{\mathcal{C}}-\xi$.

2.3 says that in order to control the speed by which the semantic leakage diminishes with $n$, we only need to control the speed by which $\epsilon$ diminishes with $n$ where we recall that $\epsilon$ is a parameter that controls how much of the total space (with respect to probability) we are considering. We note that when $\epsilon=0$ we are always considering the entire space for every $n$ so that the condition of 2.3 is trivially satisfied and we have exceptional semantic security. We will not pursue such an approach in this paper as the $\epsilon>0$ case is much more manageable. However, in all of our applications, $\epsilon$ will be exponentially diminishing with $n$ so that we will get exceptional semantic security.

Recall that $C_{T}$ is the point-to-point channel capacity of Alice and Bob’s channel and $C_{E}$ is the point-to-point channel capacity of Alice and Eve’s channel. The following is a special case of 2.2.

Corollary 2**.**

If $\xi=C_{E}$, $\epsilon n\to 0$ as $n\to\infty$, and we pick a reliable deterministic ECC $\mathcal{C}$ with rate arbitrarily close to $C_{T}$ then

[TABLE]

with semantic security.

This corollary is particularly satisfying considering that many channels have their weak secrecy capacity given by $C_{T}-C_{E}$. Thus in those cases, if we can satisfy the conditions of 2, we can achieve the secrecy capacity using our wiretap scheme $\mathcal{W}$ and moreover, we immediately have proven that the semantic secrecy capacity is equivalent to the weak secrecy capacity by using 1, a result not known in general.

IV-C Summary of Wiretap Coding Scheme

Let us end this section by summarizing what we have shown for our wiretap scheme so far and explain how this can be applied in practice and in theory.

Our wiretap scheme outlined precisely in Section III is a combination of a pre/post processor based on an SS-UHF together with a reliable ECC scheme. We constructed a concrete and efficient SS-UHF in Section III and showed that it did not affect the reliability of the ECC scheme. Hence, since we always assume the ECC scheme is chosen to be reliable, our entire wiretap scheme is always reliable. Moreover, when the ECC is exceptionally reliable the entire scheme is also exceptionally reliable.

In this section, we showed that over a truly arbitrary wiretap channel, our wiretap scheme’s semantic leakage can be bounded using 1 or 1. Moreover, if the threshold probability $\epsilon$ of our space (a parameter solely designed to aide in the proof) is chosen so that $\epsilon n\to 0$ as $n\to\infty$ then 2 gives us a precise characterization of when our wiretap coding scheme is semantically secure over any wiretap channel.

To this end, we find it beneficial to outline the steps one shall take in applying our wiretap scheme to a wiretap channel of their choice.

Procedure 1**.**

The following is the general procedure one should take when using our wiretap scheme over an arbitrary wiretap channel $W=(T,E)$.

Find which achievable rates $R_{\mathit{s}}$ are supported on $W$.

• •

For each $n$, construct a $(1-\epsilon)$-typical set $\mathcal{T}$ where $\epsilon n\to 0$ as $n\to\infty$.

• –

Preferably* construct $\mathcal{T}$ so that $\epsilon$ is exponentially diminishing to 0 so that we induce exceptional semantic security.*

• •

Find an upper bound $\xi$ such that

[TABLE]

• –

Ideally, one should find the smallest possible $\xi$ as to guarantee higher achievable rates.

• –

One could also compute $\lim_{n\to\infty}\frac{1}{n}I_{\infty}^{\epsilon}(X^{n}\wedge Z^{n})$ directly as mentioned previously, but currently this is seemingly intractable. 2. 2.

Choose operating point $R_{\mathit{s}}$.

• •

We can achieve all rates R_{\mathit{s}}<\big{(}R_{\mathcal{C}}-\xi\big{)}^{+} with semantic security (2.2).

• –

We must choose $R_{\mathcal{C}}>\xi$ in order to have positive secrecy rates using our wiretap scheme over $W$. However, if this is not possible then either $\xi$ was chosen poorly or the channel does not allow a positive semantic secrecy rate with our wiretap scheme. 3. 3.

Build the wiretap coding scheme $\mathcal{W}$.

• •

Find a reliable ECC scheme $\mathcal{C}$ of rate $R_{\mathcal{C}}$ for use over the main point-to-point channel.

• –

Preferably* choose $\mathcal{C}$ as follows:*

Concrete, so that the entire wiretap scheme is concrete.

• *

Efficient, so that the entire wiretap scheme is efficient.

• *

Exceptionally reliable, so that the entire wiretap scheme is exceptionally reliable.

• •

Use the finite field SS-UHF of 1 as the pre/post processor of this wiretap scheme.

• –

One could use any SS-UHF in practice but it is preferable to use one like ours that is concrete and efficient.

Remark .

Note that if $\epsilon$ is exponentially diminishing to 0 and $\mathcal{C}$ is chosen exceptionally reliable then $\mathcal{W}$ is an outstanding wiretap scheme.

V Applications I

In this section, we show how to actually use 1. We apply 1 to both the discrete memoryless wiretap channel (DMWC) and the memoryless additive white Gaussian noise wiretap channel (AWGN). In particular, on the AWGN and symmetric, degraded DMWCs, we achieve the semantic secrecy capacity. Lastly, we explain how our scheme can be applied in theory in the finite regime; i.e. we explain results for finite $n$.

Before we begin, we will write max-information in a more convenient form. This is both so that we can use the supporting results of [8], but also because this alternative form will have a better interpretation here.

Lemma 2**.**

The $\epsilon$-smooth max-information $I_{\infty}^{\epsilon}(X^{n}\wedge Z^{n})$ can alternatively be written as the infimum of

[TABLE]

over all $(1-\epsilon)$-typical sets $\mathcal{T}$.

Proof.

See Appendix D. ∎

V-A Semantic security on a DMWC

For our first application of 2 and 1, we consider DMWCs. This is the case when both the intended receiver’s channel and the eavesdropper’s channel are given by distinct point-to-point discrete memoryless channels (DMC). We represent the input signal by the discrete random variable $X$, Bob’s output signal by the discrete random variable $Y$, and Eve’s output signal by the discrete random variable $Z$.

Fact 3**.**

(cf. [29]) The point-to-point capacity of a DMC with input $X$ and output $Y$ is given as

[TABLE]

In particular we denote $C_{T}=\max_{P_{X}}I(X\wedge Y)$ and $C_{E}=\max_{P_{X}}I(X\wedge Z)$. As described in 1, in order to characterize a set of semantically secure rates, we need to asymptotically bound the max-information per channel symbol of Eve’s channel. The following lemma provides this bound.

Lemma 3**.**

Using a reliable ECC scheme $\mathcal{C}$, the max-information per channel symbol of the DMC $E$ is asymptotically bounded as

[TABLE]

where $\epsilon$ is exponentially decreasing to 0 with $n$.

Proof.

Using Lemma 2 (where $\mu$ is the counting measure) we can write

[TABLE]

for any $(1-\epsilon)$-typical set $\mathcal{T}$.

Luckily, [8, Lemma 5] proved a bound on this right hand term for the same modular pre/post processing scheme less our uniform requirement. Thus, by their result we immediately have that there exists a constant $c>0$ such that for $\epsilon=e^{-nc}$:

[TABLE]

where $\frac{1}{n}o(n)$ is a term diminishing to [math] as $n\rightarrow\infty$. This completes the claim asymptotically with $n$. ∎

With this bound we can apply 2.2 immediately to describe the semantically secure rates our wiretap scheme can achieve. However, in certain cases we can achieve the secrecy capacity (with semantic security), i.e. the best possible semantically secure rate. In order to describe this, let us recall the following fact.

Fact 4**.**

[30]** The secrecy capacity of a DMWC where the eavesdropper’s channel is noisier than the main channel and both channels are weakly symmetric is given by

[TABLE]

With this fact, we can state our main result of this subsection, a characterization of semantically secure achievable rates for the DMWC. Note that this result was already proven in [5] and [6], but we restate this here to show the efficacy of our proposed wiretap coding scheme and the fact that our proof differs significantly.

Theorem 3**.**

On any DMWC, our wiretap scheme $\mathcal{W}$ can achieve all secure rates,

[TABLE]

with exceptional777Recall that exceptional here means that the semantic leakage diminishes to 0 exponentially fast with $n$.* semantic security.* 2. 2.

On a DMWC where both channels are weakly symmetric and the eavesdropper’s channel is noisier than the main channel we can achieve the secrecy capacity under exceptional semantic security when $R_{\mathcal{C}}$ achieves the main channel capacity $C_{T}$.

Proof.

This follows from 2.2 and 2 combined with Lemma 3 and 4. ∎

The first part of this proposition emphasizes that our wiretap scheme $\mathcal{W}$ acts as a converter. If we input an ECC scheme for the DMC $(\mathcal{X},\omega(y|x),\mathcal{Y})$ of rate $R_{\mathcal{C}}>C_{E}$, then our procedure converts that ECC scheme into an exceptionally semantically secure wiretap code for a DMWC of rate $R_{\mathit{s}}$.

The second part of this proposition says that on degraded symmetric DMWCs, our conversion respects the optimality of rates. Specifically, it says that given an optimal ECC scheme, i.e. an ECC scheme achieving the point-to-point main channel capacity, our procedure converts this ECC scheme into an exceptionally semantically secure wiretap code of optimal rate, i.e. a wiretap scheme achieving the secrecy capacity.

With this, we again emphasize that our conversion is concrete and efficient. Thus, if the ECC scheme is such, so is the entire wiretap scheme. Moreover, if the ECC scheme is exceptionally reliable, the wiretap scheme is outstanding888Recall the definition of an outstanding wiretap coding scheme from Section II-D..

V-B Semantic security for AWGN wiretap channels

We consider now the additive white Gaussian noise (AWGN) memoryless wiretap channel where both the intended receiver’s channel and eavesdropper’s channel are given by distinct AWGN memoryless channels. We represent the input signal by the real random variable $X$ (where we suppose it satisfies the average power constraint $P$) and the additive white Gaussian noise by the real random variable $U$. The channels $T$ and $E$ can be described by their outputs given respectively as

[TABLE]

The random variables $U_{T}$ and $U_{E}$ are assumed mutually independent and sampled i.i.d. according to $\mathcal{N}(0,\sigma_{T}^{2})$ and $\mathcal{N}(0,\sigma_{E}^{2})$ respectively.

Fact 5**.**

(cf. [29]) The capacity of an AWGN channel with average input power constraint $P$ and additive noise variance $\sigma^{2}$ is given by

[TABLE]

In particular, this means the capacity of the intended receiver’s point-to-point channel is given by $C_{T}=\frac{1}{2}\log(1+\frac{P}{\sigma_{T}^{2}})$ and the capacity of the eavesdropper’s point-to-point channel is given by $C_{E}=\frac{1}{2}\log(1+\frac{P}{\sigma_{E}^{2}})$.

Our goal of this subsection is to describe the semantically secure achievable rates that our wiretap scheme $\mathcal{W}$ can achieve. Using 1 we already have a prescription of how to do this by bounding the max-information per channel symbol.

Lemma 4**.**

Using a reliable ECC scheme $\mathcal{C}$, the max-information per channel symbol of an AWGN eavesdropper channel $E$ is asymptotically bounded as

[TABLE]

where $\epsilon$ is exponentially decreasing to 0 with $n$.

Proof.

Using Lemma 2 (where $\mu$ is the Lebesgue measure) we can write

[TABLE]

for any $(1-\epsilon)$-typical set $\mathcal{T}$.

Again, [8, Lemma 6] proved a bound on this right hand term for the same modular pre/post processing scheme less our uniform requirement. Thus, by their result we immediately have the following bound for every $\delta>0$ small:

[TABLE]

Here $\epsilon=\exp(-n\delta^{n}/8)$ and $\frac{1}{n}o(n)$ is a term diminishing to 0 as $n\to\infty$.

Since this holds for every $\delta>0$ this completes the claim asymptotically with $n$. ∎

Remark .

A reworked proof of [8, Lemma 6] can be found in our Appendix D (Lemma D1). We feel it is worthwhile to see the proof of this statement for the AWGN wiretap channel, since later (specifically in 5 and 6), we prove a more complicated analogous result for the No-CSIT and partial CSIT wiretap channels.

Again, now that we have this bound in hand, we can apply 2.2 to describe the semantically secure rates our wiretap scheme can achieve. However, we notice that we can actually achieve the best possible rates after considering the following fact.

Fact 6**.**

[31]** On an AWGN wiretap channel $W=(T,E)$, the weak secrecy capacity is given as:

[TABLE]

Remark .

This fact can be upgraded to strong secrecy using the usual technique (cf. [17]). Only recently was this fact upgraded to semantic secrecy [9].

Using this fact, we have the following main result of this subsection.

Theorem 4**.**

On an AWGN wiretap channel, our wiretap scheme $\mathcal{W}$ can achieve all secure rates

[TABLE]

with exceptional semantic security as long as $R_{\mathcal{C}}>C_{E}$. 2. 2.

In particular, when $R_{\mathcal{C}}$ achieves the main channel capacity $C_{T}$, then our wiretap scheme achieves the secrecy capacity under exceptional semantic security.

Proof.

This follows from 2.2 and 2 combined with Lemma 4 and 6. ∎

Remark .

In an independent way from [9], 4.2 shows that the semantic secrecy capacity is equivalent to the weak secrecy capacity for the AWGN wiretap channel using 1.

Note that $\mathcal{W}$ is exceptionally semantically secure so that if $\mathcal{C}$ is also chosen to be exceptionally reliable, then our entire wiretap coding scheme is outstanding999Again recall the definition of an outstanding wiretap coding scheme from Section II-D..

Indeed an ECC scheme is given in [32] that is concrete, reliable, and has quadratic time complexity with respect to block length $n$ in both encoding and decoding. Moreover, it has probability of error exponentially decreasing to 0 so that it is exceptionally reliable. Thus using this particular ECC scheme with our SS-UHF implementation given in 1 gives an end-to-end wiretap coding scheme for the AWGN wiretap channel that is concrete, efficient, outstanding, semantically secure, and can achieve the secrecy capacity.

Note that the wiretap scheme used in [9] has every single one of these properties as well. However, their wiretap coding scheme is based on polar lattices and is not modular. In contrast, our scheme is modular: the exact same pre/post processor used here (that is, the SS-UHF of 1) can be used on any channel (discrete or continuous); one just needs to find a reliable ECC scheme for the given point-to-point channel.

V-C Finite Analysis

Thus far we have exclusively focused on asymptotic analysis of our wiretap scheme. Despite this, 1 gives an extremely useful bound of security and rates in the finite regime, that is, for a fixed finite coding blocklength $n$. We do not pursue this line any further here, but for an interesting look into finite block length analysis see Yang, Schaefer, and Poor’s result [33] which also uses a UHF based scheme to derive upper and lower bounds on the achievable rates in the finite regime.

VI Applications II - Fading

In this section, we will consider even more applications of 2 and 1, specifically, applications to fading wiretap channels. Fading wiretap channels are the prototypical physical layer security models of wireless communication.

It is standard to assume some feedback of channel state information to Alice that will help her deduce the current fade and increase her overall secure transmission rate. In this sense it is obvious that fading wiretap channels are only a particular instance of a much more general case of wiretap channels: wiretap channels with side information. Side information is any information in the form of a random variable available to Alice before transmission that may be advantageous. In this way, it may help her induce more reliability or security, which in turn may help her ascertain a higher secure achievable rate. Hence, by studying wiretap channels with side information, we are inherently considering fading wiretap channels by inclusion.

To study wiretap channels with side information we will first need to manipulate the language we have introduced thus far. Let $\Lambda^{n}\in\mathcal{H}^{n}$ represent the $n$ pieces of side information that may be advantageous to the transmitter. Because we always deal in the worst case for security, it is necessary to assume that the eavesdropper also knows $\Lambda^{n}$, thus we will need to convert the previously defined security metrics in the obvious way to account for this. However, as is a common trick in fading, we can consider the entire tuple $(Z^{n},\Lambda^{n})$ to be the eavesdropper’s output instead of only $Z^{n}$ as before. Thus, for wiretap channels with side information, the semantic security metric has its leakage given by $\max_{P_{M}}I(M\wedge Z^{n},\Lambda^{n})$.

With this trick, we can also consider our main result, 2, redone for side information, however, we will only need part 2 and part 3 of that theorem.

Corollary 3** (2 redux).**

Using $\mathcal{W}$ with a reliable deterministic ECC $\mathcal{C}$ on any wiretap channel $W=(T,E)$, if $\epsilon$ is chosen such that $\epsilon n\to 0$ as $n\to\infty$ we have the following.

• •

If $\lim_{n\to\infty}\frac{1}{n}I_{\infty}^{\epsilon}(X^{n}\wedge Z^{n},\Lambda^{n})\leq\xi$ then101010As a reminder, $(\cdot)^{+}=\max(\,\cdot\,,0)$.**

[TABLE]

using semantic security.

• •

If $\epsilon$ is exponentially diminishing to 0 with $n$, then for any secure rates above, $\mathcal{W}$ is exceptionally semantically secure. In particular, if $\mathcal{C}$ is exceptionally reliable, then $\mathcal{W}$ is an outstanding semantically secure wiretap scheme.

Remark .

• •

We call this a corollary due to the numerous references hereafter; however, it is in itself just 2 in the case where side information is present.

• •

Recall that $I_{\infty}^{\epsilon}(X^{n}\wedge Z^{n},\Lambda^{n})$ is defined as the infimum of $I_{\infty}^{\mathcal{T}}(X^{n}\wedge Z^{n},\Lambda^{n})$ over all $(1-\epsilon)$-typical sets $\mathcal{T}$. To be precise, we note that now $\mathcal{T}\subset\mathscr{C}_{n}\times\mathcal{H}^{n}\times\mathcal{Z}^{n}$.

It will be beneficial in the sequel to characterize $I_{\infty}^{\mathcal{T}}(X^{n}\wedge Z^{n},\Lambda^{n})$ in the following way.

Lemma 5**.**

Let $X^{n}$ be a random variable over $\mathscr{C}_{n}$ and $\Lambda^{n}$ be some side information. If $X^{n}\bot\Lambda^{n}$ then

[TABLE]

Proof.

See Appendix F. ∎

Remark .

Indeed $X^{n}\bot\Lambda^{n}$ seems to be a restrictive assumption, however, it is not, as the forthcoming proofs will make clear.

Until this point, we have been general with respect to side information. We really do allow any extra information available to the transmitter that could be used to aide in a higher secure rate. However, we will now be focusing on fading wiretap channels, that is, when side information is a tuple of fading coefficients.

VI-A Fading Preliminaries

The general channel model used to model wireless communication environments is that of the fading channel, where the output signal is an attenuation of the input signal layered with additive white Gaussian noise. The attenuation, input, and noise are represented using the complex random variables $H$, $X$, and $U$ respectively. The output of this channel at time $i$ is then given as

[TABLE]

where $X_{i}\in\mathbb{C}$, $H_{i}\in\mathbb{C}$, and $U_{i}\sim\mathcal{CN}(0,\sigma^{2})$. Here, $\mathcal{CN}(0,\sigma^{2})$ is a circularly-symmetric normal distribution with [math] mean and variance $\sigma^{2}$. We shall refer to the random variable representing attenuation, $H$, as the channel coefficient.

For the purposes of this paper, we will only be considering fast fading channels, that is, the fading coefficient is sampled i.i.d. for each use of the channel (cf. [34]). In particular, we will consider the case of fast fading wiretap channels, i.e., channels $T$ and $E$ are both taken to be fast fading channels. More specifically, during the $i$-th symbol of the codeword, the output at Bob from channel $T$ and the output at Eve from channel $E$ are given respectively by

[TABLE]

where $U_{T,i}$ and $U_{E,i}$ are i.i.d. $\mathcal{CN}(0,\sigma_{T}^{2})$ and $\mathcal{CN}(0,\sigma_{E}^{2})$ additive noise respectively, $X_{i}\in\mathbb{C}$ is subject to the power constraint $\mathbb{E}\left[|X|^{2}\right]\leq P^{\prime}$, and the coefficients $H_{T,i},H_{E,i}\in\mathbb{C}$ are also i.i.d. and $H_{T,i}\bot H_{E,j}$ for all $i,j$. For technical reasons we assume that the second order moment of $|H_{E}|$ exists, i.e., $\mathbb{E}[|H_{E}|^{2}]<\infty$. We note that this is not a very limiting constraint since it can be interpreted as the channel having an attenuation with finite energy. Apart from this, we do not assume which distribution the channel coefficients follow so as to remain as general as possible. Note that this is in contrast to much of the fast fading literature that a priori assumes a distribution on both $H_{T}$ and $H_{E}$.

Achievability results for fading channels depend on which parties have instantaneous access to the realizations of $H_{T,i}$ and $H_{E,i}$, or rather, which parties have full channel state information. If a party only has access to the statistics of $H_{T,i}$ or $H_{E,i}$ we say that party has no channel state information.

Fact 7**.**

On a complex fast fading channel, if the receiver has full channel state information (CSIR) then the channel can be decomposed into two real parallel channels.

Proof.

See Appendix F for the usual proof. ∎

For the remainder of this paper, we will assume both the intended receiver and the eavesdropper have full channel state information (CSIR) about their respective channels. In particular, this means that we will only be considering the real fast fading channels given at time $i$ as $Y_{i}=|H_{T,i}|X_{i}+U_{T,i}$ and $Z_{i}=|H_{E,i}|X_{i}+U_{E,i}$ due to 7. Since carrying around the modulus on the channel coefficients is cumbersome, we shall simply write $H_{T}$ and $H_{E}$ for the remainder of the paper where it will be clear that both are non-negative real random variables instead of complex as previously mentioned. An illustration of our setup is given in Figure 2.

Thus far, we have made no assumptions as to what information the transmitter has about the channel coefficients $H_{T}$ and $H_{E}$. We shall notate full channel state information at the transmitter by CSIT and will focus on three separate cases. The first case we will consider is No-CSIT where the transmitter has knowledge only of the main channel and eavesdropper channel statistics. Next we will consider partial CSIT, where the transmitter has instantaneous knowledge of the main channel’s realizations of $H_{T}$ at each time $i$ but no knowledge of the eavesdropper’s instantaneous channel coefficient - only its statistics. Finally, we will consider full CSIT, where the transmitter has instantaneous knowledge of both the main channel’s and eavesdropper channel’s realizations of $H_{T}$ and $H_{E}$ respectively.

For each of these scenarios, we wish to characterize a set of achievable secure rates. To do so, we utilize 3 with Lemma 5 where we take the side information to be $\Lambda^{n}=(H_{T}^{n},H_{E}^{n})$.

VI-B Fading: No-CSIT

The case of No-CSIT, where the transmitter knows only the channel statistics of both the main and eavesdropper channels, is arguably the most realistic scenario of a modern wireless communication environment. It requires no special real-time feedback implementation for the main channel and assumes that the eavesdropper is purely a malicious party (although still passive). Under this assumption, in this subsection we give a set of semantically secure achievable rates for the fast fading wiretap channel. To the best of the authors’ knowledge, this is the first time semantic security has been characterized on the fast fading wiretap channel with No-CSIT in general. To do so, we find an asymptotic upper bound, $\xi$, to the leakage max-information per channel symbol, i.e., $\frac{1}{n}I_{\infty}^{\epsilon}(X^{n}\wedge Z^{n},H_{T}^{n},H_{E}^{n})$, for any choice of code so as to use 3 and 1. In particular, we will be focused on $\xi=C_{E}$, where $C_{E}$ denotes the point-to-point channel capacity of the eavesdropper’s channel.

We start by first simplifying the expression for max-information of Lemma 5 in the case of No-CSIT.

Lemma 6**.**

On the No-CSIT real fast fading channel, max-information can be simplified as

[TABLE]

where $X^{n}$ is a random variable over $\mathscr{C}_{n}$.

Proof.

See Appendix F. ∎

With codeword power constraint $P$ and noise variance $\sigma^{2}$, we note the following fact.

Fact 8**.**

[34]** The point-to-point capacity of a real fast fading channel with No-CSIT is given by

[TABLE]

where $H$ is the random variable representing the channel coefficient.

To this end, our goal for the remainder of this section will be to show

[TABLE]

such that $\mathsf{SNR}$ denotes the eavesdropper’s average signal to noise ratio $P/\sigma_{E}^{2}$. In particular, we need to show the above holds for some $(1-\epsilon)$-typical set $\mathcal{T}$ such that $\epsilon$ is exponentially decreasing to [math] as $n\to\infty$.

We begin by constructing such a set $\mathcal{T}$ and showing that it is typical in an exponential fashion with respect to $n$. The set is made up of three constituent sets; one each concerning the output power, noise power, and eavesdropper channel coefficient power.

We define111111Motivation for defining these typical sets is based on a sphere packing argument and can be found in Appendix E. the following sets for $\delta_{n},\delta_{n}^{\prime},\delta_{n}^{\prime\prime}>0$ small:

• •

$\mathcal{P}^{1}_{n}$ as the set of tuples $(h_{E}^{n},z^{n})\in\mathbb{R}_{+}^{n}\times\mathbb{R}^{n}$ such that

[TABLE]

• •

$\mathcal{P}^{2}_{n}$ as the set of $z^{n}\in\mathbb{R}^{n}$ that satisfy

[TABLE]

given a fixed $x^{n}\in\mathscr{C}_{n}$ and $h_{E}^{n}\in\mathbb{R}_{+}^{n}$,

• •

$\mathcal{P}^{3}_{n}$ as the set of $h_{E}^{n}\in\mathbb{R}_{+}^{n}$ that satisfy

[TABLE]

Intuitively, $\mathcal{P}^{1}_{n}$ corresponds to the set of eavesdropper output powers and channel coefficients most likely to occur in conjunction. $\mathcal{P}^{2}_{n}$ corresponds to the least amount of noise added to $h_{E}^{n}x^{n}$ during transmission. $\mathcal{P}^{3}_{n}$ corresponds to the set of eavesdropper channel coefficients that we expect to occur and is needed for technical reasons. The following lemma proves that events from each of these sets occur with sufficiently high probability.

Lemma 7**.**

Consider121212$K^{*}$ is a parameter of the channel defined in Appendix G, 12. the constant $c=1/(4K^{*})>0$.

Let $\epsilon_{n}^{1}=2e^{-nc\delta_{n}^{2}}$. For any $x^{n}\in\mathscr{C}_{n}$,

[TABLE] 2. 2.

Let $\epsilon_{n}^{2}=e^{-\frac{n}{4}{\delta^{\prime}_{n}}^{2}}$. For any $x^{n}\in\mathscr{C}_{n}$ and $h_{E}^{n}\in\mathbb{R}_{+}^{n}$,

[TABLE] 3. 3.

Let $\epsilon_{n}^{3}=2e^{-nc{\delta^{\prime\prime}_{n}}^{2}}$. Then,

[TABLE]

Proof.

See Appendix G. ∎

We now use the sets constructed above to create our typical set. Define each of the following sets:

[TABLE]

We can think of each of these three sets as the expansion set that corresponds to each of the previous three sets $\mathcal{P}^{1}_{n}$, $\mathcal{P}^{2}_{n}$, and $\mathcal{P}^{3}_{n}$ but lives in the space $\mathscr{C}_{n}\times\mathbb{R}_{+}^{n}\times\mathbb{R}^{n}$, the tuple of all codewords, eavesdropper channel coefficients, and eavesdropper outputs.

We now take the intersection of these sets to construct one final set

[TABLE]

The following lemma shows that the tuple of main channel coefficients and the previous set, $\mathbb{R}_{+}^{n}\times\mathcal{T}_{n}$, is typical for any $n$. The main channel coefficients must be taken into account as well since we are on a fast fading wiretap channel but we will see shortly that in the case of No-CSIT, it plays little part.

Lemma 8**.**

Let $\epsilon_{n}=\epsilon_{n}^{1}+\epsilon_{n}^{2}+\epsilon_{n}^{3}$ then

[TABLE]

for any $x^{n}\in\mathscr{C}_{n}$. That is, $\mathbb{R}_{+}^{n}\times\mathcal{T}_{n}$ is a $(1-\epsilon_{n})$-typical set where $\epsilon_{n}$ is exponentially decreasing to [math] as $n\to\infty$.

Proof.

See Appendix G. ∎

With our typical set $\mathbb{R}_{+}^{n}\times\mathcal{T}_{n}$ in hand, we are ready to prove the main result of this section and determine a characterization for semantically secure achievable rates for the fast fading wiretap channel with No-CSIT.

Theorem 5**.**

Consider the fast fading wiretap channel with No-CSIT and let $\mathcal{T}_{n}$ and $\epsilon_{n}$ be defined as in Lemma 8. It follows that:

[TABLE]

Proof.

See Appendix G. ∎

The following corollary then tells us what semantically secure rates we can achieve given this bound.

Corollary 4**.**

The wiretap coding scheme of Section III can achieve an overall semantic secrecy rate of $C_{T}-C_{E}$ on the No-CSIT fast fading wiretap channel when $C_{T}>C_{E}$ and $R_{\mathcal{C}}$ is chosen arbitrarily close to $C_{T}$.

Proof.

We can combine the previous theorem with 3 and note that $\delta_{n},\delta^{\prime}_{n},\delta^{\prime\prime}_{n}$ can be chosen in such a way that $\epsilon_{n}\to 0$ exponentially as $n\to\infty$. ∎

Note that to the best of the authors’ knowledge, this is the best semantically secure achievable rate on a No-CSIT fast fading wiretap channel to date. Going further, we actually have achieved the secrecy capacity for a specific class of wiretap channels.

Fact 9**.**

[14]** The weak secrecy capacity of a stochastically degraded fast fading wiretap channel with No-CSIT is given by

[TABLE]

Immediately this fact with the previous corollary implies that we can achieve the secrecy capacity with our wiretap coding scheme of Section III on stochastically degraded fast fading channels with No-CSIT.

Corollary 5**.**

Using the wiretap coding scheme of Section III on any fast fading stochastically degraded wiretap channel with No-CSIT we have the following:

It is possible to achieve the semantic secrecy capacity. 2. 2.

C_{\mathit{s}}\big{|}_{\text{weak}}=C_{\mathit{s}}\big{|}_{\text{semantic}}.

VI-C Fading: Partial CSIT

We now turn to the case of partial CSIT, where the transmitter has access to full CSI about the main channel but knows only the statistics of Eve’s channel. Our goal in this subsection is the same as in the previous subsection - we wish to characterize a set of semantically secure rates for the wiretap channel at hand and we use 3 to do so.

Since the transmitter has access to CSI about the main channel, every party can demultiplex the fast fading wiretap channel into a set of $d$ parallel channels by partitioning the channel coefficients of the main channel into $d$ intervals as done in [17, 35]. Each parallel wiretap channel is then composed of a time-invariant, constant gain Gaussian main channel with a fast fading eavesdropper channel characterized by $H_{E}$ as depicted in Figure 3.

More specifically, we assume the fading gain of the main channel is bounded as usual and divide the possible realizations of $H_{T}$ into intervals $\left[h_{T,i},h_{T,i+1}\right)$ with $i\in\{1,\ldots,d\}$. Let

[TABLE]

Let $N_{i}$ be the random variable representing the number of times channel $i$ is actually used, i.e., the number of times $h_{T,i}$ belongs to the $i$-th interval over all $n$ channel uses. Let $n_{i}=p_{i}n-\varepsilon_{i}$ be a real number, where $\varepsilon_{i}$ is chosen sufficiently large so that $N_{i}$ is greater than $n_{i}$ with high probability and $\varepsilon_{i}\rightarrow 0$ as $n\rightarrow\infty$. In short, $n_{i}$ represents the number of times we plan on the channel coefficients being realized in the $i$-th interval, whereas the realization of $N_{i}$ is how many times the the channel coefficients actually do occur in the $i$-th interval. For every index $i$, the transmitter and legitimate receiver will publicly agree on a transmit power $\gamma_{i}(H_{T})$ where $\{\gamma_{i}\}_{i=1}^{d}$ is chosen such that

[TABLE]

For $1\leq i\leq d$, the transmitter and legitimate receiver also publicly agree upon an ECC $\mathcal{C}_{n_{i}}^{i}$ (with codebook $\mathscr{C}_{n_{i}}^{i}$) designed to operate on the Gaussian point-to-point channel with constant channel gain $h_{T,i}$. We denote by $R_{i}$ the rate of $\mathcal{C}_{n_{i}}^{i}$ and the overall rate over the main channel to be

[TABLE]

The full coding scheme is then outlined as follows: a message $m\in\mathcal{M}$ is chosen which passes through the preprocessing layer to produce an $l$-length pseudo-message $m^{\prime}\in\mathcal{M}^{\prime}$. These $l$ bits are then divided into sets of $n_{i}R_{i}$ bits such that

[TABLE]

A codeword is then generated for each of these sets by their respective $\mathcal{C}_{n_{i}}^{i}$ and the multiplexing strategy outlined in [17, 35] is then employed to transmit the $i$th codeword when the channel state is in the $i$th interval. In more detail, at each time instant $i$ the multiplexer will determine what the channel state is and send one symbol from the codeword associated with that channel gain.

The reliability of this scheme comes from the aggregate reliability of all the ECC’s being employed on the $d$ parallel channels and the fact that we are choosing $n_{i}<N_{i}$ with high probability. Since we are assuming an ECC $\mathcal{C}_{n_{i}}^{i}$ is chosen to be reliable over the $i$th point-to-point main channel, we know that the probability of error will be negligible:

[TABLE]

In other words, the receiver will be able to recover each $n_{i}$-length codeword with high probability. Thus the probability of error for the entire $n$-length transmission is just probability of error for each individual $n_{i}$-length codeword weighted by the probability that that code is used:

[TABLE]

since $n_{i}$ grows with $n$. Now that this scheme has been shown to be reliable, we now address its security.

We wish to asymptotically bound $\frac{1}{n}I_{\infty}^{\epsilon}(X^{n}\wedge Z^{n},H_{T}^{n},H_{E}^{n})$ of this fast fading channel by considering the set of $d$ parallel wiretap channels outlined above and each of their individual associated max-information terms for which we already know the bound found in 5. This is due to the fact that 5 did not impose any restrictions on the main channel distribution, it only required Eve’s channel to be given arbitrarily as $H_{E}$. Thus having a constant gain main channel and no CSIT of Eve’s channel is a special case of No-CSIT. The only way this differs from that of Section VI-B is that in the case of No-CSIT, we are not allowed to vary the power we are transmitting at due to our lack of knowledge of instantaneous CSIT, whereas in the case of partial CSIT, we can vary our power to align with what the current main channel gain is.

Similarly to the case of No-CSIT, we wish to create a typical set which will contain enough content about our space of inputs, outputs, and channel coefficients. We accomplish this by creating typical sets for each of the $d$ subchannels and taking the Cartesian product of these to generate the typical set for the entire wiretap channel.

Define the following sets:

[TABLE]

where $\mathcal{T}_{n_{i}}$ is defined in Section VI-B.

Lemma 9**.**

$\mathcal{T}^{\prime}_{n}$* as defined above is a $(1-\epsilon_{n})$ typical set where $\epsilon_{n}$ is exponentially decreasing with $n$.*

Proof.

See Appendix H. ∎

With the typical set $\mathcal{T}_{n}^{\prime}$ in hand, we now aim to find an asymptotic bound $\xi$ for the average max-information for the entire $n$ uses of the wiretap channel $W$.

Theorem 6**.**

Consider a fast fading wiretap channel where the transmitter has partial CSIT with $\mathcal{T}^{\prime}_{n}$ and $\epsilon_{n}$ as defined in Lemma 9. Using the multiplexing scheme above, it follows that:

[TABLE]

Proof.

See Appendix H. ∎

Now that we have found $\xi$, 3 immediately tells us that by using the SS-UHF based preprocessing scheme we can achieve any positive rate, $R_{s}$, with semantic security satisfying

[TABLE]

Let’s see how this compares to previous results.

Fact 10**.**

[12, 17]** For the fast fading wiretap channel where the CSI of the main channel but not the CSI of the eavesdropper channel is known at the transmitter, all rates $R_{s}$ such that

[TABLE]

where $\gamma:\mathbb{R}_{+}\rightarrow\mathbb{R}_{+}$ obeys the constraint $\mathbb{E}\left[\gamma(H_{T})\right]\leq P$ are achievable secrecy rates under the strong (and weak) secrecy metric.

To the extent of the authors’ knowledge, the secure achievable rates given in 10 have never been extended to semantic security. However, the next corollary remedies this.

Corollary 6**.**

The wiretap coding scheme of Section III can achieve all rates given in 10 with semantic security on the partial CSIT fast fading wiretap channel when the rate of the ECC, $R_{\mathcal{C}}$, is taken arbitrarily close to

[TABLE]

for any power allocation $\gamma(H_{T})$. Moreover, these rates are achieved with exceptional semantic security.

Proof.

The result follows immediately after combining 3 with 6 and noting that there does exist some ECC which can achieve this rate due to the fact that the above expression is less than or equal to the point-to-point capacity of the fast fading channel. ∎

VI-D Fading: Full CSIT

In this subsection, we shall assume full CSIT; that is, we assume the transmitter knows instantaneously the realizations at time instance $i$ of both the main and eavesdropper channel coefficients. The strategy used to find a set of semantically secure rates in this scenario is almost identical to that used in Section VI-C thus we omit most of the redundant explanations and proofs here. We now demultiplex the wiretap channel into $d^{2}$ parallel constant gain Gaussian wiretap channels determined by the channel coefficients of both channel $T$ and channel $E$. Since each of the parallel wiretap channels are now Gaussian wiretap channels, we no longer use the bounds found in 5, but rather use the bounds from Lemma 4 to bound the max-information of each of the parallel wiretap channels.

As before, we define a typical set for this channel as the Cartesian product of simpler sets:

[TABLE]

Note that $\mathcal{T}_{n_{ij}}^{1}$ and $\mathcal{T}_{n_{ij}}^{2}$ are defined in Section VI-B. The following lemma, which is analogous to Lemma 9 from Section VI-C, shows that $T^{\prime}_{n}$ is a typical set.

Lemma 10**.**

$\mathcal{T}^{\prime}_{n}$* as defined above is a $(1-\epsilon_{n})$ typical set where $\epsilon_{n}$ is exponentially decreasing with $n$.*

Now in an analogous way to 5 and 6, we have the following theorem for the full CSIT scenario.

Theorem 7**.**

Consider the fast fading wiretap channel with full CSIT at the transmitter with $\mathcal{T}^{\prime}_{n}$ and $\epsilon_{n}$ as defined in Lemma 10. Using the multiplexing scheme above, it follows that:

[TABLE]

Now that we have found the bound $\xi$, 3 again tells us that by using the SS-UHF based preprocessing scheme we can achieve any positive rate, $R_{s}$, with semantic security satisfying

[TABLE]

Once again, let’s see how this compares to previous results.

Fact 11**.**

With full CSI for both the main channel and the eavesdropper channels available at the transmitter, the strong secrecy capacity of the fast fading wiretap channel is:

[TABLE]

where $\gamma:\mathbb{R}_{+}^{2}\rightarrow\mathbb{R}_{+}$ obeys the power constraint $\mathbb{E}\left[\gamma(H_{T},H_{E})\right]\leq P$.

This fact was originally given in [10] under the weak security metric but was upgraded to the strong security metric in [11]. However, to the extent of the authors’ knowledge, this result has never been upgraded to semantic security. We provide such a generalization in the next corollary.

Corollary 7**.**

The semantic secrecy capacity of the fast fading wiretap channel with full CSIT is given by:

[TABLE]

Furthermore, the transmission scheme of Section III can achieve the semantic secrecy capacity of the fast fading wiretap channel with full CSIT exceptionally fast.

Proof.

Let $\gamma^{*}$ be the power allocation function that maximizes the expression in 11 as found in [10]. Let the rate of the ECC, $R_{\mathcal{C}}$, be taken arbitrarily close to

[TABLE]

We know by Shannon’s noisy channel coding theorem that some ECC will exist which satisfies this rate due to the above expression being less than or equal to the point-to-point capacity of the main fast fading channel. Since the bound found in 7 holds for any power allocation function $\gamma$, it holds for $\gamma^{*}$ in particular. In 7 we found an upper bound to the right hand term of the difference in 11, thus invoking 3 we know we can achieve any rate arbitrarily close to the secrecy capacity given in 11. Therefore the semantic secrecy capacity is equal to the weak secrecy capacity by 1 in the case of full CSIT and the given wiretap coding scheme achieves it. ∎

VII Future Work

For wiretap channels that do not fall into the purview of the previously listed channels, one must apply 1 in its entirety. Hopefully however, the proof techniques employed here will help guide those pursuits.

As another interesting line of future work, one may try to find a tighter upper bound $\xi$ to the max-information per channel symbol on the fast fading wiretap channel with No-CSIT. Indeed, we proved the case when $\xi=C_{E}$ (the capacity of the eavesdropper’s point-to-point channel), but perhaps this can be improved by clever power allocation techniques.

VIII Conclusion

The main purpose of this paper has been to amplify the results of physical layer security into a more practical setting. In particular, we have developed a concrete and efficient converter that takes as input an error correcting code and outputs a semantically secure wiretap code. We have addressed five separate wiretap channels that are arguably the most popular in literature and have shown for each which semantically secure rates are achievable.

Acknowledgment

The authors would like to thank Himanshu Tyagi of the Indian Institute of Science and Alexander Vardy of UC San Diego upon whose work this paper is largely motivated.

Appendix A Our Construction is an efficient SS-UHF: Proof of 1 and 2

In this beginning appendix, we will prove that our UHF construction based on finite field arithmetic is an SS-UHF (1) and that it is efficient (2).

Proof of 1

.

We will show $\mathcal{F}^{*}$ is universal, uniform, $(l-k)$-regular, and evenly invertible.

• •

Universality: Fix $m^{\prime}_{1}\neq m^{\prime}_{2}\in\mathcal{M}^{\prime}$. We wish to count how many $(s,t)$ satisfy:

[TABLE]

Since $\oplus$ is equivalent to bitwise addition, we can distribute $[\cdot]_{k}$ and reduce the equation to:

[TABLE]

where $\oplus_{k}$ is addition over $GF(2^{k})$. This reduces even further to $[s\odot m^{\prime}_{1}]_{k}=[s\odot m^{\prime}_{2}]_{k}$, however, this is an equation that does not involve $t$ so that indeed, any choice of $t$ satisfies the original equation. This equation can be rewritten as

[TABLE]

where we have defined $m^{\prime\prime}=m^{\prime}_{1}\oplus m^{\prime}_{2}$. Now since $m^{\prime}_{1}\neq m^{\prime}_{2}$ then $m^{\prime\prime}=m^{\prime}_{1}\oplus m^{\prime}_{2}\neq 0^{l}$. Moreover, by assumption $s\neq 0^{l}$ so that for each choice of $s$, the multiplication $s\odot m^{\prime\prime}$ is a unique element in $\{0,1\}^{l}\setminus 0^{l}$. Note that since there are $2^{l-k}-1$ elements in $\{0,1\}^{l}\setminus 0^{l}$ where the first $k$ bits set to [math], then there are $2^{l-k}-1$ choices of $s$ that satisfy $0^{k}=[s\odot m^{\prime\prime}]_{k}$. In summary, we have $2^{l}$ choices for $t$ and $2^{-k}(2^{l}-2^{k})$ choices for $s$, thus we have $2^{-k}2^{l}(2^{l}-2^{k})$ choices for $(s,t)$ that satisfy $[(s\odot m^{\prime}_{1})\oplus t]_{k}=[\left(s\odot m^{\prime}_{2}\right)\oplus t]_{k}$. However, $2^{-k}2^{l}(2^{l}-2^{k})\leq 2^{-k}2^{l}(2^{l}-1)$ since $k\geq 1$ so that (noting $|\mathcal{S}|=2^{l}(2^{l}-1)$) we have proved that $\mathcal{F}^{*}$ is a universal hash family.

• •

Uniformity: Fix $m^{\prime}\in\mathcal{M}^{\prime}$ and $m\in\mathcal{M}$. We wish to count how many $(s,t)$ satisfy:

[TABLE]

We can distribute $[\cdot]_{k}$ and view this as the equation $[t]_{k}=m\oplus_{k}[s\odot m^{\prime}]_{k}$. For each choice of $s$ the first $k$ bits of $t$ are fixed and the last $l-k$ bits are free; thus there are $2^{l-k}$ choices for $t$. Since there are no restrictions at all on $s$, we can choose any of the $2^{l}-1$ $l$-length bits strings (excluding $0^{l}$) for $s$. In aggregate there are $2^{l-k}(2^{l}-1)$ choices of $(s,t)$ that satisfy $[\left(s\odot m^{\prime}\right)\oplus t]_{k}=m$. Noting again that $|\mathcal{S}|=2^{l}(2^{l}-1)$ we have proven that our family $\mathcal{F}^{*}$ is uniform.

• •

Regularity: Fix some $m\in\mathcal{M}$, $s\in\{0,1\}^{l}\setminus 0^{l}$, and $t\in\{0,1\}^{l}$. We wish to count how many $m^{\prime}$ satisfy:

[TABLE]

As usual, break up this equation to $[s\odot m^{\prime}]_{k}=m\oplus_{k}[t]_{k}$. Since we are working in $GF(2^{l})$ and $s\neq 0^{l}$, for each choice of $m^{\prime}\in\{0,1\}^{l}$ the product $s\odot m^{\prime}$ will be a unique element in $\{0,1\}^{l}$. But by the previous equation, the first $k$ bits of $s\odot m^{\prime}$ are fixed at $m\oplus_{k}[t]_{k}$ while the last $l-k$ bits are completely free. Hence there will be $2^{l-k}$ choices of $m^{\prime}$ that satisfy the original equation.

Therefore, $\mathcal{F}^{*}$ is $(l-k)$-regular.

• •

Invertibility: Let $m\in\mathcal{M}$, $s\in\{0,1\}^{l}\setminus 0^{l}$, and $t\in\{0,1\}^{l}$. Then,

[TABLE]

Hence, $\mathcal{F}^{*}$ is invertible.

• •

Even Invertibility: Suppose we are given a $m\in\mathcal{M}$, $s\in\{0,1\}^{l}\setminus 0^{l}$, and $t\in\{0,1\}^{l}$. Then $\phi_{s,t,r}(m)=\left(s^{-1}\odot(m||r)\oplus t\right)$ is a unique element for every choice of $r$. Since $R\sim\textnormal{unif}(\{0,1\}^{l-k})$ the pseudo-message $M^{\prime}=\phi_{s,t,R}(M)$ will be uniform.

In summary, we have proven that $\mathcal{F}^{*}$ is an SS-UHF, thus concluding the proof of 1. ∎

Proof of 2

.

First recall that $l$ and $k$ are functions of the block length $n$.

Concatenation has time complexity $\mathcal{O}(k+(l-k))$ and thus is linear with $n$: $\mathcal{O}(k+(l-k))=\mathcal{O}(l)=\mathcal{O}(nR_{\mathcal{C}_{n}})=\mathcal{O}(n)$. Addition in $GF(2^{l})$ operates as bitwise addition (or XOR) and thus the time complexity is also linear with $n$: $\mathcal{O}(l)=\mathcal{O}(nR_{\mathcal{C}_{n}})=\mathcal{O}(n)$. Therefore, the operation $(m||r)\oplus t$ has linear time complexity.

Now inversion and multiplication in $GF(2^{l})$ is known to be computed in at worst quadratic time in $l$ (cf. [36, Chapter 2]). Thus computing the entire inverse $s^{-1}\odot((m||r)\oplus t)$ is $\mathcal{O}(n^{2})$. 2. 2.

Using the same arguments as above, the operation $m^{\prime}\odot s$ can be implemented in quadratic time and addition can be implemented in linear time. Clearly, $[\cdot]_{k}$ can be implemented in $\mathcal{O}(k)=\mathcal{O}(n)$: linear time with $n$. Thus, the entire post-processing scheme also can be implemented in quadratic time in $n$.

This concludes the proof of 2. ∎

Appendix B Security and Rates: Proof of 1 and 2

In this appendix, we will prove the two main statements related to the security and achievable rates of our wiretap coding scheme of Section III. Before we begin, we will need the following lemma. Not only do we use it several times in the proofs of the aforementioned results, but also, this lemma justifies our definition of $\alpha$-mutual information as we required $M^{\prime}$ to be uniform there.

Lemma B1**.**

The pseudo-message $M^{\prime}$ is a uniform random variable over the set $\mathcal{M}^{\prime}$ where $|\mathcal{M}^{\prime}|=2^{l}$, i.e., $\omega(m^{\prime})=2^{-l}$.

Proof.

We claim that $M^{\prime}$ is a uniform random variable over the set $\mathcal{M}^{\prime}=\{0,1\}^{l}$. We already argued in Section III that given $m$ and $s$, $M^{\prime}$ is a uniform random variable over $\text{supp}(\phi_{s}(m))$, hence, we simply need to show that $\omega(m^{\prime})=2^{-l}$. Consider the following string of equalities:

[TABLE]

Justification .

Marginal density properties. 2. 2)

$M\bot S$* by assumption.* 3. 3)

$\omega(m^{\prime}|m,s)=2^{-b}\mathbbm{1}\left(m=f_{s}(m^{\prime})\right)$* as mentioned in Section III.* 4. 4)

The term $\left(\frac{1}{|\mathcal{S}|}\sum_{s\in\mathcal{S}}\mathbbm{1}\left(m=f_{s}(m^{\prime})\right)\right)=2^{-k}$ for any $m\in\mathcal{M}$ and $m^{\prime}\in\mathcal{M}^{\prime}$ by the uniform property of our SS-UHF. Moreover $b=l-k$.

This concludes the proof of Lemma B1. ∎

Proof of 1

.

This theorem is the primary tool of this paper. The proof is similar at times to the proof given in [8] (for the analogous result for strong security only) and is a very straightforward application of our SS-UHF to the definition of mutual information. Notwithstanding, the proof is rather long and as a point of convenience we note that the proof ends on page B.

We first need the following fact which follows immediately from the chain rule of mutual information:

[TABLE]

Thus, it is sufficient to bound $\max_{P_{M}}I(M\wedge Z^{n},S)$.

We will split the proof into two parts, $\epsilon>0$ and $\epsilon=0$, starting with the $\epsilon=0$ case. As mentioned previously, $1$-typical sets $\mathcal{T}$ are equal to the entire space $\mathcal{M}^{\prime}\times\mathcal{Z}^{n}$ less a set of measure [math], so that $I_{\alpha}^{0}(M^{\prime}\wedge Z^{n})=I_{\alpha}(M^{\prime}\wedge Z^{n})$. To show our claim is valid, it is therefore sufficient in the case of $\epsilon=0$ to show:

[TABLE]

To begin, suppose $M$ has some arbitrary distribution. Since $\mathcal{S}$ and $\mathcal{M}$ are finite the definition of conditional mutual information $I(M\wedge Z^{n}|S)$ is given by

[TABLE]

where $\mu$ is some measure on $\mathcal{Z}^{n}$.

From the chain rule of mutual information, since $M\bot S$ by assumption, we have $I(M\wedge Z^{n},S)=I(M\wedge Z^{n}|S)$. It then follows that

[TABLE]

Let us now expand each conditional density of the numerator and denominator of the logarithm in Equation 1. Starting with the numerator we have:

[TABLE]

Equation 2 follows from the fact that we can take $M^{\prime}$ as an intermediate node and sum over all possible realizations of $M^{\prime}$; by assumption, since we are given $m$ and $s$, then $M^{\prime}$ can only be found in $\text{supp}(\phi_{s}(m))$ where $\phi_{s}$ is the even-inverse of $f_{s}$. Equation 3 follows from the fact that once given $m$ and $s$, the density of $M^{\prime}$ is uniform on a set with $2^{b}$ elements which follows from the fact that our SS-UHF is $b$-regular and evenly invertible.

The expansion of the conditional density in the denominator of the logarithm of Equation 1 is given by:

[TABLE]

Justification .

Marginal density property. 2. 2.

By assumption, $M\bot S$. 3. 3.

When $s$ is fixed, $f_{s}$ is a well defined function. Thus, inside the sum over $\mathcal{M}^{\prime}$, $f_{s}(m^{\prime})$ can map to only a single $m\in\mathcal{M}$. Therefore, the indicator is $1$ only for a single value of $m$; namely, when $m=f_{s}(m^{\prime})$.

We now continue expanding the leakage (Equation 1) using these two conditional densities.

[TABLE]

Justification .

We will break with our convention slightly. Here we have written $\omega(z^{n}|u^{\prime})$ as shorthand for $\omega_{Z^{n}|M^{\prime}}(z^{n}|u^{\prime})$; analogously for $\omega(z^{n}|u^{\prime\prime})$. We will stick with this new convention for the remainder of the proof; i.e. $\omega(\cdot|u^{*})$ and $\omega(u^{*})$ will be shorthand for densities with respect to $M^{\prime}$. 2. 5.

By assumption, $M\bot S$. 3. 6.

By assumption, $S\sim\textnormal{unif}(\mathcal{S})$.

At this point we can expand the conditional density $\omega(z^{n}|m,s)$ (from Equation 4) and continue:

[TABLE]

Justification .

The entire summand is 0 unless $m=f_{s}(m^{\prime})$, so we can replace the $m$ in the indicator function of the log as such as long as we stick with the convention that $0\log 0=0$ as the limit suggests. 2. 8.

As in Equation 5, the indicator will filter all but a single $m$; namely, when $m=f_{s}(m^{\prime})$. 3. 9.

We can break up the logarithm into a subtraction where we change indices of the summation so as not to become confused.

We will now consider each of expressions within the square brackets of Equation 7 separately, starting with the first. The first square bracket can be written (after multiplying by the unit $2^{-k}2^{k}$) as

[TABLE]

Our goal now will be to move the sum over $s$ inside of the logarithm via Jensen’s inequality. However, Jensen’s incurs a multiplicative penalty if the weights do not sum to 1. Fortunately, our weights do sum to 1 as shown next. Our preprocessor is an SS-UHF and hence it is uniform. Thus for any $m^{\prime}\in\mathcal{M}^{\prime}$ we have:

[TABLE]

Thus we can aptly apply Jensen’s inequality (without carrying around any extra factors) and move the preceding term inside of the logarithm at the expense of an inequality. This yields:

[TABLE]

If $u^{\prime}=m^{\prime}$ in Equation 9, it is clear that the indicator will always return 1 regardless of $s\in\mathcal{S}$ so that the argument of the logarithm becomes

[TABLE]

where we have again used the fact that our preprocessor is a SS-UHF and is hence uniform.

On the contrary, if $u^{\prime}\neq m^{\prime}$ in Equation 9, the indicator will only return 1 some of the time, and a nice simplification of the expression is not obvious at this time; we will address this in a bit.

Combining these cases together, the entire first square bracket of Equation 7 is less than or equal to:

[TABLE]

Let us now move onto the second square bracket of Equation 7 above. We can write this term as

[TABLE]

where the inequality follows from the log-sum inequality. Now again using the fact that our preprocessor is an SS-UHF and hence uniform we have the formula $\sum_{s\in\mathcal{S}}\left(\frac{1}{|\mathcal{S}|}P_{M}(f_{s}(m^{\prime}))\right)=2^{-k}$ for any $m^{\prime}\in\mathcal{M}^{\prime}$. Using this, the entire second square bracket of Equation 7 becomes less than or equal to

[TABLE]

We are now at a point where each square bracket of Equation 7 is properly simplified. Thus:

[TABLE]

We will now simplify the inside of the logarithm. Consider the first summand given by

[TABLE]

Conditional densities are defined as $\omega(z^{n}|u^{\prime\prime})=\frac{\omega(z^{n},u^{\prime\prime})}{\omega(u^{\prime\prime})}$. By Lemma B1, $\omega(u^{\prime\prime})=2^{-l}$ for every $u^{\prime\prime}\in\mathcal{M}^{\prime}$ so that $\omega(z^{n}|u^{\prime\prime})=2^{l}\omega(z^{n},u^{\prime\prime})$. Then by the marginal property of densities, $\sum_{u^{\prime\prime}\in\mathcal{M}^{\prime}}\omega(z^{n}|u^{\prime\prime})=2^{l}\sum_{u^{\prime\prime}\in\mathcal{M}^{\prime}}\omega(z^{n},u^{\prime\prime})=2^{l}\omega(z^{n})$. Moreover, using Bayes theorem and Lemma B1 again we can write

[TABLE]

The term $2^{l}\omega(z^{n})$ appears both in the numerator and denominator and thus cancels out. Hence the entire first summand of the logarithm in Equation 10 becomes

[TABLE]

Now the second summand of the logarithm of Equation 10 is given by

[TABLE]

Using the same argument as in the preceding paragraph we have $\sum_{u^{\prime\prime}\in\mathcal{M}^{\prime}}\omega(z^{n}|u^{\prime\prime})=2^{l}\omega(z^{n})$ and $\omega(z^{n}|u^{\prime})=2^{l}\omega(z^{n})\omega(u^{\prime}|z^{n})$. Again, the term $2^{l}\omega(z^{n})$ appears in both the numerator and denominator thus canceling each other out. Thus the second summand of the logarithm of Equation 10 simplifies immediately to:

[TABLE]

Now note that

[TABLE]

However,

[TABLE]

where Equation 14 follows immediately from the uniform property of our SS-UHF. From this we also have:

[TABLE]

Thus, combining Equation 13 and Equation 15 together with Equation 12 simplifies the entire second summand of the logarithm in Equation 10 to

[TABLE]

Then it follows, (continuing on from Equation 10):

[TABLE]

Justification .

Equation 11* and $b=l-k$.* 2. 11.

Jensen’s inequality on the sum over $m^{\prime}$. 3. 12.

Use the bound $\log(1+x)\leq\frac{1}{\ln 2}\sqrt{x}$ for all $x\geq 0$. 4. 13.

By Lemma B1, $M^{\prime}$ is uniform so that $H_{\alpha}(M^{\prime})=l$ for any $\alpha$ and $I_{\alpha}(M^{\prime}\wedge Z^{n})=H_{\alpha}(M^{\prime})-H_{\alpha}(M^{\prime}|Z^{n})$. Also recall $b=l-k$. 5. 14.

By 2, $I_{2}(M^{\prime}\wedge Z^{n})\leq I_{\alpha}(M^{\prime}\wedge Z^{n})$ for any $\alpha\in[2,\infty]$. In particular, $\alpha=\infty$ here proves the second part of our claim for the $\epsilon=0$ case.

With this, we have constructed an upper bound to $I(M\wedge Z^{n},S)$ for an arbitrary message distribution $P_{M}$. However, since the bound did not depend on the specific choice of $P_{M}$, the bound also holds for $\max_{P_{M}}I(M\wedge Z^{n},S)$. Therefore, we have concluded the $\epsilon=0$ case.

Let us move onto the $\epsilon>0$ case. Fix some $\epsilon>0$ and consider some $(1-\epsilon)$ typical set $\mathcal{T}\subset\mathcal{M}^{\prime}\times\mathcal{Z}^{n}$.

Now consider Equation 6 in the previous string of inequalities written as:

[TABLE]

Inside of the square bracket of Equation 16, $z^{n}$ and $m$ can be considered fixed, and thus, each of the 3 sums over $\mathcal{M}^{\prime}$ can be considered as a sum over two other sets:

[TABLE]

[TABLE]

where $\mathcal{T}^{\complement}$ denotes the complement of $\mathcal{T}$ in $\mathcal{M}^{\prime}\times\mathcal{Z}^{n}$.

With this, we can then apply the log-sum inequality to Equation 16 to yield the following:

[TABLE]

Now define $\mathcal{Q}_{\mathcal{T}}$ by

[TABLE]

so that Equation 16 yields:

[TABLE]

When considering just $\mathcal{Q}_{\mathcal{T}}$ we can continue where we left off from Equation 6 of the previous proof ($\epsilon=0$ case). In fact, it is not hard to see that almost nothing changes and we end up with

[TABLE]

for $\alpha\in[2,\infty]$.

Now let’s focus on $\mathcal{Q}_{\mathcal{T}^{\complement}}$. It follows that:

[TABLE]

Justification .

In the numerator of the logarithm, we have used the trivial bound $\mathbbm{1}{(f_{s}(u^{\prime})=m)}\leq 1$ for all $s,u^{\prime},m$. 2. 16.

Log-sum inequality. 3. 17.

Our preprocessor is a SS-UHF and hence it is uniform. 4. 18.

We chose $\mathcal{T}$ to be a $(1-\epsilon)$ typical set and there are $2^{l}$ pseudo-messages.

Again, just as in the $\epsilon=0$ case, we have provided an upper bound to $I(M\wedge Z^{n},S)$ for an arbitrary message distribution $P_{M}$ so that the upper bound also holds for $\max_{P_{M}}I(M\wedge Z^{n},S)$. This concludes the $\epsilon>0$ case.

Combining both cases, we have for any $\epsilon\geq 0$, $\alpha\in[2,\infty]$:

[TABLE]

Since this inequality was derived using an arbitrary $(1-\epsilon)$-typical set $\mathcal{T}$, we may as well optimize our choice of $\mathcal{T}$ while keeping $\epsilon$ fixed so as to obtain the tightest possible bound. With this we have proven the claim of 1. ∎

Proof of 2

.

Consider 1: we need the right hand side of the inequality to approach [math] as $n\to\infty$ to show our wiretap coding scheme is semantically secure. We have as $n\to\infty$ that $R_{n}\to R_{\mathit{s}}$ and $R_{\mathcal{C}_{n}}\to R_{\mathcal{C}}$. Since $R_{\mathit{s}}$ is finite then $\lim_{n\to\infty}\epsilon nR_{n}=0$ by the assumption that $\epsilon n\to 0$ as $n\to\infty$. Now if $\lim_{n\to\infty}(R_{\mathcal{C}_{n}}-R_{n}-\frac{I_{\infty}^{\epsilon}(X^{n}\wedge Z^{n})}{n})>0$ then the first term in the sum on the right hand side of 1 will also go to 0. But this is equivalent to

[TABLE]

If the right hand side is non-positive however, we will instead choose $R_{\mathit{s}}=0$ since rates must be non-negative. 2. 2.

Consider 1 again. Since $\lim_{n\to\infty}\frac{I_{\infty}^{\epsilon}(X^{n}\wedge Z^{n})}{n}\leq\xi$ by assumption, we can bound the asymptotic leakage as

[TABLE]

At this point we can continue exactly as in part 1). 3. 3.

Clearly the first of the two summands on the right hand side of the conclusion of 1 is exponentially decreasing when $R_{\mathit{s}}$ satisfies the rates given in either (1) or (2) above. Thus, if $\epsilon nR_{n}$ is exponentially decreasing with $n$, the semantic leakage is exponentially decreasing to 0; i.e. $\mathcal{W}$ is exceptionally semantically secure. For $\epsilon nR_{n}$ to be exponentially decreasing, it suffices for $\epsilon$ to be exponentially decreasing.

This concludes the proof of 2. ∎

Appendix C Removing the assumption of a public seed

In this appendix we shall overview a method that removes the assumption of a public seed without rate/security/reliability loss. This method is called seed recycling and can be found in [5] and [8].

We have seen in 2 that our wiretap coding scheme can provide semantic security for certain achievable rates (provided that we prove a bound on the max-information rate), however, we have assumed hitherto that the seed $S$ was publicly available to all parties. This is in strict violation of assumptions on a wiretap channel; that is, all communication must take place over the wiretap channel. In this section, we remove this assumption and transmit the seed over the wiretap channel. We will show asymptotically that no rate, security, or reliability is lost.

As a first attempt to resolve this violation, suppose the seed is transmitted before beginning transmission of an actual message. This is a problem, however, because it leads to information rate loss as follows. Suppose the seed can be transmitted with a probability of error less than some $p_{e,n}$ to the intended receiver in $nc$ channel uses for some constant $c>1$. Then the transmitter sends $k$ message bits of information in another $n$ channel uses. Overall, $k$ bits of information were transferred in $n+nc=n(1+c)$ channel uses, thus our overall secure information rate in this case is given asymptotically by

[TABLE]

where $R_{\mathit{s}}$ is the previous secure achievable rate assuming the seed was public. In other words, the possible asymptotic rates now achievable when sending the seed before message transmission are strictly less than before. Therefore, in this case, the rates achieved using 2 are no longer possible.

As a better attempt to resolve this problem, suppose we use the same seed to send $\eta$ messages $M_{1},M_{2},\dots,M_{\eta}$ using $\eta$ independent instances of the wiretap channel. First we will pick a block-length $n$ and on the first instance of the wiretap channel, we will send the seed over in $nc$ channel uses, where $c>1$ is chosen so that the seed’s probability of error at the intended receiver is less than or equal to $p_{e,n}$. Pessimistically (from the point of view at the transmitter), we will assume that the eavesdropper always receives a perfect copy of the seed. Now on each of the $\eta$ independent channel instances, we will send a corresponding message using the same scheme as outlined in section III except using the same seed for each instance. Let $\textbf{M}=(M_{1},M_{2},\dots,M_{\eta})$ be the vector consisting of the $\eta$ messages and let $\textbf{Z}=(Z^{n}(1),Z^{n}(2),\dots,Z^{n}(\eta))$ where $Z^{n}(i)$ is the $n$-letter eavesdropper output corresponding to the $i$-th message (also to the $i$-th channel instance).

Consider first the rate of this new procedure. In each of the $\eta$ channel uses, we are sending $k$ bits of information. Moreover, we will end up using the channel $\eta\cdot n$ times for the messages and $nc$ times for the seed. Overall, the asymptotic secure rate of this new procedure is thus given by

[TABLE]

where $R_{\mathit{s}}$ is again the previous asymptotic secure achievable rate when the seed was public. Since $c$ is a constant, the only way to avoid information rate loss asymptotically is if $\eta\to\infty$ as $n\to\infty$.

Consider next the reliability of this new procedure. If each message has probability of error at the intended receiver bounded by $p_{e,n}$, then the probability that M is in error is given in the next lemma.

Lemma C1** (Reliability).**

The probability that M is in error is upper bounded by

[TABLE]

Proof.

Let $A_{i}$ be the event corresponding to the $i$-th message being in error. Then $A=\bigcup_{i=1}^{\eta}A_{i}$ is the event corresponding to at least one of the $\eta$ messages being in error. Hence $\mathbb{P}(A)$ is the probability of error of M.

Then since each instance of the wiretap channel is independent, we have the following.

[TABLE]

This concludes the proof of Lemma C1. ∎

With this lemma, we see that in order to transmit reliably, we have another constraint on $\eta$, that is, we must choose $\eta$ so that $(1-p_{e,n})^{\eta}\to 1$ as $n\to\infty$.

Consider last the leakage of this new procedure.

Lemma C2** (Security).**

For some $i\in\{1,\dots,\eta\}$ the following holds:

[TABLE]

Proof.

Let M have an arbitrary distribution $P_{\textbf{M}}$. By the chain rule of mutual information,

[TABLE]

Since $S\bot M_{i}$ for each $i$, then $S\bot\textbf{M}$. Then by the chain rule of mutual information again, we have,

[TABLE]

Now $(M_{1},Z^{n}(1)),\ldots,(M_{\eta},Z^{n}(\eta))$ are mutually independent once we are given $S$, thus by a standard mutual information inequality we have

[TABLE]

We want to maximize $I(\textbf{M}\wedge\textbf{Z})$ over all probability distributions $P_{\textbf{M}}$. However, that is equivalent to maximizing over each choice of $P_{M_{i}}$ individually. The above becomes:

[TABLE]

Here $i$ represents an instance of the wiretap channel. Choose the channel instance $j$ that corresponds to the most leakage $\max_{P_{M_{j}}}I(M_{j}\wedge Z^{n}(j)|S)$ leaked to the eavesdropper. The above then becomes

[TABLE]

This concludes the proof of Lemma C2. ∎

This lemma intuitively says that the message leakage of all $\eta$ wiretap channel instances is no more than the number of channel instances multiplied by the leakage over the “worst case” wiretap channel (worst here is with respect to the transmitter). Combining this result with 1 and 1 gives the following proposition.

Proposition 3**.**

Let $i$ be the wiretap channel instance where the transmitter leaks the most information to the eavesdropper. Let $R_{\mathcal{C}_{n}}$ be the rate of the ECC and $R_{n}$ the secure rate of transmission for that wiretap channel instance. It follows that

[TABLE]

With this, just as in 2, we see that if $R_{n}<R_{\mathcal{C}_{n}}-\frac{1}{n}I_{\infty}^{\epsilon}(X^{n}\wedge Z^{n})$ for each $n$, then so long as $\eta$ grows with $n$ strictly slower than exponential, the first term will go to 0. Furthermore, $\eta$ must be chosen slow enough so that $\epsilon\eta n\to 0$ as $n\to\infty$.

In summary, with regards to how $\eta$ must grow with $n$ we need the following as $n\to\infty$:

• •

$\eta\to\infty$ to guarantee negligible rate loss,

• •

$(1-p_{e,n})^{\eta}\to 1$ to guarantee negligible reliability loss,

• •

$\eta$ must grow slower than exponential in $n$ and $\epsilon\eta n\to 0$ to guarantee negligible security loss.

It will depend on the specific choice of $\epsilon$ and $p_{e,n}$ in each case in order to properly determine $\eta$, however, if for example $\epsilon$ is exponentially diminishing with $n$ and $p_{e,n}$ diminishes on the order of $1/n$, then picking $\eta$ on the order of $\log(n)$ will be sufficient to satisfy all of the previous requirements. Indeed, there is significant flexibility in these three parameters and finding them to satisfy the previous requirements should not be too intrusive.

Intuitively, the previous has a nice interpretation. It says that as long as we keep on adding new independent messages when increasing the block length, we can still achieve the same rate, reliability, and security asymptotically as before when we assumed the seed to be public.

Appendix D Proofs from Section V

In this appendix we will prove two statements from the first applications section. We first prove Lemma 2, which simplifies the expression of max information. Then we provide a reworked proof of [8, Lemma 6] (Lemma D1) as an aid for our proof of 5 in Appendix G.

Proof of Lemma 2

.

Recall that $X^{n}=e_{n}(M^{\prime})$ is a random variable over $\mathscr{C}_{n}$ with the same distribution as $M^{\prime}$. By Lemma B1, this means $X^{n}$ is uniform over $\mathscr{C}_{n}$. Since $\mathscr{C}_{n}$ has $2^{l}$ elements then $\omega(x^{n})=2^{-l}$. Now consider the following string of equalities.

[TABLE]

This proves the validity of Lemma 2. ∎

Lemma D1** ([8, Lemma 6]).**

Let $\delta>0$ small. Then for any $(1-\epsilon)$ typical set $\mathcal{T}$ where $\epsilon=\exp(-n\delta^{n}/8)$, the asymptotic $\epsilon$-smooth average max-information of an AWGN eavesdropper channel $E$ is bounded by the point-to-point capacity:

[TABLE]

Proof.

Define a set

[TABLE]

Also for each $x^{n}\in\mathscr{C}_{n}$ define a set

[TABLE]

Now let $\mathcal{T}_{\text{out}},\mathcal{T}_{\text{noise}}\subset\mathscr{C}_{n}\times\mathbb{R}^{n}$ be sets defined as $\mathcal{T}_{\text{out}}=\mathscr{C}_{n}\times\mathcal{P}_{\text{out}}$ and $\mathcal{T}_{\text{noise}}=\{(x^{n},z^{n})\,|\,z^{n}\in\mathcal{P}_{\text{noise}}^{x^{n}}\text{ for each }x^{n}\in\mathscr{C}_{n}\}$. Then define a set $\mathcal{T}=\mathcal{T}_{\text{out}}\cap\mathcal{T}_{\text{noise}}$.

It was shown in [8] that $\mathcal{T}$ is a $(1-\epsilon)$-typical set using the given $\epsilon$. Note that $\epsilon\to 0$ exponentially fast with $n$. With this we have the following.

[TABLE]

Justification .

On an AWGN channel, given that $x_{i}$ was sent, we know that each output is a normal random variable with mean $x_{i}$ and variance $\sigma_{E}^{2}$. Since we assume the channel is memoryless, we can split this density simply into a product. 2. 2.

We are working on $\mathcal{T}$ in the integral and thus $\mathcal{P}_{\text{noise}}$. Thus, $\left\lVert z^{n}-x^{n}\right\rVert^{2}\geq n\sigma_{E}^{2}(1-\delta)$. 3. 3.

The indicator function returns either 0 or 1 in the area of interest $\mathcal{P}_{\text{out}}\cap\mathcal{P}_{\text{noise}}$ and 0 elsewhere. Thus, we can simply upper bound the indicator by 1 everywhere inside of $\mathcal{P}_{\text{out}}$. 4. 4.

Consider the following equalities:

[TABLE] 5. 5.

$\mathcal{P}_{\text{out}}$* is clearly a ball in real $n$ space of radius $n(P+\sigma_{E}^{2})(1+\delta)$. The volume of an $n$ ball of radius $r$ is given by*

[TABLE]

where here $\Gamma$ is the gamma function (generalized factorial) from analysis.

Taking the logarithm of both sides of the preceding and dividing by $n$ yields:

[TABLE]

Fortunately, $\frac{n}{\Gamma(n/2+1)^{2/n}}\to 2e$ as $n\to\infty$. Moreover, our choice of $\delta$ is not restricted and can be made arbitrarily small. This completes the proof of Lemma D1. ∎

Appendix E Sphere Packing Argument for No-CSIT Channels

In this appendix we provide motivation for how we constructed the typical set in the No-CSIT scenario. We provide sphere packing bounds in this case that are analogous to their AWGN counterparts (cf. [29, 34]).

The capacity expression for an additive white Gaussian noise channel (AWGN) is motivated by an intuitive argument called sphere packing. The argument asserts that due to properties of Gaussian random variables, a received output vector should be contained in some small $n$-dimensional ball around the transmitted codeword with high probability. In other words, the noise of the channel will only disturb the input vector by a certain amount (the radius of the small ball) with high probability. Furthermore, all received outputs should be contained in some larger ball with high probability since we are assuming that all the codewords are being transmitted while obeying the power constraint. If we use maximum likelihood decoding, given an output that resides in one of the small balls, the receiver assumes it came from the codeword that generated said ball. Therefore, the maximum number of small spheres we can pack into the larger ball roughly corresponds to how many codewords we can transmit reliably. This technique is called sphere packing since we are attempting to pack the larger ball with smaller spheres. Exact calculation is quite challenging; however, simply dividing the volume of the large ball by the volume in a small sphere gives an upper bound. What is perhaps surprising is that as the block length approaches infinity, this upper bound is actually achievable and is exactly the capacity of the AWGN channel.

We will provide a symmetric argument for the fast fading channel as justification for how and why we choose our typical sets the way we do in the No-CSIT case. Given an input $x^{n}$ and channel coefficient $h^{n}$, we know the output $z^{n}$ will reside in some small ball about the point $h^{n}x^{n}$ with high probability since we assume the noise follows a Gaussian distribution. In fact, such a ball will have radius $\sqrt{n\sigma_{E}^{2}(1+\delta)}$ for $\delta>0$ small.

In the case of the AWGN channel, the larger ball’s dimensions were derived using the fact that we expect our channel to obey the law of conservation of energy; that is, the maximum output energy should be equal to the summation of the maximum input energy and noise energy. We expect a similar phenomenon to hold on the fast fading channel; however, the input energy will also depend on the channel coefficient realization. During the $i$th symbol transmission, suppose $h_{i}$ is the realized channel coefficient; then the effective maximum input power is given by $h_{i}^{2}P$ so that the effective maximum average output power $\frac{1}{n}Z_{i}^{2}$ is given by $h_{i}^{2}P+\sigma_{E}^{2}$. Therefore we expect the realization $z_{i}^{2}$ to be less than $n(h_{i}^{2}P+\sigma_{E}^{2})(1+\delta)$.

Since $i$ is a coordinate of the vector $z^{n}$, we should then expect $z^{n}$ to be found in some volume where each component $z_{i}$ is bounded by $\pm\sqrt{n(h_{i}^{2}P+\sigma_{E}^{2})(1+\delta)}$. Because $h_{i}$ is changing for each use of the channel, each of these bounds will be different. Therefore, in contrast to the AWGN channel where each upper bound was constant with respect to each component, the volume in this case is actually an $n$-dimensional ellipsoid with radii $\sqrt{n(h_{i}^{2}P+\sigma_{E}^{2})(1+\delta)}$. Thus, if we try to pack as many spheres into this ellipsoid as possible as illustrated in the (2-dimensional) Figure 4, we should come up with the maximum number of codewords we can transmit reliably, i.e., an expression for capacity.

Using the same technique as [29], we simply divide the volume of the ellipsoid by the volume of the small balls. That is, since the volume of an ellipsoid with radii $r_{i}$ is given by $c\cdot\prod_{i=1}^{n}r_{i}$ where $c$ is the same constant factor used to calculate the volume of an $n$-dimensional ball, it follows that an upper bound to the max number of codewords is given by:

[TABLE]

Since rate is usually defined as the logarithm of the number of codewords normalized by $n$, an upper bound to the max achievable rate is given by:

[TABLE]

where the convergence follows from the law of large numbers.

Since the above characterizations correctly estimated the asymptotic upper bound for the fast fading channel using the same sphere packing argument as in the AWGN case, we are confident moving forward that these bounds will produce sets that are typical in the proper sense.

Appendix F Fading: Proof of Lemma 5, 7, and Lemma 6

In this appendix we prove results related to fading. In particular we prove Lemma 5 (a simplification of max information on fast fading channels), 7 (the usual result converting complex fast fading channels into real parallel fading channels when CSIR is available), and Lemma 6 (further simplification of max-information in the No-CSIT case).

Proof of Lemma 5

.

The proof follows directly.

[TABLE]

Justification .

First recall that $|\mathscr{C}_{n}|=2^{l}$. Next, $X^{n}=e_{n}(M^{\prime})$ has the same distribution as $M^{\prime}$; that is, $\omega(x^{n})=2^{-l}$ by Lemma B1. Thus, we can move the $2^{l}$ inside of the maximization then convert to $\omega(x^{n})$. Moreover, we can move $\omega(z^{n},\lambda^{n})$ inside of the maximization since it does not depend on the maximizing variable $x^{n}$. Lastly note that each $\mu$ here is not equivalent to each other or the measure from the previous line, it is denoted such simply for notational convenience. 2. 2)

We can multiply by the unit $\omega(\lambda^{n})/\omega(\lambda^{n})$ inside of the maximization. Then we can pull out $\omega(\lambda^{n})$ since it does not depend on the maximizing variable $x^{n}$. 3. 3)

Here we are using the assumption that $X^{n}\bot\Lambda^{n}$ so that $\omega(x^{n})\omega(\lambda^{n})=\omega(x^{n},\lambda^{n})$. Then we use the definition of a conditional probability density function.

This concludes the proof of Lemma 5. ∎

Proof of 7.

.

Without loss of generality, consider the intended receiver’s channel given above and drop the index $i$ for simplicity. Therefore, we are working with the complex fading channel $Y=H_{T}X+U_{T}$. Since $H_{T}\in\mathbb{C}$ we can write $H_{T}=|H_{T}|e^{i\theta}$ and thus, the receiver will receive the random variable $Y=|H_{T}|e^{i\theta}X+U_{T}$. However, since we are assuming channel state information is available at the receiver, the receiver actually knows the realization of $H_{T}$ and hence knows the value $e^{i\theta}$. The receiver thus adjusts his output $Y$ accordingly: $Ye^{-i\theta}=|H_{T}|X+U_{T}e^{-i\theta}$. Also, the additive white Gaussian noise is assumed to be circularly symmetric, so that $U_{T}e^{-i\theta}$ is actually distributed the same way as was $U_{T}$. Therefore, if we define $\tilde{Y}=Ye^{-i\theta}$ as the new output and $\tilde{U}_{T}=U_{T}e^{-i\theta}$ as the rotated noise, under the assumption of CSIR, the receiver can convert the original channel into the new channel: $\tilde{Y}=|H_{T}|X+\tilde{U}_{T}$. Now we can break up this channel into its real and imaginary parts:

[TABLE]

Combining the real and imaginary parts respectively yields two parallel channels

[TABLE]

Here each output is identically given as

[TABLE]

where $|H_{T}|\in\mathbb{R}_{+},X^{\prime}\in\mathbb{R}$, $U_{T}^{\prime}\sim\mathcal{N}(0,\sigma_{T}^{2})$, and $\mathbb{E}\left[(X^{\prime})^{2}\right]\leq P$. This concludes the proof of 7. ∎

Proof of Lemma 6.

.

From Lemma 5 and recalling that $\Lambda^{n}=(H_{T}^{n},H_{E}^{n})$, we have:

[TABLE]

Justification .

Independence of $H_{E}^{n}$ and $H_{T}^{n}$. Also, $Z_{i}=H_{E,i}X_{i}+U_{E,i}$ and $X_{i}$ is not a function of the channel coefficients since we have No-CSIT; therefore, $Z^{n}$ is independent of $H_{T}^{n}$.

This concludes the proof of Lemma 6. ∎

Appendix G No-CSIT: Proof of Lemma 7, Lemma 8, and 5

In this appendix we prove the main results related to the No-CSIT fast fading wiretap channel. In particular, we prove Lemma 7, Lemma 8 (proves that the sets we defined for No-CSIT are actually typical), and 5 (one of our main results that proves a bound on max-information in the No-CSIT scenario).

Proof of Lemma 7

To prove Lemma 7, we will first need a fact and a lemma. The fact is due to [37] where we have modified its form so as to be easily utilized in the following proofs. It can be considered a generalization of Hoeffding’s inequality [38] to the case of unbounded random variables.

Fact 12**.**

[37, Theorem 2.1]** Let $\{W_{i}\}_{i=1}^{n}$ be a sequence of independent random variables. Suppose for all $i$ there exists a $\gamma_{i}>0$ such that $\mathbb{E}\left[e^{\gamma_{i}|W_{i}|}\right]<\infty.$ Then for any sufficiently small $a>0$,

[TABLE]

where $K_{i}=2(\mathbb{E}\left[W_{i}^{4}\right])^{\frac{1}{2}}\mathbb{E}\left[e^{a|W_{i}|}\right]$ and $K^{*}=\max\limits_{i}K_{i}$.

The second item that will be needed for the proof of Lemma 7 is the following.

Lemma G1**.**

The following inequality holds:

[TABLE]

Proof.

[TABLE]

Justification .

Follows from independence of $H_{E}$, $U_{E}$. 2. 2)

$U_{E}$* is i.i.d. and $\sim\mathcal{N}(0,\sigma_{E}^{2})$.* 3. 3)

Follows from the power constraint on all codewords.

This completes the proof of Lemma G1. ∎

With these tools in hand, we now give the proof of Lemma 7.

.

*Proof of Lemma 7.1.

*Let131313Note that $\hat{\mu}$ is the mean here, i.e. it is a number, and is not related to the measure $\mu$. \hat{\mu}=\mathbb{E}\left[\frac{1}{n}\sum_{i=1}^{n}\frac{Z_{i}^{2}}{\sigma_{E}^{2}+H_{E,i}^{2}P}\,\biggr{|}\,X^{n}=x^{n}\right]. Then,

[TABLE]

where the inequality follows from Lemma G1.

Since $x^{n}$ is a constant and $\{H_{E,i}\}$ and $\{U_{E,i}\}$ are each mutually independent, the term

[TABLE]

is an independent random variable. Let us show that it also satisfies the main condition of 12 (dropping the subscript $E$ on $H_{E,i}$ and $U_{E,i}$ to reduce clutter).

[TABLE]

Justification .

$H_{i}>1$* implies $H_{i}\leq H_{i}^{2}$.* 2. 2)

$G_{i}\sim\mathcal{N}(x_{i}\frac{P+\sigma^{2}}{2P\sigma}$, 1) implies that $G_{i}^{2}$ is a non-central $\chi^{2}$ random variable. 3. 3)

Choosing $\gamma$ appropriately ensures the moment generating function is finite.

Since a finite moment generating function implies every moment is finite, $K_{i}$ exists for all $i$ so that $K^{*}$ is well defined. Therefore, using 12, it follows immediately that

[TABLE]

thereby completing the proof of Lemma 8.1. ∎ 2. 2.

.

Proof of Lemma 7.2.

[TABLE]

Justification .

Chi-squared tail bounds **[39, Lemma 1]**.

∎ 3. 3.

.

*Proof of Lemma 7.3.

*To prove this, we will use 12 reduced to the i.i.d. case. We have that $\{\log(1+H_{E,i}^{2}\mathsf{SNR})\}$ is a sequence of i.i.d. random variables; to employ 12 it remains to prove that $\mathbb{E}\left[e^{\gamma|\log(1+H_{E}^{2}SNR)|}\right]<\infty$ for some $\gamma>0$.

[TABLE]

Then 12 gives us:

[TABLE]

where

[TABLE]

∎

At this point we have finished the proof of Lemma 7.

Proof of Lemma 8.

.

[TABLE]

Justification .

Fréchet inequality for Cartesian products. 2. 2.

Fréchet inequality for intersections. 3. 3.

The second term of the sum is explained here:

[TABLE] 4. 4.

This line follows immediately from Lemma 7.

This completes the proof of Lemma 8. ∎

Proof of 5

.

The proof of 5 follows directly and is analogous to our proof of Lemma D1 found in Appendix D.

[TABLE]

Justification .

$\mathbb{R}_{+}^{n}\times\mathcal{T}_{n}$* is a $(1-\epsilon_{n})$ typical set; however, it may not be the set corresponding to the “smallest” $\epsilon_{n}$ smooth max-information. Note that here we are labeling our typical set as just $\mathcal{T}_{n}$ for ease and dropping the subscript on $\epsilon_{n}$.* 2. 2.

Lemma 6*. Since we no longer have any dependencies on $H_{T}$, we will henceforth write our typical set as just $\mathcal{T}_{n}$.* 3. 3.

Each output, given $X_{i}=x_{i}$ and $H_{E,i}=h_{E,i}$, is $Z_{i}=h_{E,i}x_{i}+U_{E,i}$. This is simply a normal random variable that is shifted in mean by $h_{E,i}x_{i}$ with variance $\sigma_{E}^{2}$. Thus, the density for each transmission is given as

[TABLE]

Since we assume the channel is memoryless, we can split this density simply into a product. 4. 4.

We are working on $\mathcal{T}_{n}$ and thus $\mathcal{P}^{2}_{n}$; thus, $\left\lVert z^{n}-h_{E}^{n}x^{n}\right\rVert^{2}\geq n\sigma_{E}^{2}(1-\delta_{n}^{\prime})$. 5. 5.

$\mathcal{T}^{1}_{n},\mathcal{T}^{2}_{n},\mathcal{T}^{3}_{n}$* are defined in Section VI-B.*

Let us gain some intuition of what is happening at this point. In Equation 18, suppose $\mathcal{T}_{n}^{\star}=\mathcal{T}^{1}_{n}\cap\mathcal{T}^{2}_{n}$ and let us understand the term

[TABLE]

If we temporarily fix $z^{n}$ and $h_{E}^{n}$, then this maximization is simply asking if there exists some codeword $x^{n}\in\mathscr{C}_{n}$ that makes the sequence $(x^{n},h_{E}^{n},z^{n})$ an element of the set $\mathcal{T}_{n}^{\star}$. If there does exist such an $x^{n}$ then this function returns 1; otherwise, it returns 0. If we now relax $z^{n}$ and only fix $h_{E}^{n}$, $\mathcal{T}_{n}^{\star}$ can be thought of as a typical set as well: it is the set of typical input-output pairs. Thus the above function takes some output $z^{n}$ and asks if there is possibly any codewords that could have generated such an output knowing the channel coefficient is $h_{E}^{n}$. It follows then, that the integral

[TABLE]

roughly “counts” the number of valid input-output pairs given some $h_{E}^{n}$.

To calculate such an integral, we need to know the shape of $\mathcal{T}_{n}^{\star}$ and it is clear that $\mathcal{T}_{n}^{\star}=\mathcal{T}^{1}_{n}\cap\mathcal{T}^{2}_{n}\subset\mathcal{T}^{1}_{n}$ so that we can replace the $\mathcal{T}_{n}^{\star}$ with a $\mathcal{T}^{1}_{n}$ in the above integral at the expense of an inequality. However, this has removed the maximization since $\mathcal{T}^{1}_{n}$ has no dependence on codewords. Therefore the above integration is less than or equal to

[TABLE]

Given some $h_{E}^{n}$, by definition this integral is equal to the Lebesgue measure of $\mathcal{P}^{1}_{n}$ which is precisely the volume of $\mathcal{P}^{1}_{n}$. Since $\mathcal{P}^{1}_{n}$ is actually an ellipsoid with radii, $\sqrt{n\sigma_{E}^{2}(1+h_{E,i}^{2}\mathsf{SNR})(1+\delta_{n})}$, then this integration is actually calculating the volume of said ellipsoid, which is calculated to be

[TABLE]

where $\Gamma$ is the usual gamma function of analysis.

Let us return to Equation 18; using the aforementioned reasoning above we have:

[TABLE]

Justification .

Due to the bounds of integration we know that every value of $h_{e}$ will satisfy the definition of $\mathcal{P}^{3}_{n}$, thus it satisfies:

[TABLE]

Continuing from the last string of inequalities and equalities, we take the logarithm of the beginning and end, and divide by $n$:

[TABLE]

Let us see the asymptotic behavior of these first two terms.

• A1.

If we choose $\delta_{n}\to 0$ and $\delta_{n}^{\prime}\to 0$ as $n\to\infty$ at rates sufficiently slow (so as to allow $1-\epsilon_{n}^{1}\to 1$ and $1-\epsilon_{n}^{2}\to 1$ resp.), then $\textnormal{A1}\to 0$ as $n\to\infty$.

• A2.

It can be shown that $\frac{n}{2e\cdot\Gamma(\frac{n}{2}+1)^{\frac{2}{n}}}\to 1$ as $n\to\infty$ so that $\textnormal{A2}\to 0$ as $n\to\infty$.

Since we can choose $\delta_{n},\delta^{\prime}_{n},\delta^{\prime\prime}_{n}$ in such a way so that $\delta_{n}^{\prime\prime}\rightarrow 0$ and $\epsilon_{n}^{1},\epsilon_{n}^{2},\epsilon_{n}^{3}\to 0$ as $n\to\infty$, it follows that $\epsilon_{n}\to 0$ as $n\to\infty$. Combing these previous steps yields our claim:

[TABLE]

Thus, we have completed the proof of 5. ∎

Appendix H Partial CSIT: Proof of Lemma 9 and 6

In this final appendix, we shall prove results related to partial CSIT. In particular, we will prove Lemma 9 (proves that the sets we defined for partial CSIT are actually typical) and 6 (another main result of our paper that proves an upper bound on max-information in the the partial CSIT scenario).

Proof of Lemma 9.

.

We first see that $\mathcal{T}^{\prime}_{n_{i}}$ is $(1-\epsilon_{n_{i}})$ typical directly from Section VI-B. Then:

[TABLE]

Since $\epsilon^{*}$ is going to [math] with $n\rightarrow\infty$ and we are free to choose $d$, we see that $\mathcal{T}^{\prime}_{n}$ is a $(1-\epsilon_{n})$ typical set.

Justification .

Fréchet inequality for Cartesian products. 2. 2.

We know that $\mathcal{T}^{\prime}_{n_{i}}$ is a $(1-\epsilon_{n_{i}})$ typical set for all $i$ thus:

[TABLE]

and we sum over all $i$.

This concludes the proof of Lemma 9. ∎

Proof of 6

.

The proof follows in a similar fashion to both Lemma 2 and 5.

[TABLE]

Justification .

$\mathcal{T}^{\prime}_{n}$* is a $(1-\epsilon_{n})$ typical set; however, it may not be the set corresponding to the “smallest” $\epsilon$ smooth max-information.* 2. 2.

We wish to integrate over all $n$ and to do so, we break up the integral into integrals over each $n_{i}$.

1. (a)

*Suppose $N_{i}\geq n_{i}$. In this case, we have transmitted a full $n_{i}$ length codeword over the *$i$th channel and choose to not send information over the channel during the remaining $N_{i}-n_{i}$ channel uses. Then:

[TABLE]

Thus, if $N_{i}\geq n_{i}\,\forall i$ then we obtain equality at this line. 2. (b)

*Suppose $N_{i}<n_{i}$. In this case, the *$i$th channel did not appear often enough for the transmitter to send an entire $n_{i}$ length codeword. By not sending the full codeword, we are inherently limiting the amount of information sent across the channel and therefore the amount of information that can be leaked to the eavesdropper. Hence, sending the full $n_{i}$ length codeword allows more information (or equal amount of information) to be leaked to the eavesdropper and therefore serves as an upper bound to the actual value. More clearly:

[TABLE] 3. 3.

Due to the partitioning of the channel coefficients, we know that for each $i$, $H_{T}\in\left[h_{T,i},h_{T,i+1}\right)$.

Continuing on we have:

[TABLE]

Taking the logarithm of each side and dividing by $n$ we have:

[TABLE]

as $n\rightarrow\infty$ and $\epsilon\rightarrow 0$.

Justification .

We can split up the conditional density as

[TABLE]

where the first equality follows from the fact that $h_{T}^{n_{i}}$ is independent of $z^{n_{i}},x^{n_{i}},\text{ and }h_{E}^{n_{i}}$. Note that $h_{T}^{n_{i}}$ was indeed used to determine which codebook to use on this channel, but at this point that has been determined and we have restricted the integration of $h_{T}^{n_{i}}$ to take this into account, i.e. $x^{n_{i}}$ is independent of $h_{T}^{n_{i}}$. Thus the multiplicand becomes:

[TABLE]

The equality follows from the fact that we know $h_{T}\in\left[h_{T,i},h_{T,i+1}\right)$ for each component of the $n_{i}$ length vector for every $i$. Therefore integrating $\omega(h_{T}^{i})$ over the whole space where $h_{T}$ is guaranteed to be will yield $1$ for each of the $\sum_{i}n_{i}$ integrals. We then rewrite the integral over $h_{E}^{n_{i}}$ in the form of expected value. 2. 5.

Definition of $I_{\infty}^{\mathcal{T}^{\prime}_{n_{i}}}(X^{n_{i}}\wedge Z^{n_{i}},H_{T}^{n_{i}},H_{E}^{n_{i}})$ and Lemma 6. 3. 6.

Upper bound as found in 5. 4. 7.

$d$* can be made arbitrarily large and thus the channel coefficient intervals can be made arbitrarily small, hence the convergence of the first term to the expected value. For the second term:*

[TABLE]

Since $\mathbb{E}_{H_{E}}\left[\log\left(1+H_{E}^{2}\frac{\gamma_{i}(h_{T,i})}{\sigma_{E}^{2}}\right)\right]$ is constant with respect to $n$ and $\varepsilon_{i}\rightarrow 0$. Also, $\delta_{n},\delta^{\prime}_{n},\delta^{\prime\prime}_{n}$ (from Theorem 1) can be chosen in such a way that $\epsilon\rightarrow 0$ as $n\rightarrow\infty$.

This concludes the proof of 6. ∎