We further study the keyless authentication problem in a noisy model in our previous work, where no secret setup is available for sender Alice and receiver Bob while there is discrete memoryless channel (DMC) W1 from Alice to Bob and a two-way noiseless but insecure channel between them. We propose a construction such that the message length over DMC W1 does not depend on the size of the source space. If the source space is S and the number of channel W1 uses is n, then our protocol only has a round complexity of log* |S| - log* n + 4. In addition, we show that the round complexity of any secure protocol in our model is lower bounded by log* |S| - log* n - 5. We also obtain a lower bound on the success probability when the message size on DMC W1 is given. Finally, we derive the capacity for a noninteractive authentication protocol under general DMCs, which extends the result under Binary Symmetric Channels in our previous work.
We further study the keyless authentication problem in a noisy model in our previous work, where no secret setup is available for sender Alice and receiver Bob while there is discrete memoryless channel (DMC) W1 from Alice to Bob and a two-way noiseless but insecure channel between them. We propose a construction such that the message length over DMC W1 does not depend on the size of the source space. If the source space is S and the number of channel W1 uses is n, then our protocol only has a round complexity of log* |S| - log* n + 4. In addition, we show that the round complexity of any secure protocol in our model is lower bounded by log* |S| - log* n - 5. We also obtain a lower bound on the success probability when the message size on DMC W1 is given. Finally, we derive the capacity for a noninteractive authentication protocol under general DMCs, which extends the result under Binary Symmetric Channels in our previous work.
We study a keyless authentication problem in a new noisy model, where there is a discrete memoryless channel (DMC) W1from sender Alice to receiver Bob and a DMC W2from adversary Oscar to Bob. In addition, there is an insecure noiseless channel between Alice and Bob. Under this model, we characterize the condition under which an authentication from Alice to Bob is possible. We also construct a secure authentication protocol that has an authentication rate approaching infinity. Finally, we prove that the authentication capacity of a noninteractive authentication over binary symmetric channels is exactly 1. This is an interesting result as Shannon capacity of channel W1is strictly less than 1 while the noiseless channel is completely unreliable.
In this paper, a novel message authentication model using the same key over wiretap channel is proposed to achieveinformation-theoretic security. Specifically, in the proposed model, there is a discrete memoryless channelW1:X→Ybetween transmitter Alice and receiver Bob, while an attacker Oscar is connected with Alice via discrete memoryless channelW2:X→Z. Alice encodes messageMto codeword (S,Xn), using an encoding function with secret keyK. Then,Sis sent to Bob over a one-way noiseless channel (fully controlled by Oscar), andXnis sent over the wiretap channel, sayX→(Y,Z). Building on this model, a new message authentication scheme is proposed. The scheme incorporates a secure channel coding, which uses random coding techniques to detect man-in-the-middle (MITM) attacks. The authentication channel capacity is studied in a specific channel model whenW2is not less noisy thanW1. We theoretically demonstrate that the authentication channel capacity is much larger than the secrecy capacity, since Bob does not need to recover information transmitted over the noisy channel.
We consider the problem of keyless message authentication over noisy channels in the presence of an active adversary. Different from the existing models, in our model, the legitimate users do not have any pre-shared key for authentication. Instead, we use the noisy channel connecting the legitimate users for authentication. The main idea is to utilize the noisy channel connecting the legitimate users to distinguish a legitimate message from a fake message, by generating an output at the receiver that is difficult for the adversary to replicate through its noisy channel. By interpreting the message authentication as a hypothesis testing problem, we investigate the authentication exponent and the authenticated channel capacity of the noisy channel. In the authentication exponent problem, for a given message rate, we investigate the speed at which the optimal successful attack probability can be driven to zero. We fully characterize the authentication exponent for the zero-rate message case and provide both an upper bound and a lower bound on the exponent for the non-zero message rate case. In the authenticated capacity problem, we study the largest data transmission rate under which the attacker's optimal successful attack probability can still be made arbitrarily small. We establish an all or nothing result. In particular, we show that the authenticated channel capacity is the same as the classic channel capacity if a simulatability condition is not satisfied, while the authenticated capacity will be zero if this condition is satisfied. We also provide efficient algorithms to check this condition. We further show that our results are robust to modeling uncertainties about the eavesdropper's channels.
This is the second part of a two-part paper on information-theoretically secure secret key agreement. This part covers the secret key capacity under the channel model. In this model, multiple terminals wish to create a shared secret key that is secure from an eavesdropper with unlimited computational resources. The terminals are all connected to a noiseless and authenticated but insecure channel, called the “public channel.” Furthermore, the terminals have access to a secure but noisy discrete memoryless broadcast channel (DMBC). The first terminal can choose a sequence of inputs to the DMBC, which has outputs at the other terminals and at the eavesdropper. After each channel use, the terminals can engage in arbitrarily many rounds of interactive authenticated communication over the public channel. At the end, each legitimate terminal should be able to generate the secret key. In this paper, we derive new lower and upper bounds on the secrecy capacity. In each case, an example is provided to show that the new bound represents a strict improvement over the previously best known bound. This part of the paper is not standalone, and is written under the assumption that the reader has access to Part I, which is published in the same issue.
Keyless authentication is considered in an adversarial point-to-point channel. Namely, a legitimate transmitter and receiver aim to communicate over a noisy channel that may or may not also contain an active adversary, capable of transmitting an arbitrary signal into the channel. If the adversary is not present, then the receiver must successfully decode the message with high probability; if it is present, then the receiver must either decode the message or detect the adversary's presence. Thus, whenever the receiver decodes, it can be certain that the decoded message is authentic. The exact authentication capacity is characterized for discrete-memoryless adversary channels, where the adversary is assumed to know the code but not the message. The authentication capacity is shown to be either zero or equal to the no-adversary capacity, depending on whether the channel satisfies a condition termed overwritability.
Abstract. We study the problem of unconditionally secure Secret Key Establishment (SKE) when Alice and Bob are connected by two noisy channels in opposite directions, and the channels are eavesdropped by Eve. We consider the case that Alice and Bob do not have any sources of initial randomness at their disposal. We start by discussing special cases of interest where SKE is impossible, and then provide a simple SKE construction over a binary symmetric channel that achieves some rates of secret key. We next focus on the Secret Key (SK) capacity, i.e., the highest rate of secure and reliable key establishment (in bits per channel use) that the parties can achieve. Relying on the existence of capacity-achieving coding schemes, we propose a multi-round SKE protocol, called the main protocol, that proves a lower bound on the SK capacity. The main protocol consists of an initialization round, followed by repeated use of a two-round SKE protocol, called the basic protocol. We also provide an upper bound on the SK capacity and show that the two bounds coincide when channels do not leak information to the adversary. We apply the results to the case that communicants are connected by binary symmetric channels. 1