In this paper without tailoring to any physical channel condition or any restriction on adversary's computational resources we design a secrecy scheme with information leakage that decays at an exponential rate. The only advantage for legitimate users over eavesdropper is existence of a key source that is partially known by Eve. A key extractor based on a sampler and a Renyi extractor derives secret keys with the required entropy from this source. Encryption using this key with a general cipher maps Eve's uncertainty about the key to uncertainty about the plaintext that can also be interpreted as degradation in her channel. Using privacy amplification on top of this cipher based on inverse universal2 hashing results in information leakage with decreasing exponent that can be optimized to guarantee a higher level of secrecy.
In this paper without tailoring to any physical channel condition or any restriction on adversary's computational resources we design a secrecy scheme with information leakage that decays at an exponential rate. The only advantage for legitimate users over eavesdropper is existence of a key source that is partially known by Eve. A key extractor based on a sampler and a Renyi extractor derives secret keys with the required entropy from this source. Encryption using this key with a general cipher maps Eve's uncertainty about the key to uncertainty about the plaintext that can also be interpreted as degradation in her channel. Using privacy amplification on top of this cipher based on inverse universal2 hashing results in information leakage with decreasing exponent that can be optimized to guarantee a higher level of secrecy.
In this paper without tailoring to any presumed condition on communication channel or any restriction on adversary's resources we design a secrecy scheme with information leakage that decays at an exponential rate. The only requirement for such an exponentially secure system is existence of a common key source between legitimate users that is partially known by Eve. A key extractor based on a sampler and a Rényi extractor derives secret keys with the required entropy from this source. A general cipher uses this key to ensure the required equivocation for the plaintext and to establish the first layer of secrecy. Using privacy amplification on top of this cipher based on inverse universal2hashing constitutes the second layer of secrecy for highly confidential message transmission with information leakage that is exponentially decreasing. We provide exponent analysis and optimization to minimize information leakage in terms of Eve's distinguishability based on L1norm distance from uniformity. The required key rate is characterized for different source entropies in order to guarantee the secrecy that is demanded in terms of secrecy exponent for the second layer and Eve's error rate for the first layer.
We derive a new upper bound for Eve's information in secret key generation from a common random number without communication. This bound improves on Bennett 's bound based on the Rényi entropy of order 2 because the bound obtained here uses the Rényi entropy of order 1+sfors∈ [0,1]. This bound is applied to a wire-tap channel. Then, we derive an exponential upper bound for Eve's information. Our exponent is compared with Hayashi 's exponent. For the additive case, the bound obtained here is better. The result is applied to secret key agreement by public discussion.
This is the third part of a three-part paper on se- cret-key agreement secure against active adversaries. Here, we con- sider the special case where the legitimate partners already share a mutual string which might, however, be partially known to the adversary. The problem of generating a key in this case has been well studied in the passive-adversary model—for instance, in the context of quantum key agreement—under the name of privacy amplification. We consider the same problem with respect to an ac- tive adversary and propose two protocols, one based on universal hashing and one based on extractors, allowing for privacy ampli- fication secure against an adversary whose knowledge about the initial partially string is limited to one third of the length of this string. Our results are based on novel techniques for au- thentication secure even against adversaries knowing a substantial amount of the secret key. information about . From Eve's point of view, the length of can in this case be roughly equal to the Renyi entropy of . In this paper, we investigate the same problem under the as- sumption that the communication between Alice and Bob is not authenticated. Note that, in contrast to the model where many independent repetitions of the involved random variables are given (15), the same piece of information must be used here both for authentication and as the input for privacy amplifica- tion. Two problems that arise in this context are authentication with an only partially key, and the fact that this authenti- cation leaks information about , hence potentially also about , to the adversary. We show that for our purpose, a new, inter- active, authentication method is better than one-way authentica- tion by strongly universal hashing, and that so-called extractors, requiring fewer random bits (i.e., shorter messages to be com- municated), are a better technique for privacy amplification than
Abstract — We derive a new upper bound for Eve’s information in secret key generation from a common random number without communication. This bound improves on Bennett[7]’s bound based on the Rényi entropy of order 2 because the bound obtained here uses the Rényi entropy of order 1+s for s ∈ [0, 1]. This bound is applied to a wire-tap channel. Then, we derive an exponential upper bound for Eve’s information. Our exponent is compared with Hayashi[8]’s exponent. For the additive case, the bound obtained here is better. The result is applied to secret key agreement by public discussion. Index Terms — exponential rate, non-asymptotic setting, secret key agreement, universal hash function, wire-tap channel I.
We study the problem of “privacy amplification”: key agreement between two parties who both know a weak secret w, such as a password. (Such a setting is ubiquitous on the internet, where passwords are the most commonly used security device.) We assume that the key agreement protocol is taking place in the presence of an active computationally unbounded adversary Eve. The adversary may have partial knowledge about w, so we assume only that w has some entropy from Eve’s point of view. Thus, the goal of the protocol is to convert this non-uniform secret w into a uniformly distributed string R that is fully secret from Eve. R may then be used as a key for running symmetric cryptographic protocols (such as encryption, authentication, etc.). Because we make no computational assumptions, the entropy in R can come only from w. Thus such a protocol must minimize the entropy loss during its execution, so that R is as long as possible. The best previous results have entropy loss of Θ(κ 2), where κ is the security parameter, thus requiring the password to be very long even for small values of κ. In this work, we present the first protocol for information-theoretic key agreement that has entropy loss linear in the security parameter. The result is optimal up
Motivated by the desirability of universal composability, we analyze in terms of L1 distinguishability the task of secret key generation from a joint random variable. Under this secrecy criterion, using the Rényi entropy of order 1+s for s ∈ [0,1], we derive a new upper bound of Eve's distinguishability under the application of the universal2 hash functions. It is also shown that this bound gives the tight exponential rate of decrease in the case of independent and identical distributions. The result is applied to the wiretap channel model and to secret key generation (distillation) by public discussion.