Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

ACM Symposium on Theory of Computing (STOC)

Communication with secrecy constraints

Alon Orlitsky, Abbas El Gamal

Published Jan 1, 1984• 28 citations
Publisher

Abstract

Let x, y, z be finite sets, X,Y random variables uniformly distributed over x×y, f a function from x×y to Z and 0≤ε&le1. A person PX knows X and a person PY knows Y and they want to exchange X and Y. An eavesdropper who knows their protocol listens to their communication in order to obtain information about f(X, Y). PX and PY want to ensure that for every value (x,y) of (X,Y) the eavesdropper's a priori and a posteriori probabilities of {f(X,Y)=j} are ε-close for all j. Therefore, they encrypt some of the transmitted bits. The problem is to find a protocol that minimizes the number of bits encrypted in the worst case. Two kinds of protocols are considered: deterministic and randomized.

DOI
10.1145/800057.808684

Related papers

Secrecy Enhancement via Public Discussion

Alon Orlitsky, Avi Wigderson

(X, Y, Z) is an ensemble of independent random triples, each distributed according to some probability distribution p(x, y, z). Two legitimate users, Px having X and Py having Y, communicate in order to agree on a joint key while keeping it almost unknown to an eavesdropper Pz who knows Z. Communication is conducted over a noiseless channel according to a predetermined protocol. P2 hears all transmissions over the channel and knows the protocol used. We show: (1) The legitimate communicators can agree on the secret if and only if they can find one using just two messages. (2) There are cases where a secret can be found, but one message does not suffice. (3) Similar results hold whether the legitimate communicators are required to agree on the secret with probability one or just with high probability.

IEEE International Symposium on Information Theory (ISIT)•Aug 24, 2005•10 citations

The Communication Complexity of Correlation

Prahladh Harsha, Rahul Jain, David McAllester +1 more

LetXandYbe finite nonempty sets and(X,Y) a pair of random variables taking values inX?Y. We consider communication protocols between two parties,AliceandBob, for generatingXandY.Aliceis provided anx?Xgenerated according to the distribution ofX, and is required to send a message toBobin order to enable him to generatey?Y, whose distribution is the same as that ofY|X=x. Both parties have access to a shared random string generated in advance. LetT[X:Y] be the minimum (over all protocols) of the expected number of bitsAliceneeds to transmit to achieve this. We show that I[X:Y] ? T[X:Y] ? I [X:Y] + 2 log2(I[X:Y]+ O(1). We also consider the worst case communication required for this problem, where we seek to minimize the average number of bitsAlicemust transmit for the worst casex?X. We show that the communication required in this case is related to the capacityC(E) of the channelE, derived from(X,Y) , that mapsx?Xto the distribution ofY|X=x. We also show that the required communicationT(E) satisfiesC(E) ?T(E) ?C(E) + 2 log2(C(E)+1) +O(1). Using the first result, we derive a direct-sum theorem in communication complexity that substantially improves the previous such result shown by Jain, Radhakrishnan, and Sen [In Proc. 30th International Colloquium of Automata, Languages and Programming (ICALP), ser. Lecture Notes in Computer Science, vol. 2719. 2003, pp. 300-315]. These results are obtained by employing a rejection sampling procedure that relates the relative entropy between two distributions to the communication complexity of generating one distribution from the other.

IEEE Transactions on Information Theory•Jun 1, 2007•203 citations

On Secure Distributed Source Coding

Vinod M. Prabhakaran, Kannan Ramchandran

Exploiting correlated observations at multiple remote nodes for generating a secret common randomness to facilitate secure communication of data between the terminals has been addressed by many authors [1][2][3]. But in many applications such as sensor networks, the correlated observations might themselves be the data that need to be communicated. We address this problem of secure distributed source coding where we want to leak the least amount of information about the sources to an eavesdropper who may have access to a correlated observation of its own and who can listen in on the communication between the distributed encoders. The focus here is on minimizing the amount of information revealed to the eavesdropper rather than on minimizing the rate required to effect the communication.

IEEE Information Theory Workshop (ITW)•Sep 1, 2007•75 citations

Protocols for secure computations

Andrew Chi-Chih Yao

Two millionaires wish to know who is richer; however, they do not want to find out inadvertently any additional information about each other’s wealth. How can they carry out such a conversation? This is a special case of the following general problem. Suppose m people wish to compute the value of a function f(x1, x2, x3, . . . , xm), which is an integer-valued function of m integer variables xi of bounded range. Assume initially person Pi knows the value of xi and no other x’s. Is it possible for them to compute the value of f , by communicating among themselves, without unduly giving away any information about the values of their own variables? The millionaires’ problem corresponds to the case when m = 2 and f(x1, x2) = 1 if x1 < x2, and 0 otherwise. In this paper, we will give precise formulation of this general problem and describe three ways of solving it by use of one-way functions (i.e., functions which are easy to evaluate but hard to invert). These results have applications to secret voting, private querying of database, oblivious negotiation, playing mental poker, etc. We will also discuss the complexity question “How many bits need to be exchanged for the computation”, and describe methods to prevent participants from cheating. Finally, we study the question “What cannot be accomplished with one-way functions”. Before describing these results, we would like to put this work in perspective by first considering a unified view of secure computation in the next section.

•Nov 3, 1982•2,659 citations

Information-theoretical Secret-key agreement and Bound information

Martin Kreißig

One big problem of the communication between two parties is the secrecy. That means how\nmuch information a third party can obtain by intercepting the messages transmitted from\none honest party to the other one. Therefore cryptography offers a wide range of protocols\nto ensure security with assumptions on the eavesdropper. So one was looking for an\ninformation-theoretical description of the scenario to get unconditional secure communication.\nIn this scenario we are considering two honest parties that want to communicate over\nan authenticated channel that the eavesdropper is wiretapping. This scenario introduced the definition of the intrinsic information and the secret-key rate which are a measure of the secrecy in this setting. Later because of strong analogies to quantum mechanics it turned out that this description was lacking a phenomena called bound information which is the disability of a probability distribution to create a secret-key even though it has predicted secrecy.\nNearly ten years of research have shown the existence of bound information for the multipartite case where several parties are communicating but not yet for the bipartite case.\nHence the approach of non-distillability seems a very promising one to find this conjecture.\nMotivated by this the approach we implemented this tool and simulated some distributions that have conjectured bound information. Thereby we improved the tool to reduce its calculationtime and to get closer to the aim.

•Feb 25, 2009•1 citation

Private interactive communication across an adversarial channel

Ran Gelles, Amit Sahai, Akshay Wadia

Consider two parties Alice and Bob, who hold private inputs x and y, and wish to compute a function f(x, y) privately in the information theoretic sense; that is, each party should learn nothing beyond f(x, y). However, the communication channel available to them is noisy. This means that the channel can introduce errors in the transmission between the two parties. Moreover, the channel is adversarial in the sense that it knows the protocol that Alice and Bob are running, and maliciously introduces errors to disrupt the communication, subject to some bound on the total number of errors. A fundamental question in this setting is to design a protocol that remains private in the presence of large number of errors.

Conference on Innovations in Theoretical Computer Science•Jan 12, 2014•9 citations
Let x, y, z be finite sets, X,Y random variables uniformly distributed over x×y, f a function from x×y to Z and 0≤ε&le1. A person PX knows X and a person PY knows Y and they want to exchange X and Y. An eavesdropper who knows their protocol listens to their communication in order to obtain information about f(X, Y). PX and PY want to ensure that for every value (x,y) of (X,Y) the eavesdropper's a priori and a posteriori probabilities of {f(X,Y)=j} are ε-close for all j. Therefore, they encrypt some of the transmitted bits. The problem is to find a protocol that minimizes the number of bits encrypted in the worst case. Two kinds of protocols are considered: deterministic and randomized.
(X, Y, Z) is an ensemble of independent random triples, each distributed according to some probability distribution p(x, y, z). Two legitimate users, Px having X and Py having Y, communicate in order to agree on a joint key while keeping it almost unknown to an eavesdropper Pz who knows Z. Communication is conducted over a noiseless channel according to a predetermined protocol. P2 hears all transmissions over the channel and knows the protocol used. We show: (1) The legitimate communicators can agree on the secret if and only if they can find one using just two messages. (2) There are cases where a secret can be found, but one message does not suffice. (3) Similar results hold whether the legitimate communicators are required to agree on the secret with probability one or just with high probability.
LetXandYbe finite nonempty sets and(X,Y) a pair of random variables taking values inX?Y. We consider communication protocols between two parties,AliceandBob, for generatingXandY.Aliceis provided anx?Xgenerated according to the distribution ofX, and is required to send a message toBobin order to enable him to generatey?Y, whose distribution is the same as that ofY|X=x. Both parties have access to a shared random string generated in advance. LetT[X:Y] be the minimum (over all protocols) of the expected number of bitsAliceneeds to transmit to achieve this. We show that I[X:Y] ? T[X:Y] ? I [X:Y] + 2 log2(I[X:Y]+ O(1). We also consider the worst case communication required for this problem, where we seek to minimize the average number of bitsAlicemust transmit for the worst casex?X. We show that the communication required in this case is related to the capacityC(E) of the channelE, derived from(X,Y) , that mapsx?Xto the distribution ofY|X=x. We also show that the required communicationT(E) satisfiesC(E) ?T(E) ?C(E) + 2 log2(C(E)+1) +O(1). Using the first result, we derive a direct-sum theorem in communication complexity that substantially improves the previous such result shown by Jain, Radhakrishnan, and Sen [In Proc. 30th International Colloquium of Automata, Languages and Programming (ICALP), ser. Lecture Notes in Computer Science, vol. 2719. 2003, pp. 300-315]. These results are obtained by employing a rejection sampling procedure that relates the relative entropy between two distributions to the communication complexity of generating one distribution from the other.
Exploiting correlated observations at multiple remote nodes for generating a secret common randomness to facilitate secure communication of data between the terminals has been addressed by many authors [1][2][3]. But in many applications such as sensor networks, the correlated observations might themselves be the data that need to be communicated. We address this problem of secure distributed source coding where we want to leak the least amount of information about the sources to an eavesdropper who may have access to a correlated observation of its own and who can listen in on the communication between the distributed encoders. The focus here is on minimizing the amount of information revealed to the eavesdropper rather than on minimizing the rate required to effect the communication.
Two millionaires wish to know who is richer; however, they do not want to find out inadvertently any additional information about each other’s wealth. How can they carry out such a conversation? This is a special case of the following general problem. Suppose m people wish to compute the value of a function f(x1, x2, x3, . . . , xm), which is an integer-valued function of m integer variables xi of bounded range. Assume initially person Pi knows the value of xi and no other x’s. Is it possible for them to compute the value of f , by communicating among themselves, without unduly giving away any information about the values of their own variables? The millionaires’ problem corresponds to the case when m = 2 and f(x1, x2) = 1 if x1 < x2, and 0 otherwise. In this paper, we will give precise formulation of this general problem and describe three ways of solving it by use of one-way functions (i.e., functions which are easy to evaluate but hard to invert). These results have applications to secret voting, private querying of database, oblivious negotiation, playing mental poker, etc. We will also discuss the complexity question “How many bits need to be exchanged for the computation”, and describe methods to prevent participants from cheating. Finally, we study the question “What cannot be accomplished with one-way functions”. Before describing these results, we would like to put this work in perspective by first considering a unified view of secure computation in the next section.
One big problem of the communication between two parties is the secrecy. That means how\nmuch information a third party can obtain by intercepting the messages transmitted from\none honest party to the other one. Therefore cryptography offers a wide range of protocols\nto ensure security with assumptions on the eavesdropper. So one was looking for an\ninformation-theoretical description of the scenario to get unconditional secure communication.\nIn this scenario we are considering two honest parties that want to communicate over\nan authenticated channel that the eavesdropper is wiretapping. This scenario introduced the definition of the intrinsic information and the secret-key rate which are a measure of the secrecy in this setting. Later because of strong analogies to quantum mechanics it turned out that this description was lacking a phenomena called bound information which is the disability of a probability distribution to create a secret-key even though it has predicted secrecy.\nNearly ten years of research have shown the existence of bound information for the multipartite case where several parties are communicating but not yet for the bipartite case.\nHence the approach of non-distillability seems a very promising one to find this conjecture.\nMotivated by this the approach we implemented this tool and simulated some distributions that have conjectured bound information. Thereby we improved the tool to reduce its calculationtime and to get closer to the aim.
Consider two parties Alice and Bob, who hold private inputs x and y, and wish to compute a function f(x, y) privately in the information theoretic sense; that is, each party should learn nothing beyond f(x, y). However, the communication channel available to them is noisy. This means that the channel can introduce errors in the transmission between the two parties. Moreover, the channel is adversarial in the sense that it knows the protocol that Alice and Bob are running, and maliciously introduces errors to disrupt the communication, subject to some bound on the total number of errors. A fundamental question in this setting is to design a protocol that remains private in the presence of large number of errors.