In this paper, a novel message authentication model using the same key over wiretap channel is proposed to achieveinformation-theoretic security. Specifically, in the proposed model, there is a discrete memoryless channelW1:X→Ybetween transmitter Alice and receiver Bob, while an attacker Oscar is connected with Alice via discrete memoryless channelW2:X→Z. Alice encodes messageMto codeword (S,Xn), using an encoding function with secret keyK. Then,Sis sent to Bob over a one-way noiseless channel (fully controlled by Oscar), andXnis sent over the wiretap channel, sayX→(Y,Z). Building on this model, a new message authentication scheme is proposed. The scheme incorporates a secure channel coding, which uses random coding techniques to detect man-in-the-middle (MITM) attacks. The authentication channel capacity is studied in a specific channel model whenW2is not less noisy thanW1. We theoretically demonstrate that the authentication channel capacity is much larger than the secrecy capacity, since Bob does not need to recover information transmitted over the noisy channel.
In this paper, a novel message authentication model using the same key over wiretap channel is proposed to achieveinformation-theoretic security. Specifically, in the proposed model, there is a discrete memoryless channelW1:X→Ybetween transmitter Alice and receiver Bob, while an attacker Oscar is connected with Alice via discrete memoryless channelW2:X→Z. Alice encodes messageMto codeword (S,Xn), using an encoding function with secret keyK. Then,Sis sent to Bob over a one-way noiseless channel (fully controlled by Oscar), andXnis sent over the wiretap channel, sayX→(Y,Z). Building on this model, a new message authentication scheme is proposed. The scheme incorporates a secure channel coding, which uses random coding techniques to detect man-in-the-middle (MITM) attacks. The authentication channel capacity is studied in a specific channel model whenW2is not less noisy thanW1. We theoretically demonstrate that the authentication channel capacity is much larger than the secrecy capacity, since Bob does not need to recover information transmitted over the noisy channel.
Message authentication is an interactive procedure that allows a legitimate sender Alice to send and authenticate a message M to a legitimate receiver Bob. To prevent the attacks from an adversary Eve, Alice and Bob usually share a secret key K. In this paper, we study a novel authentication framework as follows. Firstly, Alice sends a message M to Bob over a noiseless channel; Secondly, Alice generates an authentication tag with the message M and secret key K; Thirdly, Alice encodes the tag into a codeword Xn; Finally, Alice transmits the codeword Xn to Bob over a wiretap channel. This paper defines an authentication channel capacity under a fixed tag rate, and show that it equals to H(X|Z). Specifically, we prove that the authentication protocol proposed in Ref. [15] is capacity-achievable under our authentication model.
In this paper, we investigate multi-message authentication to combat adversaries with infinite computational capacity. An authentication framework over a wiretap channel (W1,W2) is proposed to achieve information-theoretic security with the same key. The proposed framework bridges the two research areas in physical (PHY) layer security: secure transmission and message authentication. Specifically, the sender Alice first transmits message M to the receiver Bob over (W1,W2) with an error correction code; then Alice employs a hash function (i.e., ε-AWU2 hash functions) to generate a message tag S of message M using key K, and encodes S to a codeword Xn by leveraging an existing strongly secure channel coding with exponentially small (in code length n) average probability of error; finally, Alice sends Xn over (W1,W2) to Bob who authenticates the received messages. We develop a theorem regarding the requirements/conditions for the authentication framework to be information-theoretic secure for authenticating a polynomial number of messages in terms of n. Based on this theorem, we propose an authentication protocol that can guarantee the security requirements, and prove its authentication rate can approach infinity when n goes to infinity. Furthermore, we design and implement an efficient and feasible authentication protocol over binary symmetric wiretap channel (BSWC) by using \emph{Linear Feedback Shifting Register} based (LFSR-based) hash functions and strong secure polar code. Through extensive experiments, it is demonstrated that the proposed protocol can achieve low time cost, high authentication rate, and low authentication error rate.
We study a keyless authentication problem in a new noisy model, where there is a discrete memoryless channel (DMC) W1from sender Alice to receiver Bob and a DMC W2from adversary Oscar to Bob. In addition, there is an insecure noiseless channel between Alice and Bob. Under this model, we characterize the condition under which an authentication from Alice to Bob is possible. We also construct a secure authentication protocol that has an authentication rate approaching infinity. Finally, we prove that the authentication capacity of a noninteractive authentication over binary symmetric channels is exactly 1. This is an interesting result as Shannon capacity of channel W1is strictly less than 1 while the noiseless channel is completely unreliable.
In this paper, we investigate multi-message authentication to combat adversaries with infinite computational capacity. An authentication framework over a wiretap channel (W_1, W_2) is proposed to achieve information-theoretic security with the same key. The proposed framework bridges the two research areas in physical (PHY) layer security: secure transmission and message authentication. Specifically, the sender Alice first transmits message M to the receiver Bob over (W_1, W_2) with an error correction code; then Alice employs a hash function (i.e., ε-AWU_2 hash functions) to generate a message tag S of message M using key K, and encodes S to a codeword X^n by leveraging an existing strongly secure channel coding with exponentially small (in code length n) average probability of error; finally, Alice sends X^n over (W_1, W_2) to Bob who authenticates the received messages. We develop a theorem regarding the requirements/conditions for the authentication framework to be information-theoretic secure for authenticating a polynomial number of messages. Based on this theorem, we propose and implement an efficient and feasible authentication protocol over binary symmetric wiretap channel (BSWC) by using Linear Feedback Shifting Register based (LFSR-based) hash functions and strong secure polar code. Through extensive experiments, it is demonstrated that the proposed protocol can achieve low time cost, high authentication rate, and low authentication error rate.
The security of information is an indispensable element of a communication system when transmitted signals are vulnerable to eavesdropping. This issue is a challenging problem in a wireless network as propagated signals can be easily captured by unauthorized receivers, and so achieving a perfectly secure communication is a desire in such a wiretap channel. On the other hand, cryptographic algorithms usually lack to attain this goal due to the following restrictive assumptions made for their design. First, wiretappers basically have limited computational power and time. Second, each authorized party has often access to a reasonably large sequence of uniform random bits concealed from wiretappers. \nTo guarantee the security of information, Information Theory (IT) offers the following two approaches based on physical-layer security. \nFirst, IT suggests using wiretap (block) codes to securely and reliably transmit messages over a noisy wiretap channel. No confidential common key is usually required for the wiretap codes. The secrecy problem investigates an optimum wiretap code that achieves the secrecy capacity of a given wiretap channel. \nSecond, IT introduces key agreement (block) codes to exchange keys between legitimate parties over a wiretap model. The agreed keys are to be reliable, secure, and (uniformly) random, at least in an asymptotic sense, such that they can be finally employed in symmetric key cryptography for data transmission. The key agreement problem investigates an optimum key agreement code that obtains the key capacity of a given wiretap model. \nIn this thesis, we study the key agreement problem for two wiretap models: a Discrete Memoryless (DM) model and a Gaussian model. Each model consists of a wiretap channel \nparalleled with an authenticated public channel. The wiretap channel is from a transmitter, called Alice, to an authorized receiver, called Bob, and to a wiretapper, called Eve. The Probability Transition Function (PTF) of the wiretap channel is controlled by a random sequence of Channel State Information (CSI), which is assumed to be non-causally available at Alice. The capacity of the public channel is C_P₁∈[0,∞) in the forward direction from Alice to Bob and C_P₂∈[0,∞) in the backward direction from Bob to Alice. For each model, the key capacity as a function of the pair (C_P₁, C_P₂) is denoted by C_K(C_P₁, C_P₂). We investigate the forward key capacity of each model, i.e., C_K(C_P₁, 0) in this thesis. We also study the key generation over the Gaussian model when Eve's channel is less noisy than Bob's. \nIn the DM model, the wiretap channel is a Discrete Memoryless State-dependent Wiretap Channel (DM-SWC) in which Bob and Eve each may also have access to a sequence of Side Information (SI) dependent on the CSI. We establish a Lower Bound (LB) and an Upper Bound (UB) on the forward key capacity of the DM model. When the model is less noisy in Bob's favor, another UB on the forward key capacity is derived. The achievable key agreement code is asymptotically optimum as C_P₁→ ∞. For any given DM model, there also exists a finite capacity C⁰_P₁, which is determined by the DM-SWC, such that the forward key capacity is achievable if C_P₁≥ C⁰_P₁. Moreover, the key generation is saturated at capacity C_P₁= C⁰_P₁, and thus increasing the public channel capacity beyond C⁰_P₁ makes no improvement on the forward key capacity of the DM model. If the CSI is fully known at Bob in addition to Alice, C⁰_P₁=0, and so the public channel has no contribution in key generation when the public channel is in the forward direction. \nThe achievable key agreement code of the DM model exploits both a random generator and the CSI as resources for key generation at Alice. The randomness property of channel states can be employed for key generation, and so the agreed keys depend on the CSI in general. However, a message is independent of the CSI in a secrecy problem. Hence, we justify that the forward key capacity can exceed both the main channel capacity and the secrecy capacity of the DM-SWC. \nIn the Gaussian model, the wiretap channel is a Gaussian State-dependent Wiretap Channel (G-SWC) with Additive White Gaussian Interference (AWGI) having average power Λ. For simplicity, no side information is assumed at Bob and Eve. \nBob's channel and Eve's channel suffer from Additive White Gaussian Noise (AWGN), where the correlation coefficient between noise of Bob's channel and that of Eve's channel is given by ϱ. \nWe prove that the forward key capacity of the Gaussian model is independent of ϱ. Moreover, we establish that the forward key capacity is positive unless Eve's channel is less noisy than Bob's. We also prove that the key capacity of the Gaussian model vanishes if the G-SWC is physically degraded in Eve's favor. However, we justify that obtaining a positive key capacity is feasible even if Eve's channel is less noisy than Bob's according to our achieved LB on the key capacity for case (C_P₁, C_P₂)→ (∞, ∞). Hence, the key capacity of the Gaussian model is a function of ϱ. \nIn this thesis, an LB on the forward key capacity of the Gaussian model is achieved. For a fixed Λ, the achievable key agreement code is optimum for any C_P₁∈[0,∞) in both low Signal-to-Interference Ratio (SIR) and high SIR regimes. We show that the forward key capacity is asymptotically independent of C_P₁ and Λ as the SIR goes to infinity, and thus the public channel and the interference have negligible contributions in key generation in the high SIR regime. On the other hand, the forward key capacity is a function of C_P₁ and Λ in the low SIR regime. Contributions of the interference and the public channel in key generation are significant in the low SIR regime that will be illustrated by simulations. \nThe proposed key agreement code asymptotically achieves the forward key capacity of the Gaussian model for any SIR as C_P₁→ ∞. Hence, C_K(∞,0) is calculated, and it is suggested as a UB on C_K(C_P₁,0). Using simulations, we also compute the minimum required C_P₁ for which the forward key capacity is upper bounded within a given tolerance. \nThe achievable key agreement code is designed based on a generalized version of the Dirty Paper Coding (DPC) in which transmitted signals are correlated with the CSI. The correlation coefficient is to be determined by C_P₁. In contrast to the DM model, the LB on the forward key capacity of a Gaussian model is a strictly increasing function of C_P₁ according to our simulations. This fact is an essential difference between this model and the DM model. \nFor C_P₁=0 and a fixed Λ, the forward key capacity of the Gaussian model exceeds the main channel capacity of the G-SWC in the low SIR regime. By simulations, we show that the interference enhances key generation in the low SIR regime. In this regime, we also justify that the positive effect of the interference on the (forward) key capacity is generally more than its positive effect on the secrecy capacity of the G-SWC, while the interference has no influence on the main channel capacity of the G-SWC.
In this paper, a new wiretap channel model is proposed, where the legitimate transmitter and receiver communicate over a discrete memoryless channel. The wiretapper has perfect access to a fixed-length subset of the transmitted codeword symbols of her choosing. Additionally, she observes the remainder of the transmitted symbols through a discrete memoryless channel. This new model subsumes the classical wiretap channel and wiretap channel II with noisy main channel as its special cases. The strong secrecy capacity of the proposed channel model is identified. Achievability is established by solving a dual secret key agreement problem in the source model, and converting the solution to the original channel model using probability distribution approximation arguments. In the dual problem, a source encoder and decoder, who observe random sequences independent and identically distributed according to the input and output distributions of the legitimate channel in the original problem, communicate a confidential key over a public error-free channel using a single forward transmission, in the presence of a compound wiretapping source who has perfect access to the public discussion. The security of the key is guaranteed for the exponentially many possibilities of the subset chosen at wiretapper by deriving a lemma which provides a doubly-exponential convergence rate for the probability that, for a fixed choice of the subset, the key is uniform and independent from the public discussion and the wiretapping source's observation. The converse is derived by using Sanov's theorem to upper bound the secrecy capacity of the new wiretap channel model by the secrecy capacity when the tapped subset is randomly chosen by nature.