Wyner [96] proved that unconditionally secure communication over noisy channels is possible if the wiretapping channel is noisier than the main channel. The work has developed the following belief: Physical-channel characteristics are great resources to build security functionalities in the information-theoretic framework. We follow this belief and investigate the three problems of secret key establishment, manipulation detection, and distance bounding verification over physical-layer channels. We investigate secret key establishment (SKE) between Alice and Bob when they are connected through a pair of noisy wiretap channels with leakage to Eve. Our results show the possibility of SKE even in cases where the main channels are noisier than Eve's channels. We then notice two implicit assumptions of this work: (i) local randomness is freely available, and (ii) the wiretap channels are independent. We remove Assumption (i) by considering no local randomness for the parties. The results appreciate the role of noise as a single resource for randomness derivation and key generation in this setting. Regarding the second assumption, we consider the general two-way wiretap channel, where simultaneous data transmission can help achieve higher key rates. We show under what condition our security requirements can be strengthened without sacrificing the SK capacity. We consider manipulation detection against physical-layer adversaries noticing their limitations. We define leakage-resilient algebraic manipulation detection (LR-AMD) codes and prove optimal LR-AMD code constructions in general and special leakage scenarios. We show two applications of these codes: (i) robust nonperfect secret sharing and (ii) manipulation detection over wiretap channels. We then discuss how these codes can be composed with other primitives to guarantee bitwise manipulation detection and SKE against active adversaries over binary wiretap channels. Distance bounding verification (DBV) allows a verifier to check an upper bound on a claimed distance from a prover. We study DBV over physical channels with security against distance fraud (DFA), ma a fraud (MFA) and terrorist fraud (TFA) attacks. We show efficient DFA- and MFA-secure protocols only using physical channel properties. We further prove that TFA-security becomes feasible if the parties' communication is limited by the bounded retrieval model (BRM).
Wyner [96] proved that unconditionally secure communication over noisy channels is possible if the wiretapping channel is noisier than the main channel. The work has developed the following belief: Physical-channel characteristics are great resources to build security functionalities in the information-theoretic framework. We follow this belief and investigate the three problems of secret key establishment, manipulation detection, and distance bounding verification over physical-layer channels. We investigate secret key establishment (SKE) between Alice and Bob when they are connected through a pair of noisy wiretap channels with leakage to Eve. Our results show the possibility of SKE even in cases where the main channels are noisier than Eve's channels. We then notice two implicit assumptions of this work: (i) local randomness is freely available, and (ii) the wiretap channels are independent. We remove Assumption (i) by considering no local randomness for the parties. The results appreciate the role of noise as a single resource for randomness derivation and key generation in this setting. Regarding the second assumption, we consider the general two-way wiretap channel, where simultaneous data transmission can help achieve higher key rates. We show under what condition our security requirements can be strengthened without sacrificing the SK capacity. We consider manipulation detection against physical-layer adversaries noticing their limitations. We define leakage-resilient algebraic manipulation detection (LR-AMD) codes and prove optimal LR-AMD code constructions in general and special leakage scenarios. We show two applications of these codes: (i) robust nonperfect secret sharing and (ii) manipulation detection over wiretap channels. We then discuss how these codes can be composed with other primitives to guarantee bitwise manipulation detection and SKE against active adversaries over binary wiretap channels. Distance bounding verification (DBV) allows a verifier to check an upper bound on a claimed distance from a prover. We study DBV over physical channels with security against distance fraud (DFA), ma a fraud (MFA) and terrorist fraud (TFA) attacks. We show efficient DFA- and MFA-secure protocols only using physical channel properties. We further prove that TFA-security becomes feasible if the parties' communication is limited by the bounded retrieval model (BRM).
Secure communication ensures the integrity and confidentiality of communication between connected devices. An information-theoretic approach to secure communication gives the strongest confidentiality guarantee by assuming that the attacker has unlimited computing power. The earliest formal model and definition of information-theoretic secure communication is by Shannon, who employed a secret key shared between communicating parties to provide confidentiality. An alternative elegant information-theoretic approach to secure communication views the natural characteristics of the environment (i.e., channel’s noise) as a resource to build security functionalities. This approach was first proposed by Wyner, and the corresponding secure communication model is called the wiretap channel model. These two approaches introduce two primary resources for providing information-theoretic secure communication: the shared secret key and physical properties of the communication medium. In this thesis, we study how to employ the above two resources for secure message transmission. We study this by using channel’s noise in the wiretap channel model. In this model, a sender is connected to the receiver and the adversary through two noisy channels. We propose a new wiretap encoding scheme with strong secrecy that provides perfect secrecy and reliability, asymptotically. The construction treats the noise in the adversary’s channel as a source of randomness that is extracted and used to hide the message from the adversary. We realize the wiretap channel model using cooperative jamming to evaluate the performance of wiretap codes in practice. We consider a model called keyed wiretap channel that unifies Wyner’s model with Shannon’s model of perfect secrecy for information systems, and propose a keyed encoding schemes with strong secrecy and other properties that are attractive in practice. We also study two-party information-theoretic secret key agreement when the two parties have access to samples of a common source of randomness and use a single message transmission to arrive at a shared random key. We propose a secret key agreement protocol in this setting, prove its security, and show its superior performance compared to other known protocols with the same properties. Finally, we propose an information-theoretic secret key agreement over a virtual wiretap channel created by cooperative jamming.
The security of information is an indispensable element of a communication system when transmitted signals are vulnerable to eavesdropping. This issue is a challenging problem in a wireless network as propagated signals can be easily captured by unauthorized receivers, and so achieving a perfectly secure communication is a desire in such a wiretap channel. On the other hand, cryptographic algorithms usually lack to attain this goal due to the following restrictive assumptions made for their design. First, wiretappers basically have limited computational power and time. Second, each authorized party has often access to a reasonably large sequence of uniform random bits concealed from wiretappers. \nTo guarantee the security of information, Information Theory (IT) offers the following two approaches based on physical-layer security. \nFirst, IT suggests using wiretap (block) codes to securely and reliably transmit messages over a noisy wiretap channel. No confidential common key is usually required for the wiretap codes. The secrecy problem investigates an optimum wiretap code that achieves the secrecy capacity of a given wiretap channel. \nSecond, IT introduces key agreement (block) codes to exchange keys between legitimate parties over a wiretap model. The agreed keys are to be reliable, secure, and (uniformly) random, at least in an asymptotic sense, such that they can be finally employed in symmetric key cryptography for data transmission. The key agreement problem investigates an optimum key agreement code that obtains the key capacity of a given wiretap model. \nIn this thesis, we study the key agreement problem for two wiretap models: a Discrete Memoryless (DM) model and a Gaussian model. Each model consists of a wiretap channel \nparalleled with an authenticated public channel. The wiretap channel is from a transmitter, called Alice, to an authorized receiver, called Bob, and to a wiretapper, called Eve. The Probability Transition Function (PTF) of the wiretap channel is controlled by a random sequence of Channel State Information (CSI), which is assumed to be non-causally available at Alice. The capacity of the public channel is C_P₁∈[0,∞) in the forward direction from Alice to Bob and C_P₂∈[0,∞) in the backward direction from Bob to Alice. For each model, the key capacity as a function of the pair (C_P₁, C_P₂) is denoted by C_K(C_P₁, C_P₂). We investigate the forward key capacity of each model, i.e., C_K(C_P₁, 0) in this thesis. We also study the key generation over the Gaussian model when Eve's channel is less noisy than Bob's. \nIn the DM model, the wiretap channel is a Discrete Memoryless State-dependent Wiretap Channel (DM-SWC) in which Bob and Eve each may also have access to a sequence of Side Information (SI) dependent on the CSI. We establish a Lower Bound (LB) and an Upper Bound (UB) on the forward key capacity of the DM model. When the model is less noisy in Bob's favor, another UB on the forward key capacity is derived. The achievable key agreement code is asymptotically optimum as C_P₁→ ∞. For any given DM model, there also exists a finite capacity C⁰_P₁, which is determined by the DM-SWC, such that the forward key capacity is achievable if C_P₁≥ C⁰_P₁. Moreover, the key generation is saturated at capacity C_P₁= C⁰_P₁, and thus increasing the public channel capacity beyond C⁰_P₁ makes no improvement on the forward key capacity of the DM model. If the CSI is fully known at Bob in addition to Alice, C⁰_P₁=0, and so the public channel has no contribution in key generation when the public channel is in the forward direction. \nThe achievable key agreement code of the DM model exploits both a random generator and the CSI as resources for key generation at Alice. The randomness property of channel states can be employed for key generation, and so the agreed keys depend on the CSI in general. However, a message is independent of the CSI in a secrecy problem. Hence, we justify that the forward key capacity can exceed both the main channel capacity and the secrecy capacity of the DM-SWC. \nIn the Gaussian model, the wiretap channel is a Gaussian State-dependent Wiretap Channel (G-SWC) with Additive White Gaussian Interference (AWGI) having average power Λ. For simplicity, no side information is assumed at Bob and Eve. \nBob's channel and Eve's channel suffer from Additive White Gaussian Noise (AWGN), where the correlation coefficient between noise of Bob's channel and that of Eve's channel is given by ϱ. \nWe prove that the forward key capacity of the Gaussian model is independent of ϱ. Moreover, we establish that the forward key capacity is positive unless Eve's channel is less noisy than Bob's. We also prove that the key capacity of the Gaussian model vanishes if the G-SWC is physically degraded in Eve's favor. However, we justify that obtaining a positive key capacity is feasible even if Eve's channel is less noisy than Bob's according to our achieved LB on the key capacity for case (C_P₁, C_P₂)→ (∞, ∞). Hence, the key capacity of the Gaussian model is a function of ϱ. \nIn this thesis, an LB on the forward key capacity of the Gaussian model is achieved. For a fixed Λ, the achievable key agreement code is optimum for any C_P₁∈[0,∞) in both low Signal-to-Interference Ratio (SIR) and high SIR regimes. We show that the forward key capacity is asymptotically independent of C_P₁ and Λ as the SIR goes to infinity, and thus the public channel and the interference have negligible contributions in key generation in the high SIR regime. On the other hand, the forward key capacity is a function of C_P₁ and Λ in the low SIR regime. Contributions of the interference and the public channel in key generation are significant in the low SIR regime that will be illustrated by simulations. \nThe proposed key agreement code asymptotically achieves the forward key capacity of the Gaussian model for any SIR as C_P₁→ ∞. Hence, C_K(∞,0) is calculated, and it is suggested as a UB on C_K(C_P₁,0). Using simulations, we also compute the minimum required C_P₁ for which the forward key capacity is upper bounded within a given tolerance. \nThe achievable key agreement code is designed based on a generalized version of the Dirty Paper Coding (DPC) in which transmitted signals are correlated with the CSI. The correlation coefficient is to be determined by C_P₁. In contrast to the DM model, the LB on the forward key capacity of a Gaussian model is a strictly increasing function of C_P₁ according to our simulations. This fact is an essential difference between this model and the DM model. \nFor C_P₁=0 and a fixed Λ, the forward key capacity of the Gaussian model exceeds the main channel capacity of the G-SWC in the low SIR regime. By simulations, we show that the interference enhances key generation in the low SIR regime. In this regime, we also justify that the positive effect of the interference on the (forward) key capacity is generally more than its positive effect on the secrecy capacity of the G-SWC, while the interference has no influence on the main channel capacity of the G-SWC.
In Chapter 3, we considered the transmission of information over a noisy broadcast channel subject to reliability and security constraints; we showed that appropriate coding schemes can exploit the presence of noise to confuse the eavesdropper and guarantee some amount of information-theoretic security. It is important to note that the wiretap channel model assumes that all communications occur over the channel, hence communications are inherently rate-limited and one-way. Consequently, the results obtained do not fully capture the role of noise for secrecy; in particular, for situations in which the secrecy capacity is zero, it is not entirely clear whether this stems from the lack of any “physical advantage” over the eavesdropper or the restrictions imposed on the communication schemes. The objective of this chapter is to study more precisely the fundamental role of noise in information-theoretic security. Instead of studying how we can communicate messages securely over a noisy channel, we now analyze how much secrecy we can extract from the noise itself in the form of a secret key. Specifically, we assume that the legitimate parties and the eavesdropper observe the realizations of correlated random variables and that the legitimate parties attempt to agree on a secret key unknown to the eavesdropper. To isolate the role played by noise, we remove restrictions on communication schemes and we assume that the legitimate parties can distill their key by communicating over a two-way, public, noiseless , and authenticated channel at no cost.
Abstract. We study the problem of unconditionally secure Secret Key Establishment (SKE) when Alice and Bob are connected by two noisy channels in opposite directions, and the channels are eavesdropped by Eve. We consider the case that Alice and Bob do not have any sources of initial randomness at their disposal. We start by discussing special cases of interest where SKE is impossible, and then provide a simple SKE construction over a binary symmetric channel that achieves some rates of secret key. We next focus on the Secret Key (SK) capacity, i.e., the highest rate of secure and reliable key establishment (in bits per channel use) that the parties can achieve. Relying on the existence of capacity-achieving coding schemes, we propose a multi-round SKE protocol, called the main protocol, that proves a lower bound on the SK capacity. The main protocol consists of an initialization round, followed by repeated use of a two-round SKE protocol, called the basic protocol. We also provide an upper bound on the SK capacity and show that the two bounds coincide when channels do not leak information to the adversary. We apply the results to the case that communicants are connected by binary symmetric channels. 1
We consider the problem of distance bounding verification (DBV), where a proving party claims a distance and a verifying party ensures that the prover is within the claimed distance. Current approaches to "secure" distance estimation use signal's time of flight, which requires the verifier to have an accurate clock. We study secure DBV using physical channel properties as an alternative to time measurement. We consider a signal propagation environment that attenuates signal as a function of distance, and then corrupts it by an additive noise. We consider three attacking scenarios against DBV, namely distance fraud (DFA), mafia fraud (MFA) and terrorist fraud (TFA) attacks. We show it is possible to construct efficient DBV protocols with DFA and MFA security, even against an unbounded adversary; on the other hand, it is impossible to design TFA-secure protocols without time measurement, even with a computationally-bounded adversary. We however provide a TFA-secure construction under the condition that the adversary's communication capability is limited to the bounded retrieval model (BRM). We use numerical analysis to examine the communication complexity of the introduced DBV protocols. We discuss our results and give directions for future research.
Shannon introduced the classic model of a cryptosystem in 1949, where Eve has access to an identical copy of the cyphertext that Alice sends to Bob. Shannon defined perfect secrecy to be the case when the mutual information between the plaintext and the cyphertext is zero. Perfect secrecy is motivated by error-free transmission and requires that Bob and Alice share a secret key. Wyner in 1975 and later I. Csiszar and J. Korner in 1978 modified the Shannon model assuming that the channels are noisy and proved that secrecy can be achieved without sharing a secret key. This model is called wiretap channel model and secrecy capacity is known when Eve's channel is noisier than Bob's channel. In this paper we review the concept of wiretap coding from the satellite channel viewpoint. We also review subsequently introduced stronger secrecy levels which can be numerically quantified and are keyless unconditionally secure under certain assumptions. We introduce the general construction of wiretap coding and analyse its applicability for a typical satellite channel. From our analysis we discuss the potential of keyless information theoretic physical layer security for satellite channels based on wiretap coding. We also identify system design implications for enabling simultaneous operation with additional information theoretic security protocols.