The Secret Key Capacity of a Class of Noisy Channels with Correlated Sources

Abstract

This paper investigates the problem of secret key generation over a wiretap channel when the terminals observe correlated sources. These sources are independent of the main channel and the users overhear them before the transmission takes place. A novel outer bound is proposed and, employing a previously reported inner bound, the secret key capacity is derived under certain less-noisy conditions on the channel or source components. This result improves upon the existing literature where the more stringent condition of degradedness is required. Furthermore, numerical evaluation of the achievable scheme and previously reported results for a binary model are presented; a comparison of the numerical bounds provides insights on the benefit of the chosen scheme.

1. Introduction

The wiretap channel, introduced by Wyner [1], is the basic model for analyzing secrecy in wireless communications. In this model, the transmitter, named Alice, wants to communicate reliably with Bob while keeping the transmitted message—or part of it—secret from an eavesdropper, named Eve, overhearing the communication through another channel. Secrecy is characterized by the amount of information that is not leaked, which can be measured by the equivocation rate—the remaining uncertainty about the message at the eavesdropper. The secrecy capacity of the wiretap channel is thus defined as the maximum transmission rate that can be attained with zero leakage. In their influential paper [2], Csiszár and Körner determined the rate-equivocation region of a general broadcast channel with any arbitrary level of security, which also establishes the secrecy capacity of the wiretap channel. These schemes guarantee secrecy by exploiting an artificial random noise that saturates the eavesdropper’s decoding capabilities.

On the other hand, Shannon [3] showed that it is also possible to achieve a positive secrecy rate by means of a secret key. Alice and Bob can safely communicate over a noiseless public broadcast channel as long as they share a secret key. The rate of this key, however, must be at least as large as the rate of the message to attain zero leakage. The main question that arises in this scenario is therefore: how do the legitimate users safely share the secret key? The answer is that the users should not communicate the key itself, which would then be compromised. Instead, they should only convey enough information to allow themselves to agree upon a key without disclosing, at the same time, any relevant information about it to the eavesdropper (for further discussion, the reader is referred to [4,5]).

In this work, we study the problem of secret key generation over a wiretap channel with correlated sources at each terminal. These sources are assumed to be independent of the main channel and there is no additional public broadcast channel of finite or infinite rate, as seen in Figure 1. It is assumed that each node acquires the n-sequence observation of its corresponding source before the communication begins.

1.1. Related Work

Maurer [6] and Ahlswede and Csiszár [7] were among the first to study the use of correlated observations available at the legitimate users as a means to agree upon a key. In addition to the correlated observations, the terminals may communicate over a public broadcast channel of infinite capacity to which the eavesdropper has also access. Two models are proposed in [7]: the “source model”, where the users observe correlated random sources controlled by nature, and the “channel model”, where the users observe inputs and outputs of a noisy channel controlled by one of the users. In [8], Csiszár and Narayan studied the first model but assumed that the public broadcast channel has finite capacity and there is a third “helper” node who is not interested in recovering the key but rather helping Alice and Bob. The same authors also analyzed the channel model with only one [9] or with multiple channel inputs [10]. Capacity results are presented in [8,9,10] assuming that there is only one round of communication over the public channel. General inner and outer bounds for both source and channel models with interaction over the public channel were introduced by Gohari and Anantharam [11,12].

More recently, Khisti et al. [13] investigated the situation where there is no helper node, the users communicate over a wiretap channel, and a separate public discussion channel may or may not be available. The simultaneous transmission of a secret message along with a key generation scheme using correlated sources was analyzed by Prabhakaran et al. [14]. They obtained a simple expression that reveals the trade-off between the achievable secrecy rate and the achievable rate of the secret key. The corresponding Gaussian channel with correlated Gaussian sources but independent of the channel components is recently studied in [15]. Closed form expressions for both secret key generation and secret message transmission are derived. On the other hand, Salimi et al. [16] considered simultaneous key generation of two independent users over a multiple access channel with feedback, where each user eavesdrops the other. In addition, the receiver can actively send feedback, through a private noiseless (or noisy) link, to increase the size of the shared keys.

The authors of [13,14,15] did not assume interactive communication, i.e., there is only one round of communication. Salimi et al. [16], however, allowed the end user to respond once through the feedback link. Other authors have analyzed key generation schemes that rely on several rounds of transmissions. Tyagi [17] characterized the minimum communication rate required to generate a maximum-rate secret key with r rounds of interactive communication. He showed that this rate is equal to the interactive common information (a quantity he introduces) minus the secret key capacity. In his model, two users observe i.i.d. correlated sources and communicate over an error-free channel. Hayashi et al. [18] studied a similar problem but consider general (not necessarily i.i.d.) source sequences of finite length. Their proposed protocol attains the secret key capacity for general observations as well as the second-order asymptotic term of the maximum feasible secret key length for i.i.d. observations. They also proved that the standard one-way communication protocol fails to attain the aforementioned asymptotic result. Courtade and Halford [19] analyzed the related problem of how many rounds of public transmissions are required to generate a specific number of secret keys. Their model assumes that there are n terminals connected through an error-free public channel, where each terminal is provided with a number of messages before transmission that it uses to generate the keys. More recently, Boche et al. [20] investigated the computability of the secret key in the source model with only one forward communication. They showed that the corresponding secret key capacity is not Turing computable when the public communication is rate-limited, and consequently there is no algorithm that can simulate or compute the secret key capacity.

As previously mentioned, the focus of the present work is on sources that are independent of the main channel; nonetheless, some works have addressed the general situation of correlated sources and channels. Prior work on secrecy for channels with state include Chen and Vinck’s [21] and Liu and Chen’s [22] analyses of the wiretap channel with state. These works employ Gelfand and Pinsker’s scheme [23] to correlate the transmitted codeword with the channel state at the same time that it saturates the eavesdropper’s decoding capabilities. A single-letter expression of the secrecy capacity for this model is still unknown, although a multi-letter bound was provided by Muramatsu [24] and a novel lower bound is recently reported in [25]. As a matter of fact, the complexity of this problem also lies in the derivation of an outer bound that can handle simultaneously secrecy and channels with state.

To the best of our knowledge, only a handful of works have studied the problem of key generation for channels with state. The previously mentioned result of Prabhakaran et al. [14] is one of these examples. Zibaeenejad [26] analyzed a similar scenario where there is also a public channel of finite capacity between the users and he provides an inner and an outer bound for this model. Although the inner bound is developed for a channel with state, it is possible to apply it to the model used in the present work, i.e., sources independent of the main channel. However, some steps of the proof reported in [26] appear to be obscure and a constraint seems to be missing in the final expression; the resulting achievable rate was recently shown in [27] to be in certain cases unachievable. As a consequence, we decided not to compare our inner bound to this previously reported scheme.

1.2. Contributions and Organization of the Paper

In this work, we introduce a novel outer bound (Theorem 2) for the problem of secret key generation over a wiretap channel with correlated sources at each terminal. The correlated sources are assumed to be independent of the main channel and, thanks to a previously reported inner bound (Theorem 1), we obtain the capacity region (Propositions 1–3) whenever the channel and/or source components satisfy the specific less-noisy conditions described in

Table 1. Regimes where Theorem 1 is optimal. No secret key is achievable if $Z{⪰}_{X}Y$ and $E{⪰}_{A}B$.

$\mathit{Z}{⪰}_{\mathit{X}}\mathit{Y}$			$\mathit{Y}{⪰}_{\mathit{X}}\mathit{Z}$
$E{⪰}_{A}B$	$B{⪰}_{A}E$		$E{⪰}_{A}B$	$B{⪰}_{A}E$
$R_k=0$	Proposition 1		Proposition 2	Proposition 3

. In contrast, the proposed schemes in [13,14,15,16] are optimal only when the stronger degradedness condition holds true for the channel and source components.

The results and tools introduced in this work have connections to ones in a previous work of ours [28], where we studied both the secrecy capacity and the secret key capacity of the wiretap channel with generalized feedback. In [28], we determined some capacity regions for the problem dealt here as a secondary result of the main problem. It is not surprising that, by being the main focus of the present work, the capacity results shown here are more general than those in [28]. Furthermore, we go deeper into the analysis of secret key agreement schemes and we show, in Section 4, the suboptimality of a previously published achievable scheme.

This paper is organized as follows. Section 2 provides some definitions and the previously reported inner bound. In Section 3, we first present the outer bound for the problem of secret key agreement and then we enumerate the cases where we obtain the capacity region. Section 4 illustrates with a binary example the benefit of the present inner bound over a previously reported scheme. Finally, Section 5 summarizes and concludes the work, while some technical proofs are deferred to the appendices.

1.3. Notation and Conventions

Throughout this work, we use the standard notation of El Gamal and Kim [29]. Specifically, given two integers i and j, the expression $[i:j]$ denotes the set $\{i,i+1,\dots ,j\}$, whereas for real values a and b, $[a,b]$ denotes the closed interval between a and b. We use the notation $x_i^j=(x_i,x_{i+1},\dots ,x_j)$ to denote the sequence of length $j-i+1$ for $1\le i\le j$. If $i=1$, we drop the subscript for succinctness, i.e., $x^j=(x_1,x_2,\dots ,x_j)$. Lowercase letters such as x and y are mainly used to represent constants or realizations of random variables, capital letters such as X and Y stand for the random variables in itself, and calligraphic letters such as $\mathcal{X}$ and $\mathcal{Y}$ are reserved for sets, codebooks, or special functions.

The set of nonnegative real numbers is denoted by ${\mathbb{R}}_{+}$. The probability distribution (PD) of the random vector $X^n$, $p_{X^n}(x^n)$, is succinctly written as $p(x^n)$ without subscript when it can be understood from the argument $x^n$. Given three random variables X, Y, and Z, if its joint PD can be decomposed as $p(xyz)=p(x)p(y|x)p(z|y)$, then they form a Markov chain, denoted by $X —⚬ Y —⚬ Z$. The random variable Y is said to be less noisy than Z w.r.t. X if $I(U;Y)\ge I(U;Z)$ for each random variable U such that $U —⚬ X —⚬ (Y,Z)$; this relation is denoted by $Y{⪰}_{X}Z$. Entropy is denoted by $H(·)$ and mutual information, $I(·;·)$. The expression ${[x]}^{+}$ denotes $max\{x,0\}$. Given $u,v\in [0,1]$, the function $h_2(u)\triangleq -u{log}_{2}u-(1-u){log}_2(1-u)$ is the binary entropy function and $u\ast v\triangleq u(1-v)+v(1-u)$. We denote typical and conditional typical sets by ${\mathcal{T}}_{\delta }^n(X)$ and ${\mathcal{T}}_{\delta }^n(Y|x^n)$, respectively.

2. Preliminaries

2.1. Problem Definition

Consider the wiretap channel with correlated sources at every node $(A,B,E)$, as shown in Figure 1. The legitimate users (Alice and Bob) want to agree upon a secret key $K\in \mathcal{K}$ while an eavesdropper (Eve) is overhearing the communication. Let $\mathcal{A}$, $\mathcal{B}$, $\mathcal{E}$, $\mathcal{X}$, $\mathcal{Y}$, and $\mathcal{Z}$ be six finite sets. Alice, Bob, and Eve observe the random sequences (sources) $A^n$, $B^n$, and $E^n$, respectively, drawn i.i.d. according to the joint distribution $p(abe)$ on $\mathcal{A}\times \mathcal{B}\times \mathcal{E}$. Alice communicates with Bob through m instances of a discrete memoryless channel with input $X\in \mathcal{X}$ and output $Y\in \mathcal{Y}$. Eve is listening the communication through another channel with input $X\in \mathcal{X}$ and output $Z\in \mathcal{Z}$. This channel is defined by its transition probability $p(yz|x)$ and it is independent of the sources’ distribution.

Definition 1 (Code).

A $(2^{n{R}_k},n,m)$ secret key code ${\mathsf{c}}_n$ for this model consists of:

• a key set ${\mathcal{K}}_n\triangleq [1:2^{n{R}_k}]$, where $R_k$ is the rate of the secret key;
• a source of local randomness $R_r\in {\mathcal{R}}_r$ at Alice;
• an encoding function $\phi :{\mathcal{A}}^n\times {\mathcal{R}}_r\to {\mathcal{X}}^m$;
• a key generation function ${\psi }_a:{\mathcal{A}}^n\times {\mathcal{R}}_r\to {\mathcal{K}}_n$; and
• a key generation function ${\psi }_b:{\mathcal{B}}^n\times {\mathcal{Y}}^m\to {\mathcal{K}}_n$.

The rate of such a code is defined as the number of channel uses per source symbol ${\displaystyle \frac{m}{n}}$.

Given a code, let $K={\psi }_a(A^n,R_r)$ and $X^m=\phi (A^n,R_r)$; then, the performance of the $(2^{n{R}_k},n,m)$ secret key code ${\mathsf{c}}_n$ is measured in terms of its average probability of error

$${\mathsf{P}}_e({\mathsf{c}}_n)\triangleq \mathrm{Pr}\left\{{\psi }_b(B^n,Y^m)\ne K|{\mathsf{c}}_n\right\},$$

(1)

in terms of the information leakage

$${\mathsf{L}}_k({\mathsf{c}}_n)\triangleq I(K;E^n{Z}^m|{\mathsf{c}}_n),$$

(2)

and in terms of the uniformity of the keys

$${\mathsf{U}}_k({\mathsf{c}}_n)\triangleq n{R}_k-H(K|{\mathsf{c}}_n).$$

(3)

Definition 2 (Achievability).

A tuple $(\eta ,R_k)\in {\mathbb{R}}_{+}^2$ is said to be achievable for this model if, for every $ϵ>0$ and sufficiently large n, there exists a $(2^{n{R}_k},n,m)$ secret key code ${\mathsf{c}}_n$ such that

$$\begin{array}{ccccccccc}\hfill \frac{m}{n}& \le \eta +ϵ,\hfill & \hfill {\mathsf{P}}_e({\mathsf{c}}_n)& \le ϵ,\hfill & \hfill \mathsf{L}({\mathsf{c}}_n)& \le ϵ,\hfill & \mathrm{and}\hfill & \hfill \mathsf{U}({\mathsf{c}}_n)& \le ϵ.\hfill \end{array}$$

(4)

The set of all achievable tuples is denoted by ${\mathcal{R}}^{\star }$ and is referred to as the secret key region.

2.2. Inner Bound

The following theorem gives an inner bound on ${\mathcal{R}}^{\star }$, i.e., it defines the region ${\mathcal{R}}_{\mathrm{in}}\subseteq {\mathcal{R}}^{\star }$.

Theorem 1

([30], Theorem 2). A tuple $(\eta ,R_k)\in {\mathbb{R}}_{+}^2$ is achievable if there exist random variables U, V, Q, T, and X on finite sets $\mathcal{U}$, $\mathcal{V}$, $\mathcal{Q}$, $\mathcal{T}$, and $\mathcal{X}$, respectively, with joint distribution $p(uvqtxyzabe)=p(q|t)p(tx)p(yz|x)p(abe)p(v|a)p(u|v)$, which verify

$$R_k\le \eta \left[I(T;Y|Q)-I(T;Z|Q)\right]+I(V;B|U)-I(V;E|U)$$

(5)

subject to

$$\begin{array}{cc}\hfill I(U;A|B)& \le \eta I(Q;Y),\hfill \end{array}$$

(6a)

$$\begin{array}{cc}\hfill I(V;A|B)& \le \eta I(T;Y).\hfill \end{array}$$

(6b)

Moreover, it suffices to consider sets $\mathcal{U}$, $\mathcal{V}$, $\mathcal{Q}$, and $\mathcal{T}$ such that $|\mathcal{U}|\le |\mathcal{A}|+2$, $|\mathcal{V}|\le (|\mathcal{A}|+1)(|\mathcal{A}|+2)$, $|\mathcal{Q}|\le |\mathcal{X}|+2$, and $|\mathcal{T}|\le (|\mathcal{X}|+1)(|\mathcal{X}|+2)$.

Sketch of Proof.

Alice employs the two-layer description $(U,V)$ to compress the source A and she transmits it through the two-layer channel codeword $(Q,T)$. Each layer of the description must fit in the corresponding layer of the channel codeword according to Equation (6). In brief, the encoder randomly picks codewords $u^n(s_1)$ from ${\mathcal{T}}_{\delta }^n(U)$ and, for each one, it randomly picks codewords $v^n(s_1,s_2)$ from ${\mathcal{T}}_{\delta }^n(V|u^n(s_1))$. After observing the source sequence $a^n$, the encoder selects the indices $({\widehat{s}}_1,{\widehat{s}}_2)$ of the codewords that are jointly typical with $a^n$. The codewords $u^n(s_1)$ and $v^n(s_1,s_2)$ are distributed in bins, i.e., $u^n(s_1)\in {\mathcal{B}}_1(r_1)$ and $v^n(s_1,s_2)\in {\tilde{\mathcal{B}}}_2(s_1,r_2,r_p)$, and it is the bin indices $({\widehat{r}}_1,{\widehat{r}}_2,{\widehat{r}}_p)$ which are transmitted through the noisy channel. The channel codewords $q^m(r_1,r_2)$ are randomly picked from ${\mathcal{T}}_{\delta }^m(Q)$ and, for each $q^m(r_1,r_2)$, the codewords $t^m(r_1,r_2,r_p,k_2,r_f)$ are randomly picked from ${\mathcal{T}}_{\delta }^m(T|q^m(r_1,r_2))$. In addition to the bin indices from the two-layer description of the source, the encoder uses the noisy channel to transmit a part of the secret key ($k_2$), which is protected using a wiretap code; the dummy index $r_f$ corresponds to the artificial noise used to exhaust the decoding capabilities of the eavesdropper. Once the decoder successfully decodes the channel and source codewords using its side information $b^n$, it can obtain the other part of the key ($k_1$) from another bin index of the source codeword, i.e., $v^n(s_1,s_2)\in {\overline{\mathcal{B}}}_2(s_1,r_2,k_1)$. We note that the achievable secret key rate in Equation (5) is a combination of the secret bits transmitted through the noisy channel in the manner of the wiretap channel and the secret bits obtained by the reconstruction of the source at Bob.

The inner bound in [30] is obtained using the weak secrecy and uniformity conditions, i.e., $\mathsf{L}({\mathsf{c}}_n)\le nϵ$ and $\mathsf{U}({\mathsf{c}}_n)\le nϵ$. However, an improved proof of the inner bound is found in [31], which shows that the strong secrecy and uniformity conditions in Equation (4) also hold true. We refer the interested reader to [30,31] for a detailed proof of the inner bound. □

Remark 1.

By setting $U=\varnothing$, the region in Theorem 1 recovers the results in ([13], Theorems 1 and 4), when the eavesdropper has access to a correlated source, and ([14], Theorem 2), when there is no secret message to be transmitted. The advantage of having two layers of description is that Theorem 1 can potentially achieve higher secret key rates (see Section 4) and it recovers the result of Csiszár and Narayan [8] (see Remark 6).

Remark 2.

The inner bound in Theorem 1 is a special case of the inner bound recently proposed in [27] for a more general system model.

Remark 3.

The region in Theorem 1 also recovers the result in ([32], Theorem 1) which was published after the original submission of Bassi et al. [30]. In that work, Alice and Bob communicate over a public noiseless channel of rate $R_1$ and a secure noiseless channel of rate $R_2$. The proposed achievable scheme in [32] sends the codeword Q through the public channel, i.e., $I(Q;Y)=R_1$, and the codeword T through the secure channel, i.e., $I(T;Y|Q)=R_2$ and $I(T;Z|Q)=0$. The reader may verify that, by using the aforementioned quantities and $\eta =1$, both regions are equal.

3. Main Results

In this section, we first introduce an outer bound for the secret key region (Theorem 2). We then study some special cases where the inner bound of Theorem 1 turns out to achieve the (optimal) secret key region (Propositions 1–3).

3.1. Outer Bound

The following theorem gives an outer bound on ${\mathcal{R}}^{\star }$, i.e., it defines the region ${\mathcal{R}}_{\mathrm{out}}\supseteq {\mathcal{R}}^{\star }$.

Theorem 2.

An outer bound on the secret key region for this channel model is given by

$$R_k\le \underset{p\in \mathcal{P}}{max}\left\{\eta \left[I(T;Y)-I(T;Z)\right]+I(V;B|U)-I(V;E|U)\right\}$$

(7)

subject to

$$I(V;A|B)\le \eta I(X;Y),$$

(8)

where $\mathcal{P}$ is the set of all input probability distributions given by

$$\mathcal{P}=\left\{p(txyzuvabe)=p(tx)p(yz|x)p(abe)p(v|a)p(u|v)\right\}$$

(9)

with $|\mathcal{T}|\le |\mathcal{X}|$, $|\mathcal{U}|\le |\mathcal{A}|+1$, and $|\mathcal{V}|\le {(|\mathcal{A}|+1)}^2$.

Proof. 

Refer to Appendix A for details. □

Theorem 2 shows that the secret key generated between Alice and Bob has two components. The first two terms on the r.h.s. of Equation (7) represent the part of the key that is securely transmitted through the noisy channel (given by the random variable T) as in the wiretap channel. On the other hand, the last two terms on the r.h.s. of Equation (7) characterize the part of the key that is securely extracted from the correlated sources (given by the random variables U and V). Since the source and channel variables are independent in the model, it should not be surprising that the variable T is independent of $(U,V)$. However, given that the users need to agree on common extracted bits from the source, the noisy channel imposes the restriction in Equation (8) on the amount of information exchanged during that agreement.

Remark 4.

The regions ${\mathcal{R}}_{\mathrm{out}}$ and ${\mathcal{R}}_{\mathrm{in}}$ do not coincide in general. This is due to the presence of the condition in Equation (6a) in the inner bound, and the looser condition in Equation (8) in the outer bound with respect to Equation (6b). We present in Section 3.2 a few special cases where these differences disappear and both regions coincide.

Remark 5.

We note that, although the model defines source and channel sequences of potentially different lengths, the final bounds in Equations (7) and (8) are single-letter and they are calculated using the single-letter probability distribution in Equation (9). The difference in sequence length is captured by the coefficient η defined in Equation (4).

3.2. Optimal Characterization of the Secret Key Rate

The inner bound ${\mathcal{R}}_{\mathrm{in}}$ is optimal under certain less-noisy conditions on the channel and/or source components. These special cases are summarized in Table 1 and explained in the sequel.

3.2.1. Eve Has a Less Noisy Channel

If Eve has a less noisy channel than Bob, i.e., $Z{⪰}_{X}Y$, the information transmitted over the channel is compromised. Therefore, the amount of secret key that can be generated only depends on the statistical differences between the sources.

Proposition 1.

If $Z{⪰}_{X}Y$, a tuple $(\eta ,R_k)\in {\mathbb{R}}_{+}^2$ is achievable if and only if there exist random variables U, V, and X on finite sets $\mathcal{U}$, $\mathcal{V}$, and $\mathcal{X}$, respectively, with joint distribution $p(uvabexyz)=p(u|v)p(v|a)p(abe)p(x)p(yz|x)$, which verify

$$\begin{array}{c}{R}_k\le I(V;B|U)-I(V;E|U)\end{array}$$

(10a)

$$\begin{array}{c}\mathrm{subject} \mathrm{to}I(V;A|B)\le \eta I(X;Y).\end{array}$$

(10b)

Proof. 

Given the less-noisy condition on Eve’s channel, i.e., $I(T;Y)\le I(T;Z)$ for any RV T such that $T —⚬ X —⚬ (YZ)$, the bound in Equation (7) is maximized with $T=\varnothing$. On the other hand, the region in Equation (10) is achievable by setting auxiliary RVs $Q=T=X$ in ${\mathcal{R}}_{\mathrm{in}}$. □

Remark 6.

The secret key capacity of the wiretap channel with a public noiseless channel of rate R ([8], Theorem 2.6) turns out to be a special case of Proposition 1, where $X=Y=Z$ and defining $\eta H(X)=\eta log|\mathcal{X}|\equiv R$.

3.2.2. Eve Has a Less Noisy Source

If Eve has a less noisy source than Bob, i.e., $E{⪰}_{A}B$, the amount of secret key that can be generated depends on the amount of secure information transmitted through the wiretap channel.

Proposition 2.

If $E{⪰}_{A}B$, a tuple $(\eta ,R_k)\in {\mathbb{R}}_{+}^2$ is achievable if and only if there exist random variables T and X on finite sets $\mathcal{T}$ and $\mathcal{X}$, respectively, with joint distribution $p(txyz)=p(tx)p(yz|x)$, which verify

$$R_k\le \eta \left[I(T;Y)-I(T;Z)\right].$$

(11)

Proof. 

Given the less-noisy condition on Eve’s source, i.e., $I(V;B)\le I(V;E)$ for any RV V such that $V —⚬ A —⚬ (BE)$, the bound in Equation (7) is maximized with $U=V$ and independent of the sources. The region in Equation (11) is achievable by using the same auxiliary RVs in the inner bound as in the outer bound. □

Remark 7.

The bound in Equation (11) is equal to the secrecy capacity of the wiretap channel.

Remark 8.

Even though the bound in Equation (11) becomes independent of the sources sequences $(A^n,B^n,E^n)$, we assume $n\ne 0$, and thus the rate η is finite.

3.2.3. Bob Has a Less Noisy Channel and Source

If Bob has a less noisy channel and source than Eve, i.e., $Y{⪰}_{X}Z$ and $B{⪰}_{A}E$, the lower layers of the channel and source codewords are no longer needed.

Proposition 3.

If $Y{⪰}_{X}Z$ and $B{⪰}_{A}E$, a tuple $(\eta ,R_k)\in {\mathbb{R}}_{+}^2$ is achievable if and only if there exist random variables V and X on finite sets $\mathcal{V}$ and $\mathcal{X}$, respectively, with joint distribution $p(vabexyz)=p(v|a)p(abe)p(x)p(yz|x)$, which verify

$$\begin{array}{c}{R}_k\le \eta \left[I(X;Y)-I(X;Z)\right]+I(V;B)-I(V;E)\end{array}$$

(12a)

$$\begin{array}{c}\text{subject to}I(V;A|B)\le \eta I(X;Y).\end{array}$$

(12b)

Proof. 

Given the less-noisy conditions on Bob’s channel and source, the bound in Equation (7) is maximized with $U=\varnothing$ and $T=X$. The region in Equation (12) is achievable by also setting auxiliary RVs $U=Q=\varnothing$ and $T=X$ in the inner bound. □

Remark 9.

Proposition 3 extends the results from ([13], Theorem 4) and ([14], Theorem 3) which assume the more stringent conditions of degradedness: $A —⚬ B —⚬ E$ and $X —⚬ Y —⚬ Z$.

4. Secret Key Agreement over a Wiretap Channel with BEC/BSC Sources

As mentioned in Remark 1, the inner bound introduced in Section 2.2 employs two layers of description, and thus it is an improvement over previously reported results. In this section, we compare the performance of this achievable scheme with the scheme in [13] for a specific binary source and channel model.

4.1. System Model

Consider the communication system depicted in Figure 2. The main channel consists of a noiseless link from Alice to Bob and a binary symmetric channel (BSC) with crossover probability $\zeta \in \left[0,\frac{1}{2}\right]$ from Alice to Eve (see Figure 2a). Additionally, the three nodes have access to correlated sources; in particular, Alice observes a binary uniformly distributed source, i.e., $A\sim \mathcal{B}\left(\frac{1}{2}\right)$, which is the input of two parallel channels, as shown in Figure 2b. Bob observes the output of a binary erasure channel (BEC) with erasure probability $\beta \in [0,1]$, and Eve, a BSC with crossover probability $ϵ\in \left[0,\frac{1}{2}\right]$. For simplicity, we assume $\eta =1$ in the sequel.

Remark 10.

The sources $(A,B,E)$ satisfy different properties according to the values of the parameters $(\beta ,ϵ)$ [33], specifically:

• If $0\le \beta <2ϵ$, E is a degraded version of B, i.e., $A —⚬ B —⚬ E$.
• If $2ϵ\le \beta <4ϵ(1-ϵ)$, B is less noisy than E, i.e., $B{⪰}_{A}E$.
• If $4ϵ(1-ϵ)\le \beta <h_2(ϵ)$, B is more capable than E.

4.2. Performance of the Coding Scheme

The following proposition provides a simple expression of the inner bound from Theorem 1. The expression is obtained by simplifying the maximization process of the input distribution, and thus it might not be optimal. However, this suffices to show the higher rates achieved by this scheme as we see later.

Proposition 4.

The tuple $(\eta =1,R_k)\in {\mathcal{R}}_{\mathrm{in}}$ if there exist $u,v,q\in \left[0,\frac{1}{2}\right]$ such that:

$$\begin{array}{c}{R}_k\le (1-\beta )\left[h_2(v\ast u)-h_2(v)\right]+h_2(v\ast ϵ)-h_2(v\ast u\ast ϵ)+h_2(\zeta )+h_2(q)-h_2(\zeta \ast q),\hfill \end{array}$$

(13a)

$$\begin{array}{c}\text{subject to}\beta \left[1-h_2(v\ast u)\right]\le 1-h_2(q).\hfill \end{array}$$

(13b)

Proof. 

The bound in Equation (13) is directly calculated from Equations (5) and (6a) with the following choice of input random variables: $T=X$, $Q=X\oplus Q^{\prime }$, $V=A\oplus V^{\prime }$, and $U=V\oplus U^{\prime }$. Here, $X\sim \mathcal{B}\left(\frac{1}{2}\right)$, $Q^{\prime }\sim \mathcal{B}(q)$, $V^{\prime }\sim \mathcal{B}(v)$, and $U^{\prime }\sim \mathcal{B}(u)$, and each random variable is independent of each other and $(A,B,E)$. The condition in Equation (6b) in the inner bound becomes redundant with the aforementioned choice of input distribution. □

As previously mentioned, we provide next the inner bound presented in ([13], Theorem 4) as a means of comparison. This inner bound is similar to Theorem 1 but with only one layer of description for the source A; thus, its achievable region is denoted ${\mathcal{R}}_{\mathrm{in}-1\mathrm{L}}$. We note that Theorem 4 from [13] is actually a capacity result assuming that $A —⚬ B —⚬ E$ and $X —⚬ Y —⚬ Z$. In our present example, only the second Markov chain holds independently of the value of the parameters $\beta$ and $ϵ$, but this does not invalidate the use of the inner bound.

Proposition 5

([13], Theorem 4). The tuple $(\eta =1,R_k)\in {\mathcal{R}}_{\mathrm{in}-1\mathrm{L}}$ if and only if

$$R_k\le {\left[h_2(ϵ)-\beta \right]}^{+}+h_2(\zeta ).$$

(14)

Proof. 

See Appendix B. □

Remark 11.

Proposition 5 is a special case of Proposition 4 with $u=q=\frac{1}{2}$, and $v=0$ or $v=\frac{1}{2}$. As mentioned in Remark 1, the inner bound ([13], Theorem 4) is a special case of Theorem 1 with $U=\varnothing$ (thus $u=\frac{1}{2}$). Moreover, given that in this model the Markov chain $X —⚬ Y —⚬ Z$ holds, the channel codebook of Proposition 5 only has one layer (thus $q=\frac{1}{2}$). On the other hand, there are two layers of description in Proposition 4, and whenever $U\ne \varnothing$ (i.e., $u<\frac{1}{2}$), we have that $Q\ne \varnothing$ (i.e., $q<\frac{1}{2}$). This relationship is determined by Equation (13b).

We performed numerical optimization of the bound in Equation (13) for different values of $\beta$ while fixing $\zeta =0.01$ and $ϵ=0.05$; the results are shown in Figure 3 along with the bound in Equation (14). We see in the figure the advantage of having two layers of description for the source A. The proposed scheme in Proposition 4 attains higher secret key rates than the scheme with only one layer of description (Proposition 5) for intermediate values of $\beta$. It is in this regime, when the source B is no longer less noisy than E, that two layers of description are needed.

5. Summary and Concluding Remarks

In this work, we investigated the problem of secret key generation over a noisy channel in presence of correlated sources (independent of the main channel) at all terminals. We introduced a novel outer bound for this channel model, which allowed us to show that a particular achievable scheme is optimal for all classes of less-noisy sources and channels (Propositions 1–3). In Section 4, we further compared the performance of the aforementioned achievable scheme with a previously reported result for a simple binary model. Numerical computation of the corresponding bounds provided interesting insights on the regimes where the achievable scheme outperforms the previous one.

This work, however, does not address the scenario where the sources and the noisy channel are correlated. The extension of the previously mentioned result of Prabhakaran et al. [14] by using two description layers is a natural consequence. Indeed, this extension—posterior to the short version of the present work in [30]—has been recently addressed in [27]. By using two description layers, the proposed achievable scheme recovers the present inner bound for $\eta =1$ provided that the sources are independent of the channel.