Robust Secure Authentication and Data Storage with Perfect Secrecy

: We consider an authentication process that makes use of biometric data or the output of a physical unclonable function (PUF), respectively, from an information theoretical point of view. We analyse different deﬁnitions of achievability for the authentication model. For the secrecy of the key generated for authentication, these deﬁnitions differ in their requirements. In the ﬁrst work on PUF based authentication, weak secrecy has been used and the corresponding capacity regions have been characterized. The disadvantages of weak secrecy are well known. The ultimate performance criteria for the key are perfect secrecy together with uniform distribution of the key. We derive the corresponding capacity region. We show that, for perfect secrecy and uniform distribution of the key, we can achieve the same rates as for weak secrecy together with a weaker requirement on the distribution of the key. In the classical works on PUF based authentication, it is assumed that the source statistics are known perfectly. This requirement is rarely met in applications. That is why the model is generalized to a compound model, taking into account source uncertainty. We also derive the capacity region for the compound model requiring perfect secrecy. Additionally, we consider results for secure storage using a biometric or PUF source that follow directly from the results for authentication. We also generalize known results for this problem by weakening the assumption concerning the distribution of the data that shall be stored. This allows us to combine source compression and secure storage.


Introduction
The present work addresses two essential practical problems concerning secrecy in information systems.The first problem is authentication in order to manage access to the system.The second problem is secure storage in public databases.Both problems are of essential importance for further development of future communication systems.The goal of this work is to derive a fundamental characterization of the possible performance of such communication systems that meets very strict secrecy requirements.We show that these strict requirements can be met without loss in performance compared to known results with weaker secrecy requirements.
Information theoretic security has become a very active field of research in information theory in the past ten years, with a large number of promising approaches.For a current presentation, see [1].In [2], the paper first introducing information theoretic security, the authors suggest requiring perfect secrecy [3] to guarantee security in communication.This means the data available to an attacker should be stochastically independent of the message that should be kept secret (the data and the message are modeled using random variables (RVs)).Thus, an attacker does not benefit from learning these data.In [4], this notion of security is weakened.The authors use weak secrecy [3] instead of perfect secrecy to guarantee secure communication.In many of the works on information theoretic security following [4], one considers weak secrecy or strong secrecy [3], which is yet another security requirement that is also weaker than perfect secrecy.As the name suggests, perfect secrecy is the desired ideal situation in cryptographic applications where an attacker does not get any information about the secret.Considering the roots of information theoretic security and its intuitive motivation, it suggests itself to require perfect secrecy for secure communications.Additionally, in [3], the recommendation is to not use weak secrecy as a secrecy measure.In [5], there is an example of a protocol that is obviously not secure, but meets the weak secrecy requirement.
The authors of the landmark paper [6] derive the capacity for secret key generation requiring perfect secrecy.A different model in information theoretic security has as an essential feature a biometric source or a PUF source.The outputs of biometric sources and the outputs of PUF sources both uniquely characterize a person [7], or a device, respectively [8].This property qualifies them for being used for authentication as well as for secure storage.In [7,9], the authors consider a model for authentication using the output of a biometric source.They also consider a model that can be interpreted as a model for secure storage using a biometric source.Both of these models are very similar to the model for secret key generation and for both of the models the authors require weak secrecy to hold when defining achievability.
In [6,7,9], the authors assume that the statistics of the (PUF) source are perfectly known.A simple analysis of [6,7,9] shows that the protocols for authentication constructed there heavily depend on the knowledge of the source statistics.Particularly, it is possible that small variations of the source statistics influence the reliability and secrecy of the protocols for authentication or storage, respectively.
The assumption that the source statistics are perfectly known is too optimistic in applications.That is why we are interested in considering the uncertainty of the source or PUF source.We assume that we do not know the statistics of the source, but that we know a set of source statistics that contains the actual source statistic.Thus, we consider a compound version of the source model.We want to develop robust protocols that work for all source statistics in a given set.The compound model also allows us to describe an attack scenario where the attacker is able to alter the source statistics.There are relatively few results concerning compound sources.The compound version of the source model from [6] is considered in [10].
One of our contributions in the present work is the generalization of the model for authentication from [7], by considering authentication using a compound PUF source (or equivalently a biometric source).Additionally, our work differs from the state of the art as we consider protocols for authentication that achieve perfect secrecy.
We also consider secure data storage making use of a PUF source (or equivalently a biometric source).The corresponding information theoretic model is very similar to the second model presented in [7], but, in contrast to [7], we define achievability requiring perfect secrecy and we consider source uncertainty of the PUF source.Our considerations concerning perfect secrecy in this work answer the question posed in the conclusion of [11].
Some of the results for secure authentication described in this work have already been published in [12].Here, we additionally present the proofs that have been omitted in [12], i.e., the proofs of Theorem 4 and Theorem 5 and some more discussion.The results concerning secure storage have been presented in [13,14].As these results heavily depend on [12], we briefly state them here (as well as the corresponding definitions).
In Section 2, we describe the authentication process and define the corresponding information theoretic model.We discuss different definitions of achievability for the model in Section 3. In this context, protocols that achieve perfect secrecy are of special interest.We develop the corresponding definition of achievability in this section.In Section 4, we prove capacity results for the model with respect to the various definitions of achievability.The main result in this section is Theorem 2. In Section 5, we generalize the model for authentication to the case with source uncertainty and define achievability for this model in Section 6.In Section 7, we derive the capacity region for the compound storage model.In Section 8, we consider some results for secure storage that follow from our results for authentication.
The key result from authentication that we use for secure storage with perfect secrecy is Theorem 2. In Section 9, we further discuss our results.
For the most part, we use the notation introduced in [3].

Authentication Model
At first, we consider authentication using biometric or PUF data.This means we consider a scenario where a user enrolls in a system by giving a certain amount of biometric or PUF data to the system.Later, when the user wants to be authenticated, he again gives biometric or PUF data to the system.The system then decides if the user is accepted, i.e., if it is the same user that is enrolled in the system.In our considerations, we assume that the system can store some data in a public database.
Figure 1 depicts the authentication process as described in [7].The process consists of two phases.In the first phase, the enrollment phase, the authentication system receives X n from the PUF source and the ID of a user.It generates a helper message M and a secret-key K from X n .It then uses a one-way function f on K and stores the result and M in a public database together with the user's ID.The second phase is the authentication phase.In this phase, the system receives Y n from the PUF source and the ID of a user.It reads the corresponding helper message M and f (K) from the database.From M and Y n , it generates a secret-key K.Then, the system compares f (K) and f ( K).If they are equal, the user is accepted; otherwise, the user is rejected.

Enrollment Phase Authentication Phase
Encoder Decoder Authentication process considered in [7].
Now, we define an information theoretic model of the authentication process.We use random variables (RVs) to model the data.In the first chapters of this work, we assume that the distribution of the RVs is perfectly known.We drop this assumption in Section 5.

Definition 1.
Let n ∈ N. The authentication model consists of a discrete memoryless multiple source (DMMS) with generic variables XY [3], the (possibly randomized) encoders [3] Φ : X n → M, Θ : X n → K and the deterministic decoder ψ : Y n × M → K. Let X n and Y n be the output of the DMMS.The RVs M and K are generated from X n using Φ and Θ.The RV K is generated from Y n and M using ψ.We use the term authentication protocol for (Φ, Θ, ψ).Remark 1.It is possible to define the authentication protocol in a more general way by permitting randomized decoders Ψ, but one can argue that in our definition of achievability a randomized Ψ does not improve the performance of the protocols ( [3], Problem 17.11).For convenience, we use the less general definition.
Remark 2. We model the PUF source as a DMMS.Due to physically induced distortions, we model the biometric/PUF data read in the two phases as jointly distributed RVs.Remark 3. The distribution of XY is assumed to be known and can be used for the generation of the RVs.Thus, the encoders and the decoder are allowed to depend on the distribution.

Various Definitions of Achievability
For the authentication model, we define achievable secret-key rate versus privacy-leakage rate pairs.Intuitively, we want the probability that a legitimate user is rejected in the authentication phase to be small.Thus, Pr(K = K) should be large to fulfill this reliability condition.Additionally, the probability that an attacker is accepted in the authentication phase should be as small as possible.Thus, we consider the maximum false acceptance probability (mFAP) [15], which is the probability that an attacker using the best possible attack strategy is accepted in the authentication phase averaged over all public messages m ∈ M. As we want the mFAP to be as small as possible, we are interested in the largest possible set of secret keys K.This reasoning is explained below.The system uses the output of a PUF source as input so it should leak as little information about X n as possible [7].This motivates the following definition of achievable rate pairs.Definition 2. A tuple (R, L), R, L ≥ 0, is an achievable secret-key rate versus privacy-leakage rate pair for the authentication model if for every δ > 0 there is an n 0 = n 0 (δ) such that for all n ≥ n 0 there exists an authentication protocol such that Pr ( We denote the corresponding authentication protocols by FAP-Protocols (False-Acceptance-Probability-Protocols).
Remark 4. In [15], a very similar definition of achievability is used.Instead of considering the relation between the mFAP and the set of secret-keys (1), the authors define the false-acceptance exponent that describes the exponential decrease of the mFAP in n.A rate pair (R, L) that is achievable using FAP-protocols is also achievable according to the definition in [15], R playing the role of the false-acceptance exponent.
We now clarify the bound on the mFAP in Inequality (1) and our interest in large secret-key rates.For this purpose, we consider the following observation.
Lemma 1.For a communication protocol fulfilling the reliability condition, it holds that mFAP ≥ 1−δ |K| .
Proof.Introduce the RV E, setting E = 1 for K = K and E = 0, otherwise.
Here, (a) follows as P K|ME (k|m, 0) = 0 if there is no y n ∈ Y n such that ψ(y n , m) = k and (b) follows from the δ-recoverability of K from K. Thus, Lemma 1 shows that requiring Inequality (1) is in fact equivalent to requiring the mFAP to be as small as possible.It also justifies our interest in a large set K.
There is another way to define achievable secret-key rate versus privacy-leakage rate pairs for the authentication model.Here, we want to keep the key secret from the attacker.H(K|M) can be interpreted as the average information required to specify k when m is known ([16], Chapter 2).Thus, we want H(K|M) to be as large as possible instead of requiring a small mFAP.This means we require log |K| = H(K|M).This condition is equivalent to the combination of the perfect secrecy condition I(K; M) = 0 [5] and the uniform distribution of the key, i.e., H(K) = log |K|.Thus, we define achievability as follows.Definition 3. A tuple (R, L), R, L ≥ 0, is an achievable secret-key rate versus privacy-leakage rate pair for the authentication model if for every δ > 0 there is an n 0 = n 0 (δ) such that for all n ≥ n 0 there exists an authentication protocol such that We denote the corresponding authentication protocols by PSA-Protocols (Perfect-Secrecy-Authentication-Protocols).
Remark 5.In [6], the authors derive the secret-key capacity for the source model.They define achievability requiring perfect secrecy and uniform distribution of the key.They do not consider the privacy-leakage in contrast to our definition of achievability.
It is interesting to compare the rate pairs achievable with respect to the restrictive Definition 3 with commonly used weaker requirements.In ( [7], Definition 3.1), the authors give a different definition of achievable secret-key rate versus privacy-leakage rate pairs.Instead of Eqation (2), they require which is called the weak secrecy condition [5].Thus, we get a third definition of achievability.Definition 4 ([7]).A tuple (R, L), R, L ≥ 0, is an achievable secret-key rate versus privacy-leakage rate pair for the authentication model if for every δ > 0 there is an n 0 = n 0 (δ) such that for all n ≥ n 0 there exists an authentication protocol such that We denote the corresponding authentication protocols by WSA-Protocols (Weak-Secrecy-Authentication-Protocols).Definition 5.The set of achievable rate pairs that are achievable using PSA-Protocols is called the capacity region R PSA .The set of achievable rate pairs that are achievable using WSA-Protocols is called the capacity region R WSA and the set of achievable rate pairs that are achievable using FAP-Protocols is called the capacity region R FAP .Now, we look at some straightforward relations between these capacity regions.We can directly see that Definition 3 is more restrictive than Definition 4 so a PSA-Protocol is also a WSA-Protocol and thus We now show that a PSA-Protocol is also a FAP-Protocol.

Capacity Regions for the Authentication Model
In ( [7], Theorem 3.1), the authors derive the capacity region R WSA .

Theorem 1 ([7]
).It holds that The union is over all RVs U such that U − X − Y.We only have to consider RVs U with |U | ≤ |X | + 1.
Remark 6.The authors of [7] do not consider randomized encoders.In contrast, we permit randomization of the encoders in the enrollment phase.Using the strategy described in ( [3], Problem 17.15), one can use the converse for deterministic encoders to prove the converse for randomized encoders with the same bounds on the secret-key rate and the privacy-leakage rate.Thus, the converse in [7] also holds true when randomization is permitted.
The following theorem is one of our main results.
Theorem 2. It holds that Proof.We do not prove Theorem 2 here but prove a more general result in the remainder of the text.This result is Theorem 5.It is more general as it is concerned with a compound version of the authentication model.The authentication model is a special case of the compound authentication model where the compound set consists of a single DMMS.
We now strengthen Lemma 2.
Theorem 3. It holds that Proof.The achievability result is implied by Lemma 2. For the converse, we use a result of [15].As discussed in Remark 4, a rate pair (R, L), which is achievable according to Definition 2 is also achievable according to the definition of achievability used in [15], where R plays the role of the false acceptance exponent E. Thus, we use ( [15], Theorem 4), which says that a rate pair (E, L) ∈ R WSA is not achievable.This implies our converse.

Compound Authentication Model
We now consider authentication when the data source is not perfectly known.Figure 2 shows the corresponding authentication process.The only difference to the authentication process in Section 2 is the source uncertainty.As one can see in Figure 2, we even assume that an attacker can influence the source in the sense that the state of the source is altered, i.e., it generates another statistic.If the protocol for authentication is not robust, then authentication will not work.

Enrollment Phase Authentication Phase
Encoder Decoder  Authentication process with source uncertainty (as considered in [12]).
We define the following information theoretic model for this authentication process with source uncertainty.Definition 6.Let n ∈ N. The compound authentication model consists of a set S of DMMSs with generic variables X s Y s , s ∈ S, (all on the same alphabets X and Y), the (possibly randomized) encoders Φ : X n → M, Θ : X n → K and the (possibly randomized) decoder Ψ : Y n × M → K. Let X n and Y n be the output of one of the DMMSs in S, i.e., P XY = P X s Y s for an s ∈ S, but s is not known.The RVs M and K are generated from X n using Φ and Θ.The RV K is generated from Y n and M using Ψ.We use the term compound authentication protocol for (Φ, Θ, Ψ).

Remark 7.
The uncertainty of the data source is modeled making use of a compound DMMS, that is, the DMMS modeling the PUF source is not known, but we know a set of DMMSs to which the actual DMMS belongs.
Remark 8. S is assumed to be known and can be used for the generation of the RVs, that is, the encoder and the decoder can depend on these distributions.Definition 7. Given S, we define the set for ŝ ∈ S. The sets I(ŝ), ŝ ∈ S, form a partition of S, as they form the equivalence classes for the corresponding equivalence relation.We denote a set of representatives by Ŝ.

Achievability for the Compound Model
For the compound authentication model, we define achievable secret-key rate versus privacyleakage rate pairs.Definition 8.A tuple (R, L), R, L ≥ 0, is an achievable secret-key rate versus privacy-leakage rate pair for the compound authentication model if for every δ > 0 there is an n 0 = n 0 (δ) such that, for all n ≥ n 0 , there exists a compound authentication protocol such that, for all s ∈ S, 1 where P XY = P X s Y s .We denote the corresponding authentication protocols by PSCA-Protocols (Perfect-Secrecy-Compound-Authentication-Protocols).

Definition 9.
The set of achievable secret-key versus privacy-leakage rate pairs that are achievable using PSCA-Protocols is called the compound capacity region R PSCA (S).

Capacity Regions for the Compound Authentication Model
We now derive the compound capacity region R PSCA (S) for the compound authentication model.We only consider compound sets S such that | Ŝ | < ∞.For the proof, we need the following theorem, which is a generalization of ([3], Theorem 6.10).
Theorem 4. Given a (possibly infinite) set W of channels W : X → Y, a set A ⊂ X n with P n (A) > η, P ∈ P (X ), η > 0 and > 0.Then, for every τ > 0 and all n large enough, there is a pair of mappings ( f , φ), f : M f → X n , φ : Y n → M f , such that ( f , φ) is an (n, )-code for all W ∈ W with codewords in A and We call this pair of mappings a compound (n, )-code for W.
Even though the proof of Theorem 4 is very similar to the proof of ([3], Theorem 6.10), the proof of ( [17], Theorem 4.3) and the proof of the results in [18], we prove Theorem 4 for the sake of completeness.The proof can be found in Appendix A.
Proof.For all ŝ ∈ Ŝ and all s ∈ I(ŝ), let U ŝ, X s and Y s be RVs where X s Y s are the output of the DMMS in S with index s and X s and U ŝ are connected by the channel V ŝ : X → U ŝ. Thus, we have the Markov chains U ŝ − X s − Y s for all s ∈ I(ŝ).Let U = ŝ∈ Ŝ U ŝ.We now show that, given δ > 0, for n large enough we can choose a set C ⊂ U n that consists of |M| disjoint subsets C m with the following properties.

•
We consider a partition of the set of all sets C m in | Ŝ | subsets.Thus, we denote the sets C m by C m,ŝ , ŝ ∈ Ŝ, indicating to which subset they belong.We denote the set of indices m corresponding to ŝ by M ŝ.For each C m,ŝ , we have

•
Each C m,ŝ consists of sequences of the same type.

•
For each ŝ ∈ Ŝ, one can define pairs of mappings that are compound (n, )-codes, > 0, for the channels W s : U → Y, W s = P Y s |U ŝ for all s ∈ I(ŝ) in the following way.Define an (arbitrary) bijective mapping for all s ∈ I(ŝ) and for all codewords u n in C m,ŝ .This is possible for all m ∈ M ŝ.
Let δ > 0. We denote the elements of Ŝ by ŝ1 , ŝ2 , • • • , ŝ| Ŝ| .We consider T n ,ξ , ξ > 0, which are disjoint subsets of U n .We show that they are in fact disjoint subsets of U n for ξ small enough.This can be seen as follows.For ŝi , ŝj ∈ Ŝ, ŝi = ŝj , it holds that P U ŝi (u) = P U ŝj (u) for at least one u ∈ U .Thus, there is a u ∈ U with for some α > 0. Now, assume that there is a u n ∈ T n P U ŝi ,ξ ∩ T n P U ŝj ,ξ .Denote the type of u n by p u n .Thus, there is a u ∈ U with where the last inequality follows from the assumption that u n ∈ T exp n(I(U ŝ1 ; Y s ) − δ ) codewords u n ∈ A 1,ŝ 1 for n large enough.We denote the set of these codewords by C 1,ŝ 1 .As there are less than (n + 1) |U | types, we know that there is a set of at least inf s∈I (ŝ 1 ) exp(n(I(U ŝ1 ;Y s )−δ )) (n+1) |U | codewords in C 1,ŝ 1 with the same type.We only pick these codewords.There are at least inf of them for n large enough.We now pick exactly inf of these codewords and we denote this set by C 1,ŝ 1 .Now, we choose a set A 2,ŝ 1 ⊂ T n codewords of the same type corresponding to an (n, )-code.We continue this process until we can not find a set This means We repeat this process for all ŝ = ŝ1 , ŝ ∈ Ŝ.Thus, we have for all ŝ ∈ Ŝ Thus, we have Inequality (8) for n large enough.We now can define the encoders/decoders Φ, Θ and Ψ.

•
We define Φ and Θ as follows.The system gets a sequence x n .It checks if x n ∈ T n P X ŝ ,ξ , ξ > 0, for an ŝ ∈ Ŝ (We can choose ξ small enough and n large enough such that the T n P X ŝ ,ξ are disjoint).If this is true for ŝ, the channel V ŝ is used n times to generate u n from x n .For Φ, the system looks in C for u n .If u n ∈ C the system chooses for m the index of the subset C m containing u n .If u n / ∈ C it chooses an arbitrary m ∈ M. In addition, if In this case, we also define ∈ C, k is chosen at random according to a uniform distribution on the alphabet.The same holds if u n is mapped on k or if x n / ∈ ŝ∈ Ŝ T n P X,ŝ ,ξ .

•
We define Ψ as follows.The system gets a sequence y n and m.It decodes y n using the code corresponding to C m,ŝ .Then, h m is used on the result.The result is k if it differs from k. Otherwise, an arbitrary k ∈ K is chosen.
Using the properties of the communication protocol, we analyse the achievability conditions.We denote the outputs of the DMMS by X n and Y n and the output of the channel used on X n by U n .Assume the index of the DMMS is s ∈ I(ŝ), ŝ ∈ S. Thus, P X n Y n = P n X s Y s .

•
We define the following events: According to ([3], Lemma 2.10), we can choose ξ small enough such that (x n , u n ) ∈ T n P XsU ŝ ,ξ implies x n ∈ T n P Xs ,ξ and u n ∈ T n P U ŝ ,ξ .We have Here, (a) follows as for x n ∈ T n P Xs ,ξ the system uses V ŝ to generate u n from x n .Thus, ).

Now, we use
and get We have as for all m ∈ M As u n ∈ C and u n ∈ T n P U ŝ ,ξ imply u n ∈ C m for an m ∈ M ŝ, we know We know for m ∈ M ŝ Thus, using Inequality ( 9), we have for n large enough.Now, consider u n ∈ C m , m ∈ M. We get We realize that, for u n ∈ C m and x n ∈ ŝ∈ Ŝ T n P X ŝ ,ξ , where the last step follows as Thus, we get .
The last term is constant for all u n of the same type.Thus, for u n ∈ C m .Now, we get We have and get respectively, if, for the source state s, it holds that s ∈ I(ŝ) for the ŝ corresponding to the smallest C m,ŝ .Here, Thus, for n large enough, and Inequality ( 5) is fulfilled for small enough constants and n large enough.

•
We define k : and the RV K = k(U n , M).We have We know ).Thus, for all k ∈ K.This means We also know for P ME K (m, e, k) > 0, (e, k) = (0, 0) as k is chosen according to a uniform distribution on K in this case.Thus, This means Equations ( 6) and ( 7) are fulfilled.

•
For the secret-key rate, we have • Finally, we analyse the privacy-leakage rate.We have where we use H(M|U n ) = 0 for the second equality (see ( [3], Problem 3.1)).Now, we use for ζ > 0 and n large enough.We also use Thus, We now use where Thus, is arbitrarily small for large n.
Thus, we get Again, using ([3], Problem 3.1), we get We also know that Here, we use ( [3], Problem 3.1) and M − X n − Y n .Thus, Thus, It follows that Now, we bound the right hand side of Inequality (11) using Inequality (12) and use Fano's inequality.Thus, we have Here, we use as I(X s ; U ŝ) is constant for all s ∈ I(ŝ).
Using these results, we conclude from Inequalities (10) and ( 13) that Using the distributive law for sets, we can see that this is equivalent to (see Appendix B).We now consider the converse.Assume X n Y n are distributed i.i.d.according to P X s Y s for an arbitrary s ∈ S. The following calculations hold for all s ∈ S. Similarly to the converse part of the proof of ( [7], Theorem 3.1), we have log |K| where we use Equation ( 6) for (a), Fano's inequality with F = δn log |K| + 1 and the data processing inequality in combination with K − MY n − K, which follows from the definition of the compound authentication protocol for (b) and Equation ( 7) for (c).From the definition of the compound authentication protocol, we also know that Y n − X n − MK.Using the definition of Markov chains, this implies i using Implications (A11) and (A13).Then, we use Implication (A12) to get Y i−1 − X i−1 Y i − MK and from this we get the desired result using Implication (A13).) The equation ], Definition 3.9).This is equivalent to ).Thus, we have which can again be seen using the results from Appendix C. Let Q be a time sharing RV independent of all others and uniformly distributed on Q = {1 • • • n} and let U = QU Q , X = X Q and Y = Y Q .Then, P UXY ((u, q), x, y) = P QU q X q Y q (q, u, x, y) (a) = P QU q |X q (u, q|x)P X q Y q (x, y) for all (u, q, x, y) ∈ U q × Q × X × Y, where (a) follows from U q − X q − Y q and the independence of Q.We have for an arbitrary q ∈ Q and (x, y) ∈ X × Y, where (a) follows as P X i Y i = P X s Y s for all i ∈ Q as the RVs X n Y n are generated i.i.d.We also have for all (u, q, x) ∈ U q × Q × X P U|X (u, q|x) = ∑ y∈Y P QUq XqYq (q,u,x,y) P X (x) = P QUq Xq (q,u,x) P Xq (x) = P QU q |X q (q, u|x).
Thus, P UXY ((u, q), x, y) = P XY (x, y)P U|X (u, q|x), which means U − X − Y.We also have Thus, using the definition of F, we get for δ > 0 and n large enough.We also consider From the definition of the compound storage model, we know K − MY n − K. Using the data processing inequality, we get I(K; MY n ) ≥ I(K; K), which means H(K|MY n ) ≤ H(K| K) ≤ F, where the last inequality follows from Fano's inequality.Thus, where (a) follows as X i and Y i are i.i.d. and (b) follows from Inequality (14).With our definition of U, X and Y and the same argumentation as before, we get for n large enough, where, for (a), we use the definition of F and Inequality (16).We have for all (u, q, x) ∈ U q × Q × X P UX ((q, u), x) = P Q (q)P U q X q (u, x) where (a) follows from M − X n − K, which follows from the definition of the compound authentication protocol.As P X n is the same for all s ∈ I(ŝ), ŝ ∈ Ŝ, this result implies that P UX is the same for all s ∈ I(ŝ), ŝ ∈ Ŝ.We get the bounds ( 16) and (17) for each s ∈ S. We denote the corresponding RVs UXY by U s X s Y s for all s ∈ S. The joint distribution of X s Y s is P X s Y s ∈ S as we see from Equation (15).Thus, Equation (18) and the Inequalities ( 16) and (17) for all s ∈ S imply We again use the distributive law for sets to get our result.The bounds on the cardinality of the alphabet of the auxiliary random variables can be derived as in [19].
Remark 9.This result implies Theorem 2 as we use a deterministic decoder for the achievability proof.
Remark 10.In [19], the authors also derive the compound capacity region for |S| < ∞, but, in contrast to this work, they consider deterministic protocols and require strong secrecy instead of perfect secrecy when defining achievability.This compound capacity region equals R PSCA (S).

Secure Storage
We now discuss some other applications of the already proven results apart from authentication.For this purpose, we take a look at some results for secure storage from [13,14], which follow directly from our results for authentication.Here, we again consider compound sets S with | Ŝ | < ∞.
In [13], we consider the following model for secure storage with source uncertainty, where the corresponding scenario is depicted in Figure 3. Y n × M → Dn .Let X n and Y n be the output of one of the DMMSs in S, i.e., P XY = P X s Y s for an s ∈ S, but s is not known.D n is independent of X n Y n .The RV M is generated from X n and D n using Φ n .The RV Dn is generated from Y n and M using Ψ n .We use the term compound storage protocol for (Φ n , Ψ n ).
Additionally, it holds that, for all δ > 0, there is an n 0 = n 0 (δ) such that for all n ≥ n 0 We define achievability for this model.

Definition 11.
A tuple (R, L), R, L ≥ 0, is an achievable storage rate versus privacy-leakage rate pair for the compound storage model if for every δ > 0 there is an n 0 = n 0 (δ) such that for all n ≥ n 0 there exists a compound storage protocol such that for all s ∈ S where P XY = P X s Y s .We denote the corresponding storage protocols by PSCS-Protocols (Perfect-Secrecy-Compound-Storage-Protocols).

Definition 12.
The set of achievable rate pairs that are achievable using PSCS-Protocols is called the compound capacity region R PSCS (S).
We then can prove the following result.
Remark 11.The compound storage model is essentially equivalent to a compound version of the chosen secret system in [7].For this reason, Theorem 6 follows using the same approach as the authors of [7].
We combine source compression and secure storage in [14] by considering the following model, which models the scenario depicted in Figure 4.  Definition 13.Let k, n k ∈ N. The compound source storage model consists of a set S ⊆ P (X × Y ) of DMMSs with generic variables X s Y s , s ∈ S, (all on the same alphabets X and Y), a general source V [20] that fulfills the strong converse property, the (possibly randomized) encoder Φ k : X n k × V k → M and the (possibly randomized) decoder Ψ k : Y n k × M → V k .Let X n k and Y n k be the output of one of the DMMSs in S, i.e., P XY = P X s Y s for an s ∈ S, but s is not known.The RV M is generated from X n k and V k using Φ k .The RV Vk is generated from Y n k and M using Ψ k .We use the term compound source storage protocol for (Φ k , Ψ k ).
For this model, we define achievability where we consider the output of the PUF source as a resource.Definition 14.A tuple (B, L), B, L ≥ 0, is an achievable performance pair for the compound source storage model if, for every δ > 0, there is a k 0 = k 0 (δ) such that, for all k ≥ k 0 , there exists a compound source storage protocol such that, for all s ∈ S, where P XY = P X s Y s .We denote the corresponding compound source storage protocols by PSCSS-Protocols (Perfect-Secrecy-Compound-Source-Storage-Protocols).Definition 15.The set of achievable performance pairs that are achievable using PSCSS-Protocols is called the optimal performance region R PSCSS (S, V).
We then can prove the following results.
it chooses an arbitrary m ∈ M. For Θ, the system looks in C for u n .If u n ∈ C, it considers the compound (n, )-code corresponding to the subset C m,ŝ containing u n .If |C m,ŝ | > min ŝ∈ Ŝ inf s∈I (ŝ) exp (n(I(U ŝ; Y s ) − δ)) , we consider the following deterministic mapping h m : f −1 m (C m ) → K ∪ { k}.Here,

Figure 3 .Definition 10 .
Figure3.Secure storage process with source uncertainty (as considered in[13]).Definition 10.Let n ∈ N. The compound storage model consists of a set S ⊆ P (X × Y ) of DMMSs with generic variables X s Y s , s ∈ S, (all on the same alphabets X and Y), a source P D n ∈ P (D n ) that puts out a RV D n , the (possibly randomized) encoder Φ n : X n × D n → M and the (possibly randomized) decoder Ψ n : Y n × M → Dn .Let X n and Y n be the output of one of the DMMSs in S, i.e., P XY = P X s Y s for an s ∈ S, but s is not known.D n is independent of X n Y n .The RV M is generated from X n and D n using Φ n .The RV Dn is generated from Y n and M using Ψ n .We use the term compound storage protocol for (Φ n , Ψ n ).Additionally, it holds that, for all δ > 0, there is an n 0 = n 0 (δ) such that for all n ≥ n 0
We start the construction of C by choosing a set A 1,ŝ 1 ⊂ T n ) ≥ η with η > η > 0. According to Theorem 4, there is a compound (n, )-code for the channels W s , s ∈ I(ŝ 1 )