On Optimal Information-Theoretically Secure Key Management

With an underlying secure symmetric cipher of key length l, this paper addresses how best to securely generate, distribute, and maintain a large number Λ of random keys, from an information theoretic perspective, under the practical condition that one can manage only a relatively small number L of shared secret bits K, where L ≪ Λ ≤ 2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">l</sup> . Let Ω be a set with cardinality Λ; its elements act as key indices. We first formulate a key management scheme G as a mapping G : {0,1} <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">L</sup> × Ω → {0,1} <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">l</sup> wherein for each ω ∈ Ω, its key k(ω) = G(K,ω) can be easily computed from K and ω and is distributed implicitly by distributing the key index ω, and the maintenance of the large set of keys Ψ = {k(ω) : ω ∈ Ω} reduces to that of K. Then a new concept dubbed information-theoretical β-security is introduced to measure the security of G. Specifically, G is information-theoretically β-secure if (1) for any ω ∈ Ω, k(ω) is random and uniformly distributed over {0,1} <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">l</sup> and hence distributing a randomly selected ω discloses zero information about the key k(ω); (2) for any distinct ω <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</inf> ,ω <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</inf> ∈ Ω, the difference between k(ω <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</inf> ) and k(ω <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</inf> ) is random and uniformly distributed over {0,1} <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">l</sup> ; (3) the transform K → Ψ keeps the total amount of secret information; and (4) for any independent key indices $\left\{ {{X_j}} \right\}_{j = 1}^{n + 1},$ knowing $\left\{ {k\left( {{X_j}} \right)} \right\}_{j = 1}^n$ does not reduce the amount of uncertainty about k(X <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n+1</inf> ) significantly, i.e.,$H\left( {k\left( {{X_{n + 1}}} \right)|\left\{ {{X_j}} \right\}_{j = 1}^{n + 1},\left\{ {k\left( {{X_j}} \right)} \right\}_{j = 1}^n} \right) \geq {\beta _n} \times H\left( {k\left( {{X_{n + 1}}} \right)|{X_{n + 1}}} \right),$ where H(X|Y ) is the conditional Shannon entropy of X given Y , and β <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</inf> is close to 1 for small n. Among all information-theoretically β-secure schemes, optimal schemes in terms of their strength against adversary’s attacks are further characterized. A specific information-theoretically β-secure scheme, namely G <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">∗</sup> , is constructed. G <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">∗</sup> is shown optimal.