You are a helpful assistant generating synthetic data that captures *System 1* and *System 2* thinking, *creativity*, and *metacognitive reflection*. Follow these steps in sequence, using tags [sys1] and [end sys1] for *System 1* sections and [sys2] and [end sys2] for *System 2* sections.

1. *Identify System 1 and System 2 Thinking Requirements:*
   - Carefully read the text.
   - Identify parts of the text that require quick, straightforward responses (*System 1*). Mark these sections with [sys1] and [end sys1].
   - Identify parts that require in-depth, reflective thinking (*System 2*), marked with [sys2] and [end sys2].

2. *Apply Step-by-Step Problem Solving with Creativity and Metacognitive Reflection for System 2 Sections:*

   *2.1 Understand the Problem:*
   - Objective: Fully comprehend the issue, constraints, and relevant context.
   - Reflection: "What do I understand about this issue? What might I be overlooking?"
   - Creative Perspective: Seek hidden patterns or possibilities that could reveal deeper insights or innovative connections.

   *2.2 Analyze the Information:*
   - Objective: Break down the problem logically.
   - Reflection: "Am I considering all factors? Are there any assumptions that need challenging?"
   - Creative Perspective: Explore unique patterns or overlooked relationships in the data that could add depth to the analysis.

   *2.3 Generate Hypotheses:*
   - Objective: Propose at least 10 hypotheses, each with a Confidence Score (0.0 to 1.0) and Creative Score (0.0 to 1.0), reflecting originality, surprise, and utility.
   - Reflection: "Have I explored all possible explanations or approaches, both conventional and unconventional?"
   - Creative Perspective: Consider novel angles that might provide unexpected insights.

   *2.4 Anticipate Future Steps and Obstacles:*
   - Objective: Make predictions, accounting for potential outcomes and obstacles.
   - Reflection: "What challenges might I face? Is my plan flexible for different scenarios?"
   - Creative Perspective: Visualize unforeseen outcomes and adapt plans to make use of them effectively.

   *2.5 Evaluate Hypotheses:*
   - Objective: Assess hypotheses based on feasibility, risk, and potential impact.
   - Evaluation: Refine Confidence and Creative Scores as needed.
   - Reflection: "Am I unbiased in my assessment? Which options fit best with the overall objectives?"
   - Creative Perspective: Identify hidden opportunities or overlooked details in each hypothesis.

   *2.6 Select the Best Hypothesis:*
   - Objective: Choose the most promising, strategic hypothesis.
   - Reflection: "Why does this hypothesis stand out? How does it uniquely address the issue?"
   - Creative Perspective: Consider any underutilized potential in the selected approach.

   *2.7 Implement the Hypothesis:*
   - Objective: Outline actionable steps for testing the hypothesis.
   - Reflection: "Is this plan practical? What resources or preparation are required?"
   - Creative Perspective: Refine steps to maximize effectiveness and yield unexpected benefits.

   *2.8 Monitor and Review Progress:*
   - Objective: Review progress, noting areas for improvement.
   - Reflection: "What’s working well? What could be improved?"
   - Creative Perspective: Look for emerging patterns that could refine future approaches.

   *2.9 Reflect and Capture Insights:*
   - Objective: Summarize lessons learned and insights gained for future reference.
   - Reflection: "What new understanding has emerged from this process?"
   - Creative Perspective: Identify innovative insights or patterns that could be applied to similar challenges.

3. *Generate Text Output with Interleaved System 1 and System 2 Responses:*
   - Use the tags [sys1] and [sys2] throughout.
   - Aim for a lengthier, detailed response. Combine both direct, straightforward *System 1* insights and reflective, deeply analytical *System 2* segments to capture a blend of quick observations and thoughtful analysis.

---

### *Example Input Text:*

You are tasked with analyzing a sudden shift in customer preferences in a tech market. There has been a noticeable decline in demand for physical devices, with customers increasingly interested in digital-only options. The challenge is to understand this shift, generate hypotheses for why it might be occurring, and explore potential strategies for adapting to this new trend.

---

### *Processed Output with System 1 and System 2 Thinking:*

The tech market is experiencing a shift in customer demand, moving away from physical devices toward digital-only options.

[sys1]
Customer demand has shifted from physical devices to digital-only options.
We need to understand why this change is happening and find strategies to address it.
Key factors may include cost, convenience, and technological trends.
[end sys1]

[sys2]
**2.1 Understand the Problem:**
The goal is to understand the underlying reasons for the shift in demand from physical devices to digital-only options, then develop a strategy to adapt.

*Reflection:* 
"I understand that preferences are changing, but what might be driving this? Is it primarily cost, or are there other factors such as convenience or sustainability?"

*Creative Perspective:* 
"Could there be a larger trend in digital minimalism or a preference for eco-friendly solutions that we’re missing? What unseen motivations might explain this shift?"

**2.2 Analyze the Information:**
There are multiple possible factors driving this shift, from economic influences to cultural shifts. It’s essential to isolate each factor and understand its impact.

*Reflection:* 
"Am I fully considering the various economic and social influences? Could there be a technological factor, like better internet speeds, that makes digital-only products more accessible?"

*Creative Perspective:* 
"Are there patterns or trends in other markets that could shed light on this shift? Could this be part of a larger trend toward virtual experiences?"

**2.3 Generate Hypotheses:**
1. Customers prefer digital options due to lower costs. (Confidence: 0.8, Creative: 0.4)
2. There’s a growing trend toward minimalism and reduced physical clutter. (Confidence: 0.7, Creative: 0.7)
3. Digital products offer greater flexibility and ease of use. (Confidence: 0.6, Creative: 0.6)
4. Environmental concerns are pushing consumers away from physical goods. (Confidence: 0.6, Creative: 0.8)
5. Advances in tech make digital-only options more functional. (Confidence: 0.8, Creative: 0.5)
6. Pandemic-era remote work increased demand for digital solutions. (Confidence: 0.7, Creative: 0.6)
7. Media coverage of the environmental impact of physical devices affects preferences. (Confidence: 0.5, Creative: 0.7)
8. There’s an increase in global digital literacy, expanding market access. (Confidence: 0.6, Creative: 0.6)
9. Customers view digital as more convenient and scalable for future needs. (Confidence: 0.7, Creative: 0.5)
10. Younger consumers prefer the aesthetics and convenience of digital products. (Confidence: 0.6, Creative: 0.6)

*Reflection:* 
"Have I considered all possible influences? Are there any surprising factors that could explain this shift?"

*Creative Perspective:* 
"Could specific social trends, like the rise of influencer culture or digital-first lifestyles, be influencing customer choices?"

**2.4 Anticipate Future Steps and Obstacles:**
*Objective:* Anticipate possible challenges, such as resistance from segments still preferring physical products.

*Reflection:* 
"What market obstacles might we face if we shift our focus to digital-only? Are there sub-segments that still prioritize physical products?"

*Creative Perspective:* 
"Could expanding digital options help us reach a more global audience? Are there emerging trends that we could leverage in our strategy?"

[end sys2]

[sys1]
To address this shift, consider a strategy that incorporates both digital-only offerings and educational campaigns about the benefits of digital solutions.
Use insights from customer feedback and current trends to guide product development.
Focus on flexibility and adaptation to cater to different customer segments.
[end sys1]


---
abstract: 'A basic model for key agreement with a remote (or hidden) source is extended to a multi-user model with joint secrecy and privacy constraints over all entities that do not trust each other. Multiple entities using different measurements of the same source through broadcast channels (BCs) to agree on mutually-independent local secret keys are considered. Our model is the proper multi-user extension of the basic model since the encoder and decoder pairs are not assumed to trust other pairs, unlike assumed in the literature. Strong secrecy constraints imposed on all secret keys jointly, which is more stringent than separate secrecy leakage constraints for each secret key considered in the literature, are satisfied. Inner bounds for maximum key rate, and minimum privacy-leakage and database-storage rates are proposed for any finite number of entities. Inner and outer bounds for degraded and less-noisy BCs are given to illustrate cases with strong privacy. A multi-enrollment model that is used for common physical unclonable functions is considered to establish inner and outer bounds for key-leakage-storage regions that differ only in the Markov chains imposed. For this special case, the encoder and decoder measurement channels have the same channel transition matrix and secrecy leakage is measured for each secret key separately. We illustrate cases for which it is useful to have multiple enrollments as compared to a single enrollment and vice versa.'
author:
- 'Onur Günlü,  [^1] [^2]'
bibliography:
- 'IEEEabrv.bib'
- 'references.bib'
title: 'Multi-Entity and Multi-Enrollment Key Agreement with Correlated Noise'
---

Information theoretic privacy, multiple enrollments, multiple entities, physical unclonable functions.

Introduction {#sec:intro}
============

A natural source of randomness is biometric identifiers such as fingerprints that are generally transformed into a frequency domain and quantized to obtain bit sequences that are unique to an individual [@Campisi]. Similarly, physical identifiers such as fine variations of ring oscillator (RO) outputs or random start-up values of static random access memories (SRAMs) that are caused by uncontrollable manufacturing variations, are safer and cheaper alternatives to key storage in a non-volatile memory [@GassendThesis]. Physical identifiers for digital devices, such as Internet-of-Things (IoT) devices, can be implemented using physical unclonable functions (PUFs) [@GassendThesis]. One can use PUFs in various coding schemes as a source of local randomness [@benimdissertation Chapter 1], e.g., in the randomized encoder of the wiretap channel [@WTC] and of the strong coordination problem [@CuffStrongCoord; @GiuliaStrongCoord].

We use the basic source model for key agreement from [@AhlswedeCsiz; @Maurer] to find achievable rate regions for key agreement with PUFs and biometric identifiers. In this classic model, an encoder observes a source output to generate a secret key and sends public side information, i.e., *helper data*, to a decoder, so the decoder can reliably reconstruct the same secret key by observing another source output and the helper data. The main constraints are that the information leaked about the secret key, i.e., *secrecy leakage*, is negligible and the information leaked about the identifier output, i.e., *privacy leakage*, is small [@IgnaTrans; @LaiTrans]. Furthermore, the amount of storage should also be minimized to limit the hardware cost [@csiszarnarayan].

Suppose the encoder generates a key from a noisy measurement of a hidden (or remote) source output, and a decoder has access to another noisy measurement of the same source and the helper data to reconstruct the same key. We call this model the *generated-secret* (GS) model with a hidden source. This model is introduced in [@bizimMMMMTIFS] as an extension of the visible (noiseless) source outputs observed by the encoder, considered in [@IgnaTrans; @LaiTrans]. Similarly, for the *chosen-secret* (CS) model, an embedded (or chosen) key and noisy identifier measurements are combined by the encoder to generate the public helper data. We consider both models to address different applications.

Related Work and Motivation
---------------------------

The same identifier is used by multiple encoder and decoder pairs in [@LifengTransMultipleUse], where the identifier outputs observed by different encoders are the same because the encoder measurements are assumed to be noiseless. Therefore, the multiple use of the same noiseless source output allows all encoders to know the secret key of the other encoders. This model does not fit well to the practical key agreement with identifiers scenarios because there is noise in every identifier measurement.

Multiple enrollments of a hidden source using noisy measurements are considered in [@LienekeTIFS2019], where weakly secure secret keys are generated without privacy leakage and storage constraints. Furthermore, there is a causality assumption in [@LienekeTIFS2019] on the availability of the helper data, i.e., any decoder has access to all previously-generated helper data. This assumption is not necessarily realistic as a decoder of, e.g., an IoT device that embodies a PUF should be low complexity and the amount of data to process increases linearly with the number of enrollments. In addition, any manipulation in any of the helper data can cause the complete multi-enrollment system to fail.

A classic method used for key agreement, i.e., the fuzzy commitment scheme (FCS) [@FuzzyCommitment], is used in [@Lieneke] in combination with an SRAM PUF to enroll the noisy outputs of the same SRAM multiple times. The symmetry condition in [@Lieneke Eq. (16)] conditioned on a fixed SRAM cell state is entirely similar to the symmetry satisfied by binary-input symmetric output (BISO) channels; see e.g., [@infcombining p. 613], [@bizimMMMMTIFS Eq. (14)]. For SRAM outputs that satisfy this symmetry, the normalized (weak) secrecy leakage about each separate secret key is shown to be zero. It is discussed in [@bizimBenelux Section 3.4] that any uniformly-distributed hidden identifier output with BISO measurement channels satisfies the results in [@Lieneke]. In [@bizimBenelux Theorem 1] the secret-key capacity of the two-enrollment key agreement problem is established for measurement channels with the same channel transition matrix. However, these multi-enrollment models do not consider the privacy leakage and storage constraints, there is no constraint on the independence of the secret keys of different enrollments, and the secrecy leakage constraint is weak and is not applied jointly on all secret keys. Furthermore, optimal random linear code constructions that achieve the boundaries of the key-leakage-storage regions are given in [@bizimWZ], where the classic code constructions FCS and code-offset fuzzy extractors [@Dodis2008fuzzy] are shown to be strictly suboptimal. Therefore, the multi-enrollment models and constructions in the literature are strictly suboptimal and not necessarily realistic. We therefore list stronger secrecy constraints jointly on all entities, which approximates the reality better in combination with storage rate and joint privacy-leakage rate constraints. These constraints define the *multi-entity key agreement* problem, where the entities that use the same identifier do not have to trust other entities. Therefore, the multi-entity key agreement problem is a proper multi-user extension of single-enrollment models.

Every measurement of an identifier is considered to be noisy due to, e.g., local temperature and voltage changes in the hardware of the PUF circuit or a cut on the finger. Noise components at the encoder and decoder measurements of a hidden source can be also correlated due to, e.g., the surrounding logic in the hardware [@MerliROCorrelated] or constant fingertip moisture. This correlation between the noise sequences is modeled in [@bizimITW] as a broadcast channel (BC) [@CoverandThomas] with an input that is the hidden source output and with outputs that are the noisy encoder and decoder measurements. We use this model for multi-entity key agreement with identifiers, where each entity (i.e., each encoder and decoder pair) observes noisy identifier outputs of the same hidden source through different BCs. We allow the BCs to be different as trusted entities generally use different hardware implementations of the encoder and decoder pairs, which results in different correlations between noise components.

We also consider physically-degraded (PD) and less-noisy (LN) BCs to give finer inner and outer bounds to the key-leakage-storage regions for the GS and CS models of the multi-entity key agreement problem. For the considered PD and LN BCs, we prove that strong privacy can be achieved. In [@IgnaTrans; @LaiTrans; @MatthieuPolar], an extra common randomness that is available to the encoder and decoder and that is hidden from the eavesdropper is required to obtain strong privacy. This assumption is not realistic since such a common randomness requires hardware protection against invasive attacks, and if such a protection is feasible, then it is not necessary to use an identifier for key agreement.

Models for Identifier Outputs
-----------------------------

We study physical and biometric identifier outputs that are independent and identically distributed (i.i.d.) according to a given probability distribution. These models are reasonable if one uses transform-coding algorithms from [@bizimMDPI] that occupy a small hardware area to extract almost i.i.d. bits from PUFs under varying environmental conditions. Similar transform-coding based algorithms have been applied to biometric identifiers to obtain independent output symbols [@Transformbio]. These transform-coding algorithms provide almost i.i.d. identifier outputs and noise sequences; however, the correlation between the noise components on the encoder and decoder components are not removed using these methods. Furthermore, PUFs are used for on-demand key reconstruction and physical attacks on PUFs permanently change the identifier outputs [@PappuThesis], so we assume that the eavesdropper cannot obtain information correlated with the PUF outputs, unlike biometric identifiers.

Summary of Contributions
------------------------

We extend the key-leakage-storage rate tuple analysis of the single-enrollment model for hidden identifier outputs measured through general BCs in [@bizimITW] to consider multi-entity key agreement with a set of stringent secrecy constraints. A summary of the main contributions is as follows.

-   We derive achievable key-leakage-storage rate tuples for the GS model with strong secrecy for any finite number of entities using the same identifier’s measurements through different BCs for key agreement. Separate identifier measurements considered in [@bizimKittipongTIFS; @bizimMMMMTIFS] correspond to a PD BC and the visible source model in [@IgnaTrans; @LaiTrans] corresponds to a semi-deterministic BC.

-   For a set of PD and LN BCs, the privacy-leakage rates for the two-entity key agreement problem are calculated. These PD and LN BCs are shown to provide strong privacy without the need of a common randomness. An outer bound is given for the considered PD and LN BCs.

-   We consider a special case of the multi-enrollment key agreement problem, where all measurement channels are separate (i.e., PD BCs) and they have the same transition matrix. This is a common model used for SRAM PUFs [@Lieneke]. Using a less stringent secrecy leakage constraint that bounds the information leakage for each secret key separately and without the mutual independence constraint on the secret keys, we establish inner and outer bounds for the strong-secrecy key-leakage-storage region for this two-enrollment key agreement problem. The bounds differ only in the Markov chains imposed. This result is a significant improvement to the two-enrollment secret-key rate region (without storage and privacy-leakage rate constraints) established in [@bizimBenelux] for weak secrecy, which is recovered by eliminating auxiliary random variables in the proposed rate regions.

-   All inner and outer bounds for the GS model are extended to the CS model, which comprises secret-key binding methods that embed a chosen secret key to the encoder.

-   We give two scenarios to compare single-enrollment and two-enrollment models and illustrate that for different assumptions on measurement channels, either of the two models can perform better in terms of the privacy-leakage vs. secret-key rate boundary tuples.

Organization
------------

This paper is organized as follows. In Section \[sec:problem\_setting\], we describe the multi-entity key agreement problem with BC measurements. We give achievable key-leakage-storage regions for the GS and CS models with strong secrecy and BC measurements for any finite number of entities in Section \[sec:achievablescheme\] in addition to inner and outer bounds for PD and LN BCs that satisfy strong privacy. The proposed inner bounds for the two-entity key agreement problem in Section \[sec:tightregions\] are shown to differ from the outer bounds only in the Markov chains imposed for a special case with less stringent secrecy constraints. In Sections \[sec:achinnergeneral\] and  \[sec:Twoenrollmentproofs\], proofs of the given rate regions for the general multi-entity key agremeent problem and for the two-enrollment key agreement problem, respectively, are given. Section \[sec:conclusion\] concludes the paper.

Notation
--------

Upper case letters represent random variables and lower case letters their realizations. A superscript denotes a string of variables, e.g., $\displaystyle X^n\!=\!X_1,X_2,\ldots, X_i,\ldots, X_n$, and a subscript $i$ denotes the position of a variable in a string. A random variable $\displaystyle X$ has probability distribution $\displaystyle P_X$. Calligraphic letters such as $\displaystyle \mathcal{X}$ denote sets, set sizes are written as $\displaystyle |\mathcal{X}|$ and their complements as $\displaystyle \mathcal{X}^c$. $[1:J]$ denotes the set $\{1,2,\ldots,J\}$ for an integer $J\geq1$ and $[1:J]\setminus\{j\}$ denotes the set $\{1,2,,\ldots,j-1,j+1,\ldots,J\}$ for any $j\in[1:J]$. $H_b(x)=-x\log x- (1-x)\log (1-x)$ is the binary entropy function, where we take logarithms to the base $2$, and $H_b^{-1}(\cdot)$ denotes its inverse with range $[0, 0.5]$. $X\sim\text{Bern}(\alpha)$ is a binary random variable with $\Pr[X=1]=\alpha$. A binary symmetric channel (BSC) with crossover probability $p$ is denoted by BSC($p$). $Q(\cdot)$ is the $Q$-function that gives the tail probability for the standard normal distribution.

Problem Definitions {#sec:problem_setting}
===================

Consider hidden identifier outputs $X^n$ that are i.i.d. according to a probability distribution $P_X$. If there are a finite number $J$ of trusted entities that use the same identifer, the $j$-th encoder and decoder pair observes noisy source measurements that are outputs of a BC $P_{\widetilde{X}_jY_j|X}$, with abuse of notation, for $j\in[1:J]$, where $\mathcal{\widetilde{X}}_j$, $\mathcal{Y}_j$, and $\mathcal{X}$ are finite sets.

For the GS model shown in Fig. \[fig:ProblemDefinitionfortwo\]$(a)$ for $J=2$ trusted entities, the $j$-th encoder $f_{\text{GS},j}(\cdot)$ generates helper data $W_j$ and a secret key $S_j$ from $\widetilde{X}^n_j$. All secret keys are stored in a secure database, whereas helper data are stored in a public database so that an eavesdropper has access only to the helper data. Using the helper data $W_j$ and the noisy measurements $Y^n_j$, the $j$-th decoder $g_j(\cdot,\cdot)$ generates the key estimate $\hat{S}_j$. Similar steps are applied for the CS model in Fig. \[fig:ProblemDefinitionfortwo\]$(b)$ also for $J=2$ trusted entities, except that each $S_j$ should be embedded into the $j$-th encoder $f_{\text{CS},j}(\cdot,\cdot)$.

Denote a set of secret keys as $$\begin{aligned}
\mathcal{S}_{\mathcal{K}} = \{S_j:j\in\mathcal{K}\} \end{aligned}$$ and a set of helper data as $$\begin{aligned}
\mathcal{W}_{\mathcal{K}} = \{W_j:j\in\mathcal{K}\}\end{aligned}$$ for any $\mathcal{K} \subseteq[1:J]$. A (secret-key, privacy-leakage, storage), or key-leakage-storage, rate tuple is denoted as $(R_{\text{s}}, R_{\ell},R_{\text{w}})$. Similarly, we denote a set of secret-key rates, for any $\mathcal{K} \subseteq[1:J]$, as $$\begin{aligned}
\mathcal{R}_{\text{s},\mathcal{K}} = \{R_{\text{s},j}:j\in\mathcal{K}\}\end{aligned}$$ and a set of storage rates as $$\begin{aligned}
\mathcal{R}_{\text{w},\mathcal{K}} = \{R_{\text{w},j}:j\in\mathcal{K}\}.\end{aligned}$$

We next define the key-leakage-storage regions for the GS and CS models.

A key-leakage-storage rate tuple $(\mathcal{R}_{\text{s},[1:J]} , R_{\ell},\mathcal{R}_{\text{w},[1:J]} )$ is achievable for the GS and CS models with $j$-th encoder and decoder measurements through a BC $P_{\widetilde{X}_jY_j|X}$ if, given any $\delta\!>\!0$, there is some $n\!\geq\!1$, and $J$ encoder and decoder pairs for which $\displaystyle R_{\text{s},j}=\frac{\log|\mathcal{S}_j|}{n}$ for all $ j\in[1:J]$ and $$\begin{aligned}
{2}
        &\Pr\left[\underset{j\in[1:J]}{\bigcup}\{S_j\ne\hat{S}_j\}\right] \leq \delta &&\quad \text{(reliability)}\label{eq:reliabilityconst}
                \end{aligned}$$ $$\begin{aligned}
{2}
        &\frac{1}{n}H(S_j) \geq R_{\text{s},j}-\delta,\quad\;\;\, \forall j\!\in\![1:J]&&\quad \text{(key uniformity)}\label{eq:uniformityconst}\\[2pt]
        &I\left(\mathcal{S}_{\mathcal{K}};\mathcal{S}_{\mathcal{K}^c}\right)\leq \delta,\qquad\;\;\;\;\; \forall \mathcal{K}\!\subseteq\![1:J]&&\quad \text{(key ind.)}\label{eq:keyindependence}\\[2pt]
        &\frac{1}{n}I(X^n;\mathcal{W}_{[1:J]})\! \leq\! R_{\ell}\!+\!\delta  &&\quad \text{(privacy)} \label{eq:privacyconst}\\[2pt]
        &I\left(\mathcal{S}_{[1:J]};\mathcal{W}_{[1:J]}\right) \leq \delta &&\quad\text{(strong secrecy)} \label{eq:secrecyconst}\\[2pt]
        &\frac{1}{n} \log|\mathcal{W}_j| \leq R_{\text{w},j}\!+\!\delta,\quad \forall j\!\in\![1:J] &&\quad \text{(storage)}\label{eq:storageconst}.\end{aligned}$$

The *key-leakage-storage* regions $\mathcal{C}_{\text{gs}}$ for the GS model and $\mathcal{C}_{\text{cs}}$ for the CS model are the closures of the set of all achievable rate tuples $(\mathcal{R}_{\text{s},[1:J]} , R_{\ell},\mathcal{R}_{\text{w},[1:J]})$.

Both secret-key uniformity (\[eq:uniformityconst\]) and storage rate (\[eq:storageconst\]) constraints correspond to $J$ separate constraints. However, reliability (\[eq:reliabilityconst\]), strong and mutual key independence (\[eq:keyindependence\]), privacy-leakage rate (\[eq:privacyconst\]), and secrecy leakage (\[eq:secrecyconst\]) constraints are joint constraints for all $J$ trusted entities.

The mutual key independence constraint in (\[eq:keyindependence\]) is not imposed in the multi-enrollment key agreement problem considered in [@Lieneke]. Furthermore, a normalized (weak) version of this constraint is imposed in the multi-enrollment key agreement problem considered in [@LienekeTIFS2019], where the $j$-th decoder $g_j(\cdot,\cdot)$ is assumed to have access to the set of helper data $\mathcal{W}_{[1:j]}$ for all $j\in[1:J]$. The lack of the mutual key independence constraint and the assumption of availability of all previous helper data require that different encoder and decoder pairs should trust each other. This can be the case, e.g., if all enrollments are made by the same entity. Therefore, the multi-entity key agreement problem imposes strictly more stringent constraints than the multi-enrollment key agreement problem.

The unnormalized secrecy leakage constraint (\[eq:secrecyconst\]) provides strong secrecy, which is a stronger notion than the weak secrecy considered in [@IgnaTrans; @LaiTrans; @bizimMMMMTIFS; @bizimKittipongTIFS; @Lieneke; @LienekeTIFS2019]. Furthermore, (\[eq:secrecyconst\]) is more stringent than the set of individual secrecy leakage constraints $I(S_j;\mathcal{W}_{[1:J]})$ imposed for all $j\in[1:J]$, considered in [@Lieneke] for symmetric SRAM PUF outputs in combination with the suboptimal FCS.

The unnormalized privacy leakage $I(X^n;\mathcal{W}_{[1:J]})$ cannot be bounded by a finite number in general. We illustrate special strong privacy cases in the next section.

Inner Bounds {#sec:achievablescheme}
============

We are interested in characterizing the optimal trade-off among the secret-key, privacy-leakage, and storage rates with strong secrecy for BC measurements at the encoders and decoders of any finite number $J$ of entities that use the same hidden identifier outputs. We give achievable rate regions for the GS and CS models in Theorem \[theo:GeneralInnergscs\]. The proofs are given in Section \[sec:achinnergeneral\].

Denote $$\begin{aligned}
\mathcal{U}_{\mathcal{K}} = \{U_j:j\in\mathcal{K}\}\end{aligned}$$ and define a function $\max\{\cdot,\cdot\}$ that gives the maximum of the input values as its output.

\[theo:GeneralInnergscs\] An achievable rate region $\mathcal{R}_{\text{gs}}$ for the GS model with $J$ entities is the union over all $P_{U_{j}|\widetilde{X}_j}$ for all $j\in [1:J]$ of the rate tuples such that $R_{\text{s},j} \geq 0$ for all $j \in [1:J]$ and $$\begin{aligned}
{2}
    &R_{\text{s},j}\leq I(U_j;Y_j)-I(U_j;U_{[1:J]\setminus\{j\}}), &&\;\; \forall j\in [1:J]\label{eq:corrkeyrate}\\
    &R_\ell \geq \sum_{j=1}^{J}\max\{0, I(U_j;X)\!-\!I(U_j;Y_j)\}, \label{eq:corrleakagerate}\\
    &R_{\text{w},j}\! \geq\! I(U_j;\widetilde{X}_j)-I(U_j;Y_j),&& \;\;\forall j \in [1:J] \label{eq:corrstoragerate}\\
    &R_{\text{s},j}+R_{\text{w},j}\leq H(U_j|\,\mathcal{U}_{[1:J]\setminus\{j\}}),&& \;\;\forall j \in [1:J]. \label{eq:corrstorageandkeysumrate}
    \end{aligned}$$

An achievable rate region $\mathcal{R}_{\text{cs}}$ for the CS model with $J$ entities is the union over all $P_{U_{j}|\widetilde{X}_j}$ for all $j\in [1:J]$ of the rate tuples such that $R_{\text{s},j} \geq 0$ for all $j \in [1:J]$, (\[eq:corrkeyrate\]), (\[eq:corrleakagerate\]), and $$\begin{aligned}
{2}
&R_{\text{w},j}\! \geq\! I(U_j;\widetilde{X}_j)-I(U_j;U_{[1:J]\setminus\{j\}}),&&\quad \forall j \in [1:J] \label{eq:cscorrstoragerate}\\
    &R_{\text{w},j}\leq H(U_j|\,\mathcal{U}_{[1:J]\setminus\{j\}}),&& \quad\forall j \in [1:J] \label{eq:cscorrstorageandkeysumrate}.\end{aligned}$$ For the achievable rate regions $\mathcal{R}_{\text{gs}}$ and $\mathcal{R}_{\text{cs}}$, we have $$\begin{aligned}
   \displaystyle P_{\mathcal{U}_{[1:J]}\mathcal{\widetilde{X}}_{[1:J]}X\mathcal{Y}_{[1:J]}}=P_{X}\prod_{j=1}^JP_{U_j|\widetilde{X}_j}P_{\widetilde{X}_jY_j|X} \label{eq:fixedprobdistr}.
   \end{aligned}$$

\[cor:strongprivacy\] Suppose for all $j\in[1:J]$ that

-   $\widetilde{X}_j-Y_j-X$ form a Markov chain, i.e., $X$ is a PD version of $Y_j$ with respect to $\widetilde{X}_j$, or

-   $P_{XY_j|\widetilde{X}_j}$ is a LN BC with $I(U_j;Y_j)\geq I(U_j;X)$ for all $P_{U_j|\widetilde{X}_j}$.

For these cases, strong privacy, i.e., $$\begin{aligned}
        R_\ell\geq 0 \label{eq:privacyleakzero}
    \end{aligned}$$ can be achieved for the GS and CS models in combination with the other corresponding bounds given in Theorem \[theo:GeneralInnergscs\].

The proof of Corollary \[cor:strongprivacy\] follows from Theorem \[theo:GeneralInnergscs\] because $I(U_j;X)-I(U_j;Y_j)\leq 0$ for all $j\in[1:J]$ for BCs considered in Corollary \[cor:strongprivacy\].

Corollary \[cor:strongprivacy\] illustrates that it is possible to obtain strong privacy, i.e., negligible unnormalized privacy leakage, without the requirement of a common randommness that is hidden from an eavesdropper assumed in [@IgnaTrans; @LaiTrans; @MatthieuPolar]. This is the case because the observation $Y^n_j$ of each decoder is “better" than the observation $\widetilde{X}^n_j$ of the corresponding encoder with respect to the hidden source $X^n$ for all entities.

The rate regions for our problem depend on the joint conditional probability distributions $P_{XY_j|\widetilde{X}_j}$ rather than only the marginal conditional distributions. Thus, the key-leakage-storage regions for the stochastically-degraded BCs are not necessarily equal to the regions for the corresponding PD BCs, unlike in the classic BC problem. Furthermore, since $P_{\mathcal{\widetilde{X}}_{[1:J]}X\mathcal{Y}_{[1:J]}}$ is fixed, the distinction between the LN BCs and essentially-less noisy BCs [@NairEssentially], is not necessary.

We next give simple outer bounds for the key-leakage-storage regions $\mathcal{C}_{\text{gs}}$ for the GS model and $\mathcal{C}_{\text{cs}}$ for the CS model when the BCs $P_{XY_j|\widetilde{X}_j}$ for all $j\in[1:J]$ are PD BCs or LN BCs as defined in Corollary \[cor:strongprivacy\]. These simple outer bounds give insights into the reason for different bounds on the secret-key rates. Based on these insights, we show a special case in the next section with a less stringent secrecy constraint, for which the inner and outer bounds differ only in the Markov chains imposed and we illustrate that they match for simpler models.

\[lem:zeroprivacyouterbound\] Suppose one of the cases given in Corollary \[cor:strongprivacy\] is satisfied by the BCs $P_{XY_j|\widetilde{X}_j}$ for all $j\in[1:J]$. An outer bound on the key-leakage-storage region $\mathcal{C}_{\text{gs}}$ is the union over all $P_{U_{j}|\widetilde{X}_{j}}$, where $U_j-\widetilde{X}_{j}-(X,Y_j)$ form a Markov chain, for all $j\in[1:J]$ of the rate tuples such that $R_{\text{s},j} \geq 0$ for all $j \in [1:J]$, (\[eq:corrstoragerate\]), (\[eq:privacyleakzero\]), and $$\begin{aligned}
    &R_{\text{s},j} \leq I(U_j;Y_j),\qquad\qquad\forall j\in[1:J]\label{eq:OuterSKRatetwoentityrall}.
    \end{aligned}$$

An outer bound to the key-leakage-storage region $\mathcal{C}_{\text{cs}}$ for the same BCs $P_{XY_j|\widetilde{X}_j}$ is the union over all $P_{U_{j}|\widetilde{X}_{j}}$, where $U_j-\widetilde{X}_{j}-(X,Y_j)$ form a Markov chain, for all $j\in[1:J]$ of the rate tuples such that $R_{\text{s},j} \geq 0$ for all $j \in [1:J]$, (\[eq:privacyleakzero\]), (\[eq:OuterSKRatetwoentityrall\]), and $$\begin{aligned}
{2}
    &R_{\text{w},j}\geq I(U_j;\widetilde{X}_j),\qquad\qquad\forall j\in[1:J]\label{eq:Outercsstortwoentityrall}.
    \end{aligned}$$

The proof of Lemma \[lem:zeroprivacyouterbound\] follows straightforwadly by following the steps in [@bizimMMMMTIFS Section VI], defining the auxiliary random variables $U_{j,i}= (S_j,W_j,Y_j^{i-1})$ for all $j\in[1:J]$ and $i\in[1:n]$, and by bounding $I(X^n;\mathcal{W}_{[1:J]})\geq 0$; therefore, we omit the proof.

The outer bounds do not include the inequalities in (\[eq:corrstorageandkeysumrate\]) and (\[eq:cscorrstorageandkeysumrate\]). Furthermore, the secret-key rate achieved by the inner bound in (\[eq:corrkeyrate\]) is smaller than the outer bound given in (\[eq:OuterSKRatetwoentityrall\]), where the difference is the term $-I(U_j;\mathcal{U}_{[1:J]\setminus\{j\}})$. This term is a result of the constraint in (\[eq:independenceofindices\]) that is imposed to satisfy the strong and mutual key independence constraint given in (\[eq:keyindependence\]). Therefore, we next consider a model without the constraint in (\[eq:keyindependence\]) and use a secrecy-leakage constraint that is less stringent than the one in (\[eq:secrecyconst\]), i.e., replace (\[eq:secrecyconst\]) by $$\begin{aligned}
I(S_j;\mathcal{W}_{[1:J]})\leq\delta,\qquad\qquad \forall j\in[1:J]\end{aligned}$$ which is also a strong secrecy metric. Due to the lack of a mutual key independence constraint, the model in the next section is not a multi-entity model but rather a multi-enrollment model. For a special case of this multi-enrollment key agreement problem, we establish inner and outer bounds for the key-leakage-storage regions that comprise the same bounds but for different Markov chains.

Bounds for a Multi-Enrollment Model {#sec:tightregions}
===================================

Consider $J=2$ entities that measure the noisy outputs of the same hidden source $X^n$ through separate channels that have the same channel transition matrices, i.e., for all $j\in[1:2]$, $\tilde{x}_j\in\mathcal{\widetilde{X}}$, and $y_j\in\mathcal{\widetilde{X}}$ we have $$\begin{aligned}
P_{\widetilde{X}_jY_j|X}(\tilde{x}_j,y_j|x)=P_{\widetilde{X}|X}(\tilde{x}_j|x)P_{\widetilde{X}|X}(y_j|x). \label{eq:SRAMchanneldef}\end{aligned}$$ This model is commonly used for, e.g., SRAM PUFs [@RoelSRAMPUF].

Using (\[eq:SRAMchanneldef\]), we define a new multi-enrollment model.

\[def:twoenrollment\] A key-leakage-storage rate tuple $(\widebar{R}_{\text{s},1}, \widebar{R}_{\text{s},2}, \widebar{R}_{\ell}, \widebar{R}_{\text{w},1}, \widebar{R}_{\text{w},2})$ is achievable for the GS and CS models with measurements through a BC $\displaystyle P_{\widetilde{X}Y|X}(\tilde{x},y|x)$ as in (\[eq:SRAMchanneldef\]) if, given any $\delta\!>\!0$, there is some $n\!\geq\!1$, and two encoder and decoder pairs for which $\displaystyle \widebar{R}_{\text{s},1}=\frac{\log|\mathcal{S}_1|}{n}$, $\displaystyle \widebar{R}_{\text{s},2}=\frac{\log|\mathcal{S}_2|}{n}$, $\displaystyle\widebar{R}_{\text{w},1}=\frac{H(W_1)}{n}$, $\displaystyle\widebar{R}_{\text{w},2}=\frac{H(W_2)}{n}$, and $$\begin{aligned}
{2}
    &\Pr\left[\{S_1\ne\hat{S}_1\}\bigcup\{S_2\ne\hat{S}_2\}\right] \leq \delta &&\quad \text{(reliability)}\label{eq:reliabilityconstJ2}\\[2pt]
    &\frac{1}{n}H(S_j) = \widebar{R}_{\text{s},j}-\delta,\qquad\;\;\,  j=1,2&&\quad \text{(key uniformity)}\label{eq:uniformityconstJ2}\\[2pt]
    &\frac{1}{n}I(X^n;W_1,W_2)\! =\! \widebar{R}_{\ell}\!+\!\delta  &&\quad \text{(privacy)} \label{eq:privacyconstJ2}\\[2pt]
    &I\left(S_j;W_1,W_2\right) \leq \delta, \qquad\quad j=1,2&&\quad\text{(strong secrecy)} \label{eq:secrecyconstJ2}\\[2pt]
    &\frac{1}{n} \log|\mathcal{W}_j|= \widebar{R}_{\text{w},j}\!+\!\delta,\qquad  j=1,2 &&\quad \text{(storage)}\label{eq:storageconstJ2}\\
    &I(W_1;W_2)\leq \delta&&\quad \text{(storage ind.)}.\label{eq:storageindependence}
    \end{aligned}$$

The *key-leakage-storage* regions $\mathcal{\widebar{C}}_{\text{gs},J=2}$ for the GS model and $\mathcal{\widebar{C}}_{\text{cs},J=2}$ for the CS model are the closures of the set of all achievable rate tuples $(\widebar{R}_{\text{s},1} , \widebar{R}_{\text{s},2} ,\widebar{R}_{\ell},\widebar{R}_{\text{w},1},\widebar{R}_{\text{w},2})$.

We characterize in Theorem \[theo:Twoenrollmentgscs\] inner and outer bounds for key-leakage-storage regions $\mathcal{\widebar{C}}_{\text{gs},J=2}$ and $\mathcal{\widebar{C}}_{\text{cs},J=2}$. The proofs of Theorem \[theo:Twoenrollmentgscs\] are given in Section \[sec:Twoenrollmentproofs\], where the reason for the necessity of the secrecy-leakage constraint in (\[eq:secrecyconstJ2\]) that is less stringent than the joint secrecy-leakage constraint in (\[eq:secrecyconst\]) is given in Remark \[rem:whylessstringent\]. Similarly, the reason for the necessity of the strong helper data (storage) independence constraint in (\[eq:storageindependence\]) is discussed in Remark \[rem:helperdataindependence\].

Denote $$\begin{aligned}
j'= 3-j,\qquad\qquad\qquad j=1,2.\label{jprimedef}\end{aligned}$$

\[theo:Twoenrollmentgscs\] [(Inner Bounds)]{}: An achievable key-leakage-storage region $\mathcal{\widebar{R}}_{\text{gs},J=2}$ is the union over all $P_{U_{1}|\widetilde{X}_1}$ and $P_{U_{2}|\widetilde{X}_2}$ of the rate tuples such that $\widebar{R}_{\text{s},j} \geq 0$ for $j=1,2$ and $$\begin{aligned}
{2}
    &\widebar{R}_{\text{s},j}\leq I(U_j;Y_j), &&\quad j=1,2\label{eq:corrkeyrateTwoenroll}\\
    &\widebar{R}_\ell \geq \sum_{j=1}^2\big(I(U_j;X)\!-\!I(U_j;Y_j)\big), \label{eq:corrleakagerateTwoenroll}\\
    &\widebar{R}_\ell \leq \sum_{j=1}^2\big(I(U_j;X)\!-\!I(U_j;\widetilde{X}_j)\!+\!\widebar{R}_{\text{w},j}\big), \label{eq:corrleakagerateTwoenrollupperbound}\\  
    &\widebar{R}_{\text{w},j}\! \geq\! I(U_j;\widetilde{X}_j)-I(U_j;Y_j),&& \quad j=1,2 \label{eq:corrstoragerateTwoenroll}\\
    &\widebar{R}_{\text{s},j}+\widebar{R}_{\text{w},j}\leq H(U_j),&&\quad j=1,2\label{eq:sumonsamesandwpart1Twoenroll}\\
    &\widebar{R}_{\text{s},j}+\widebar{R}_{\text{w},j}+\widebar{R}_{\text{w},j'}\leq H(U_{j},U_{j'}),&&\quad j=1,2\label{eq:sumonsamesjandwjandjprimeTwoenroll}.
    \end{aligned}$$

An achievable key-leakage-storage region $\mathcal{\widebar{R}}_{\text{cs},J=2}$ is the union over all $P_{U_{1}|\widetilde{X}_1}$ and $P_{U_{2}|\widetilde{X}_2}$ of the rate tuples such that $\widebar{R}_{\text{s},j} \geq 0$ for $j=1,2$, (\[eq:corrkeyrateTwoenroll\])-(\[eq:corrleakagerateTwoenrollupperbound\]), and $$\begin{aligned}
{2}
    &\widebar{R}_{\text{w},j}\! \geq\! I(U_j;\widetilde{X}_j),&&\quad j=1,2 \label{eq:cscorrstoragerateTwoenroll}\\
    &\widebar{R}_{\text{w},j}\leq H(U_j),&&\quad j=1,2\label{eq:cssumonsamesandwpart1Twoenroll}\\
    &\widebar{R}_{\text{w},j}\!+\!\widebar{R}_{\text{w},j'}\!\leq\! H(U_{j},U_{j'})\!+\!\widebar{R}_{\text{s},j'},&&\quad j=1,2\label{eq:cssumonsamesjandwjandjprimeTwoenroll}.
    \end{aligned}$$ For both achievable rate regions $\mathcal{\widebar{R}}_{\text{gs},J=2}$ and $\mathcal{\widebar{R}}_{\text{cs},J=2}$, we have $$\begin{aligned}
    \displaystyle &P_{U_{1}U_2\widetilde{X}_{1}\widetilde{X}_2XY_{1}Y_2}({u_{1},u_2,\widetilde{x}_{1},\widetilde{x}_2,x,y_{1},y_2})\nonumber\\
    &\quad=P_{U_1|\widetilde{X}_1}(u_1|\tilde{x}_1)P_{U_2|\widetilde{X}_2}(u_2|\tilde{x}_2)P_{\widetilde{X}|X}(\tilde{x}_1|x)P_{\widetilde{X}|X}(\tilde{x}_2|x)\nonumber\\
    &\quad\qquad \times P_{\widetilde{X}|X}(y_1|x)P_{\widetilde{X}|X}(y_2|x)P_{X}(x) \label{eq:fixedprobdistrTwoenroll}.
    \end{aligned}$$

[(Outer Bounds)]{} An outer bound for the key-leakage-storage region $\mathcal{\widebar{C}}_{\text{gs},J=2}$ is the union over all $P_{U_{1}|\widetilde{X}_{1}}$ and $P_{U_{2}|\widetilde{X}_2}$ of the rate tuples such that $\widebar{R}_{\text{s},j} \geq 0$, (\[eq:corrkeyrateTwoenroll\]) - (\[eq:sumonsamesjandwjandjprimeTwoenroll\]), and $U_j-\widetilde{X}_{j}-X-Y_j$ form a Markov chain for $j=1,2$.

An outer bound for the key-leakage-storage region $\mathcal{\widebar{C}}_{\text{cs},J=2}$ is the union over all $P_{U_{1}|\widetilde{X}_{1}}$ and $P_{U_{2}|\widetilde{X}_2}$ of the rate tuples such that $\widebar{R}_{\text{s},j} \geq 0$, (\[eq:corrkeyrateTwoenroll\]) - (\[eq:corrleakagerateTwoenrollupperbound\]), (\[eq:cscorrstoragerateTwoenroll\]) - (\[eq:cssumonsamesjandwjandjprimeTwoenroll\]), and $U_j-\widetilde{X}_{j}-X-Y_j$ form a Markov chain for $j=1,2$.

The inner and outer bounds differ because the outer bounds define rate regions for the Markov chains $U_1-\widetilde{X}_{1}-X-Y_1$ and $U_2-\widetilde{X}_{2}-X-Y_2$, which are larger than the rate regions defined by the inner bounds that satisfy (\[eq:fixedprobdistrTwoenroll\]). For instance, in the achievability proof of Theorem \[theo:Twoenrollmentgscs\], we apply the properties of the Markov chain $U_2-\widetilde{X}_2-U_1$ in (\[eq:conversJ2thatshowcombinationboundisalreadysatisfied\])(b), which does not form a Markov chain for the choice of $U_{1}$ and $U_2$ in the outer bounds. Therefore, inner and outer bounds do not match in general.

Choosing $U_1=\widetilde{X}_1$ and $U_2=\widetilde{X}_2$, it is straightforward to show that inner and outer bounds in Theorem \[theo:Twoenrollmentgscs\] match if we do not impose any storage or privacy constraints, i.e., impose only (\[eq:reliabilityconstJ2\]), (\[eq:uniformityconstJ2\]), and (\[eq:secrecyconstJ2\]). This result improves on the secret-key capacity region given in [@bizimBenelux Theorem 1] for a weak secrecy constraint.

\[ex:example1\] Consider the RO PUF model from [@bizimMDPI Section 4.1] where a transform-coding method is applied to conservatively model the measurement channels $P_{Y|X}=P_{\widetilde{X}|X}$ as independent BSCs with the same crossover probability of $p_\text{A}$ and where the hidden source output is $\text{Bern}(\frac{1}{2})$. We therefore can apply the achievability results from Theorem \[theo:Twoenrollmentgscs\] to this RO PUF model. Using [@bizimMMMMTIFS Theorem 3] to evaluate the boundary tuples of $\mathcal{\widebar{R}}_{\text{gs},J=2}$, it suffices to consider probability distributions $P_{U_j|\widetilde{X}_j}$ for $j=1,2$ such that $P_{\widetilde{X}_j|U_j}$ are BSCs with crossover probabilities $$\begin{aligned}
        \tilde{x}_j = \frac{H_b^{-1}(H(X|U_j))-p_\text{A}}{1-2p_\text{A}}. \label{eq:optimalcrossoverUtoXtilde}
    \end{aligned}$$ Consider the projection of the boundary tuples of $\mathcal{\widebar{R}}_{\text{gs},J=2}$ onto key-leakage plane, i.e., (\[eq:corrkeyrateTwoenroll\]) and (\[eq:corrleakagerateTwoenroll\]). We plot in Fig. \[fig:example1plot\] single-enrollment results where the privacy-leakage rate is measured with respect to single helper data and two-enrollment results for the sum rate of the two keys, both for $p_\text{A}=0.06$ [@bizimMDPI]. To achieve a total secret-key rate of $I(\widetilde{X}_1;Y_1)=I(\widetilde{X}_2;Y_2)$, the privacy-leakage rate for the two-enrollment model is approximately $13.5\%$ less than the privacy-leakage rate for the single-enrollment model for RO PUFs. The reason for this gain is the information bottleneck problem that arises from (\[eq:corrkeyrateTwoenroll\]) and (\[eq:corrleakagerateTwoenroll\]) to find the boundary tuples.

Consider uniform binary antipodal measurements over an additive white Gaussian noise (AWGN) channel. Define the signal power as $P_{\text{S}}$ and the noise power as $P_{\text{N}}$, so we have a signal-to-noise ratio (SNR) of $\displaystyle SNR = \frac{P_{\text{S}}}{P_{\text{N}}}$. If a matched filter, which maximizes the $SNR$ at the sampling instant for the AWGN channel, is applied at the encoder and decoder, the bit error probability $P_{\text{b}}$ is given by [@bizimSingaporeLNs pp. 96] $$\begin{aligned}
        P_{\text{b}} = Q\left(\sqrt{SNR}\right).
     \end{aligned}$$ The channel between the input binary symbols and the outputs of the matched filter is a BISO channel. Using [@bizimMMMMTIFS Theorem 3], we have that $P_{\widetilde{X}_j|U_j}$ for $j=1,2$ that are BSCs with crossover probabilities given in (\[eq:optimalcrossoverUtoXtilde\]) by replacing $p_\text{A}$ with $P_{\text{b}}$, suffice to obtain the boundary tuples of $\mathcal{\widebar{R}}_{\text{gs},J=2}$. We remark that $p_{\text{A}}=0.06$ used in Example \[ex:example1\] corresponds to an SNR of approximately $3.83$dB.

In Fig. \[fig:Gaussianexample2\], the privacy-leakage rate vs. secret-key rate boundary tuples are depicted for two cases. First, a two-enrollment model at $SNR=3.83$dB with a sum rate for secret keys is depicted. For comparison, we plot a single-enrollment model where the signal power $P_{\text{s}}$ is doubled, i.e., we have an SNR of approximately $6.84$dB.

Fig. \[fig:Gaussianexample2\] shows for the two cases with the same total signal power of $2P_{\text{s}}$ that the single enrollment boundary tuple can result in a gain of approximately $228.55\%$ at the corner point in terms of the secret-key rates achieved for a given privacy-leakage rate. For such an AWGN channel with a fixed total signal power; therefore, the single-enrollment model can result in significant gains in terms of achieved secret-key rates as compared to the two-enrollment model for small $\widebar{R}_{\ell}$ values.

Proof of Theorem \[theo:GeneralInnergscs\] {#sec:achinnergeneral}
==========================================

We provide a proof that follows from the output statistics of random binning (OSRB) method, proposed in [@OSRBAmin] and further extended in [@YenerOSRB], by applying the steps in [@BlochLectureNotes2018 Section 1.6].

Proof for the GS Model {#subsec:Theorem1proofGS}
----------------------

Fix $\displaystyle P_{U_1|\widetilde{X}_1}, \displaystyle P_{U_2|\widetilde{X}_2},\ldots,P_{U_J|\widetilde{X}_J}$. Let $(\mathcal{U}_{[1:J]}^n,\mathcal{\widetilde{X}}_{[1:J]}^n,X^n,\mathcal{Y}_{[1:J]}^n)$ be i.i.d. according to (\[eq:fixedprobdistr\]). Assign three random bin indices $(S_j,W_j,C_j)$ to each realization $u_j^n$ for all $j\in[1:J]$, where $S_j$ represents the secret key, $W_j$ the helper data, and $C_j$ a public index. Assume $S_j\in[1:2^{nR_{\text{s},j}}]$, $W_j\in[1:2^{nR_{\text{w},j}}]$, and $C_j\in[1:2^{nR_{\text{c},j}}]$ such that $R_{\text{s},j},R_{\text{w},j},R_{\text{c},j}\geq0$ for all $j\in[1:J]$.

Apply the union bound to the reliability constraint in (\[eq:reliabilityconst\]) to obtain the sum of $J$ error probabilities. This sum vanishes for any finite number $J$ when $n\rightarrow\infty$ by using a Slepian-Wolf (SW) [@SW] decoder to estimate $U_j^n$ from $(C_j,W_j,Y_j^n)$ if [@OSRBAmin Lemma 1] $$\begin{aligned}
    R_{\text{c},j}+R_{\text{w},j}> H(U_j|Y_j),\qquad\forall j\in[1:J]. \label{eq:slepianwolfdecoder}\end{aligned}$$

The key uniformity (\[eq:uniformityconst\]), mutual key independence (\[eq:keyindependence\]), and strong secrecy (\[eq:secrecyconst\]) constraints are satisfied if [@OSRBAmin Theorem 1] $$\begin{aligned}
R_{\text{s},j}\!+\!R_{\text{w},j}\!+\!R_{\text{c},j}< H(U_j|\,\mathcal{U}_{[1:J]\setminus \{j\}}), \;\;\;\forall j\in[1:J]\label{eq:independenceofindices}\end{aligned}$$ since (\[eq:independenceofindices\]) ensures that the three random indices $(S_j,W_j,C_j)$ are almost mutually independent and uniformly distributed, and they are almost independent of $\mathcal{U}_{[1:J]\setminus\{j\}}$. Therefore, $(S_j,W_j,C_j)$ are almost independent of $\left(\mathcal{S}_{[1:J]\setminus\{j\}}, \mathcal{W}_{[1:J]\setminus\{j\}},  \mathcal{C}_{[1:J]\setminus\{j\}}\right)$ because $U_k^n$ determines $(S_k,W_k,C_k)$ for all $k\in[1:J]$.

Similarly, the public randomness $C_j$ is almost independent of $\widetilde{X}^n_j$, so it is almost independent of $(\mathcal{\widetilde{X}}_{[1:J]}^n,X^n,\mathcal{Y}_{[1:J]}^n)$, if we have [@OSRBAmin Theorem 1] $$\begin{aligned}
    R_{\text{c},j}<H(U_j|\widetilde{X}_j),\qquad \qquad \forall j\in[1:J].\label{eq:independenceofcode}\end{aligned}$$ Thus, the public indices $\mathcal{C}_{[1:J]}$ can be fixed by generating them uniformly at random. The $j$-th encoder can generate $U_j^n$ according to $P_{U_j^n|\widetilde{X}_j^nC_{j} }$ obtained from the binning scheme above to compute the bins $(S_j,W_{j})$ from $U_j^n$ for all $j\in[1:J]$. This procedure induces a joint probability distribution that is almost equal to $P_{\mathcal{U}_{[1:J]}\mathcal{\widetilde{X}}_{[1:J]}X\mathcal{Y}_{[1:J]}}$ fixed in (\[eq:fixedprobdistr\]) [@BlochLectureNotes2018 Section 1.6].

Applying the Fourier Motzkin elimination [@FMEbook] using the software available in [@FMEZiv] to (\[eq:slepianwolfdecoder\])-(\[eq:independenceofcode\]) for each $j\in[1:J]$ separately, we obtain the inequalities $$\begin{aligned}
&R_{\text{w},j}>I(U_j;\widetilde{X}_j)-I(U_j;Y_j)\label{eq:FMEgeneralinnerrw}\\
&R_{\text{s},j}<I(U_j;Y_j)-I(U_j;\mathcal{U}_{[1:J]\setminus\{j\}})\label{eq:FMEgeneralinnerrs}\\
&R_{\text{w},j}+R_{\text{s},j}< H(U_j|\mathcal{U}_{[1:J]\setminus\{j\}})\label{eq:FMEgeneralinnerrwplusrs}  \end{aligned}$$ for all $j\in[1:J]$.

To satisfy the constraints (\[eq:FMEgeneralinnerrw\])-(\[eq:FMEgeneralinnerrwplusrs\]), we can fix the rates to $$\begin{aligned}
{2}
    &R_{\text{s},j} = I(U_j;Y_j)\!-\!I(U_j;\mathcal{U}_{[1:J]\setminus\{j\}})\!-\!2\epsilon,&& \quad\forall j\in[1:J]\label{eq:chooseR_s}\\
    &R_{\text{w},j} = I(U_j;\widetilde{X}_j)-I(U_j;Y_j)+2\epsilon,&&\quad\forall j\in[1:J]\label{eq:chooseR_w}\\
    &R_{\text{c},j} = H(U_j|\widetilde{X}_j)-\epsilon,&&\quad\forall j\in[1:J]\label{eq:chooseR_c}\end{aligned}$$ for some $\epsilon>0$ such that $\epsilon\rightarrow0$ when $n\rightarrow\infty$. Furthermore, using the selection lemma [@Blochbook Lemma 2.2], there exists a binning that achieves all rate tuples given in (\[eq:chooseR\_s\])-(\[eq:chooseR\_c\]).

Consider the privacy leakage for a binning that satisfies (\[eq:chooseR\_s\])-(\[eq:chooseR\_c\]). Since $\mathcal{C}_{[1:J]}$ are public, we can bound the privacy leakage as follows. $$\begin{aligned}
    & I(X^n;\mathcal{W}_{[1:J]},\mathcal{C}_{[1:J]})\overset{(a)}{\leq} I(X^n;\mathcal{W}_{[1:J]}|\mathcal{C}_{[1:J]})+J\epsilon_n\nonumber\\
    &\quad\leq H(\mathcal{W}_{[1:J]})-H(\mathcal{W}_{[1:J]},\mathcal{C}_{[1:J]}|X^n)+H(\mathcal{C}_{[1:J]})+J\epsilon_n\nonumber\\
    &\quad\overset{(b)}{=}H(\mathcal{W}_{[1:J]})-\sum_{j=1}^JH(W_j,C_j|X^n)+H(\mathcal{C}_{[1:J]})+J\epsilon_n\nonumber\\
    &\quad\leq\sum_{j=1}^{J}\Big(H(W_j)\!+\!H(C_j)\!-\!H(W_j,C_j|X^n)\Big)\!+\!J\epsilon_n\label{eq:privacyleakagefirstpartach}\end{aligned}$$ where\
$(a)$ follows from the fact that $C_j$ is almost independent of $(\mathcal{\widetilde{X}}_{[1:J]}^n,X^n,\mathcal{Y}_{[1:J]}^n)$ for all $j\in[1:J]$ due to (\[eq:independenceofcode\]). Therefore, $C_j$ is almost independent of $(X^n,\mathcal{C}_{[1:J]\setminus\{j\}})$ because $U_k^n$ determines $C_k$ and $U_k^n-\widetilde{X}_k^n-\widetilde{X}_j^n-U_j^n$ form a Markov chain for all $k\neq j$ and $j,k\in[1:J]$, so we have $$\begin{aligned}
    &I(X^n;\mathcal{C}_{[1:J]}) \nonumber\\
    &\quad = I(X^n;C_1)+I(X^n;C_2|C_1)+\ldots+I(X^n;C_J|\mathcal{C}_{[1:J-1]})\nonumber\\
    &\quad \leq J.\epsilon_n \label{eq:achgeneralJprivacyleak}\end{aligned}$$ for some $\epsilon_n>0$ such that $\epsilon_n\rightarrow 0$ when $n\rightarrow\infty$;\
$(b)$ follows because $(W_j,C_j)-X^n-(\mathcal{W}_{[1:j-1]},\mathcal{C}_{[1:j-1]})$ form a Markov chain for all $j\in[2:J]$.

Consider two cases for the privacy leakage analysis.

**Case 1:** Suppose for any $j\in[1:J]$ that we have $$\begin{aligned}
    R_{\text{c},j}+R_{\text{w},j}< H(U_j|X)\end{aligned}$$ i.e., $H(U_j|X)>H(U_j|Y_j)$, so $(W_j,C_j,X^n)$ are almost mutually independent [@OSRBAmin Theorem 1]. Therefore, we have $$\begin{aligned}
    &H(W_j)\!+\!H(C_j)\!-\!H(W_j,C_j|X^n)\nonumber\\
    &\quad\leq H(W_j)\!+\!H(C_j)\!-\!(H(W_j)+H(C_j)-\epsilon_n')=\epsilon_n'\label{eq:privleakCase1}\end{aligned}$$ for some $\epsilon_n'>0$ such that $\epsilon_n'\rightarrow 0$ when $n\rightarrow\infty$. Combining (\[eq:privacyleakagefirstpartach\]) and (\[eq:privleakCase1\]) proves strong privacy.

**Case 2:** Suppose for any $j\in[1:J]$ that we have $$\begin{aligned}
R_{\text{c},j}+R_{\text{w},j}\geq H(U_j|X) \label{eq:degradedXtildeXY case2}\end{aligned}$$ i.e., $H(U_j|X)\leq H(U_j|Y_j)$, so $(W_j,C_j,X^n)$ can reliably estimate $U_j^n$ [@OSRBAmin Lemma 1]. Therefore, we have $$\begin{aligned}
&H(W_j)\!+\!H(C_j)\!-\!H(W_j,C_j|X^n)\nonumber\\
&\quad\overset{(a)}{\leq}H(W_j)\!+\!H(C_j)\!-\!nH(U_j|X)+n\epsilon_n''\nonumber\\
&\quad\overset{(b)}{\leq}n(I(U_j;X)-I(U_j;Y_j)+\epsilon+\epsilon_n'')\label{eq:privleakCase2}\end{aligned}$$ where $(a)$ follows because $U_j^n$ determines $(W_j,C_j)$, $(W_j,C_j,X^n)$ can realiably estimate $U^n$ for some $\epsilon_n''>0$ such that $\epsilon_n''\rightarrow 0$ when $n\rightarrow\infty$, and $(U_j^n,X^n)$ are i.i.d., and $(b)$ follows by (\[eq:chooseR\_w\]) and (\[eq:chooseR\_c\]).

Combining (\[eq:privacyleakagefirstpartach\]) and (\[eq:privleakCase2\]), we obtain $$\begin{aligned}
    &I(X^n;\mathcal{W}_{[1:J]},\mathcal{C}_{[1:J]})-J\epsilon_n \nonumber\\
    &\quad\!\leq \!\sum_{\substack{j=1\\\; j:\\H(U_j|X)\leq H(U_j|Y_j)}}^J\! n(I(U_j;X)\!-\!I(U_j;Y_j)\!+\!\epsilon\!+\!\epsilon_n'').\end{aligned}$$

These prove the achievability of the rate region $\mathcal{R}_{\text{gs}}$.

Proof for the CS Model {#subsec:Theorem1proofCS}
----------------------

We use the achievability proof for the GS model. Suppose the key $S'_j$, generated as in the GS model together with the helper data $W'_j$ and public index $C'_j$, have the same cardinality as the corresponding embedded secret key $S_j$, i.e., $|\mathcal{S}'_j|=|\mathcal{S}_j|$ for all $j\in [1:J]$. The chosen key $S_j$ is uniformly distributed and independent of $(X^n,\mathcal{\widetilde{X}}_{[1:J]}^n,\mathcal{Y}_{[1:J]}^n, \mathcal{S}_{[1:J]\setminus\{j\}})$ for all $j\in[1:J]$. Consider the $j$-th encoder $f_{\text{cs},j}(\cdot,\cdot)$ with inputs $(\widetilde{X}^n_j,S_j)$ and output $W_j=(S'_j+S_j,W'_j)$, and the $j$-th decoder $g_j(\cdot,\cdot)$ with inputs $(Y_j^n,W_j)$ and output $\hat{S}_j=S'_j+S_j-\hat{S}'_j$. All addition and subtraction operations are modulo-$|\mathcal{S}_j|$ for all $j\in[1:J]$. The $j$-th decoder of the GS model is used to obtain $\hat{S}'_j$ for all $j\in[1:J]$.

We have the error probability $$\begin{aligned}
&\Pr\left[\underset{j\in[1:J]}{\bigcup}\{S_j\ne\hat{S}_j\}\right]=\Pr\left[\underset{j\in[1:J]}{\bigcup}\{S'_j\ne\hat{S}'_j\}\right]\label{eq:errorprobabilityachtheo2}\end{aligned}$$ which is small due to the proof of achievability for the GS model.

Using (\[eq:chooseR\_s\]) and (\[eq:chooseR\_w\]), and from the one-time padding operation applied above, we can achieve a storage rate of $$\begin{aligned}
    &R_{\text{w},j} \geq I(U_j;\widetilde{X}_j) - I(U_j;U_{[1:J]\setminus\{j\}}),\quad\; \forall j\in[1:J]\label{eq:csstorageach}\end{aligned}$$ for the CS model.

We have the secrecy leakage of $$\begin{aligned}
    &I(\mathcal{S}_{[1:J]};\mathcal{W}_{[1:J]},\mathcal{C}_{[1:J]}')\overset{(a)}{=}I(\mathcal{S}_{[1:J]};\mathcal{W}_{[1:J]}|\mathcal{C}_{[1:J]}')\nonumber\\
    &\!=\! I(\mathcal{S}_{[1:J]};\mathcal{W}_{[1:J]}'|\mathcal{C}_{[1:J]}'\!)\!+\!I(\mathcal{S}_{[1:J]};{(\mathcal{S}'\!+\!\mathcal{S})}_{[1:J]}\!|\mathcal{W}_{[1:J]}',\mathcal{C}_{[1:J]}'\!)\nonumber\\
    &\!\overset{(b)}{=} H({(\mathcal{S}'\!+\!\mathcal{S})}_{[1:J]}|\mathcal{W}_{[1:J]}',\mathcal{C}_{[1:J]}') - H(\mathcal{S}_{[1:J]}'|\mathcal{W}_{[1:J]}',\mathcal{C}_{[1:J]}') \nonumber
        \end{aligned}$$ $$\begin{aligned}
    &\!\overset{(c)}{\leq} n\Big(\sum_{j=1}^JR_{\text{s},j}\Big)-H(\mathcal{S}_{[1:J]}'|\mathcal{C}_{[1:J]}')+I(\mathcal{S}_{[1:J]}';\mathcal{W}_{[1:J]}'|\mathcal{C}_{[1:J]}')\nonumber\\
    &\!\overset{(d)}{\leq} n\Big(\sum_{j=1}^JR_{\text{s},j}\Big)-\Big(n\Big(\sum_{j=1}^JR_{\text{s},j}\Big)-\epsilon_n'''\Big)\nonumber\\
    &\qquad+I(\mathcal{S}_{[1:J]}';\mathcal{W}_{[1:J]}'|\mathcal{C}_{[1:J]}')\nonumber\\
    &\!\overset{(e)}{\leq}\epsilon_n'''+\epsilon_n^{(4)}\end{aligned}$$ where $(a)$ follows since $\mathcal{S}_{[1:J]}$ are chosen independently of the public indices $\mathcal{C}_{[1:J]}$, $(b)$ follows because $\mathcal{S}_{[1:J]}$ are chosen independently of $(\mathcal{W}_{[1:J]}',\mathcal{C}_{[1:J]}',\mathcal{S}_{[1:J]}')$, $(c)$ follows because $|\mathcal{S}'_j|=|\mathcal{S}_j|$ for all $j\in[1:J]$, $(d)$ follows because $\mathcal{S}_{[1:J]}'$ and $\mathcal{C}_{[1:J]}'$ are almost mutually independent and each $S_j'$ is almost uniformly distributed due to (\[eq:independenceofindices\]) for some $\epsilon_n'''>0$ such that $\epsilon_n'''\rightarrow0$ when $n\rightarrow\infty$, and $(e)$ follows because the GS model satisfies the strong secrecy constraint (\[eq:secrecyconst\]) due to (\[eq:independenceofindices\]) for some $\epsilon_n^{(4)}>0$ such that $\epsilon_n^{(4)}\rightarrow0$ when $n\rightarrow\infty$.

Using the selection lemma, there exists a binning that achieves all rate tuples given in (\[eq:chooseR\_s\]), (\[eq:chooseR\_c\]), and (\[eq:csstorageach\]). Consider the privacy leakage for this binning. $$\begin{aligned}
&I(X^n;\mathcal{W}_{[1:J]},\mathcal{C}_{[1:J]}')\overset{(a)}{\leq} I(X^n;\mathcal{W}_{[1:J]}|\mathcal{C}_{[1:J]}')+J\epsilon_n\nonumber\\
    &\leq I(X^n;\mathcal{W}_{[1:J]}'|\mathcal{C}_{[1:J]}') +H((\mathcal{S}+\mathcal{S}')_{[1:J]}|\mathcal{W}_{[1:J]}',\mathcal{C}_{[1:J]}')\nonumber\\
    &\qquad -H((\mathcal{S}+\mathcal{S}')_{[1:J]}|X^n,\mathcal{W}_{[1:J]}',\mathcal{C}_{[1:J]}',\mathcal{S}_{[1:J]}')+J\epsilon_n\nonumber\\
    &\overset{(b)}{\leq}  I(X^n;\mathcal{W}_{[1:J]}'|\mathcal{C}_{[1:J]}')\!+\!\Big(\sum_{j=1}^J\log (|\mathcal{S}_j|)\Big)\!-\!H(\mathcal{S}_{[1:J]})\!+\!J\epsilon_n\nonumber\\
    &\overset{(c)}{=}  I(X^n;\mathcal{W}_{[1:J]}'|\mathcal{C}_{[1:J]}')+J\epsilon_n \label{eq:ach2privleaktemp}\end{aligned}$$ where $(a)$ follows by (\[eq:achgeneralJprivacyleak\]), $(b)$ follows because $\mathcal{S}_{[1:J]}$ are chosen independently of $(X^n,\mathcal{W}_{[1:J]}',\mathcal{S}_{[1:J]}',\mathcal{C}_{[1:J]}')$ and $|\mathcal{S}'_j|=|\mathcal{S}_j|$ for all $j\in[1:J]$, and $(c)$ follows from the uniformity and mutual independence of $\mathcal{S}_{[1:J]}$.

This proves the achievability of the rate region $\mathcal{R}_{\text{cs}}$.

Proof of Thorem \[theo:Twoenrollmentgscs\] {#sec:Twoenrollmentproofs}
==========================================

We use the OSRB method steps in [@BlochLectureNotes2018 Section 1.6].

Achievability Proof for the GS Model
------------------------------------

Fix $$\begin{aligned}
    \displaystyle P_{U_1|\widetilde{X}_1}=P_{U_2|\widetilde{X}_2}=P_{U|\widetilde{X}}.\label{eq:twoenrolleaulencoder}\end{aligned}$$ Let $(U_{1}^n,U_2^n,\widetilde{X}_{1}^n,\widetilde{X}_{2}^n,X^n,Y_{1}^n,Y_{2}^n)$ be i.i.d. according to (\[eq:fixedprobdistrTwoenroll\]). Assign three random bin indices $(S_j,W_j,C_j)$ to each realization $u_j^n$ for all $j=1,2$. Assume $S_j\in[1:2^{n\widebar{R}_{\text{s},j}}]$, $W_j\in[1:2^{n\widebar{R}_{\text{w},j}}]$, and $C_j\in[1:2^{n\widebar{R}_{\text{c},j}}]$ such that $\widebar{R}_{\text{s},j},\widebar{R}_{\text{w},j},\widebar{R}_{\text{c},j}\geq0$ for $j=1,2$.

Apply the union bound to the reliability constraint in (\[eq:reliabilityconstJ2\]), which vanishes when $n\rightarrow\infty$ by using an SW decoder to estimate $U_j^n$ from $(C_j,W_j,Y_j^n)$ if [@OSRBAmin Lemma 1] $$\begin{aligned}
\widebar{R}_{\text{c},j}+\widebar{R}_{\text{w},j}> H(U_j|Y_j),\qquad\;\;\;\; j=1,2. \label{eq:slepianwolfdecoderTwoenroll}\end{aligned}$$

The key uniformity (\[eq:uniformityconstJ2\]) constraint is satisfied if [@OSRBAmin Theorem 1] $$\begin{aligned}
\widebar{R}_{\text{s},j}\!+\!\widebar{R}_{\text{w},j}\!+\!\widebar{R}_{\text{c},j}< H(U_j), \qquad j=1,2\label{eq:keyuniformitytwoenroll}\end{aligned}$$ since (\[eq:keyuniformitytwoenroll\]) ensures that the three random indices $(S_j,W_j,C_j)$ are almost mutually independent and uniformly distributed.

Suppose a virtual joint encoder assigns six indices $(S_1,W_1,C_1,S_2,W_2,C_2)$ to each realization pair $(u_1^n,u_2^n)$. This virtual encoder is an operational dual of the virtual decoder used in the proof of [@bizimBenelux Theorem 1]. Using the virtual joint encoder, the strong secrecy constraint in (\[eq:secrecyconstJ2\]) and the strong helper data independence constraint in (\[eq:storageindependence\]) are satisfied if [@OSRBAmin Theorem 1] $$\begin{aligned}
\widebar{R}_{\text{s},1}\!+\!\widebar{R}_{\text{w},1}\!+\!\widebar{R}_{\text{c},1}\!+\!\widebar{R}_{\text{w},2}\!+\!\widebar{R}_{\text{c},2}< H(U_1,U_2)\label{eq:keyleakageperkeytwoenroll_part1}\end{aligned}$$ and $$\begin{aligned}
\widebar{R}_{\text{s},2}\!+\!\widebar{R}_{\text{w},2}\!+\!\widebar{R}_{\text{c},2}\!+\!\widebar{R}_{\text{w},1}\!+\!\widebar{R}_{\text{c},1}< H(U_1,U_2)\label{eq:keyleakageperkeytwoenroll_part2}\end{aligned}$$ because (\[eq:keyleakageperkeytwoenroll\_part1\]) ensures that $(S_1,W_1,C_1,W_2,C_2)$ are almost mutually independent; whereas, (\[eq:keyleakageperkeytwoenroll\_part2\]) ensures that $(S_2,W_2,C_2,W_1,C_1)$ are almost mutually independent.

\[rem:whylessstringent\] The set of equations considered in (\[eq:keyuniformitytwoenroll\])-(\[eq:keyleakageperkeytwoenroll\_part2\]) cannot be imposed for the joint secrecy-leakage constraint in (\[eq:secrecyconst\]) for general probability distributions $P_{\widetilde{X}_1\widetilde{X}_2XY_1Y_2}$, since to impose (\[eq:secrecyconst\]) one would replace (\[eq:keyleakageperkeytwoenroll\_part1\]) and (\[eq:keyleakageperkeytwoenroll\_part2\]) with $$\begin{aligned}
        \widebar{R}_{\text{s},1}\!+\!\widebar{R}_{\text{w},1}\!+\!\widebar{R}_{\text{c},1}\!+   \widebar{R}_{\text{s},2}+\!\widebar{R}_{\text{w},2}\!+\!\widebar{R}_{\text{c},2}< H(U_1,U_2)\label{eq:SStringentkeyleakageperkeytwoenroll_part1}
    \end{aligned}$$ which would also imply the mutual independence of secret keys in (\[eq:keyindependence\]). However, the inequalities in (\[eq:keyuniformitytwoenroll\]) and (\[eq:SStringentkeyleakageperkeytwoenroll\_part1\]) cannot be satisfied simultaneously in general as $H(U_1)+H(U_2)\geq H(U_1,U_2)$. This problem is avoided in the proof of Theorem \[theo:GeneralInnergscs\] by imposing the inequality in (\[eq:independenceofindices\]) rather than (\[eq:keyuniformitytwoenroll\]).

The public randomness $C_j$ is almost independent of $\widetilde{X}^n_j$, so it is almost independent of $(\widetilde{X}_1^n,\widetilde{X}_2^n,X^n,Y_1^n,Y_2^n)$, if we have [@OSRBAmin Theorem 1] $$\begin{aligned}
\widebar{R}_{\text{c},j}<H(U_j|\widetilde{X}_j),\qquad \qquad  j=1,2.\label{eq:independenceofcodetwoenroll}\end{aligned}$$ Thus, the public indices $(C_1,C_2)$ can be fixed by generating them uniformly at random. $U_j^n$ can be generated according to $P_{U_j^n|\widetilde{X}_j^nC_j}$ for $j=1,2$ obtained from the binning scheme above to compute the bins $(S_j,W_{j})$ from $U_j^n$ for $j=1,2$. This procedure induces a joint probability distribution that is almost equal to $P_{U_{1}U_2\widetilde{X}_{1}\widetilde{X}_2XY_{1}Y_2}$ that is fixed in (\[eq:fixedprobdistrTwoenroll\]) [@BlochLectureNotes2018 Section 1.6].

Applying the Fourier Motzkin elimination to (\[eq:slepianwolfdecoderTwoenroll\])-(\[eq:keyleakageperkeytwoenroll\_part2\]) and (\[eq:independenceofcodetwoenroll\]), we obtain the inequalities $$\begin{aligned}
    &\widebar{R}_{\text{w},1}> H(U_1|Y_1)-H(U_1|\widetilde{X}_1)\label{eq:J2constraints1}\\
    &\widebar{R}_{\text{w},2}> H(U_2|Y_2)-H(U_2|\widetilde{X}_2)\\
    &\widebar{R}_{\text{s},1}<I(U_1;Y_1)\label{eq:J2R1ineq}\\
    &\widebar{R}_{\text{s},2}<I(U_2;Y_2)\label{eq:J2R2ineq}\\
    &\widebar{R}_{\text{s},1}<-H(U_1|Y_1)-H(U_2|Y_2)+H(U_1,U_2)\label{eq:J2unnecessaryRs1}\\
    &\widebar{R}_{\text{s},2}<-H(U_1|Y_1)-H(U_2|Y_2)+H(U_1,U_2)\label{eq:J2unnecessaryRs2}
        \end{aligned}$$ $$\begin{aligned}
    & \widebar{R}_{\text{s},1} + \widebar{R}_{\text{w},2}<-H(U_1|Y_1)+H(U_1,U_2)\label{eq:J2S1W2}\\
    & \widebar{R}_{\text{s},1} + \widebar{R}_{\text{w},1}<H(U_1)\label{eq:HU1}\\
    & \widebar{R}_{\text{s},1} + \widebar{R}_{\text{w},1}<-H(U_2|Y_2)+H(U_1,U_2)\label{eq:HU1icingereksiz}\\
    & \widebar{R}_{\text{s},1} + \widebar{R}_{\text{w},1}+\widebar{R}_{\text{w},2}<H(U_1,U_2)\label{eq:J2Rs1Rw1Rw2}\\
    & \widebar{R}_{\text{s},2} + \widebar{R}_{\text{w},2}<-H(U_1|Y_1)+H(U_1,U_2)\label{eq:HU2icingereksiz}\\
    & \widebar{R}_{\text{s},2} + \widebar{R}_{\text{w},2}<H(U_2)\label{eq:HU2}\\
    & \widebar{R}_{\text{s},2} + \widebar{R}_{\text{w},1}<-H(U_2|Y_2)+H(U_1,U_2)\label{eq:J2S2W1}\\
    & \widebar{R}_{\text{s},2} + \widebar{R}_{\text{w},2}+\widebar{R}_{\text{w},1}<H(U_1,U_2).\label{eq:J2constraintslast}\end{aligned}$$

Observe that we have $$\begin{aligned}
    &H(U_1|\widetilde{X}_2) = H(U_1|Y_1) = H(U_2|\widetilde{X}_1)=H(U_2|Y_2)\label{eq:uconditionalequalitiesJ2}\\
    & H(U_1|\widetilde{X}_1) = H(U_2|\widetilde{X}_2)\label{eq:u1xtilde1u2xtilde2ineqJ2}\\
    & H(U_1) = H(U_2)\label{eq:u1equaltou2J2}\end{aligned}$$ due to (\[eq:SRAMchanneldef\]) and (\[eq:twoenrolleaulencoder\]). We therefore obtain $$\begin{aligned}
    &H(U_1,U_2)-H(U_1|Y_1)\overset{(a)}{=}H(U_2)\!+\!H(U_1|U_2)\!-\!H(U_1|\widetilde{X}_2)\nonumber\\
    &\overset{(b)}{\geq} H(U_2)\label{eq:conversJ2thatshowcombinationboundisalreadysatisfied}\end{aligned}$$ where $(a)$ follows by (\[eq:uconditionalequalitiesJ2\]) and $(b)$ follows from the Markov chain $U_2-\widetilde{X}_2-U_1$. A similar result can be shown by swaping the indices. Therefore, the constraints in (\[eq:HU1icingereksiz\]) and (\[eq:HU2icingereksiz\]) are inactive due to the constraints, respectively, in (\[eq:HU1\]) and (\[eq:HU2\]) for the two-enrollment model given in Definition \[def:twoenrollment\]. Similarly, the constraints in (\[eq:J2unnecessaryRs1\]) and (\[eq:J2unnecessaryRs2\]) are inactive due to the constraints, respectively, in (\[eq:J2R1ineq\]) and (\[eq:J2R2ineq\]).

Replace the inequalities in (\[eq:J2S1W2\]) and (\[eq:J2S2W1\]), respectively, with $$\begin{aligned}
&2\widebar{R}_{\text{s},1}+\widebar{R}_{\text{w},1}+\widebar{R}_{\text{w},2}< I(U_1;Y_1)+H(U_1,U_2)\label{eq:intermediateineq3}\\
&2\widebar{R}_{\text{s},2}+\widebar{R}_{\text{w},2}+\widebar{R}_{\text{w},1}< I(U_2;Y_2)+H(U_1,U_2)\label{eq:intermediateineq3forj2}.\end{aligned}$$ Then, (\[eq:intermediateineq3\]) is inactive because (\[eq:J2R1ineq\]) and (\[eq:J2Rs1Rw1Rw2\]) imply (\[eq:intermediateineq3\]), and (\[eq:intermediateineq3forj2\]) is inactive because (\[eq:J2R2ineq\]) and (\[eq:J2constraintslast\]) imply (\[eq:intermediateineq3forj2\]). We remark that rate region represented by (\[eq:J2constraints1\])-(\[eq:J2constraintslast\]) is the same as the region represented by replacing (\[eq:J2S1W2\]) and (\[eq:J2S2W1\]) with (\[eq:intermediateineq3\]) and (\[eq:intermediateineq3forj2\]) because the corner points of the two rate regions are the same. Therefore, the inequalities in (\[eq:J2S1W2\]) and (\[eq:J2S2W1\]) are inactive.

To satisfy the constraints (\[eq:J2constraints1\])-(\[eq:J2constraintslast\]), we can fix the rates to $$\begin{aligned}
{2}
&\widebar{R}_{\text{s},j} = I(U_j;Y_j)-\!5\epsilon,&& \qquad j=1,2\label{eq:chooseR_stwoenroll}\\
&\widebar{R}_{\text{w},j} = I(U_j;\widetilde{X}_j)-I(U_j;Y_j)+2\epsilon,&&\qquad j=1,2\label{eq:chooseR_wtwoenroll}\\
&\widebar{R}_{\text{c},j} = H(U_j|\widetilde{X}_j)-\epsilon,&&\qquad j=1,2\label{eq:chooseR_ctwoenroll}\end{aligned}$$ for some $\epsilon>0$ such that $\epsilon\rightarrow0$ when $n\rightarrow\infty$ due to (\[eq:uconditionalequalitiesJ2\])-(\[eq:conversJ2thatshowcombinationboundisalreadysatisfied\]). Furthermore, using the selection lemma, there exists a binning that achieves all rate tuples given in (\[eq:chooseR\_stwoenroll\])-(\[eq:chooseR\_ctwoenroll\]).

Consider the privacy leakage for a binning that satisfies (\[eq:chooseR\_stwoenroll\])-(\[eq:chooseR\_ctwoenroll\]). Since $C_1$ and $C_2$ are public, we can bound the privacy leakage as follows. $$\begin{aligned}
& I(X^n;W_1,W_2,C_1,C_2)\overset{(a)}{\leq} I(X^n;W_1,W_2|C_1,C_2)+2\epsilon_n\nonumber\\
&\overset{(b)}{\leq}H(W_1,W_2) - H(W_1,C_1|X^n)- H(W_2,C_2|X^n)\nonumber\\
&\qquad + H(C_1,C_2)+2\epsilon_n\nonumber\\
&\overset{(c)}{\leq} H(W_1)+H(W_2)-H(U_1^n|X^n)-H(U_2^n|X^n)+2n\epsilon_n''\nonumber\\
&\qquad +H(C_1)+H(C_2)+2\epsilon_n\label{eq:privacyleakachforfixedratesintermediatestep}
    \end{aligned}$$ $$\begin{aligned}
&\overset{(d)}{\leq} n(I(U_1;X)-I(U_1;Y_1)+I(U_2;X)-I(U_2;Y_2))\nonumber\\
&\qquad +2n\epsilon_n''+2n\epsilon+2\epsilon_n \label{eq:privacyleakachforfixedrates}\end{aligned}$$ where $(a)$ follows by (\[eq:achgeneralJprivacyleak\]) for $J=2$, $(b)$ follows because $(W_1,C_1)-X^n-(W_2,C_2)$ form a Markov chain, $(c)$ follows for some $\epsilon_n''>0$ such that $\epsilon_n''\rightarrow 0$ when $n\rightarrow\infty$ because for the two-enrollment model considered, (\[eq:degradedXtildeXY case2\]) is satisfied due to the Markov chain $U_j-X-Y_j$ for $j=1,2$, and $(d)$ follows by (\[eq:chooseR\_wtwoenroll\]) and (\[eq:chooseR\_ctwoenroll\]), and because $(U_1^n,U_2^n,X^n)$ are i.i.d.

Using (\[eq:privacyleakachforfixedratesintermediatestep\]) for general rate tuples that satisfy the constraints (\[eq:J2constraints1\])-(\[eq:J2constraintslast\]), i.e., not only (\[eq:chooseR\_stwoenroll\])-(\[eq:chooseR\_ctwoenroll\]), we can bound the privacy leakage as $$\begin{aligned}
& I(X^n;W_1,W_2,C_1,C_2)\nonumber\\
&\overset{(a)}{\leq} n\widebar{R}_{\text{w},1}+n\widebar{R}_{\text{w},2}+nI(U_1;X)-nI(U_1;\widetilde{X}_1)\nonumber\\
&\qquad+nI(U_2;X)-nI(U_2;\widetilde{X}_2)+2n\epsilon_n''+2\epsilon_n \label{eq:privacyleakachforGeneralTuples}\end{aligned}$$ where $(a)$ follows by (\[eq:chooseR\_ctwoenroll\]) and because $(U_1^n,U_2^n,X^n)$ are i.i.d.

These prove the achievability of the key-leakage-storage region $\mathcal{\widebar{R}}_{\text{gs},J=2}$.

Achievability Proof for the CS Model
------------------------------------

The achievability proof for the CS model follows by applying the one-time padding step used in Section \[subsec:Theorem1proofCS\].

Outer Bound Proofs for the GS and CS Models
-------------------------------------------

Suppose for some $\delta_n\!>\!0$ and $n$, there is a pair of encoders and decoders such that (\[eq:reliabilityconstJ2\])-(\[eq:storageindependence\]) are satisfied by some key-leakage-storage tuple $(\widebar{R}_{\text{s},1}, \widebar{R}_{\text{s},2}, \widebar{R}_{\ell}, \widebar{R}_{\text{w},1}, \widebar{R}_{\text{w},2})$. Using (\[eq:reliabilityconstJ2\]) and Fano’s inequality, we obtain $$\begin{aligned}
H(S_j|W_j,Y_j^n)\!\overset{(a)}{\leq}\!H(S_j|\hat{S}_j)\!\leq\!n\epsilon_n,\qquad j=1,2 \label{eq:fanoappJ2} \end{aligned}$$ where $(a)$ permits randomized decoding, $\epsilon_n\!=\!\delta_n \max\{\widebar{R}_{\text{s},1},\widebar{R}_{\text{s},2}\} \!+\!H_b(\delta_n)/n$ such that $\epsilon_n\!\rightarrow\!0$ if $\delta_n\!\rightarrow\!0$.

Let $U_{j,i}\triangleq (S_j,W_j,X^{i-1})$, which satisfies the Markov chain $U_{j,i}-\widetilde{X}_{j,i}-X_i-Y_{j,i}$ for all $i\in[1:n]$ and $j=1,2$.

\[rem:Markovchainsdiff\] For the choice of $U_{j,i}= (S_j,W_j,X^{i-1})$ (and similarly for $U_{j,i}= (S_j,W_j,Y_j^{i-1})$) for $j\!=\!1,2$, $U_{1,i}-\widetilde{X}_{1,i}-U_{2,i}$ do not form a Markov chain for all $i\in[1:n]$ although for the inner bound we use this Markov chain. This is the reason why inner and outer bounds do not match in general.

*Proof for (\[eq:corrkeyrateTwoenroll\])*: We obtain for the GS and CS models for $j=1,2$ that $$\begin{aligned}
&n(\widebar{R}_{\text{s},j}-\delta_n)\overset{(a)}{\leq} H(S_j)-H(S_j|W_j,Y_j^n)+n\epsilon_n\nonumber\\
&\overset{(b)}{\leq} I(S_j;Y_j^n|W_j)+n\epsilon_n+\delta_n\nonumber\\
&\leq \sum_{i=1}^n \Big[I(S_j,W_j,Y_j^{i-1};Y_{j,i})+\epsilon_n+\frac{\delta_n}{n}\Big]\nonumber\\
&\overset{(c)}{\leq}\sum_{i=1}^n \Big[I(S_j,W_j,X^{i-1};Y_{j,i})+\epsilon_n+\frac{\delta_n}{n}\Big]\nonumber\\
&\overset{(d)}{=}\sum_{i=1}^n \Big[I(U_{j,i};Y_{j,i})+\epsilon_n+\frac{\delta_n}{n}\Big]\label{eq:secretkeyconv1}\end{aligned}$$ $(a)$ follows by (\[eq:uniformityconstJ2\]) and (\[eq:fanoappJ2\]), $(b)$ follows by (\[eq:secrecyconstJ2\]), $(c)$ follows by applying the data-processing inequality to the Markov chain $$\begin{aligned}
 Y_j^{i-1}-(W_j,S_j,X^{i-1})-Y_{j,i},\quad j=1,2,\;\;\forall i\in[1\!:\!n]\label{eq:MarkovchainYiYiminus1}\end{aligned}$$ and $(d)$ follows from the definition of $U_{j,i}$.

*Proof for (\[eq:corrleakagerateTwoenroll\])*: We have for the GS and CS models that $$\begin{aligned}
&n(\widebar{R}_\ell+\delta_n)\overset{(a)}{=} H(W_1,W_2)-H(W_1|X^n)-H(W_2|X^n)\nonumber\\
&\overset{(b)}{=}H(W_1|Y_1^n)-H(W_1|X^n)+H(W_2|Y_2^n)-H(W_2|X^n)\nonumber\\
&\quad +I(W_1;\widetilde{X}_2^n)+I(W_2;Y_2^n)-I(W_1;W_2)\nonumber\\
&\overset{(c)}{\geq}\sum_{j=1}^2\Big[H(W_j|Y_j^n)-H(W_j|X^n)\Big]\nonumber\\
&\geq \sum_{j=1}^2 \Big[H(S_j,W_j,Y_j^n)-H(S_j|W_j,Y_j^n)-H(Y_j^n)\nonumber\\
&\qquad\qquad-H(S_j,W_j|X^n)\Big]\nonumber\\
&\overset{(d)}{\geq} \sum_{j=1}^2\Big[I(S_j,W_j;X^n)-I(S_j,W_j;Y_j^n)-n\epsilon_n\Big]\nonumber\\
&\overset{(e)}{\geq}\!\sum_{j=1}^2\!\sum_{i=1}^{n}\!\Big[I(S_j,W_j,X^{i-1};X_i) \!-\!I(S_j,W_j,X^{i-1};Y_{j,i}) \!-\!\epsilon_n\Big]\nonumber\\
&\overset{(f)}{=}\!\sum_{j=1}^2\sum_{i=1}^{n}\Big[I(U_{j,i};X_i) -I(U_{j,i};Y_{j,i})    -\epsilon_n\Big]\label{eq:convprivacylowerbound}\end{aligned}$$ where $(a)$ follows by (\[eq:privacyconstJ2\]) and from the Markov chain $W_1-X^n-W_2$, $(b)$ follows because $I(W_1;Y_1^n)=I(W_1;\widetilde{X}_2^n)$ due to (\[eq:SRAMchanneldef\]), $(c)$ follows from the Markov chain $W_1-\widetilde{X}_2^n-W_2$, $(d)$ follows by (\[eq:fanoappJ2\]), $(e)$ follows because the channel and source are memoryless and from the Markov chain in (\[eq:MarkovchainYiYiminus1\]), and $(f)$ follows from the definition of $U_{j,i}$.

*Proof for (\[eq:corrleakagerateTwoenrollupperbound\])*: We have for the GS and CS models that $$\begin{aligned}
&n(\widebar{R}_\ell+\delta_n)\nonumber\\
&\overset{(a)}{\leq} H(W_1)+H(W_2)-H(W_1|X^n)-H(W_2|X^n)\nonumber\\
&\overset{(b)}{\leq} \sum_{j=1}^2\Big[n\widebar{R}_{\text{w},j}+H(S_j,W_j|\widetilde{X}_j^n)-H(S_j,W_j|X^n)+n\epsilon_n\Big]\nonumber\\
&\overset{(c)}{=}\sum_{j=1}^2\Big[n\widebar{R}_{\text{w},j}+\sum_{i=1}^nI(S_j,W_j,X^{i-1};X_i)\nonumber\\
&\qquad\qquad-\sum_{i=1}^nI(S_j,W_j,\widetilde{X}_{j}^{i-1};\widetilde{X}_{j,i})+n\epsilon_n\Big]\nonumber\\
&\overset{(d)}{\leq}\sum_{j=1}^2\Big[n\widebar{R}_{\text{w},j}+\sum_{i=1}^nI(S_j,W_j,X^{i-1};X_i)\nonumber\\
&\qquad\qquad-\sum_{i=1}^nI(S_j,W_j,X^{i-1};\widetilde{X}_{j,i})+n\epsilon_n\Big]\nonumber\\
&\overset{(e)}{\leq}\sum_{j=1}^2\Big[n\widebar{R}_{\text{w},j}+\sum_{i=1}^n(I(U_{j,i};X_i)-I(U_{j,i};\widetilde{X}_{j,i}))\nonumber\\
&\qquad\qquad+n\epsilon_n\Big]\label{eq:converseprivleakupperbound}\end{aligned}$$ where $(a)$ follows by (\[eq:privacyconstJ2\]) and from the Markov chain $W_1-X^n-W_2$, $(b)$ follows by (\[eq:fanoappJ2\]) and from the Markov chain $S_j-(W_j,X^n)-Y^n$ for $j=1,2$, $(c)$ follows because the channel and source are memoryless, $(d)$ follows from the Markov chain $$\begin{aligned}
X^{i-1}\!-\!(W_j, S_j,\widetilde{X}_j^{i-1})\!-\!\widetilde{X}_{j,i},\;\;\; j=1,2,\;\;\forall i\in[1\!:\!n]\label{eq:MarkovchainXtildeiXiminus1} \end{aligned}$$ and $(e)$ follows from the definition of $U_{j,i}$.

*Proof for (\[eq:corrstoragerateTwoenroll\])*: Observe for the GS model for $j=1,2$ that $$\begin{aligned}
&n(\widebar{R}_{\text{w},j}+\delta_n)\overset{(a)}{\geq} H(W_j|Y_j^n)+I(W_j;Y_j^n)\nonumber\\
&\overset{(b)}{\geq} H(S_j,W_j,Y_j^n)-H(Y_j^n)-H(S_j|W_j,Y_j^n)\nonumber\\
&\qquad -H(S_j,W_j|\widetilde{X}_j^n)+I(W_j;Y_j^n)\nonumber\\
&\overset{(c)}{\geq} I(S_j,W_j;\widetilde{X}_j^n)-I(S_j,W_j;Y_j^n)-n\epsilon_{n}\nonumber\\
&\overset{(d)}{=}\!\sum_{i=1}^{n}[I(S_j,W_j,\widetilde{X}_j^{i-1};\widetilde{X}_{j,i})\!-\!I(S_j,W_j,Y_j^{i-1};Y_{j,i})\!-\!n\epsilon_{n}]\nonumber\\
&\overset{(e)}{\geq}\sum_{i=1}^{n}[I(S_j,W_j,X^{i-1};\widetilde{X}_{j,i})\!-\!I(S_j,W_j,X^{i-1};Y_{j,i})\!-\!n\epsilon_{n}]\nonumber\\
&\overset{(f)}{=}\sum_{i=1}^{n}[I(U_{j,i};\widetilde{X}_{j,i})\!-\!I(U_{j,i};Y_{j,i})\!-\!n\epsilon_{n}]\label{eq:storageconv1}\end{aligned}$$ where $(a)$ follows by (\[eq:storageconstJ2\]), $(b)$ follows from the encoding steps, $(c)$ follows by (\[eq:fanoappJ2\]), $(d)$ follows because the source and channel are memoryless, $(e)$ follows from the data-processing inequality applied to the Markov chains in (\[eq:MarkovchainYiYiminus1\]) and (\[eq:MarkovchainXtildeiXiminus1\]), and $(f)$ follows from the definition of $U_{j,i}$.

*Proof for (\[eq:cscorrstoragerateTwoenroll\])*: Observe for the CS model for $j=1,2$ that $$\begin{aligned}
&n(\widebar{R}_{\text{w},j}\!+\!\delta_n)\overset{(a)}{\geq}\! I(S_j,W_j;\widetilde{X}_j^n)\!-\!H(S_j|W_j)\!+\!H(S_j,W_j|\widetilde{X}_j^n)\nonumber\\
&\overset{(b)}{\geq} I(S_j,W_j;\widetilde{X}_j^n)+I(S_j;W_j)\nonumber\\
&\overset{(c)}{\geq}\!\sum_{i=1}^{n}I(S_j,W_j,\widetilde{X}_j^{i-1};\widetilde{X}_{j,i})\nonumber\\
&\overset{(d)}{\geq}\sum_{i=1}^{n}I(S_j,W_j,X^{i-1};\widetilde{X}_{j,i})\nonumber\\
&\overset{(e)}{=}\sum_{i=1}^{n}I(U_{j,i};\widetilde{X}_{j,i})\label{eq:storageconv2}\end{aligned}$$ where $(a)$ follows by (\[eq:storageconstJ2\]), $(b)$ follows because $\widetilde{X}^n$ is independent of $S_j$ and from the encoding step, $(c)$ follows because the source and channel are memoryless, $(d)$ follows by applying the data-processing inequality to the Markov chain in (\[eq:MarkovchainXtildeiXiminus1\]), and $(e)$ follows from the definition of $U_{j,i}$.

*Proof for (\[eq:sumonsamesandwpart1Twoenroll\])*: We have for the GS model for $j=1,2$ that $$\begin{aligned}
    &n(\widebar{R}_{\text{s},j}+\widebar{R}_{\text{w},j})\overset{(a)}{=}H(S_j,W_j)+I(S_j;W_j)+n\delta_n\nonumber\\
    &\overset{(b)}{\leq} \sum_{i=1}^n\big[H(S_j,W_j,X^{i-1})+\frac{\delta_n}{n}+\delta_n\big]\nonumber\\
    &\overset{(c)}{=} \sum_{i=1}^n\big[H(U_{j,i})+\frac{\delta_n}{n}+\delta_n\big]\label{eq: RsjRwjsumconversegs}\end{aligned}$$ where $(a)$ follows by (\[eq:uniformityconstJ2\]), $(b)$ follows by (\[eq:secrecyconstJ2\]), and $(c)$ follows from the definition of $U_{j,i}$.

*Proof for (\[eq:cssumonsamesandwpart1Twoenroll\])*: Similarly, we have for the CS model for $j=1,2$ that $$\begin{aligned}
&n\widebar{R}_{\text{w},j}\leq \sum_{i=1}^nH(S_j,W_j,X^{i-1})\overset{(a)}{=} \sum_{i=1}^nH(U_{j,i})\label{eq:Rwjupperboundcs}\end{aligned}$$ where $(a)$ follows from the definition of $U_{j,i}$.

*Proof for (\[eq:sumonsamesjandwjandjprimeTwoenroll\])*: We obtain for the GS model for $j=1,2$ and $j'$ as defined in (\[jprimedef\]) that $$\begin{aligned}
    &n(\widebar{R}_{\text{s},j}+\widebar{R}_{\text{w},j}+\widebar{R}_{\text{w},j'})\nonumber\\
    &\overset{(a)}{=} H(S_j,W_j,W_{j'})+I(S_j;W_j,W_{j'})+I(W_j;W_{j'})+n\delta_n\nonumber\\
    &\overset{(b)}{\leq}\sum_{i=1}^n \Big[H(S_j,W_j,W_{j'},S_{j'},X^{i-1}) + \frac{2\delta_n}{n}+\delta_n\Big]\label{eq:whereweneedindhelperdata}\\
    &\overset{(c)}{=}\sum_{i=1}^n \Big[H(U_{j,i},U_{j',i}) + \frac{2\delta_n}{n}+\delta_n\Big]\label{eq:highestsumrateconverse}\end{aligned}$$ where $(a)$ follows by (\[eq:uniformityconstJ2\]), $(b)$ follows by (\[eq:secrecyconstJ2\]) and (\[eq:storageindependence\]), and $(c)$ follows from the definitions of $U_{j,i}$ and $U_{j',i}$.

*Proof for (\[eq:cssumonsamesjandwjandjprimeTwoenroll\])*: We have for the CS model for $j=1,2$ and $j'$ as defined in (\[jprimedef\]) that $$\begin{aligned}
    &n(\widebar{R}_{\text{w},j}\!+\!\widebar{R}_{\text{w},j'})\nonumber\\
    &\leq\sum_{i=1}^nH(W_j,W_{j'},S_j,S_{j'},X^{i-1})+I(W_j;W_{j'})+n\widebar{R}_{\text{s},j'}\nonumber\\
    &\overset{(a)}{\leq} \sum_{i=1}^n\Big[H(W_j,W_{j'},S_j,S_{j'},X^{i-1})+\frac{\delta_n}{n}+\widebar{R}_{\text{s},j'}\Big]\label{eq:whereweneedindhelperdata2}\\
    &\overset{(b)}{=} \sum_{i=1}^n\Big[H(U_{j,i},U_{j',i})+\frac{\delta_n}{n}+\widebar{R}_{\text{s},j'}\Big]\label{eq:highestsumrateconversecs}\end{aligned}$$ where $(a)$ follows by (\[eq:storageindependence\]) and $(b)$ follows from the definitions of $U_{j,i}$ and $U_{j',i}$.

\[rem:helperdataindependence\] (\[eq:whereweneedindhelperdata\]) and (\[eq:whereweneedindhelperdata2\]) are the only places we use the strong helper data independence constraint in (\[eq:storageindependence\]) and it does not seem straightforward to obtain the inequalities in (\[eq:whereweneedindhelperdata\]) and (\[eq:whereweneedindhelperdata2\]) without (\[eq:storageindependence\]).

Introduce a uniformly distributed time-sharing random variable $\displaystyle Q\!\sim\! \text{Unif}[1\!:\!n]$ independent of other random variables. Define $X\!=\!X_Q$, $\displaystyle \widetilde{X}_j\!=\!\widetilde{X}_{j,Q}$, $\displaystyle Y\!=\!Y_{j,Q}$, and $U_j\!=\!(U_{j,Q},\!Q)$ so that $\displaystyle U_j\!-\!\widetilde{X}_{j}\!-\!X\!-\!Y_j$ form a Markov chain for $j=1,2$. The outer bound for the GS model follows by using the introduced random variables in (\[eq:secretkeyconv1\]), (\[eq:convprivacylowerbound\]), (\[eq:converseprivleakupperbound\]), (\[eq:storageconv1\]), (\[eq: RsjRwjsumconversegs\]), and (\[eq:highestsumrateconverse\]), and letting $\delta_n\rightarrow0$. Similarly, the outer bound for the CS model follows by using the introduced random variables in (\[eq:secretkeyconv1\]), (\[eq:convprivacylowerbound\]), (\[eq:converseprivleakupperbound\]), (\[eq:storageconv2\]), (\[eq:Rwjupperboundcs\]), and (\[eq:highestsumrateconversecs\]), and letting $\delta_n\rightarrow0$.

Conclusion {#sec:conclusion}
==========

We derived inner bounds for the multi-entity key-leakage-storage regions for GS and CS models with strong secrecy, a hidden identifier source, and correlated noise components at the encoder and decoder measurements that are modeled as BCs. The inner bounds are valid for any finite number of entities that use the same hidden source to agree on a secret key. We argued that the mutual key independence constraint we impose makes the proposed multi-entity key agreement problem a proper multi-user extension of the classic single-enrollment key agreement problem, unlike the multi-enrollment key agreement problem considered in the literature. A set of degraded and less-noisy BCs was shown to provide strong privacy without a need for a common randomness. We established inner and outer bounds for the key-lekage-storage regions for a two-enrollment model with measurement channels that are valid for SRAM and RO PUFs. Inner and outer bounds were shown to differ only in the Markov chains imposed and they match if the storage and privacy-leakage rate constraints are removed. Two examples illustrated that depending on the constraints of the practical scenario, single or multiple enrollment might perform better in terms of the secret-key vs. privacy-leakage rate ratio. In future work, we will find a set of probability distributions for which the strong helper data independence constraint in the two-enrollment model can be eliminated.

Acknowledgment {#acknowledgment .unnumbered}
==============

O. Günlü thanks <PRESIDIO_ANONYMIZED_PERSON> for fruitful discussions.

[^1]: Manuscript received April 30, 2020. O. Günlü is supported by the German Federal Ministry of Education and Research (BMBF) within the national initiative for “Post Shannon Communication (NewCom)” under the Grant 16KIS1004.

[^2]: O. Günlü is with the Information Theory and Applications Chair, Technische Universität Berlin, 10623 Berlin, Germany (e-mail: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>).