The

Intrinsic

Conditional

Mutual

Information

and

Perfect

Secrecy

Ueli

Maurer

and

Stefan

Wolf

Institute

for

Theoretical

Computer

Science

ETH

Z?urich

Z?urich

Switzerland

E-mail

addresses

fmaurer,wolfg@inf.ethz.ch

September

Abstract

This

paper

is

concerned

with

secret

key

agreement

by

public

discussion

two

parties

Alice

and

Bob

and

an

adversary

Eve

have

access

to

independent

realizations

of

random

variables

X

Y

and

Z

respectively

with

joint

distribution

PXY

Z

The

secret

key

rate

S

-LRB-

X

Y

jjZ

-RRB-

has

been

defined

as

the

maximal

rate

at

which

Alice

and

Bob

can

generate

a

secret

key

by

communication

over

an

insecure

but

authenticated

channel

such

that

Eve

's

information

about

this

key

is

arbitrarily

small

We

define

a

new

conditional

mutual

information

measure

the

intrinsic

conditional

mutual

information

denoted

by

I

-LRB-

X

Y

Z

-RRB-

and

show

that

it

is

an

upper

bound

on

S

-LRB-

X

Y

jjZ

-RRB-

The

special

scenarios

where

X

Y

and

Z

are

generated

by

sending

a

binary

random

variable

R

for

example

a

signal

broadcast

by

a

satellite

over

independent

channels

or

where

Z

is

generated

by

sending

X

and

Y

over

erasure

channels

are

analyzed

In

the

first

scenario

it

can

be

shown

even

for

continuous

random

variables

that

the

secret

key

rate

is

strictly

positive

if

and

only

if

the

intrinsic

conditional

mutual

information

between

X

and

Y

when

given

Z

is

strictly

positive

For

the

second

scenario

a

new

protocol

is

presented

which

allows

secret

key

agreement

even

when

all

the

previously

known

protocols

fail

Introduction

Perfectly

secure

key

agreement

has

been

studied

recently

by

several

authors

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

Two

possible

approaches

are

based

on

quantum

cryptography

-LRB-

e.g.

see

-LSB-

-RSB-

-RRB-

and

on

the

exploitation

of

the

noise

in

communication

channels

In

contrast

to

quantum

cryptography

which

is

expensive

to

realize

noise

is

a

natural

property

of

every

physical

communication

channel

In

-LSB-

-RSB-

and

in

-LSB-

-RSB-

it

has

been

illustrated

how

such

noise

in

communication

channels

can

be

used

for

unconditionally

secure

secret

key

agreement

and

furthermore

that

it

is

advantageous

to

combine

error

control

coding

and

cryptographic

coding

in

a

communication

system

In

particular

it

has

been

shown

that

if

Alice

Bob

and

Eve

receive

noisy

versions

of

a

binary

random

variable

for

example

of

a

signal

broadcast

by

a

satellite

then

Alice

and

Bob

can

agree

by

discussion

over

a

public

channel

on

a

secret

key

about

which

Eve

has

only

a

negligible

amount

of

information

if

and

only

if

Alice

's

and

Bob

's

information

have

some

arbitrarily

weak

statistical

dependence

with

the

satellite

's

signal

and

if

Eve

has

some

minimal

uncertainty

about

this

signal

It

is

a

classical

cryptographic

problem

of

transmitting

a

message

M

from

a

sender

-LRB-

referred

to

as

Alice

-RRB-

to

a

receiver

-LRB-

Bob

-RRB-

over

an

insecure

communication

channel

such

that

an

enemy

-LRB-

Eve

-RRB-

with

access

to

this

channel

is

unable

to

obtain

useful

information

about

M

In

the

classical

model

of

a

cryptosystem

-LRB-

or

cipher

-RRB-

introduced

by

Shannon

-LSB-

-RSB-

Eve

has

perfect

access

to

the

insecure

channel

thus

she

is

assumed

to

receive

an

identical

copy

of

the

ciphertext

C

received

by

the

legitimate

receiver

Bob

where

C

is

obtained

by

Alice

as

a

function

of

the

plaintext

message

M

and

a

secret

key

K

shared

by

Alice

and

Bob

Shannon

defined

a

cipher

system

to

be

perfect

if

I

-LRB-

M

C

-RRB-

i.e.

if

the

ciphertext

gives

no

information

about

the

plaintext

or

equivalently

if

M

and

C

are

statistically

independent

When

a

perfect

cipher

is

used

to

encipher

a

message

M

an

enemy

can

do

no

better

than

guess

M

without

even

looking

at

the

ciphertext

C.

Shannon

proved

the

pessimistic

result

that

perfect

secrecy

can

be

achieved

only

when

the

secret

key

is

at

least

as

long

as

the

plaintext

message

or

more

precisely

when

H

-LRB-

K

-RRB-

H

-LRB-

M

-RRB-

For

this

reason

perfect

secrecy

is

often

believed

to

be

impractical

In

-LSB-

-RSB-

this

pessimism

has

been

relativized

by

pointing

out

that

Shannon

's

apparently

innocent

assumption

that

except

for

the

secret

key

the

enemy

has

access

to

precisely

the

same

information

as

the

legitimate

receiver

is

very

restrictive

and

that

indeed

in

many

practical

scenarios

especially

if

one

considers

the

fact

that

every

transmission

of

data

is

ultimately

based

on

the

transmission

of

an

analog

signal

subject

to

noise

the

enemy

has

some

minimal

uncertainty

about

the

signal

received

by

the

legitimate

receiver

-LRB-

s

-RRB-

Wyner

-LSB-

-RSB-

and

subsequently

Csisz?ar

and

K?orner

-LSB-

-RSB-

considered

a

scenario

in

which

the

enemy

Eve

is

assumed

to

receive

messages

transmitted

by

the

sender

Alice

over

a

channel

that

is

noisier

than

the

legitimate

receiver

Bob

's

channel

The

assumption

that

Eve

's

channel

is

worse

than

the

main

channel

is

unrealistic

in

general

It

was

shown

in

-LSB-

-RSB-

that

this

assumption

can

be

unnecessary

if

Alice

and

Bob

can

also

communicate

over

a

completely

insecure

-LRB-

but

authenticated

-RRB-

public

channel

For

the

case

where

Alice

Bob

and

Eve

have

access

to

repeated

independent

realizations

of

random

variables

X

Y

and

Z

respectively

with

joint

distribution

PXY

Z

the

rate

at

which

Alice

and

Bob

can

generate

a

secret

key

by

public

discussion

over

an

insecure

channel

is

defined

in

-LSB-

-RSB-

as

follows

Definition

The

secret

key

rate

of

X

and

Y

with

respect

to

Z

denoted

by

S

-LRB-

X

Y

jjZ

-RRB-

is

the

maximum

rate

at

which

Alice

and

Bob

can

agree

on

a

secret

key

S

such

that

the

rate

at

which

Eve

obtains

information

about

S

is

arbitrarily

small

In

other

words

it

is

the

maximal

R

such

that

for

every

and

for

all

sufficiently

large

N

there

exists

a

protocol

using

public

discussion

over

an

insecure

but

authenticated

channel

such

that

Alice

and

Bob

who

receive

XN

-LSB-

XN

-RSB-

and

Y

N

-LSB-

YN

-RSB-

respectively

have

the

same

key

S

with

probability

at

least

satisfying

N

I

-LRB-

S

V

ZN

-RRB-

and

NH

-LRB-

S

-RRB-

R

where

V

denotes

the

collection

of

messages

sent

over

the

insecure

channel

by

Alice

and

Bob

and

where

ZN

-LSB-

ZN

-RSB-

The

following

lower

bound

for

S

-LRB-

X

Y

jjZ

-RRB-

is

proved

in

-LSB-

-RSB-

and

follows

from

a

result

by

Csisz?ar

and

K?orner

-LSB-

-RSB-

maxfI

-LRB-

X

Y

-RRB-

I

-LRB-

X

Z

-RRB-

I

-LRB-

Y

X

-RRB-

I

-LRB-

Y

Z

-RRB-

g

S

-LRB-

X

Y

jjZ

-RRB-

-LRB-

-RRB-

As

already

mentioned

it

has

been

first

shown

by

an

example

in

-LSB-

-RSB-

that

the

secret

key

rate

S

-LRB-

X

Y

jjZ

-RRB-

can

be

strictly

positive

even

when

both

I

-LRB-

X

Z

-RRB-

I

-LRB-

X

Y

-RRB-

and

I

-LRB-

Y

Z

-RRB-

I

-LRB-

Y

X

-RRB-

We

give

a

brief

outline

of

this

paper

In

Section

we

define

a

new

conditional

mutual

information

measure

and

show

that

this

measure

gives

an

improved

upper

bound

for

the

secret

key

rate

In

the

later

sections

we

address

the

problem

whether

secret

key

agreement

is

always

possible

when

this

new

upper

bound

is

strictly

positive

We

consider

this

in

the

scenarios

where

X

Y

and

Z

are

generated

by

sending

a

binary

random

variable

over

independent

channels

and

where

Z

is

generated

by

sending

X

and

Y

over

erasure

channels

We

show

the

somewhat

surprising

fact

that

a

new

protocol

can

be

more

powerful

than

the

previously

known

protocols

in

the

latter

scenario

The

intrinsic

conditional

mutual

information

The

following

upper

bound

on

the

secret

key

rate

has

been

proved

in

-LSB-

-RSB-

S

-LRB-

X

Y

jjZ

-RRB-

minfI

-LRB-

X

Y

-RRB-

I

-LRB-

X

Y

jZ

-RRB-

g

Trying

to

reduce

the

quantity

I

-LRB-

X

Y

jZ

-RRB-

in

this

upper

bound

the

adversary

Eve

can

send

the

random

variable

Z

over

a

channel

characterized

by

PZjZ

in

order

to

generate

the

random

variable

Z

and

hence

S

-LRB-

X

Y

jjZ

-RRB-

S

-LRB-

X

Y

jjZ

-RRB-

I

-LRB-

X

Y

jZ

-RRB-

-LRB-

-RRB-

holds

for

every

such

Z

This

motivates

the

following

definition

of

the

intrinsic

conditional

mutual

information

between

X

and

Y

when

given

Z

which

is

the

minimum

of

I

-LRB-

X

Y

jZ

-RRB-

taken

over

all

random

variables

Z

that

can

be

obtained

by

sending

Z

over

a

channel

characterized

by

PZjZ

Definition

For

a

distribution

PXY

Z

the

intrinsic

conditional

mutual

information

between

X

and

Y

when

given

Z

denoted

by

I

-LRB-

X

Y

Z

-RRB-

is

I

-LRB-

X

Y

Z

-RRB-

min

-LRB-

I

-LRB-

X

Y

jZ

-RRB-

PXY

Z

X

PXY

Z

PZjZ

-RRB-

where

the

minimum

is

taken

over

all

possible

conditional

distributions

PZjZ

Theorem

For

arbitrary

random

variables

X

Y

and

Z

we

have

S

-LRB-

X

Y

jjZ

-RRB-

I

-LRB-

X

Y

Z

-RRB-

-LRB-

-RRB-

Proof

The

bound

-LRB-

-RRB-

follows

from

-LRB-

-RRB-

Theorem

implies

in

particular

that

secret

key

agreement

can

be

possible

only

if

I

-LRB-

X

Y

Z

-RRB-

The

intrinsic

conditional

information

has

the

following

properties

I

-LRB-

X

Y

Z

-RRB-

I

-LRB-

X

Y

-RRB-

I

-LRB-

X

Y

Z

-RRB-

I

-LRB-

X

Y

jZ

-RRB-

and

I

-LRB-

X

Y

Z

-RRB-

I

-LRB-

X

Y

Z

-RRB-

where

Z

is

generated

from

Z

by

an

arbitrary

channel

The

following

example

shows

that

the

intrinsic

conditional

information

can

be

equal

to

-LRB-

and

secret

key

agreement

is

impossible

-RRB-

even

when

both

I

-LRB-

X

Y

jZ

-RRB-

and

I

-LRB-

X

Y

-RRB-

Let

X

Y

Z

PXY

Z

-LRB-

-RRB-

PXY

Z

-LRB-

-RRB-

PXY

Z

-LRB-

-RRB-

PXY

Z

-LRB-

-RRB-

and

PXY

Z

-LRB-

-RRB-

PXY

Z

-LRB-

-RRB-

Then

I

-LRB-

X

Y

-RRB-

and

I

-LRB-

X

Y

jZ

-RRB-

-LRB-

note

that

Z

X

Y

if

X

Y

-RRB-

but

I

-LRB-

X

Y

Z

-RRB-

To

see

this

consider

the

random

variable

Z

generated

by

sending

Z

over

the

channel

characterized

by

PZjZ

-LRB-

-RRB-

PZjZ

-LRB-

-RRB-

PZjZ

-LRB-

-RRB-

PZjZ

-LRB-

-RRB-

and

PZjZ

-LRB-

-RRB-

PZjZ

-LRB-

-RRB-

Intuitively

giving

the

side

information

Z

destroys

all

the

information

between

X

and

Y

but

generates

new

mutual

information

-LRB-

that

can

not

be

used

to

generate

a

secret

key

-RRB-

In

contrast

to

I

-LRB-

X

Y

jZ

-RRB-

the

intrinsic

information

I

-LRB-

X

Y

Z

-RRB-

measures

only

the

remaining

conditional

mutual

information

between

X

and

Y

-LRB-

when

given

Z

-RRB-

but

not

the

additional

information

between

X

and

Y

when

giving

Z

A

graphical

representation

of

I

-LRB-

X

Y

Z

-RRB-

is

described

in

Appendix

A.

Secret

key

agreement

with

general

random

variables

The

intrinsic

conditional

mutual

information

I

-LRB-

X

Y

Z

-RRB-

defined

above

gives

a

new

upper

bound

for

the

secret

key

rate

and

in

particular

secret

key

agreement

is

impossible

unless

I

-LRB-

X

Y

Z

-RRB-

It

appears

plausible

that

this

condition

is

also

sufficient

for

a

positive

secret

key

rate

This

is

a

fundamental

open

question

and

we

will

address

this

problem

in

the

following

sections

As

a

preparation

we

prove

three

lemmas

that

we

will

use

later

when

considering

different

scenarios

All

these

lemmas

follow

immediately

from

the

definition

of

the

secret

key

rate

Lemma

states

that

Alice

and

Bob

can

not

increase

the

secret

key

rate

when

they

discard

a

realization

of

-LSB-

X

Y

-RSB-

if

X

-LRB-

or

Y

-RRB-

does

not

lie

in

a

specified

subset

X

-LRB-

Y

-RRB-

of

the

range

X

-LRB-

Y

-RRB-

In

this

case

we

say

that

Alice

and

Bob

obtain

new

random

variables

by

restriction

of

the

ranges

Lemma

states

that

processing

X

and

Y

does

not

help

increasing

the

secret

key

rate

Lemma

Let

X

Y

and

Z

be

random

variables

with

ranges

X

Y

and

Z

and

joint

distribution

PXY

Z

For

X

ae

X

and

Y

ae

Y

we

define

a

new

random

experiment

with

random

variables

X

and

Y

-LRB-

with

ranges

X

and

Y

respectively

-RRB-

If

is

the

event

that

X

X

and

Y

Y

then

the

joint

distribution

of

X

and

Y

with

Z

is

defined

as

follows

P

X

Y

Z

-LRB-

x

y

z

-RRB-

PXY

Z

-LRB-

x

y

z

-RRB-

PXY

Z

-LSB-

-RSB-

for

all

-LRB-

x

y

z

-RRB-

X

Y

Z.

-LRB-

This

is

a

normed

probability

distribution

for

X

Y

Z.

-RRB-

Then

S

-LRB-

X

Y

jjZ

-RRB-

PXY

Z

-LSB-

-RSB-

S

-LRB-

X

Y

jjZ

-RRB-

In

other

words

the

secret

key

rate

can

not

be

increased

by

restricting

the

ranges

of

X

and

Y

Lemma

Let

X

Y

Z

X

and

Y

be

random

variables

with

distribution

PXY

ZX

Y

PXY

Z

PXjX

PY

jY

where

PXjX

and

PY

jY

are

arbitrary

conditional

probability

distributions

Then

S

-LRB-

X

Y

jjZ

-RRB-

S

-LRB-

X

Y

jjZ

-RRB-

Definition

We

say

that

X

and

Y

are

generated

from

X

and

Y

with

positive

probability

if

one

can

obtain

from

X

and

Y

random

variables

X

and

Y

by

restriction

of

the

ranges

-LRB-

see

above

-RRB-

and

the

random

variables

X

and

Y

by

sending

X

and

Y

over

two

channels

specified

by

PXj

X

and

PY

j

Y

Lemma

states

that

if

Eve

has

access

to

a

random

variable

U

-LRB-

in

addition

to

Z

-RRB-

that

can

be

interpreted

as

side

information

provided

by

an

oracle

then

the

secret

key

rate

is

not

greater

than

in

the

original

situation

Lemma

Let

X

Y

Z

and

U

be

arbitrary

random

variables

Then

S

-LRB-

X

Y

jj

-LSB-

Z

U

-RSB-

-RRB-

S

-LRB-

X

Y

jjZ

-RRB-

We

will

in

particular

make

use

of

the

following

corollary

which

is

an

immediate

consequence

of

the

three

Lemmas

and

Corollary

Let

X

Y

Z

and

U

be

arbitrary

random

variables

and

let

X

and

Y

be

generated

from

X

and

Y

with

positive

probability

Then

S

-LRB-

X

Y

jj

-LSB-

Z

U

-RSB-

-RRB-

implies

S

-LRB-

X

Y

jjZ

-RRB-

In

other

words

secret

key

agreement

by

public

discussion

with

respect

to

X

Y

and

Z

is

possible

if

the

same

holds

for

X

Y

and

-LSB-

Z

U

-RSB-

The

scenario

of

independent

channels

The

scenario

where

X

Y

and

Z

are

discrete

random

variables

generated

by

sending

a

binary

random

variable

R

over

three

arbitrary

independent

channels

CA

CB

and

CE

-LRB-

see

Figure

-RRB-

was

considered

and

completely

analyzed

in

-LSB-

-RSB-

It

was

shown

that

secret

key

agreement

is

possible

if

and

only

if

I

-LRB-

X

Y

jZ

-RRB-

which

is

therefore

equivalent

to

I

-LRB-

X

Y

Z

-RRB-

in

this

scenario

-LRB-

one

can

even

show

that

I

-LRB-

X

Y

jZ

-RRB-

I

-LRB-

X

Y

Z

-RRB-

always

holds

here

-RRB-

The

given

proof

does

not

apply

to

the

realistic

case

where

Eve

's

channel

is

an

analog

channel

because

the

resulting

random

variable

is

not

discrete

In

Appendix

B

we

prove

a

similar

result

for

continuous

random

variables

generated

from

independent

binary-input

channels

We

state

the

main

theorem

and

two

lemmas

of

-LSB-

-RSB-

which

will

be

required

in

the

following

sections

and

we

sketch

the

proof

of

the

main

result

in

order

to

present

the

protocol

for

achieving

a

positive

secret

key

rate

and

some

further

techniques

Theorem

Let

R

be

a

binary

random

variable

and

let

X

Y

and

Z

be

discrete

random

variables

-LRB-

with

ranges

X

Y

and

Z

respectively

-RRB-

generated

by

sending

R

over

independent

channels

CA

CB

and

CE

i.e.

PXY

ZjR

-LRB-

x

y

z

r

-RRB-

PXjR

-LRB-

x

r

-RRB-

PY

jR

-LRB-

y

r

-RRB-

PZjR

-LRB-

z

r

-RRB-

for

all

x

X

y

Y

z

Z

and

r

Then

the

secret

key

rate

is

strictly

positive

i.e.

S

-LRB-

X

Y

jjZ

-RRB-

if

and

only

if

I

-LRB-

X

Y

jZ

-RRB-

oeoe

CB

CA

CE

X

Y

Z

R

Figure

The

scenario

of

three

independent

channels

The

proof

of

this

theorem

-LRB-

see

-LSB-

-RSB-

-RRB-

is

roughly

as

follows

From

I

-LRB-

X

Y

jZ

-RRB-

one

can

conclude

that

there

exists

a

channel

characterized

by

PRjR

such

that

the

resulting

random

variable

R

is

binary

and

symmetrically

distributed

and

that

there

exist

symmetric

binary

random

variables

X

and

Y

which

can

be

generated

from

X

and

Y

with

positive

probability

such

that

X

and

Y

can

be

interpreted

as

generated

by

sending

R

over

independent

binary

symmetric

channels

CA

and

CB

with

identical

crossover

probabilities

smaller

than

Moreover

there

exists

side

information

U

such

that

-LSB-

Z

U

-RSB-

is

equivalent

to

a

random

variable

which

is

generated

from

R

by

an

erasure

channel

CE

with

positive

erasure

probability

and

which

is

independent

of

the

pair

-LRB-

CA

CB

-RRB-

This

situation

is

illustrated

in

Figure

oeoe

CB

CA

CE

X

Y

Z

R

oe

YX

additional

information

U

-LSB-

Z

U

-RSB-

R

oe

CB

CA

CE

oe

Figure

The

situation

in

the

proof

of

Theorem

According

to

Corollary

it

suffices

to

show

that

S

-LRB-

X

Y

jj

-LSB-

Z

U

-RSB-

-RRB-

We

state

two

lemmas

from

-LSB-

-RSB-

Lemma

states

that

in

the

scenario

with

X

Y

and

-LSB-

Z

U

-RSB-

there

exists

for

all

N

a

protocol

that

allows

Alice

to

send

a

bit

such

that

Bob

's

error

probability

about

the

bit

is

asymptotically

smaller

-LRB-

for

N

-RRB-

than

Eve

's

error

probability

-LRB-

even

when

she

uses

the

optimal

strategy

-RRB-

and

Lemma

states

that

this

is

sufficient

for

S

-LRB-

X

Y

jjZ

-RRB-

Lemma

Let

R

X

and

Y

be

symmetric

binary

random

variables

such

that

X

and

Y

can

be

interpreted

as

generated

by

sending

R

over

independent

binary

symmetric

channels

CA

and

CB

with

identical

error

probability

smaller

than

Let

Z

be

generated

by

sending

R

over

an

erasure

channel

CE

independent

of

the

pair

-LRB-

CA

CB

-RRB-

with

positive

erasure

probability

Then

for

every

N

there

exists

a

protocol

using

public

discussion

over

an

insecure

channel

that

allows

Alice

-LRB-

who

knows

XN

-LSB-

XN

-RSB-

-RRB-

to

send

a

bit

to

Bob

and

Eve

-LRB-

who

know

Y

N

and

ZN

respectively

-RRB-

such

that

Bob

's

error

probability

N

and

Eve

's

error

probability

N

-LRB-

for

all

possible

strategies

-RRB-

when

guessing

this

bit

satisfy

-LRB-

for

sufficiently

large

N

-RRB-

N

bN

N

cN

for

some

constants

b

and

c

with

b

c

The

considered

protocol

-LRB-

which

was

presented

already

in

-LSB-

-RSB-

-RRB-

works

as

follows

-LRB-

for

fixed

N

-RRB-

Protocol

A.

Alice

randomly

chooses

a

bit

C

and

sends

-LSB-

C

C

C

XN

-RSB-

over

the

public

channel

Bob

computes

-LSB-

-LRB-

C

-RRB-

-LRB-

C

XN

-RRB-

YN

-RSB-

and

accepts

if

and

only

if

this

is

equal

to

either

-LSB-

-RSB-

or

-LSB-

-RSB-

In

other

words

Alice

and

Bob

make

use

of

a

repeat

code

of

length

N

with

only

two

codewords

-LSB-

-RSB-

and

-LSB-

-RSB-

It

is

obvious

that

Eve

's

optimal

strategy

in

the

described

scenario

is

to

compute

the

block

-LSB-

-LRB-

C

-RRB-

-LRB-

C

XN

-RRB-

ZN

-RSB-

and

guess

C

as

if

at

least

half

of

the

bits

in

this

block

are

and

as

otherwise

This

protocol

is

computationally

efficient

but

it

is

not

efficient

in

terms

of

the

size

of

the

generated

secret

key

For

special

cases

there

exist

protocols

that

are

much

more

efficient

with

respect

to

the

effective

key

generation

rate

-LSB-

-RSB-

Because

of

its

importance

we

also

restate

the

proof

of

the

following

lemma

from

-LSB-

-RSB-

which

completes

the

proof

of

Theorem

Lemma

Let

X

Y

and

Z

be

arbitrary

random

variables

and

let

C

be

a

bit

randomly

chosen

by

Alice

Assume

that

for

all

N

Alice

can

generate

a

message

M

from

XN

-LSB-

XN

-RSB-

and

C

-LRB-

and

possibly

some

random

bits

-RRB-

such

that

with

some

probability

pN

Bob

-LRB-

who

knows

M

and

Y

N

-RRB-

accepts

and

can

compute

a

bit

C

such

that

Prob

-LSB-

C

C

-RSB-

bN

for

some

b

If

in

addition

given

that

Bob

accepts

for

every

strategy

for

guessing

C

when

given

M

and

ZN

the

average

error

probability

N

is

at

least

cN

for

some

c

b

and

for

sufficiently

large

N

then

S

-LRB-

X

Y

jjZ

-RRB-

Proof

According

to

inequality

-LRB-

-RRB-

it

suffices

to

show

that

Alice

and

Bob

can

for

some

N

construct

random

variables

X

and

Y

from

XN

and

Y

N

by

exchanging

messages

over

an

insecure

but

authenticated

channel

such

that

I

-LRB-

X

Y

-RRB-

I

-LRB-

X

Z

-RRB-

-LRB-

-RRB-

with

Z

-LSB-

ZN

V

-RSB-

where

V

is

the

collection

of

all

messages

sent

over

the

public

channel

Let

X

and

Y

be

defined

as

follows

If

Bob

accepts

let

X

C

and

Y

C

and

if

Bob

-LRB-

publicly

-RRB-

rejects

let

X

Y

reject

We

show

that

-LRB-

-RRB-

holds

for

sufficiently

large

N

If

Bob

accepts

then

H

-LRB-

CjC

-RRB-

h

-LRB-

bN

-RRB-

-LRB-

bN

-RRB-

N

-LRB-

b

-RRB-

cN

for

sufficiently

large

N

-LRB-

where

h

-LRB-

p

-RRB-

p

p

-LRB-

p

-RRB-

-LRB-

p

-RRB-

is

the

binary

entropy

function

the

first

inequality

follows

from

Jensen

's

inequality

and

the

reason

for

the

second

inequality

is

that

p

p

-LRB-

p

-RRB-

-LRB-

p

-RRB-

for

p

-RRB-

On

the

other

hand

H

-LRB-

Cj

Z

-RRB-

X

P

Z

-LRB-

z

-RRB-

H

-LRB-

Cj

Z

z

-RRB-

E

-LSB-

h

-LRB-

q

-LRB-

Z

-RRB-

-RRB-

-RSB-

E

-LSB-

q

-LRB-

Z

-RRB-

-RSB-

N

cN

where

q

-LRB-

z

-RRB-

is

the

probability

of

guessing

C

incorrectly

with

the

optimal

strategy

-LRB-

i.e.

q

-LRB-

z

-RRB-

-RRB-

given

that

Z

z.

Given

that

Bob

publicly

rejects

we

have

H

-LRB-

X

j

Y

-RRB-

H

-LRB-

X

j

Z

-RRB-

H

-LRB-

X

jV

-RRB-

From

pN

we

conclude

that

I

-LRB-

X

Y

-RRB-

I

-LRB-

X

Z

-RRB-

Towards

the

general

scenario

Protocol

A

is

not

optimal

In

this

section

X

and

Y

are

completely

general

random

variables

and

Eve

obtains

her

information

from

a

random

variable

that

is

generated

by

sending

X

and

Y

over

erasure

channels

The

advantage

of

considering

such

a

scenario

is

that

is

it

less

difficult

to

analyze

than

the

completely

general

situation

Moreover

many

more

general

situations

can

be

reduced

by

the

methods

of

Corollary

to

such

a

scenario

-LRB-

with

respect

to

the

question

whether

secret

key

agreement

is

possible

-RRB-

Later

in

this

section

we

will

prove

the

somewhat

surprising

fact

that

the

described

Protocol

A

is

not

optimal

A

new

protocol

Protocol

B

works

in

many

situations

in

which

Protocol

A

fails

We

will

consider

the

following

two

scenarios

Scenario

The

random

variables

X

and

Y

are

binary

and

distributed

according

to

PXY

-LRB-

-RRB-

PXY

-LRB-

-RRB-

ff

PXY

-LRB-

-RRB-

PXY

-LRB-

-RRB-

ff

-LRB-

-RRB-

for

some

ff

The

random

variable

Z

is

generated

by

sending

-LSB-

X

Y

-RSB-

over

an

erasure

channel

with

positive

erasure

probability

r.

Scenario

The

random

variables

X

and

Y

are

distributed

as

in

Scenario

and

Z

-LSB-

ZX

ZY

-RSB-

where

ZX

and

ZY

are

generated

by

sending

X

and

Y

respectively

over

two

independent

erasure

channels

with

positive

erasure

probabilities

Prior

to

this

we

show

that

under

a

condition

which

appears

to

be

satisfied

normally

if

X

Y

and

Z

are

completely

general

random

variables

with

I

-LRB-

X

Y

Z

-RRB-

there

exist

random

variables

X

and

Y

which

can

be

generated

from

X

and

Y

with

positive

probability

and

side

information

U

such

that

X

Y

and

-LSB-

Z

U

-RSB-

correspond

to

one

of

the

special

scenarios

or

Corollary

then

implies

that

S

-LRB-

X

Y

jjZ

-RRB-

if

S

-LRB-

X

Y

jj

-LSB-

Z

U

-RSB-

-RRB-

Lemma

Let

I

-LRB-

X

Y

-RRB-

Then

Alice

and

Bob

can

generate

symmetric

binary

random

variables

X

and

Y

from

X

and

Y

with

positive

probability

such

that

X

and

Y

have

a

symmetric

joint

distribution

as

given

in

-LRB-

-RRB-

for

some

ff

Proof

Because

X

and

Y

are

not

statistically

independent

there

exist

x

X

and

y

Y

satisfying

PXjY

-LRB-

x

y

-RRB-

PX

-LRB-

x

-RRB-

PXjY

-LRB-

x

-RRB-

-LRB-

-RRB-

and

PY

jX

-LRB-

y

x

-RRB-

PY

-LRB-

y

-RRB-

PY

jX

-LRB-

y

-RRB-

Alice

and

Bob

can

generate

random

variables

X

and

Y

by

restricting

the

ranges

of

X

and

Y

to

fx

and

fy

respectively

Then

X

is

sent

over

the

following

channel

-LRB-

we

can

assume

without

loss

of

generality

that

P

X

-LRB-

x

-RRB-

-RRB-

PXj

X

-LRB-

x

-RRB-

P

X

-LRB-

x

-RRB-

PXj

X

-LRB-

-RRB-

PXj

X

-LRB-

x

-RRB-

PXj

X

-LRB-

-RRB-

It

is

obvious

that

PX

-LRB-

-RRB-

PX

-LRB-

-RRB-

The

symmetrically

distributed

random

variable

Y

can

be

obtained

from

Y

in

an

analogous

way

Then

X

and

Y

are

distributed

according

to

-LRB-

-RRB-

with

ff

P

X

Y

-LRB-

x

y

-RRB-

-LRB-

P

X

-LRB-

x

-RRB-

P

Y

-LRB-

y

-RRB-

-RRB-

if

P

Y

-LRB-

y

-RRB-

and

ff

P

X

Y

-LRB-

x

-RRB-

-LRB-

P

X

-LRB-

x

-RRB-

P

Y

-LRB-

-RRB-

-RRB-

if

P

Y

-LRB-

y

-RRB-

In

both

cases

we

have

ff

because

of

-LRB-

-RRB-

If

for

such

X

and

Y

there

exists

z

Z

such

that

the

conditional

probabilities

PX

Y

jZ

z

-LRB-

i

j

-RRB-

are

positive

for

all

-LRB-

i

j

-RRB-

then

there

exists

side

information

U

such

that

U

equals

-LSB-

X

Y

-RSB-

with

some

probability

-LRB-

that

depends

on

-LSB-

X

Y

-RSB-

-RRB-

but

where

U

contains

no

information

about

X

or

Y

otherwise

and

such

that

-LSB-

Z

U

-RSB-

can

be

interpreted

as

being

obtained

by

sending

-LSB-

X

Y

-RSB-

over

an

erasure

channel

with

positive

erasure

probability

In

other

words

the

probability

that

U

-LSB-

X

Y

-RSB-

must

be

such

that

the

probabilities

that

-LSB-

X

Y

Z

-RSB-

-LSB-

i

j

z

-RSB-

-LRB-

and

that

U

contains

no

information

about

-LSB-

X

Y

-RSB-

-RRB-

are

proportional

to

the

probabilities

of

the

events

-LSB-

X

Y

-RSB-

-LSB-

i

j

-RSB-

We

conclude

that

very

general

situations

can

be

reduced

to

the

special

scenario

in

which

Z

is

obtained

by

sending

-LSB-

X

Y

-RSB-

over

an

erasure

channel

and

which

is

less

difficult

to

analyze

In

an

analogous

way

general

scenarios

can

be

reduced

to

the

-LRB-

asymmetric

-RRB-

situation

where

Eve

obtains

her

information

about

X

and

Y

from

independent

erasure

channels

However

it

appears

to

be

difficult

to

decide

in

general

which

reduction

leads

to

the

strongest

results

Analysis

of

Scenario

We

consider

the

symmetric

scenario

where

X

and

Y

are

distributed

according

to

-LRB-

-RRB-

with

ff

and

Z

is

obtained

by

sending

-LSB-

X

Y

-RSB-

over

an

erasure

channel

with

erasure

probability

r

We

now

derive

a

condition

for

when

Protocol

A

allows

secret

key

agreement

Bob

's

conditional

error

probability

when

guessing

the

bit

sent

by

Alice

given

that

he

accepts

is

N

pN

ffN

ff

ff

N

where

pN

ffN

-LRB-

ff

-RRB-

N

is

the

probability

that

Bob

accepts

the

received

block

Given

that

Bob

accepts

Eve

-LRB-

using

the

optimal

strategy

-RRB-

guesses

the

bit

sent

by

Alice

correctly

unless

she

receives

N

times

the

erasure

symbol

In

the

latter

case

her

error

probability

is

and

is

independent

of

her

strategy

Hence

Eve

's

error

probability

given

that

Bob

accepts

is

N

-LRB-

r

-RRB-

N

Using

Lemma

we

conclude

that

Protocol

A

works

and

allows

the

generation

of

a

secret

key

if

r

ff

ff

The

next

theorem

shows

that

no

other

protocol

can

improve

this

bound

i.e.

that

Protocol

A

is

optimal

here

and

that

we

have

found

another

situation

for

which

the

conditions

I

-LRB-

X

Y

Z

-RRB-

and

S

-LRB-

X

Y

jjZ

-RRB-

are

equivalent

Theorem

In

the

described

scenario

the

following

three

conditions

are

equivalent

I

-LRB-

X

Y

Z

-RRB-

r

ff

-LRB-

ff

-RRB-

S

-LRB-

X

Y

jjZ

-RRB-

Proof

It

remains

to

show

that

I

-LRB-

X

Y

Z

-RRB-

if

r

ff

-LRB-

ff

-RRB-

The

random

variable

Z

can

be

generated

from

Z

by

the

following

channel

if

Z

Z

-LSB-

-RSB-

or

Z

-LSB-

-RSB-

then

Z

When

Z

-LSB-

-RSB-

or

Z

-LSB-

-RSB-

then

Z

is

defined

to

be

equal

to

Z

with

probability

r

-LRB-

ff

-RRB-

-LRB-

-RRB-

and

equal

to

otherwise

We

show

that

I

-LRB-

X

Y

jZ

-RRB-

It

is

obvious

that

I

-LRB-

X

Y

jZ

-LSB-

-RSB-

-RRB-

I

-LRB-

X

Y

jZ

-LSB-

-RSB-

-RRB-

Because

of

PXY

Z

-LRB-

-RRB-

PXY

Z

-LRB-

-RRB-

ff

and

PXY

Z

-LRB-

-RRB-

PXY

Z

-LRB-

-RRB-

ff

-LRB-

r

-RRB-

ff

r

r

-LRB-

ff

-RRB-

ff

X

and

Y

also

are

independent

when

given

Z

i.e.

I

-LRB-

X

Y

jZ

-RRB-

A

similar

pessimistic

result

can

even

be

shown

in

the

general

scenario

of

arbitrary

random

variables

X

Y

and

Z

We

show

that

I

-LRB-

X

Y

Z

-RRB-

if

Eve

knows

X

and

Y

precisely

with

some

positive

probability

and

if

the

common

distribution

of

X

and

Y

is

too

close

to

an

independent

distribution

We

have

to

define

an

appropriate

measure

for

the

deviation

from

independence

of

the

common

distribution

PXY

of

the

two

random

variables

X

and

Y

Definition

Let

X

and

Y

be

random

variables

with

ranges

X

and

Y

respectively

and

common

distribution

PXY

Let

F

-LRB-

PXY

-RRB-

min

QXY

max

-LRB-

x

y

-RRB-

Y

PXY

-LRB-

x

y

-RRB-

QXY

-LRB-

x

y

-RRB-

max

-LRB-

x

y

-RRB-

Y

QXY

-LRB-

x

y

-RRB-

PXY

-LRB-

x

y

-RRB-

where

the

minimum

is

taken

over

all

probability

distributions

QXY

for

which

X

and

Y

are

statistically

independent

and

where

we

set

and

c

for

c

The

deviation

dind

-LRB-

PXY

-RRB-

of

PXY

from

independence

is

defined

as

dind

-LRB-

PXY

-RRB-

F

-LRB-

PXY

-RRB-

where

we

set

For

every

PXY

dind

-LRB-

PXY

-RRB-

-LRB-

-RRB-

where

equality

on

the

left

side

of

-LRB-

-RRB-

holds

if

and

only

if

the

random

variables

X

and

Y

are

independent

and

equality

on

the

right

side

of

-LRB-

-RRB-

holds

if

and

only

if

there

exist

x

y

and

such

that

PXY

-LRB-

x

y

-RRB-

but

PXY

-LRB-

x

-RRB-

and

PXY

-LRB-

y

-RRB-

Furthermore

dind

-LRB-

PXY

-RRB-

minPXY

maxPXY

This

can

be

seen

by

taking

the

uniform

distribution

for

QXY

When

X

and

Y

are

distributed

according

to

-LRB-

-RRB-

then

dind

-LRB-

PXY

-RRB-

ff

ff

ff

The

next

theorem

implies

that

secret

key

agreement

is

impossible

if

the

probability

that

Eve

reliably

knows

X

and

Y

equals

or

exceeds

dind

-LRB-

PXY

-RRB-

Theorem

Let

X

and

Y

be

arbitrary

random

variables

with

common

distribution

PXY

and

let

Z

be

generated

by

sending

-LSB-

X

Y

-RSB-

over

an

erasure

channel

with

erasure

probability

r

Then

r

dind

-LRB-

PXY

-RRB-

implies

I

-LRB-

X

Y

Z

-RRB-

Proof

Let

r

dind

-LRB-

PXY

-RRB-

F

-LRB-

PXY

-RRB-

i.e.

F

-LRB-

PXY

-RRB-

-LRB-

r

-RRB-

Then

from

the

definition

of

F

-LRB-

PXY

-RRB-

we

conclude

that

there

exists

a

distribution

QXY

corresponding

to

an

independent

distribution

of

X

and

Y

such

that

-LRB-

r

-RRB-

PXY

-LRB-

x

y

-RRB-

QXY

-LRB-

x

y

-RRB-

PXY

-LRB-

x

y

-RRB-

-LRB-

-RRB-

for

all

x

X

y

Y

and

for

some

We

define

the

random

variable

Z

which

can

be

obtained

from

Z

as

follows

If

Z

then

Z

Because

PXY

Z

-LRB-

x

y

-RRB-

-LRB-

r

-RRB-

PXY

-LRB-

x

y

-RRB-

and

because

of

-LRB-

-RRB-

Z

can

be

defined

to

be

equal

to

with

some

conditional

probability

when

given

Z

-LSB-

x

y

-RSB-

and

Z

Z

otherwise

such

that

PXY

Z

-LRB-

x

y

-RRB-

QXY

-LRB-

x

y

-RRB-

-LRB-

-RRB-

This

can

be

done

for

all

pairs

-LRB-

x

y

-RRB-

and

-LRB-

-RRB-

implies

PXY

jZ

QXY

i.e.

that

X

and

Y

are

independent

when

given

Z

Hence

I

-LRB-

X

Y

Z

-RRB-

I

-LRB-

X

Y

jZ

-RRB-

PZ

-LRB-

-RRB-

I

-LRB-

X

Y

jZ

-RRB-

Analysis

of

Scenario

We

show

that

Protocol

A

-LRB-

using

a

repeat

code

-RRB-

is

not

optimal

in

Scenario

by

presenting

a

different

protocol

that

allows

secret

key

agreement

in

many

situations

for

which

Protocol

A

fails

Let

rX

and

rY

be

the

erasure

probabilities

of

the

-LRB-

independent

-RRB-

erasure

channels

generating

ZX

and

ZY

from

X

and

Y

respectively

We

assume

that

rY

rX

For

fixed

ff

and

rY

we

prove

three

different

upper

bounds

on

rX

such

that

secret

key

agreement

is

possible

if

rX

is

smaller

than

at

least

one

of

these

bounds

According

to

the

lower

bound

-LRB-

-RRB-

the

secret

key

rate

is

positive

if

I

-LRB-

X

Y

-RRB-

I

-LRB-

X

Z

-RRB-

This

condition

is

equivalent

to

H

-LRB-

XjY

-RRB-

H

-LRB-

XjZ

-RRB-

and

to

h

-LRB-

ff

-RRB-

-LRB-

rX

-RRB-

-LRB-

rY

-RRB-

-LRB-

rX

-RRB-

rY

h

-LRB-

ff

-RRB-

-LRB-

-RRB-

The

following

lemma

gives

a

first

upper

bound

for

rX

which

depends

on

rY

and

ff

and

such

that

if

rX

is

smaller

than

this

bound

then

S

-LRB-

X

Y

jjZ

-RRB-

Lemma

In

Scenario

S

-LRB-

X

Y

jjZ

-RRB-

is

strictly

positive

if

rX

h

-LRB-

ff

-RRB-

rY

rY

h

-LRB-

ff

-RRB-

-LRB-

-RRB-

Proof

It

is

easy

to

see

that

-LRB-

-RRB-

is

equivalent

to

-LRB-

-RRB-

If

Lemma

does

not

apply

in

some

cases

one

can

prove

that

secret

key

agreement

is

nevertheless

possible

by

using

Protocol

A

When

the

block

length

is

N

the

probability

that

Bob

accepts

and

receives

the

bit

sent

by

Alice

incorrectly

and

that

Eve

receives

this

bit

correctly

is

upper

bounded

by

ffN

On

the

other

hand

the

probability

that

Bob

accepts

and

receives

the

correct

bit

and

that

Eve

receives

the

bit

incorrectly

satisfies

-LRB-

ff

-RRB-

N

-LRB-

rX

-RRB-

N

-LRB-

rY

-RRB-

N

The

reason

for

this

is

that

if

Eve

receives

only

erasure

symbols

her

error

probability

about

the

bit

sent

by

Alice

is

independent

of

her

strategy

equal

to

Finally

the

probability

that

Bob

accepts

and

that

both

Bob

and

Eve

receive

the

bit

incorrectly

satisfies

ffN

-LRB-

rX

-RRB-

N

Hence

Bob

's

error

probability

is

of

order

O

-LRB-

ffN

-RRB-

whereas

Eve

's

error

probability

is

of

order

-LRB-

-LRB-

-LRB-

ff

-RRB-

-LRB-

rX

-RRB-

-LRB-

rY

-RRB-

-RRB-

N

-LRB-

ff

-LRB-

rX

-RRB-

-RRB-

N

-RRB-

From

this

and

from

Lemma

we

can

conclude

that

Protocol

A

works

if

and

only

if

ff

-LRB-

ff

-RRB-

-LRB-

rX

-RRB-

-LRB-

rY

-RRB-

-LRB-

-RRB-

and

the

following

lemma

is

proved

Lemma

In

Scenario

the

secret

key

rate

is

strictly

positive

if

rX

ff

-LRB-

ff

-RRB-

-LRB-

rY

-RRB-

-LRB-

-RRB-

Note

that

this

bound

can

be

fulfilled

only

if

rY

ff

-LRB-

ff

-RRB-

This

is

the

same

condition

as

in

Theorem

of

the

previous

section

Corollary

In

Scenario

the

secret

key

rate

is

strictly

positive

if

rX

min

ae

h

-LRB-

ff

-RRB-

rY

rY

h

-LRB-

ff

-RRB-

ff

-LRB-

ff

-RRB-

-LRB-

rY

-RRB-

oe

-LRB-

-RRB-

We

remark

that

each

of

the

expressions

in

-LRB-

-RRB-

can

dominate

the

other

If

rY

is

constant

and

ff

the

second

expression

is

smaller

whereas

if

rY

ff

-LRB-

ff

-RRB-

the

second

expression

equals

and

the

first

is

smaller

than

for

all

ff

Intuitively

the

repeat-code

protocol

-LRB-

Protocol

A

-RRB-

does

not

appear

to

be

very

appropriate

in

a

situation

where

Eve

has

perfect

access

to

X

or

Y

with

some

positive

probability

because

revealing

one

bit

of

a

repeat

code

block

means

revealing

the

entire

block

It

is

therefore

conceivable

that

a

protocol

using

blocks

which

contain

a

certain

fraction

-LRB-

less

than

half

-RRB-

of

incorrect

bits

is

better

here

although

the

bit

reconciliation

effect

between

Alice

and

Bob

is

weaker

in

such

a

protocol

The

advantage

is

that

if

Eve

reliably

knows

one

bit

-LRB-

or

a

small

number

of

bits

-RRB-

of

a

block

she

does

not

automatically

know

the

whole

block

We

will

show

that

the

following

protocol

is

in

fact

better

here

Protocol

B.

Bob

randomly

chooses

a

bit

C

and

computes

a

random

N-bit

block

-LSB-

CN

-RSB-

such

that

tN

of

the

bits

are

equal

to

C

and

-LRB-

t

-RRB-

N

of

the

bits

are

equal

to

C

C

-LRB-

where

t

is

a

parameter

and

tN

is

an

integer

-RRB-

As

in

Protocol

A

Bob

computes

-LSB-

CN?YN

-RSB-

and

sends

this

block

over

the

public

channel

Alice

computes

-LSB-

-LRB-

-RRB-

-LRB-

CN?YN

-RRB-

XN

-RSB-

and

accepts

only

if

this

equals

-LSB-

-RSB-

or

-LSB-

-RSB-

It

is

advantageous

for

Alice

and

Bob

when

Bob

and

not

Alice

is

the

sender

of

the

bit

in

Protocol

B

The

analysis

of

this

protocol

in

Scenario

is

quite

technical

and

is

given

in

Appendix

C

There

we

prove

the

following

theorem

which

also

gives

an

upper

bound

for

rX

when

given

ff

and

rY

We

only

mention

here

the

surprising

fact

that

typically

t

has

to

be

chosen

only

slightly

larger

than

-LRB-

whereas

it

is

obvious

that

the

choice

t

is

completely

useless

-RRB-

Theorem

Protocol

B

works

in

Scenario

and

thus

S

-LRB-

X

Y

jjZ

-RRB-

if

rX

ff

-LRB-

rY

-RRB-

-LRB-

-RRB-

-LRB-

when

ff

-LRB-

ff

-RRB-

rY

-RRB-

or

if

rX

-LRB-

rY

-RRB-

ff

ff

rY

-LRB-

-RRB-

-LRB-

when

ff

-LRB-

ff

-RRB-

rY

-RRB-

respectively

Theorem

shows

that

in

Scenario

Protocol

B

is

normally

better

than

Protocol

A

which

is

therefore

not

optimal

It

is

easy

to

see

that

the

upper

bounds

of

-LRB-

-RRB-

and

-LRB-

-RRB-

are

generally

greater

than

the

bound

given

by

-LRB-

-RRB-

We

consider

two

examples

If

rY

is

constant

and

ff

then

the

bound

given

in

-LRB-

-RRB-

tends

to

much

faster

than

-LRB-

-RRB-

-LRB-

which

applies

in

this

situation

-RRB-

The

bound

of

-LRB-

-RRB-

is

even

negative

On

the

other

hand

if

ff

and

rY

then

-LRB-

-RRB-

is

smaller

than

-LRB-

-RRB-

-LRB-

which

applies

here

-RRB-

The

bound

-LRB-

-RRB-

is

negative

again

Finally

we

give

a

pessimistic

bound

on

rX

for

Scenario

As

in

the

previous

section

we

derive

a

condition

here

for

the

fact

that

I

-LRB-

X

Y

Z

-RRB-

Lemma

In

Scenario

I

-LRB-

X

Y

Z

-RRB-

if

rX

-LRB-

rY

-RRB-

-LRB-

-RRB-

rY

ff

-LRB-

rY

-RRB-

-LRB-

-RRB-

-LRB-

rY

-RRB-

-LRB-

ff

-RRB-

-LRB-

-RRB-

The

proof

of

Lemma

is

given

in

Appendix

D.

Of

course

the

bound

on

rX

given

in

-LRB-

-RRB-

is

greater

than

the

bounds

-LRB-

-RRB-

and

-LRB-

-RRB-

-LRB-

or

-LRB-

-RRB-

respectively

-RRB-

for

all

possible

choices

of

ff

and

rY

Unfortunately

the

conditions

for

I

-LRB-

X

Y

Z

-RRB-

and

for

the

presented

protocols

for

secret

key

agreement

to

be

successful

are

not

completely

complementary

Hence

it

is

still

unknown

whether

I

-LRB-

X

Y

Z

-RRB-

implies

S

-LRB-

X

Y

jjZ

-RRB-

in

Scenario

References

-LSB-

-RSB-

C.

H.

Bennett

F.

Bessette

G.

Brassard

L.

Salvail

and

J.

Smolin

Experimental

quantum

cryptography

Journal

of

Cryptology

Springer

Verlag

Vol

No.

pp.

-LSB-

-RSB-

T.

M.

Cover

and

J.

A.

Thomas

Elements

of

information

theory

Wiley

Series

in

Telecommunications

-LSB-

-RSB-

I.

Csisz?ar

and

J.

K?orner

Broadcast

channels

with

confidential

messages

IEEE

Transactions

on

Information

Theory

vol

pp

-LSB-

-RSB-

W.

Feller

An

introduction

to

probability

theory

and

its

applications

edition

Vol

Wiley

International

-LSB-

-RSB-

M.

J.

Fischer

and

R.

N.

Wright

Bounds

on

secret

key

exchange

using

a

random

deal

of

cards

Journal

of

Cryptology

Springer

Verlag

Vol

No.

pp.

-LSB-

-RSB-

U.

M.

Maurer

Protocols

for

secret

key

agreement

based

on

common

information

Advances

in

Cryptology

CRYPTO

Lecture

Notes

in

Computer

Science

Springer-Verlag

Vol

pp.

-LSB-

-RSB-

U.

M.

Maurer

Secret

key

agreement

by

public

discussion

from

common

information

IEEE

Transactions

on

Information

Theory

Vol

No.

pp.

-LSB-

-RSB-

U.

M.

Maurer

and

S.

Wolf

Towards

characterizing

when

information-theoretic

secret

key

agreement

is

possible

to

appear

in

Advances

in

Cryptology

ASIACRYPT

Lecture

Notes

in

Computer

Science

Springer-Verlag

-LSB-

-RSB-

C.

E.

Shannon

Communication

theory

of

secrecy

systems

Bell

System

Technical

Journal

Vol

pp.

Oct.

-LSB-

-RSB-

A.

D.

Wyner

The

wire-tap

channel

Bell

System

Technical

Journal

Vol

No.

pp.

Appendix

A

A

graphical

representation

of

information-theoretic

quantities

involving

three

random

variables

Let

X

and

Y

be

random

variables

Then

the

quantities

H

-LRB-

XY

-RRB-

H

-LRB-

X

-RRB-

H

-LRB-

Y

-RRB-

H

-LRB-

XjY

-RRB-

H

-LRB-

Y

jX

-RRB-

and

I

-LRB-

X

Y

-RRB-

can

be

graphically

represented

-LRB-

see

Fig.

-RRB-

Note

that

the

union

of

all

inner

regions

corresponds

to

H

-LRB-

XY

-RRB-

H

-LRB-

X

-RRB-

H

-LRB-

Y

-RRB-

H

-LRB-

X

Y

-RRB-

I

-LRB-

X

Y

-RRB-

H

-LRB-

Y

X

-RRB-

Figure

Two

random

variables

The

case

of

three

random

variables

X

Y

and

Z

is

more

complicated

Assume

first

that

I

-LRB-

X

Y

-RRB-

I

-LRB-

X

Y

jZ

-RRB-

Let

R

-LRB-

X

Y

Z

-RRB-

I

-LRB-

X

Y

-RRB-

I

-LRB-

X

Y

jZ

-RRB-

-LRB-

one

can

easily

verify

that

R

-LRB-

X

Y

Z

-RRB-

is

symmetric

in

its

three

arguments

-RRB-

It

is

obvious

that

a

simple

graphical

representation

is

possible

-LRB-

see

Fig.

-RRB-

H

-LRB-

X

-RRB-

H

-LRB-

Y

-RRB-

H

-LRB-

Z

-RRB-

H

-LRB-

X

YZ

-RRB-

H

-LRB-

Y

XZ

-RRB-

H

-LRB-

Z

XY

-RRB-

I

-LRB-

X

Y

Z

-RRB-

I

-LRB-

X

Z

Y

-RRB-

I

-LRB-

Y

Z

X

-RRB-

R

-LRB-

X

Y

Z

-RRB-

Figure

Three

random

variables

If

I

-LRB-

X

Y

-RRB-

I

-LRB-

X

Y

jZ

-RRB-

such

a

simple

representation

does

not

exist

because

R

-LRB-

X

Y

Z

-RRB-

and

the

overlapping

region

would

be

negative

For

example

when

X

and

Y

are

independent

bits

and

Z

X

Y

then

I

-LRB-

X

Y

-RRB-

I

-LRB-

X

Z

-RRB-

I

-LRB-

Y

Z

-RRB-

but

I

-LRB-

XY

Z

-RRB-

We

are

now

interested

in

a

representation

of

I

-LRB-

X

Y

Z

-RRB-

When

given

arbitrary

X

Y

and

Z

-LRB-

i.e.

even

when

R

-LRB-

X

Y

Z

-RRB-

-RRB-

we

consider

all

the

random

variables

Z

that

can

be

generated

by

sending

Z

over

a

channel

PZjZ

Then

I

-LRB-

X

Z

-RRB-

I

-LRB-

X

Z

-RRB-

and

I

-LRB-

Y

Z

-RRB-

I

-LRB-

Y

Z

-RRB-

The

particular

Z

which

minimizes

I

-LRB-

X

Y

jZ

-RRB-

fulfills

also

R

-LRB-

X

Y

Z

-RRB-

This

means

that

the

above

representation

is

always

possible

with

this

Z

-LRB-

even

when

this

is

not

the

case

for

Z

-RRB-

In

this

representation

I

-LRB-

X

Y

Z

-RRB-

can

be

directly

associated

with

one

of

the

regions

-LRB-

see

Fig.

-RRB-

The

random

variable

Z

is

the

one

that

maximally

reduces

the

size

of

this

region

H

-LRB-

X

-RRB-

H

-LRB-

Y

-RRB-

H

-LRB-

Z

-RRB-

H

-LRB-

Z

-RRB-

I

-LRB-

X

Y

Z

-RRB-

Figure

Visualization

of

I

-LRB-

X

Y

Z

-RRB-

Appendix

B

Continuous

random

variables

from

independent

channels

Here

we

show

that

the

result

of

Theorem

also

holds

when

the

random

variables

that

are

generated

from

R

are

not

discrete

For

example

this

is

the

case

in

the

realistic

scenario

where

Eve

receives

her

information

about

R

from

a

Gaussian

channel

Let

X

Y

and

Z

be

continuous

random

variables

and

let

fXY

Z

fXjY

be

the

probability

density

functions

-LRB-

we

assume

that

such

functions

exist

-RRB-

The

differential

entropy

of

X

the

conditional

differential

entropy

of

X

when

given

Y

and

the

mutual

information

between

X

and

Y

are

defined

as

follows

-LRB-

see

for

example

-LSB-

-RSB-

-RRB-

h

-LRB-

X

-RRB-

Z

fX

log

fX

dx

h

-LRB-

XjY

-RRB-

Z

fXY

log

fXjY

dx

dy

I

-LRB-

X

Y

-RRB-

h

-LRB-

X

-RRB-

h

-LRB-

XjY

-RRB-

Z

fXY

log

fXY

fX

fY

dx

dy

The

conditional

information

between

X

and

Y

when

given

Z

can

be

defined

in

analogy

to

the

case

of

discrete

random

variables

as

follows

I

-LRB-

X

Y

jZ

-RRB-

h

-LRB-

XjZ

-RRB-

h

-LRB-

XjY

Z

-RRB-

Z

fXY

Z

log

fXY

jZ

fXjZ

fY

jZ

dx

dy

dz

Z

I

-LRB-

X

Y

jZ

z

-RRB-

fZ

-LRB-

z

-RRB-

dz

As

in

Section

we

assume

that

X

Y

and

Z

are

generated

by

sending

a

binary

random

variable

R

over

independent

channels

i.e.

fXY

ZjR

fXjR

fY

jR

fZjR

-LRB-

-RRB-

or

equivalently

fXjRY

Z

fXjR

fY

jRXZ

fY

jR

and

fZjRXY

fZjR

Theorem

Let

R

be

a

binary

random

variable

and

let

X

Y

and

Z

be

-LRB-

real-valued

-RRB-

random

variables

with

probability

density

function

fXY

Z

and

conditional

density

fXY

jZ

If

-LRB-

-RRB-

holds

then

secret

key

agreement

is

possible

i.e.

S

-LRB-

X

Y

jjZ

-RRB-

if

I

-LRB-

X

Y

jZ

-RRB-

Proof

We

assume

I

-LRB-

X

Y

jZ

-RRB-

and

conclude

the

following

two

statements

We

have

PR

-LRB-

-RRB-

and

Alice

and

Bob

can

generate

binary

random

variables

X

and

Y

from

X

and

Y

with

positive

probability

such

that

PXjR

-LRB-

-RRB-

PXjR

-LRB-

-RRB-

-LRB-

-RRB-

and

PXjR

-LRB-

-RRB-

PXjR

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

as

well

as

the

corresponding

inequalities

when

replacing

X

by

Y

-RRB-

hold

The

random

variable

Z

together

with

some

specific

additional

information

U

corresponds

to

a

random

variable

Z

obtained

by

sending

R

through

a

symmetric

binary

erasure

channel

with

positive

erasure

probability

Theorem

and

Corollary

show

that

the

statements

and

together

imply

S

-LRB-

X

Y

jjZ

-RRB-

Proof

of

Obviously

PR

-LRB-

-RRB-

holds

We

show

that

Prob

-LSB-

fXjR

-LRB-

x

-RRB-

fXjR

-LRB-

x

-RRB-

-RSB-

-LRB-

-RRB-

Otherwise

if

fXjR

-LRB-

x

-RRB-

fXjR

-LRB-

x

-RRB-

with

probability

then

fXY

jZ

z

fXY

jR

PRjZ

z

-LRB-

-RRB-

fXY

jR

PRjZ

z

-LRB-

-RRB-

fXjR

fY

jR

PRjZ

z

-LRB-

-RRB-

fXjR

fY

jR

PRjZ

z

-LRB-

-RRB-

fXjR

-LRB-

fY

jR

PRjZ

z

-LRB-

-RRB-

fY

jR

PRjZ

z

-LRB-

-RRB-

-RRB-

fXjZ

z

fY

jZ

z

with

probability

Hence

I

-LRB-

X

Y

jZ

z

-RRB-

for

all

z

and

I

-LRB-

X

Y

jZ

-RRB-

which

is

a

contradiction

Therefore

-LRB-

-RRB-

holds

We

define

fx

j

fXjR

-LRB-

x

-RRB-

fXjR

-LRB-

x

-RRB-

g

and

fx

j

fXjR

-LRB-

x

-RRB-

fXjR

-LRB-

x

-RRB-

g

Then

and

are

disjoint

measurable

sets

with

PXjR

-LRB-

-RRB-

PXjR

-LRB-

-RRB-

and

PXjR

-LRB-

-RRB-

PXjR

-LRB-

-RRB-

-LRB-

where

PXjR

-LRB-

-RRB-

stands

for

R

fXjR

dx

-RRB-

If

for

example

PXjR

-LRB-

-RRB-

PXjR

-LRB-

-RRB-

then

Z

fXjR

-LRB-

x

-RRB-

fXjR

-LRB-

x

-RRB-

dx

-LRB-

and

the

same

holds

for

because

the

fXjR

i

are

densities

of

normed

probability

measures

-RRB-

It

is

a

well-known

fact

from

measure

theory

that

the

integral

of

a

strictly

positive

function

on

a

set

with

non-vanishing

measure

is

also

strictly

positive

and

hence

and

would

be

sets

which

is

a

contradiction

to

-LRB-

-RRB-

For

the

random

variable

Y

two

sets

and

can

be

defined

similarly

In

analogy

to

the

case

of

discrete

random

variables

-LRB-

see

Section

-RRB-

Alice

and

Bob

can

obtain

new

random

variables

X

and

Y

by

restriction

of

the

ranges

of

X

and

Y

to

-LSB-

and

-LSB-

respectively

and

send

these

random

variables

X

and

Y

over

two

channels

in

order

to

generate

binary

random

variables

X

and

Y

such

that

X

if

X

and

X

if

X

-LRB-

and

analogously

for

Y

-RRB-

It

is

obvious

that

-LRB-

-RRB-

and

-LRB-

-RRB-

hold

as

well

as

the

corresponding

inequalities

for

Y

Proof

of

From

I

-LRB-

X

Y

jZ

-RRB-

Z

I

-LRB-

X

Y

jZ

z

-RRB-

fZ

-LRB-

z

-RRB-

dz

we

conclude

that

there

is

a

measurable

set

A

with

-LRB-

A

-RRB-

-LRB-

-RRB-

-LRB-

where

denotes

the

Lebesgue-measure

of

R

-RRB-

and

I

-LRB-

X

Y

jZ

z

-RRB-

for

all

z

A

-LRB-

-RRB-

Because

of

-LRB-

-RRB-

we

have

both

fZjR

-LRB-

z

-RRB-

and

fZjR

-LRB-

z

-RRB-

for

all

z

A.

-LRB-

If

for

example

fZjR

-LRB-

z

-RRB-

then

fXY

jZ

z

fXY

jR

PRjZ

z

-LRB-

-RRB-

fXY

jR

PRjZ

z

-LRB-

-RRB-

fXY

jR

fXjR

fY

jR

fXjZ

z

fY

jZ

z

and

I

-LRB-

X

Y

jZ

z

-RRB-

-RRB-

For

every

n

let

An

be

the

-LRB-

measurable

-RRB-

set

of

all

z

in

A

such

that

fZjR

-LRB-

z

-RRB-

n

and

fZjR

-LRB-

z

-RRB-

n

Then

A

-LSB-

An

and

-LRB-

-RRB-

implies

-LRB-

A

-RRB-

-LRB-

-LSB-

An

-RRB-

X

n

-LRB-

An

-RRB-

We

conclude

that

there

exists

such

that

-LRB-

-RRB-

Let

U

be

a

random

variable

such

that

U

R

with

probability

if

z

and

with

probability

fZjR

i

-LRB-

z

-RRB-

fZjR

i

-LRB-

z

-RRB-

if

z

and

R

i

-LRB-

and

such

that

otherwise

U

gives

no

information

about

R

-RRB-

The

random

variable

Z

together

with

this

side

information

U

corresponds

to

a

random

variable

Z

generated

from

R

by

a

symmetric

binary

erasure

channel

with

erasure

probability

-LRB-

-RRB-

Appendix

C

Analysis

of

Protocol

B

in

Scenario

Let

the

protocol

parameter

t

be

fixed

and

let

K

K

-LRB-

t

-RRB-

We

first

compute

the

conditional

probability

N

that

Alice

receives

the

bit

sent

by

Bob

incorrectly

given

that

she

accepts

N

fftN

-LRB-

ff

-RRB-

-LRB-

t

-RRB-

N

-LRB-

ff

-RRB-

tN

ff

-LRB-

t

-RRB-

N

fftN

-LRB-

ff

-RRB-

-LRB-

t

-RRB-

N

ff

ff

N

-LRB-

-RRB-

-LRB-

-RRB-

Eve

's

conditional

error

probability

N

given

that

Alice

accepts

is

lower

bounded

by

times

the

probability

that

Eve

receives

exactly

sN

of

the

tN

correct

bits

of

Bob

's

block

-LRB-

more

precisely

that

she

receives

the

corresponding

realizations

of

Y

from

the

erasure

channel

and

erasure

symbols

for

the

other

-LRB-

t

s

-RRB-

N

realizations

of

Y

that

also

correspond

to

correct

bits

in

Bob

's

block

-RRB-

and

exactly

the

same

number

of

incorrect

bits

and

that

she

learns

nothing

about

Alice

's

block

-LRB-

i.e.

about

all

the

realizations

of

X

-RRB-

because

she

receives

only

erasure

symbols

from

that

channel

This

is

a

lower

bound

for

N

because

in

this

case

Eve

's

error

probability

for

guessing

Bob

's

bit

is

equal

to

and

is

independent

of

her

strategy

This

holds

for

all

possible

s

and

hence

the

maximum

of

this

probability

taken

over

all

s

t

gives

also

a

lower

bound

N

max

s

-LRB-

t

-RRB-

ae?tN

sN

-LRB-

rY

-RRB-

sN

-LRB-

rY

-RRB-

-LRB-

t?s

-RRB-

N

-LRB-

t

-RRB-

N

sN

-LRB-

rY

-RRB-

sN

-LRB-

rY

-RRB-

-LRB-

t?s

-RRB-

N

oe

-LRB-

rX

-RRB-

N

-LRB-

-RRB-

The

next

lemma

gives

a

simpler

lower

bound

that

can

be

derived

from

the

bound

in

-LRB-

-RRB-

by

determining

its

asymptotic

behaviour

Lemma

The

lower

bound

-LRB-

-RRB-

implies

that

N

N

-LRB-

rY

-RRB-

K

-LRB-

-RRB-

if

rY

t

holds

and

if

N

is

sufficiently

large

Proof

First

note

that

rY

t

means

that

s

rY

is

a

possible

choice

-LRB-

in

fact

this

is

the

optimal

choice

-RRB-

From

Stirling

's

formula

-LRB-

see

for

example

-LSB-

-RSB-

-RRB-

we

can

conclude

that

aN

bN

C

pN

aa

bb

-LRB-

a

b

-RRB-

a?b

N

for

some

constant

C

The

binomial

coefficients

in

-LRB-

-RRB-

can

be

replaced

by

this

expression

and

a

straightforward

computation

leads

to

the

following

asymptotic

behaviour

of

the

lower

bound

on

N

N

N

K

K

-LRB-

rY

-RRB-

K

-LRB-

rY

-RRB-

K

-LRB-

rY

-RRB-

K

-LRB-

rY

-RRB-

K

-LRB-

rX

-RRB-

-LRB-

rY

-RRB-

K

-LRB-

-RRB-

-LRB-

rY

-RRB-

K

for

sufficiently

large

N

The

bound

-LRB-

-RRB-

in

the

above

lemma

holds

for

all

K

that

correspond

to

a

protocol

parameter

t

which

satisfies

rY

t

This

is

equivalent

to

rY

-LRB-

-RRB-

The

idea

of

the

proof

of

Theorem

is

to

find

the

best

choice

for

K

-LRB-

i.e.

the

best

choice

of

t

in

Protocol

B

-RRB-

with

respect

to

the

fixed

parameters

ff

and

rY

and

such

that

-LRB-

-RRB-

holds

This

optimal

choice

of

K

leads

to

an

upper

bound

on

rX

such

that

if

rX

is

smaller

than

this

bound

then

Protocol

B

works

for

secret

key

agreement

This

is

exactly

the

upper

bound

stated

in

the

theorem

Proof

of

Theorem

According

to

-LRB-

-RRB-

and

-LRB-

-RRB-

Protocol

B

-LRB-

with

parameter

t

-RRB-

works

for

secret

key

agreement

if

N

N

-LRB-

rY

-RRB-

K

ff

ff

N

N

-LRB-

-RRB-

and

if

the

condition

-LRB-

-RRB-

also

holds

The

reason

is

that

-LRB-

-RRB-

implies

that

Eve

's

error

probability

about

the

bit

sent

by

Bob

is

asymptotically

larger

than

Alice

's

error

probability

for

N

Lemma

states

that

this

is

sufficient

for

the

possibility

of

secret

key

agreement

by

public

discussion

Let

ffi

ff

-LRB-

ff

-RRB-

Then

-LRB-

-RRB-

is

satisfied

if

rX

ffi

-LRB-

rY

-RRB-

-LRB-

-RRB-

This

bound

depends

on

K

and

from

-LRB-

-RRB-

we

can

determine

the

optimal

choice

for

K

-LRB-

and

hence

the

optimal

choice

of

the

protocol

parameter

t

-RRB-

The

only

restriction

is

that

the

choice

must

be

compatible

with

-LRB-

-RRB-

It

is

easy

to

see

that

the

expression

on

the

right

of

-LRB-

-RRB-

is

maximal

for

K

ffi

-LRB-

rY

-RRB-

It

is

somewhat

surprising

that

if

ffi

is

small

and

rY

ss

-LRB-

i.e.

in

a

situation

which

is

not

advantageous

to

Alice

and

Bob

-RRB-

K

must

be

large

and

this

means

that

t

is

only

slightly

greater

than

-LRB-

whereas

the

choice

t

is

obviously

the

worst

possible

choice

-RRB-

Taking

K

is

compatible

with

-LRB-

-RRB-

if

ffi

rY

Then

the

condition

-LRB-

-RRB-

is

rX

-LRB-

rY

-RRB-

If

ffi

rY

the

condition

-LRB-

-RRB-

is

not

fulfilled

for

K

For

K

K

-LRB-

-RRB-

-LRB-

the

smallest

choice

for

K

that

satisfies

-LRB-

-RRB-

-RRB-

the

right

side

of

-LRB-

-RRB-

equals

-LRB-

rY

-RRB-

ffi

rY

The

bounds

of

Theorem

are

not

tight

The

reason

for

this

is

that

we

have

compared

Alice

's

error

probability

with

Eve

's

conditional

error

probability

given

that

Alice

's

bit

is

correct

Eve

's

error

probability

given

that

Alice

accepts

is

greater

because

given

that

Alice

does

not

receive

the

correct

bit

it

is

more

likely

that

Eve

's

bit

is

also

incorrect

However

it

is

difficult

to

compute

the

exact

error

probability

because

it

is

complicated

to

determine

Eve

's

optimal

strategy

of

guessing

the

bit

It

is

conceivable

that

the

above

results

can

be

improved

using

a

block

protocol

where

both

Alice

and

Bob

-LRB-

and

not

only

Bob

-RRB-

have

a

block

that

is

not

composed

by

N

times

the

same

bit

Such

a

protocol

appears

to

be

much

more

difficult

to

analyze

Appendix

D

Proof

of

Lemma

We

show

that

if

-LRB-

-RRB-

is

satisfied

then

a

channel

characterized

by

PZjZ

can

be

constructed

such

that

I

-LRB-

X

Y

jZ

-RRB-

The

only

z

Z

with

I

-LRB-

X

Y

jZ

z

-RRB-

is

z

-LSB-

-RSB-

and

the

event

Z

-LSB-

-RSB-

has

probability

-LRB-

rX

-RRB-

-LRB-

rY

-RRB-

The

idea

of

the

proof

is

to

split

this

into

three

events

Z

Z

and

Z

-LRB-

where

Z

i

can

also

occur

if

Z

-LSB-

-RSB-

-RRB-

such

that

I

-LRB-

X

Y

jZ

i

-RRB-

for

i

More

precisely

the

random

variable

Z

will

be

defined

such

that

Z

is

possible

not

only

if

Z

-LSB-

-RSB-

but

also

if

Z

-LSB-

-RSB-

and

Z

-LSB-

-RSB-

whereas

Z

is

also

possible

if

Z

-LSB-

-RSB-

and

Z

-LSB-

-RSB-

and

finally

Z

if

Z

-LSB-

-RSB-

and

Z

-LSB-

-RSB-

We

determine

the

maximal

possible

probability

of

Z

-LSB-

-RSB-

which

allows

that

this

event

can

completely

be

splitted

We

define

the

random

variable

Z

as

follows

by

giving

the

joint

distribution

with

Z

PZZ

-LRB-

-LSB-

-RSB-

-RRB-

rXrY

ff

PZZ

-LRB-

-LSB-

-RSB-

-RRB-

PZZ

-LRB-

-LSB-

-RSB-

-RRB-

PZ

-LRB-

-LSB-

-RSB-

-RRB-

PZ

-LRB-

-LSB-

-RSB-

-RRB-

rXrY

ff

PZZ

-LRB-

-LSB-

-RSB-

-RRB-

PZZ

-LRB-

-LSB-

-RSB-

-RRB-

rX

-LRB-

rY

-RRB-

ff

PZZ

-LRB-

-LSB-

-RSB-

-RRB-

PZZ

-LRB-

-LSB-

-RSB-

-RRB-

PZZ

-LRB-

-LSB-

-RSB-

-RRB-

PZZ

-LRB-

-LSB-

-RSB-

-RRB-

PZ

-LRB-

-LSB-

-RSB-

-RRB-

rX

-LRB-

rY

-RRB-

and

Z

Z

otherwise

The

parameter

is

such

that

i

PZZ

-LRB-

i

-LSB-

-RSB-

-RRB-

PZ

-LRB-

-LSB-

-RSB-

-RRB-

Note

that

is

not

possible

It

is

easy

to

see

that

the

random

variable

Z

can

be

obtained

by

sending

Z

over

a

channel

specified

by

some

conditional

probability

distribution

PZjZ

We

show

that

I

-LRB-

X

Y

jZ

i

-RRB-

for

i

For

i

this

follows

from

PXY

Z

-LRB-

-RRB-

PXY

Z

-LRB-

-RRB-

rXrY

ff

-LRB-

ff

-RRB-

-LRB-

-RRB-

and

PXY

Z

-LRB-

-RRB-

PXY

Z

-LRB-

-RRB-

rXrY

ff

ff

rXrY

ff

rXrY

ff

-LRB-

ff

-RRB-

-LRB-

-RRB-

For

i

and

i

one

can

easily

verify

that

PXY

Z

-LRB-

i

-RRB-

PXY

Z

-LRB-

i

-RRB-

PXY

Z

-LRB-

i

-RRB-

PXY

Z

-LRB-

i

-RRB-

holds

and

that

this

implies

that

X

and

Y

are

statistically

independent

given

that

Z

i

If

z

f

then

I

-LRB-

X

Y

jZ

z

-RRB-

obviously

holds

and

we

conclude

I

-LRB-

X

Y

jZ

-RRB-

and

I

-LRB-

X

Y

Z

-RRB-

The

maximal

probability

PZ

-LRB-

-LSB-

-RSB-

-RRB-

such

that

the

event

Z

-LSB-

-RSB-

can

be

completely

splitted

into

Z

i

as

above

is

the

sum

of

the

probabilities

PZZ

-LRB-

i

-LSB-

-RSB-

-RRB-

-LRB-

i

-RRB-

with

Thus

the

described

construction

of

Z

works

if

rXrY

ff

-LRB-

rY

-RRB-

ff

PZ

-LRB-

-LSB-

-RSB-

-RRB-

-LRB-

rX

-RRB-

-LRB-

rY

-RRB-

-LRB-

-RRB-

and

this

is

equivalent

to

-LRB-

-RRB-

Note

that

the

condition

given

in

the

lemma

is

sufficient

but

not

necessary

for

I

-LRB-

X

Y

Z

-RRB-

For

certain

rX

rY

and

ff

a

more

complicated

cascade

where

Z

-LSB-

-RSB-

and

Z

-LSB-

-RSB-

are

not

transformed

symmetrically

to

Z

leads

to

a

slightly

better

bound

cryptography
perfect secrecy
secret key agreement