[Paper Review] Success Exponent of Wiretapper: A Tradeoff between Secrecy and Reliability

Chung Chan|ArXiv.org|May 23, 2008

Wireless Communication Security Techniques10 references3 citations

TL;DR

This paper introduces the success exponent as a new measure of security in wiretap channels, quantifying the exponential decay rate of a wiretapper's success in guessing a secret through sequential yes/no queries. By extending coding and converse proofs using an overlap lemma, the authors derive a tradeoff between secrecy (measured by the wiretapper's success exponent) and reliability (authorized decoding error exponent), establishing an inner bound to the region of achievable rates for public, private, and guessing rates with strictly positive exponents.

ABSTRACT

Equivocation rate has been widely used as an information-theoretic measure of security after Shannon[10]. It simplifies problems by removing the effect of atypical behavior from the system. In [9], however, Merhav and Arikan considered the alternative of using guessing exponent to analyze the Shannon's cipher system. Because guessing exponent captures the atypical behavior, the strongest expressible notion of secrecy requires the more stringent condition that the size of the key, instead of its entropy rate, to be equal to the size of the message. The relationship between equivocation and guessing exponent are also investigated in [6][7] but it is unclear which is a better measure, and whether there is a unifying measure of security. Instead of using equivocation rate or guessing exponent, we study the wiretap channel in [2] using the success exponent, defined as the exponent of a wiretapper successfully learn the secret after making an exponential number of guesses to a sequential verifier that gives yes/no answer to each guess. By extending the coding scheme in [2][5] and the converse proof in [4] with the new Overlap Lemma 5.2, we obtain a tradeoff between secrecy and reliability expressed in terms of lower bounds on the error and success exponents of authorized and respectively unauthorized decoding of the transmitted messages. From this, we obtain an inner bound to the region of strongly achievable public, private and guessing rate triples for which the exponents are strictly positive. The closure of this region is equivalent to the closure of the region in Theorem 1 of [2] when we treat equivocation rate as the guessing rate. However, it is unclear if the inner bound is tight.

Motivation & Objective

• To address the limitations of traditional secrecy measures like equivocation rate, which ignore atypical behavior and are insufficient for capturing active cryptanalytic threats.
• To propose the success exponent as a more operationally meaningful measure of security, reflecting the wiretapper's effort in guessing secrets through sequential verification.
• To establish a tradeoff between secrecy (low success exponent for wiretapper) and reliability (low error exponent for legitimate receiver) in wiretap systems.
• To derive an inner bound to the region of strongly achievable rate triples (public, private, guessing rates) with strictly positive exponents, using a novel coding and converse framework.

Proposed method

• The success exponent is defined as the exponential decay rate of the wiretapper’s probability of correctly guessing the secret after making sequential yes/no queries.
• The authors extend the coding scheme from reference [2] and the converse proof from [4] by incorporating a new overlap lemma (Lemma V.2) to handle the joint behavior of guessing and decoding errors.
• A Markov chain structure is used: $\mathsf{U} \to \tilde{\mathsf{X}} \to \mathsf{X} \to \mathsf{Y}\mathsf{Z}$, with constraints on mutual information and entropy to preserve channel behavior.
• The construction ensures that the mutual information terms $I(\mathsf{U};\mathsf{Y})$, $I(\mathsf{U};\mathsf{Z})$, and conditional mutual informations are preserved across equivalent distributions.
• The size of the auxiliary random variable $\mathsf{U}$ is bounded by $4 + \min\{\lvert\mathcal{X}\rvert-1, \lvert\mathcal{Y}\rvert + \lvert\mathcal{Z}\rvert - 2\}$, ensuring finite complexity.
• The proof leverages the Eggleton-Carathéodory theorem to preserve marginal distributions of $\mathsf{Y}$ and $\mathsf{Z}$ while minimizing the size of auxiliary variables.

Experimental results

Research questions

• RQ1 How can the success exponent be used as a more operationally meaningful measure of secrecy than equivocation rate in wiretap channels?
• RQ2 What is the fundamental tradeoff between the wiretapper’s success exponent and the legitimate receiver’s error exponent in a wiretap system?
• RQ3 Can a new inner bound be derived for the region of achievable public, private, and guessing rate triples using the success exponent as a security metric?
• RQ4 Is the proposed inner bound tight, or does it fall short of characterizing the full achievable region?

Key findings

• The success exponent provides a stronger operational measure of security by modeling the wiretapper’s active guessing process through sequential yes/no queries.
• The paper establishes a tradeoff region between the success exponent of the wiretapper and the error exponent of the legitimate receiver, expressed through lower bounds on both exponents.
• An inner bound is derived for the set of strongly achievable rate triples (public, private, guessing rates), with all exponents strictly positive.
• The closure of this inner bound is equivalent to the closure of the region in Theorem 1 of [2] when equivocation rate is interpreted as the guessing rate.
• The inner bound is not proven to be tight, leaving open the question of whether it fully characterizes the achievable region.
• The construction ensures that $\mathsf{X} = \mathsf{X}'$ when $\lvert\mathcal{X}\rvert - 1 \leq \lvert\mathcal{Y}\rvert + \lvert\mathcal{Z}\rvert - 2$, simplifying the model under certain conditions.