1

Generalizing Multiple Access Wiretap and
Wiretap II Channel Models: Achievable Rates

arXiv:1802.02131v1 [] 6 Feb 2018

and Cost of Strong Secrecy
Mohamed Nafea, Student Member, IEEE, and Aylin Yener, Fellow, IEEE
Wireless Communications and Networking Laboratory (WCAN)
Electrical Engineering Department
The Pennsylvania State University, University Park, PA 16802.

mnafea@psu.edu

yener@engr.psu.edu

Abstract
In this paper, new two-user multiple access wiretap channel models are studied. First, the multiple
access wiretap channel II with a discrete memoryless main channel, under three different wiretapping
scenarios, is introduced. The wiretapper, as in the classical wiretap channel II model, chooses a fixedlength subset of the channel uses on which she obtains noise-free observations of one of the codewords,
a superposition of the two codewords, or each of the two codewords. These thus extend the recently
examined wiretap channel II with a noisy main channel to a multiple access setting with a variety of
attack models for the wiretapper. Next, a new multiple access wiretap channel model, which further
generalizes the multiple access wiretap channel II under the third wiretapping scenario, i.e., that which
features the strongest adversarial model, is proposed. In this model, the wiretapper, besides choosing
a subset of the channel uses to noiselessly observe the transmitted codeword symbols of both users,
observes the remainder of the two codewords through a discrete memoryless multiple access channel.
Achievable strong secrecy rate regions for all the proposed models are derived. Achievability is established by solving dual multi-terminal secret key agreement problems in the source model, and converting
the solution to the original channel models using probability distribution approximation arguments.
The derived achievable rate regions quantify the secrecy cost due to the additional capabilities of the
wiretapper with respect to the previous multiple access wiretap models.
This work was supported in part by NSF Grant CNS 13-14719. This paper was presented in part at the 2016 IEEE International
Symposium on Information Theory [1] and the 2016 IEEE Information Theory Workshop [2].

2

I. I NTRODUCTION
The wiretap channel II, in which the legitimate terminals communicate over a noiseless channel
while the wiretapper has perfect access to a fixed fraction of her choosing of the transmitted bits,
was introduced in [3]. This model, while similar to a classical wiretap channel [4] with a noiseless
main channel and a binary erasure channel to the wiretapper, models a more capable wiretapper
who is able to select the positions of erasures. Using random partitioning and combinatorial
arguments, [3] has shown that the secrecy capacity of the wiretap channel II model does not
decrease if the wiretapper is a passive observer with a binary erasure channel whose erasures
are randomly chosen by nature, demonstrating the immunity of wiretap coding against a more
capable adversary who is able to choose the erasure positions.
Considerable amount of research on practical code design for secrecy has been motivated by
the coset coding scheme devised in [3], see for example [5]–[9]. However, for several decades,
there has been no effort for generalizing the wiretap II model outside the special scenario of the
noiseless main channel. Recently, [10] has introduced a discrete memoryless main channel to
the wiretap channel II model, and derived inner and outer bounds for its capacity-equivocation
region. Reference [11] has characterized the secrecy capacity of this model, showing that, once
again, the secrecy capacity of the model does not decrease when the more capable wiretapper
is replaced with an erasure channel.
More recently, [12] has introduced the generalized wiretap channel and identified its secrecy
capacity. In this model, the main channel is a discrete memoryless channel while the wiretapper,
besides noiselessly observing a subset of the transmitted codeword symbols of her choice,
observes the remainder through a discrete memoryless channel. This new model subsumes both
the classical wiretap channel [13] and the wiretap channel II with a discrete memoryless main
channel [10] as its special cases. The secrecy capacity of this generalized model quantifies the
secrecy penalty of the additional capability at the wiretapper with respect to the previous wiretap
models. Investigating the multi-terminal extensions of this new wiretap model is the natural next
step, much like what happened with Wyner’s wiretap channel, see for example [14]–[20],
In this paper, we thus extend this new wiretap channel model to the multiple access scenario
[16]. In particular, we first consider the special case of the multiple access wiretap channel II
with a discrete memoryless main channel, and propose three different attack models for the

3

wiretapper. In each of these models, the wiretapper chooses a fixed-length subset of the channel
uses and observes erasures outside this subset. In the first wiretapping model, the wiretapper, in
each position of the subset, decides to observe either the first or the second user’s symbol. In the
second model, the wiretapper observes a noiseless superposition of the two transmitted symbols
in the positions of the subset, while in the third model, the wiretapper observes the transmitted
symbols of both users.
The first attack model is a setting in which the wiretapper is able to tap one of the two
transmissions but not both. For instance, if two transmitters are distant from each other, the
wiretapper may need get close to one in order to obtain noise-free observations, and thus is
able to tap one at a time. The second attack model mimics a medium that superposes both
transmissions (e.g., wireless), where the attacker is close enough to both transmitters. In the
third attack model, the wiretapper is able to tap both codewords individually, which can be
interpreted as the wiretapper being able to obtain noiseless (partial) side information about both
transmitted codewords.
For each of these models, we derive an achievable strong secrecy rate region. Even though
the third attack model, in which the wiretapper sees the transmitted symbols of both users, is
stronger than the first, the ability of the wiretapper in the first model to choose which user’s
symbol to tap into results in identical achievable strong secrecy rate regions for the two models.
That is, each transmitter designs their encoding according to the worst case scenario in which the
wiretapper chooses to see his symbols in all positions of the subset. The achievable secrecy rate
region for the second attack model is shown to be larger than the achievable secrecy rate region
for the other two models, demonstrating the intrinsic cooperation introduced by superposition.
After obtaining these insights, we generalize these models by replacing the wiretapper’s
erasures with noisy channel outputs as was done in [12] for the single user channel. In particular,
we generalize the multiple access wiretap channel II with a discrete memoryless main channel,
under the third wiretapping scenario, i.e., the strongest attack model, to the case when the
wiretapper observes the remainder of the codewords of both users separately through a discrete
memoryless channel. This model also generalizes the multiple access wiretap channel in [15] to
the case when the wiretapper is provided with a subset of noiseless observations of her choice for
the transmitted symbols of both users. An achievable strong secrecy rate region, which quantifies

4

the secrecy cost of the additional capability of the wiretapper in this model with respect to the
multiple access wiretap channel in [15], [21], is derived.
Achievability of the strong secrecy rate regions for all the proposed models is established by
muti-terminal extensions of methods in [12], [22], [23]. In particular, for each of the proposed
models, a corresponding dual multi-terminal secret key agreement problem in the source model
is introduced. In this dual model, two independent sources wish to agree on two indepedent
keys with a common decoder in the presence of a compound wiretapping source. We solve the
problem in the dual source model, and convert the solution to the original channel model by
means of deriving the joint distributions of the two problems to become almost identical, in the
total variation distance sense. The technical challenge in the present paper lies in generalizing
the tool utilized for establishing secrecy of the key in the dual source model from the single
source case, [12, Lemma 2], to the case of two independent sources. This is done by adapting the
lemma in order to establish all the corner (extreme) points of the rate region for the two keys,
generated at the independent sources, such that the convergence rate for the probability of the two
keys being independent from the wiretapper’s observation is doubly-exponential. Time sharing
between the resulting corner points produces the desired rate region. This doubly-exponential
convergence rate is needed in order to exhaust the exponentially many possible strategies for the
wiretapper [11], [12].
The remainder of the paper is organized as follows. Section II describes the channel models
considered in this paper. Section III presents the main results. The proofs of the results are
presented in Sections IV and V. Section VI concludes the paper.
II. C HANNEL M ODELS
We first remark the notation we use throughout the paper. Vectors are denoted by bold lowercase superscripted letters while their components are denoted by lower-case subscripted letters. A
similar convention but with upper-case letters is used for random vectors and their components.
Vector superscripts are omitted when the dimensions are clear from the context. A1 ×A2 denotes
the Cartesian product of the sets A1 , A2 . For random variables (vectors) and their components,
we use A[i:j] to denote {Ai , · · · , Aj }, where i, j ∈ N, i < j. We also use AS , {Ai }i∈S for
S ⊆ N. We use 1{A} to denote the indicator function of the event A. For a, b ∈ R, [a : b]

5

Fig. 1: The two-user multiple access wiretap channel II with a noisy main channel.
denotes the set of integers {i ∈ N : a ≤ i ≤ b}. We use upper-case letters to denote random1
probability distributions, e.g., PX . We use pUX to denote a uniform distribution over the random
variable X. The argument of the probability distribution is omitted when it is clear from its
subscript. V(pX , qX ) and D(pX ||qX ) denote the total variation distance and the Kullback-Leibler
(K-L) divergence between the two probability distributions pX and qX .
Next, we describe the channel models we consider in this paper. In Section II-A, we present
the multiple access wiretap channel II with a noisy main channel under the three aforementioned
attack models for the wiretapper. Section II-B describes a new multiple access wiretap channel
model that generalizes the strongest attack model in Section II-A.

A. The Multiple Access Wiretap Channel II with a Noisy Main Channel
Consider the channel model in Fig. 1. The main channel {X1 , X2 , Y, pY |X1 X2 } is a discrete
memoryless channel consisting of two finite input alphabets X1 and X2 , a finite output alphabet Y,
and a transition probability distribution pY |X1 X2 . Each transmitter wishes to reliably communicate
an independent message to a common receiver and to keep it secret from the wiretapper. To do
so, transmitter j maps its message, Wj , uniformly distributed over [1 : 2nRj ], into the transmitted
codeword Xnj = [Xj,1, Xj,2 , · · · , Xj,n] ∈ Xnj using a stochastic encoder, j = 1, 2. The receiver
observes the sequence Y n = [Y1 , Y2 , · · · , Yn ] ∈ Yn and outputs the estimates Ŵj , j = 1, 2, of
1
Random probability distribution PX describes a mapping from the random experiment to the simplex of probability
distributions over X.

6

the transmitted messages. As shown in Fig. 1, we consider the following three models for the
wiretapper channel.
1) Model 1: This model is described in Fig. 1, when the switch is on position 1. The wiretapper
chooses the subset Sp ∈ Sp and the sequence u = [u1 , u2 , · · · , uµ ] ∈ {1, 2}µ, where Sp , {Sp ⊆
[1 : n] : |Sp | = µ ≤ n}. That is, Sp represents the set of positions noiselessly tapped by the
wiretapper and u represents her sequence of decisions to observe either the first or the second
user codeword symbols. We define the fraction of the tapped symbols by the wiretapper as
α=

µ
,
n

0 ≤ α ≤ 1.

(1)

Let Sp (k) and u(k) denote the kth elements of the subset Sp and the sequence u, where k =
1, 2, · · · , µ. Let S be the set of all possible strategies for the wiretapper, where S is defined as
S , {(Sp (k), u(k)) : Sp ∈ Sp , u ∈ {1, 2}µ , k = 1, 2, · · · , µ} .

(2)

For S ∈ S, the wiretapper observes ZnS = [ZS,1, ZS,2, · · · , ZS,n] ∈ Zn , where

ZS,i =

and the alphabet Z , {X1 ∪ X2 } ∪ {?}.



Xj,i ,

?,

(i, j) ∈ S

(3)

(i, j) ∈
/ S,

2) Model 2: The model is described in Fig. 1, when the switch is on position 2. The wiretapper
chooses the subset S ∈ S, where we redfine the set S as
S , {S ⊆ [1 : n] : |S| = µ ≤ n} .

(4)

The wiretapper then observes ZnS = [ZS,1, ZS,2, · · · , ZS,n] ∈ Zn , where

ZS,i =



X1,i + X2,i ,

?, ,

i∈S
(5)

i∈
/ S,

and Z , {X1 + X2 } ∪ {?}. That is, the wiretapper observes noiseless superposition of the two
users codeword symbols in the positions of the subset S, and erasures otherwise. The ratio α is
defined as in (1). Note that in the definition of the set Z, we consider natural addition over the

7

Fig. 2: The generalized two-user multiple access wiretap channel.
alphabets X1 and X2 , i.e., X1 + X2 , {x1 + x2 : x1 ∈ X1 , x2 ∈ X2 }.
3) Model 3: The model is described in Fig. 1, when the switch is on position 3. The wiretapper
chooses the subset S ∈ S, with S defined as in (4), and observes ZnS = [ZS,1 , ZS,2, · · · , ZS,n ] ∈
Zn , where

ZS,i =



{X1,i , X2,i },

?, ,

i∈S

(6)

i∈
/ S,

and Z , {X1 × X2 } ∪ {?}. That is, the wiretapper observes the transmitted codeword symbols
of both users in the positions of the subset S, and erasures otherwise.
Next, we present a generalized multiple access wiretap channel model which extends the
strongest attack model in Section II-A3 to the case when the wiretapper sees noisy observations,
instead of erasures, outside the subset she chooses.

B. The Generalized Multiple Access Wiretap Channel
Consider the channel model in Fig. 2. The main channel in this model is identical to the main
channel in Section II-A. The wiretapper however chooses the subset S ∈ S, with S defined as
in (4), and observes ZnS = [ZS,1, ZS,2, · · · , ZS,n ] ∈ Zn , where

ZS,i =



{X1,i , X2,i },

V ,
i

i∈S
(7)

i∈
/ S.

Vn = [V1 , V2 , · · · , Vn ] ∈ Vn is the n-letter output of the discrete memoryless multiple access
channel pV |X1 X2 , V is a finite alphabet, and Z , {X1 × X2 } ∪ V.

8

For the channel models described in Sections II-A and II-B, an (n, 2nR1 , 2nR2 ) channel code
Cn , {C1,n , C2,n } consists of two message sets W1 = [1 : 2nR1 ], W2 = [1 : 2nR2 ]; two stochastic
encoders PXn1 |W1 ,C1,n , PXn2 |W2 ,C2,n , and a decoder at the receiver. (R1 , R2 ) is an achievable strong
secrecy rate pair if there exists a sequence of (n, 2nR1 , 2nR2 ) codes, {Cn }n≥1 , such that
!
[
lim P
(Ŵj 6= Wj ) Cn = 0,
n→∞

(8)

j=1,2

and lim max I(W1 , W2 ; ZnS |Cn ) = 0.
n→∞ S∈S

(9)

Strong secrecy capacity region for the channel is the supremum of all achievable strong secrecy
rate pairs (R1 , R2 ). In the following section, we describe the main results of this paper.
III. M AIN R ESULTS
We first present achievable strong secrecy rate regions for the two-user multiple access wiretap
channel II with a discrete memoryless main channel, under the attack models for the wiretapper
described in Sections II-A1 and II-A2.
Theorem 1 For 0 ≤ α ≤ 1, an achievable strong secrecy rate region for the multiple access
wiretap channel II in Fig. 1 under the wiretapper model 1, R(1) (α), is given by the convex hull
of all rate pairs (R1 , R2 ) satisfying
R1 ≤ I(U1 ; Y |U2 ) − αI(U1 ; X1 ),

(10)

R2 ≤ I(U2 ; Y |U1 ) − αI(U2 ; X2 ),

(11)

R1 + R2 ≤ I(U1 , U2 ; Y ) − αI(U1 , U2 ; X1 , X2 ),

(12)

for some distribution pU1 X1 pU2 X2 which satisfies the Markov chains U1 −X1 −Y and U2 −X2 −Y .
Remark 1 The achievable strong secrecy rate region for the wiretapper model 1 in Theorem 1
is identical to the achievable region for the more capable wiretapper in model 3, see Corollary
1. When the wiretapper has the ability of choosing to observe either symbol in every tapped
position, each user ought to design their transmission according to the worst case scenario in
which the wiretapper decides to observe only his symbols in all the positions she taps. This
results in an achievable rate region for the wiretapper model 1 as when the wiretapper observes
both users symbols in each position she taps.

9

Theorem 2 For 0 ≤ α ≤ 1, an achievable strong secrecy rate region for the multiple access
wiretap channel II in Fig. 1 under the wiretapper model 2, R(2) (α), is given by the convex hull
of all rate pairs (R1 , R2 ) satisfying
R1 ≤ I(U1 ; Y |U2 ) − αI(U1 ; X1 + X2 ),

(13)

R2 ≤ I(U2 ; Y |U1 ) − αI(U2 ; X1 + X2 ),

(14)

R1 + R2 ≤ I(U1 , U2 ; Y ) − αI(U1 , U2 ; X1 + X2 ),

(15)

for some distribution pU1 X1 pU2 X2 which satisfies the Markov chains U1 −X1 −Y and U2 −X2 −Y .
Remark 2 The achievable strong secrecy rate region for the wiretapper models 1 and 3 is
included in the achievable region for the wiretapper model 2, i.e., R(1) (α) ⊆ R(2) (α). This
follows due to the Markov chains U1 − X1 − (X1 + X2 ); U2 − X2 − (X1 + X2 ), and (U1 , U2 ) −
(X1 , X2 ) − (X1 + X2 ). By data processing inequality, we have
I(Uj ; Xj ) ≥ I(Uj ; X1 + X2 ),

j = 1, 2,

I(U1 , U2 ; X1 , X2 ) ≥ I(U1 , U2 ; X1 + X2 ).

(16)
(17)

Next, we present achievable strong secrecy rate regions for the generalized multiple access
wiretap channel in Fig. 2.
Theorem 3 For 0 ≤ α ≤ 1, an achievable strong secrecy rate region for the generalized multiple
access wiretap channel in Fig. 2, R(α), is given by the convex hull of all rate pairs (R1 , R2 )
satisfying
R1 ≤ I(U1 ; Y |U2 ) − I(U1 ; V ) − αI(U1 ; X1 |V ),

(18)

R2 ≤ I(U2 ; Y |U1 ) − I(U2 ; V ) − αI(U2 ; X2 |V ),

(19)

R1 + R2 ≤ I(U1 , U2 ; Y ) − I(U1 , U2 ; V ) − αI(U1 , U2 ; X1 , X2 |V ),

(20)

for some distribution pU1 X1 pU2 X2 which satisfies the Markov chains U1 − X1 − (Y, V ) and
U2 − X2 − (Y, V ).

10

Corollary 1 For 0 ≤ α ≤ 1, an achievable strong secrecy rate region for the multiple access
wiretap channel II in Section II-A3, i.e., in Fig. 1 under the wiretapper model 3, R(3) (α), is
given by the convex hull of all rate pairs (R1 , R2 ) satisfying
R1 ≤ I(U1 ; Y |U2 ) − αI(U1 ; X1 ),

(21)

R2 ≤ I(U2 ; Y |U1 ) − αI(U2 ; X2 ),

(22)

R1 + R2 ≤ I(U1 , U2 ; Y ) − αI(U1 , U2 ; X1 , X2 ),

(23)

for some distribution pU1 X1 pU2 X2 which satisfies the Markov chains U1 −X1 −Y and U2 −X2 −Y .
Corollary 1 follows directly from Theorem 3 by setting V = const., i.e., the channel pV |X1 X2
is an erasure channel with erasure probability one. The proofs for Theorems 1, 2, and 3, are
provided in Sections IV and V.
Remark 3 By setting the size of the subset S to zero, i.e., α = 0, in Theorem 3, we obtain
the achievable strong secrecy rate region in [21, Theorem 1] for the two user multiple access
wiretap channel. The same region was derived under a weak secrecy criterion in [16], [24].
IV. P ROOF

FOR

T HEOREM 1

The achievability proof for Theorem 1 follows the same key steps as in [12], with the need
of extending the technique to address the multi-terminal setting as will be explained shortly.
In particular, we first assume the availability of common randomness at all terminals of the
original channel model. We then define a dual multi-terminal secret key agreement problem in
the source model, which introduces a set of random variables similar to those introduced by
the original problem with the assumed common randomness. We then solve for rate conditions
which result in the induced joint distributions from the two models to be almost identical in the
total variation distance sense. We also provide rate conditions which satisfy certain reliability
and secrecy (independence) conditions in the source model. Next, we use the closeness of the
induced joint distributions to show that, under the same rate conditions, the desired reliability and
secrecy properties in the original channel model are satisfied. Finally, we eliminate the common
randomness from the channel model by conditioning on a certain instance of that randomness.

11

The outline of achievability is hence threefold: (i) Reliability of the keys in the dual source
model, (ii) Security of the keys in the dual source model, and (iii) Closeness of the induced
joint distributions. Reliability of the keys follows from Slepian-Wolf source coding theorem
for multiple sources [25, Theorem 10.3]. Closeness of joint distributions, and converting the
reliability and security conditions from the dual model to the original problem, are ensured by
deriving an exponential convergence rate for the average total variation distance between the
two distributions. This is done using a rather straightforward generalization of [12, Lemma 1].
The main challenge in the proof lies in ensuring security for the keys in the dual source model,
which requires doubly-exponential convergence rate for the probability of the two keys being
uniform and independent from the wiretapper’s observation, in the Kullback-Leibler divergence
sense. The double-exponential convergence is needed in order to ensure security against the
exponentially many possible strategies for the wiretapper. This is established by adapting the
lemma derived for the single source case in [12] so that we derive the corner points of the
rate region, for the two keys, that satisfies the doubly-exponential convergence. Time sharing
between these corner points hence results in the desired rate region.
Let us first fix the distribution pU1 X1 pU2 X2 = pU1 pU2 pX1 |U1 pX2 |U2 . Let pY |U1 U2 be the distribution resulting from concatenating the discrete memoryless channels pY |X1 X2 and pX1 X2 |U1U2 =
pX1 |U1 pX2 |U2 , where pY |X1 X2 is the main channel transition probability distribution for the model
in Section II-A. That is,
pY |U1 U2 (y|u1, u2) =

X

pX1 |U1 (x1 |u1 ) pX2 |U2 (x2 |u2 ) pY |X1 X2 (y|x1, x2 ).

(24)

x1 ,x2 ∈X1 ×X2

We describe the following two protocols, each of which introduces a set of random variables
and induces a joint distribution over them. We precisely identify the joint distribution induced
by each protocol.
Protocol A: This protocol describes a multi-terminal secret key agreement problem in the
source model as shown in Fig. 3. Let Un1 , Un2 , Y n be independent and identically distributed
(i.i.d.) sequences according to the distribution pU1 pU2 pY |U1 U2 . Source encoder j observes the
sequence Uj , j = 1, 2. The sequence Uj is randomly and independently binned into the two
(j)

(j)

(j)

(j)

indices Wj = B1 (Xj ) and Fj = B2 (Xj ), where B1 and B2 are independent and uniformly
distributed over [1 : 2nRj ] and [1 : 2nR̃j ], respectively. The bins Fj , j = 1, 2, represent the

12

Fig. 3: Protocol A: Multi-terminal secret key agreement problem in the source model.
public messages transmitted noiselessly to the common decoder and perfectly accessed by the
wiretapper. The bins Wj , j = 1, 2, represent the independent confidential keys generated at the
two encoders. The decoder observes the i.i.d. sequence Y and the public messages F1 , F2 , and
outputs the estimates Û1 , Û2 , Ŵ1 , Ŵ2 .
Let S and ZS , for all S ∈ S, be defined as in (2) and (3). The wiretapper chooses the strategy
S ∈ S whose realization is unknown to the legitimate terminals. The wiretapper can thus be
represented by the source ZS , {Z, pZS , S ∈ S} whose distribution is only known to belong to
the finite class {pZS }S∈S ; the cardinality of the set S of all possible wiretapper’s strategies for
the attack model 1 is upper bounded as
 
 
n
n
µ
× 2αn < 2n × 2αn = 2(1+α)n .
×2 =
|S| =
αn
µ

(25)

Protocol A hence introduces the random variables W[1:2] , F[1:2] , U[1:2] , Y, ZS , Û[1:2] , Ŵ[1:2] . The
induced distribution over these variables is given by
P̃W[1:2] F[1:2] U[1:2] YZS Û[1:2] = pU[1:2] YZS P̃W[1:2] F[1:2] |U[1:2] P̃Û[1:2] |YF[1:2]
n
o
(j)
(j)
= pU[1:2] YZS P̃Û[1:2] |YF[1:2] 1 B1 (Uj ) = Wj , B2 (Uj ) = Fj , ∀j = 1, 2
= P̃W[1:2] F[1:2] P̃U[1:2] |W[1:2] F[1:2] pYZS |U[1:2] P̃Û[1:2] |YF[1:2] .

(26)
(27)
(28)

Protocol B: This protocol is described as the original channel model in Section II-A1, with
assuming the availability of common randomness F1 , F2 , at all terminals. F1 and F2 are independent, uniformly distributed over [1 : 2nR̃1 ] and [1 : 2nR̃2 ], and independent from all other
random variables. We utilize here the encoders and decoder in (28). That is,
PU[1:2] |W[1:2]F[1:2] = P̃U[1:2] |W[1:2] F[1:2] ,

and

PÛ[1:2] |YF[1:2] = P̃Û[1:2] |YF[1:2] .

(29)

13

The induced joint distribution for protocol B is thus given by
PW[1:2] F[1:2] U[1:2] YZS Û[1:2] = pUW[1:2] pUF[1:2] P̃U[1:2] |W[1:2] F[1:2] pYZS |U[1:2] P̃Û[1:2] |YF[1:2] .

(30)

Remark 4 We have ignored the Ŵ variables from the joint distributions in (28) and (30) at this
stage, as we will introduce them later as deterministic functions of the Û random vectors, after
fixing the binning functions.
Remark 5 Notice that P̃U[1:2] |W[1:2] F[1:2] factorizes as P̃U1 |W1 F1 P̃U2 |W2 F2 . That is, the common
randomness Fi available at the jth transmitter, i, j = 1, 2, i 6= j, is not utilized to generate Uj .
The common randomness Fi , i = 1, 2, represents the realization of transmitter i’s codebook,
which is known at all terminals. However, the transmitted codeword at one transmitter does not
depend on the codebook of the other transmitter.
Remark 6 The induced joint distributions from the two protocols in (28) and (30) are random
due to the random binning of Un1 and Un2 .
Before continuing with the proof, we state the following lemmas.

A. Useful Lemmas
By comparing the joint distributions for protocols A and B in (28) and (30), we find that they
only differ in the distribution for W[1:2] and F[1:2] . In particular, W[1:2] and F[1:2] are independent
and uniformly distributed in protocol B, while their distribution in protocol A is determined by
the random binning of U1 and U2 . The following lemma is a one-shot result which provides
conditions on the binning rates such that the random binning of U1 and U2 described in
protocol A results in a distribution for the bins that is close, in the total variation distance sense,
to independent uniform distributions. The convergence rate provided by the lemma, which is
exponential, is needed for converting the secrecy (independence) condition, established for the
source model in protocol A, to the original channel model in protocol B.
Lemma 1 Let X1 , {X1 , pX1 } and X2 , {X2 , pX2 } be two independent sources. The source
(j)

(j)

Xj , j = 1, 2, is randomly binned into the two indices Wj = B1 (Xj ) and Fj = B2 (Xj ),

14

(j)

(j)

where B1 and B2 are independent and uniformly distributed over [1 : W̃j ] and [1 : F̃j ]. Let
n
o
(j)
(j)
B , B1 (xj ), B2 (xj ) : xj ∈ Xj , j = 1, 2 , and for γj > 0, j = 1, 2, define
Dγj ,




1
xj ∈ Xj : log
> γj .
pXj (xj )

(31)

Then, we have

2 
 X
 
 1q
U
U
−γ
j
/ Dγj +
≤
PP X j Xj ∈
EB V PW[1:2] F[1:2] , pW[1:2] pF[1:2]
,
W̃j F̃j 2
2
j=1

(32)

where P is the induced distribution over W[1:2] and F[1:2] .
Proof: Lemma 1 is a generalization of [12, Lemma 1]. In particular, using the triangle inequality,
V





U
U
= V PW1 F1 PW2 F2 , pW[1:2] pF[1:2]



≤ V PW1 F1 PW2 F2 , pUW1 pUF1 PW2 F2 + V pUW1 pUF1 PW2 F2 , pUW[1:2] pUF[1:2]

X 
V PWj Fj , pUWj pUFj ,
=

PW[1:2] F[1:2] , pUW[1:2] pUF[1:2]



(33)
(34)
(35)

j=1,2

where (33) follows since X1 and X2 are independent, and hence {W1 , F1 } and {W2 , F2 } are
independent as well. Using [12, Lemma 1], we have, for j = 1, 2,
 

 1q
U
U
EB V PWj Fj , pWj pFj
W̃j F̃j 2−γj ,
≤ PP Xj Xj ∈
/ Dγj +
2

(36)

which completes the proof for Lemma 1. 
Lemma 2 below is again a one-shot result which provides rate conditions for a certain
secrecy (independence) condition in the source model. In particular, the lemma provides a
doubly-exponential convergence rate for the probability of the confidential keys W[1:2] and the
public messages F[1:2] being independent, uniformly distributed, and all independent from the
wiretapper’s observation ZS . This doubly-exponential convergence is utilized, along with the
union bound, to guarantee secrecy against the exponentially many choices for the wiretapper.
Lemma 2 Let X1 , {X1 , pX1 } and X2 , {X2 , pX2 } be two sources, both are correlated with
the source {ZS } , {Z, pZS } , S ∈ S. The alphabets X1 , X2 , Z, and S, are finite. For j = 1, 2,
the source Xj is randomly binned into the two indices Wj and Fj as in Lemma 1. For γj , γij >

15

0, i, j = 1, 2, i 6= j, and for any S ∈ S, define
n
o
DSj , (x[1:2] , z) ∈ X1 × X2 × Z : (xj , z) ∈ DSγj , (x[1:2] , z) ∈ DSγij ,


1
S
> γj ,
where Dγj , (xj , z) ∈ Xj × Z : log
pXj |ZS (xj |z)


1
S
and Dγij , (x[1:2] , z) ∈ X1 × X2 × Z : log
> γij .
pXi |Xj ZS (xi |xj , z)

(37)
(38)
(39)

If there exists a δ ∈ (0, 12 ) such that for j = 1, 2, and for all S ∈ S, we have

PpX[1:2] ZS (X[1:2] , ZS ) ∈ DSj ≥ 1 − δ 2 ,

(40)

then, we have, for every ǫ ∈ [0, 1], that


PB max
S∈S

D(PW[1:2] F[1:2] ZS ||pUW[1:2] pUF[1:2] pZS )
(

≤ |S||Z| min

i,j=1,2,i6=j

exp


≥ 2ǫ̃

−ǫ2 (1 − δ)2γj
3W̃j F̃j

!!

+ exp



−ǫ2 (1 − δ)2γij
3W̃i F̃i

)

, (41)

where P is the induced distribution over W[1:2] and F[1:2] ,
n
o
ǫ̃ = max ǫ + (δ + δ 2 ) log(W̃j F̃j ) + Hb (δ 2 ) ,
j=1,2

(42)

and Hb is the binary entropy function.
Proof: See the Appendix. 
Remark 7 In applying Lemmas 1 and 2 to the source model in protocol A, we utilize the
version of Hoeffding’s inequality in [26, Theorem 2], [12, Lemma 3]. In addition, after showing
that the reliability and secrecy properties established for the source model hold as well for the
channel model in protocol B, we utilize the selection lemma, [27, Lemma 2.2], in order to prove
the existence of a binning realization such that both properties are still satisfied for the channel
model. It is also utilized to eliminate the common randomness F[1:2] from the channel model.
B. Proof
We first apply Lemma 1 to the source model in protocol A to establish the closeness of the
induced joint distributions from the two protocols. In Lemma 1, set Xj = Uj , W̃j = 2nRj , and

16

F̃j = 2nR̃j , for j = 1, 2; Uj , W̃j , F̃j are defined as in protocol A. Let Dγj be defined as in (31)
with Xj = Uj for j = 1, 2. For ǫj > 0, j = 1, 2, choose γj = n(1 − ǫj )H(Uj ). Without loss of
generality, assume that for all uj , j = 1, 2, pUj (uj ) > 0. Using Hoeffding’s inequality, we have
/ Dγj
PpUj Uj ∈
=P

n
X




= P log

1
≤ γj
pUj (Uj )



1
log
≤ n(1 − ǫj )H(Uj )
p
Uj (Uj,k )
k=1

!

(43)
≤ exp(−βj n),

(44)

where βj > 0. By substituting the choices for W̃j , F̃j , γj , and (44) in (32), as long as
R1 + R̃1 < (1 − ǫ1 )H(U1 )

(45)

R2 + R̃2 < (1 − ǫ2 )H(U2 ),

(46)


 
U
U
≤ 4 exp(−βn).
EB V P̃W[1:2] F[1:2] , pW[1:2] pF[1:2]

(47)

there exists a β > 0 such that

Using (28), (30), and (47), we have

 
EB V P̃W[1:2] F[1:2] U[1:2] YZS Û[1:2] , PW[1:2] F[1:2] U[1:2] YZS Û[1:2]

 
U
U
≤ 4 exp(−βn).
= EB V P̃W[1:2] F[1:2] , pW[1:2] pF[1:2]

(48)

Next, we establish a reliability condition for the source model in protocol A. We utilize a
Slepian-Wolf decoder [28], which implies that [25, Theorem 10.3]


lim EB PP̃ (Û[1:2] 6= U[1:2] ) = 0,

n→∞

(49)

as long as
R̃1 ≥ H(U1 |U2 , Y ),

(50)

R̃2 ≥ H(U2 |U1 , Y ),

(51)

R̃1 + R̃2 ≥ H(U1 , U2 |Y ).

(52)

Using (49) and [23, Lemma 1], which is a variation on the Slepian-Wolf source coding theorem,

17

we have, for all S ∈ S,
 

lim EB V P̃W[1:2] F[1:2] U[1:2] YZS Û[1:2] , P̃W[1:2] F[1:2] U[1:2] YZS 1{Û[1:2] = U[1:2] }
n→∞


= lim EB PP̃ (Û[1:2] 6= U[1:2] ) = 0.
n→∞

(53)

Next, we use Lemma 2 to establish the secrecy condition for the source model in protocol
A. In Lemma 2, for j = 1, 2, set Xj = Uj , W̃j = 2nRj , F̃j = 2nR̃j , ZS = ZS , for all S ∈ S,
where Uj , S, ZS are defined as in protocol A. In addition, let DSj , DSγj , and DSγij be defined as
in (37)-(39), with Xj = Uj and ZS = ZS .
For S ∈ S, define S j , {k : (k, j) ∈ S}. That is, S j is the set of positions in which
the wiretapper observes the jth transmitter’s symbols. For j = 1, 2, let |S j | = µj , and hence
µ1 + µ2 = µ. Thus, we have
H(U1 |ZS ) = H(U1 |X1,S 1 , X2,S2 ) = H(U1,S 1 , U1,S c1 |X1,S 1 , X2,S 2 )

(54)

= H(U1,S 1 |X1,S 1 , X2,S 2 ) + H(U1,S c1 |X1,S 1 , X2,S2 , U1,S 1 )

(55)

= H(U1,S 1 |X1,S 1 ) + H(U1,S c1 ) = µ1 H(U1 |X1 ) + (n − µ1 )H(U1 )

(56)

H(U2 |ZS ) = µ2 H(U2 |X2 ) + (n − µ2 )H(U2 )

(57)

H(U1 |U2 ,ZS ) = H(U1 |U2 , X1,S 1 , X2,S 2 ) = H(U1,S 1 , U1,S c1 |U2 , X1,S 1 , X2,S2 )

(58)

= H(U1,S 1 |U2 , X1,S 1 , X2,S 2 ) + H(U1,S c1 |U2 , X1,S 1 , X2,S 2 , U1,S 1 )

(59)

= H(U1,S 1 |X1,S 1 ) + H(U1,S c1 ) = µ1 H(U1 |X1 ) + (n − µ1 )H(U1 )

(60)

H(U2 |U1 ,ZS ) = µ2 H(U2 |X2 ) + (n − µ2 )H(U2 ),

(61)

where (56) follows since {U1,S 1 , X1,S 1 } are independent from X2,S 2 , and U1,S c1 is independent
from {X1,S 1 , X2,S 2 , U1,S 1 }, since U1 is an i.i.d. sequence and pX1 |U1 is a discrete memoryless
channel. Similarly, (60) follows since {U1,S 1 , X1,S 1 } are independent from {U2 , X2,S 2 }, and
U1,S c1 is independent from {U2 , X1,S 1 , X2,S 2 , U1,S 1 }.
In addition, for the tuples (x[1,2] , z) with pXj |ZS (xj |z) > 0 and pXi |Xj ZS (xi |xj , z) > 0, where
i, j = 1, 2, i 6= j, we have, for all S ∈ S, that
pUj |ZS (uj |z) = p(uj,S j , uj,S cj |xj,Sj , xi,S i ) = p(uj,Sj |xj,S j , xi,S i ) p(uj,Scj |uj,S j , xj,S j , xi,S i )

18

= p(uj,S j |xj,S j ) p(uj,S cj ) =

Y

p(uj,k |xj,k )

k∈S j

pUi |Uj ZS (ui |uj , z) = p(ui,S i |xi,S i ) p(ui,S ci ) =

Y

p(ui,k |xi,k )

k∈S i

Y

p(uj,k ),

(62)

c
k∈S j

Y

p(ui,k ).

(63)

c
k∈S i

For i, j = 1, 2, i 6= j, and ǫ̃j > 0, let
γj = (1 − ǫ̃j ) min H(Uj |ZS ) = (1 − ǫ̃j )[µH(Uj |Xj ) + (n − µ)H(Uj )],

(64)

γij = (1 − ǫ̃j ) min H(Ui |Uj , ZS ) = (1 − ǫ̃j )[µH(Ui |Xi ) + (n − µ)H(Ui )],

(65)

S∈S

S∈S

where (64) and (65) follow from (56), (57), (60), (61), and the fact that µj H(Uj |Xj ) + (n −
µj )H(Uj ) is minimized by µj = µ, which occurs when S = {(k, j) : k ∈ Sp }, i.e., when the
wiretapper observes the symbols of the jth transmitter in all the positions she chooses.
Using Hoeffding inequality and the definition of DSγj in (38), we have, for all S ∈ S,


/
PpUj ZS (Uj , ZS ) ∈

X
= PpUj ZS 
log
k∈S j



≤ PpUj ZS 

X

k∈S j

log

DSγj



= PpUj ZS



1
≤ γj
log
pUj |ZS (Uj |ZS )



(66)


X
1
1
log
+
≤ (1 − ǫ̃j )[µH(Uj |Xj ) + (n − µ)H(Uj )]
p(Uj,k |Xj,k )
p(Uj,k )
c
k∈S j

(67)


X
1
1
log
+
≤ (1 − ǫ̃j )[µj H(Uj |Xj ) + (n − µj )H(Uj )]
p(Uj,k |Xj,k )
p(Uj,k )
c
k∈S j

(68)

≤ exp(−β̃j n),

(69)

where β̃j > 0 for j = 1, 2, and (68) follows because, for all S ∈ S,
µH(Uj |Xj ) + (n − µ)H(Uj ) ≤ µj H(Uj |Xj ) + (n − µj )H(Uj ).

(70)

Note that, for any finite γj , in order to compute the probability on the left hand side of (66),
we only need to consider the tuples (uj , z) with pUj |ZS (uj |z) > 0.
Similarly, for i, j = 1, 2, i 6= j and all S ∈ S, using Hoeffding’s inequality, (63), (65), and the

19

definition for DSγij in (39), we have


/
PpU[1:2] ZS (U[1:2] , ZS ) ∈

DSγij



= PpU[1:2] ZS



1
log
≤ γij
pUi |Uj ZS (Ui |Uj , ZS )



≤ exp(−β̃i n).
(71)

Taking δ 2 = 2 exp(−β̃n), where β̃ = min{β̃1 , β̃2 }, yields

PpU[1:2] ZS (U[1:2] , ZS ) 6∈ DSj ≤ δ 2 ,

(72)

for j = 1, 2 and all S ∈ S. Note that lim δ 2 = 0, and hence, for n sufficiently large, δ 2 ∈ (0, 14 ).
n→∞

Thus, the conditions for Lemma 2 are satisfied. We also have, for j = 1, 2, that
lim (δ + δ 2 ) log(W̃j F̃j ) = lim n(Rj + R̃j )(2 exp(−β̃n) + 4 exp(−2β̃n)) = 0
n→∞


lim Hb (δ 2 ) = Hb lim δ 2 = 0,

n→∞

n→∞

n→∞

(73)
(74)

where (74) follows because Hb is a continuous function. Thus, we have
lim ǫ̃ = ǫ + lim (δ + δ 2 ) log(W̃j F̃j ) + lim Hb (δ 2 ) = ǫ.

n→∞

n→∞

n→∞

(75)

By substituting the choices for W̃j , F̃j , γj , γij , where i, j = 1, 2, i 6= j, and
|S||Zn | ≤ exp(n[(1 + α) ln 2 + ln(|X1 | + |X2 | + 1)]),

(76)

in (41), and using (75), we have, for every ǫ, ǫ′ > 0, ǫ̃ = ǫ + ǫ′ , there exist n∗ ∈ N and κǫ , κ̃ > 0
such that for all n ≥ n∗ ,





U
U
PB max D P̃W[1:2] F[1:2] ZS ||pW[1:2] pF[1:2] pZS ≥ 2ǫ̃ ≤ exp −κǫ eκ̃n ,
S∈S

(77)

as long as
R1 + R̃1 ≤ (1 − ǫ̃1 ) [αH(U1 |X1 ) + (1 − α)H(U1 )],

(78)

R2 + R̃2 ≤ (1 − ǫ̃2 ) [αH(U2 |X2 ) + (1 − α)H(U2 )].

(79)

By applying the first Borel-Cantelli Lemma to (77), we get
lim PB

n→∞






U
U
max D P̃W[1:2] F[1:2] ZS ||pW[1:2] pF[1:2] pZS > 0 = 0.
S∈S

(80)

20

In addition, using Markov’s inequality and (47), we have, for any r > 0, that
∞
X

∞

 4X
 
PB V P̃W[1:2] F[1:2] , pUW[1:2] pUF[1:2] > r ≤
exp(−βn) < ∞.
r
n=1
n=1

(81)

Using the first Borel-Cantelli lemma, it follows from (81) that


 
U
U
lim PB V P̃W[1:2] F[1:2] , pW[1:2] pF[1:2] > 0 = 0.

n→∞

(82)

Remark 8 In the secrecy condition for the source model, (80), we require the independence
of the public messages F[1:2] from the confidential keys W[1:2] and the wiretapper’s observation
ZS . The reason is that, after showing that the secrecy condition in (80) holds as well for the
channel model in protocol B, we need to eliminate the common randomness F[1:2] from the
channel model by conditioning on a certain instance of it, without distributing the established
independence between the messages W[1:2] and the wiretapper’s observation ZS .
Now, we show that the reliability and secrecy conditions in (53) and (80) hold as well for the
channel model in protocol B. First, for the reliability condition, using (28), (30), and the triangle
inequality, we have


V PW[1:2] F[1:2] U[1:2] YZS Û[1:2] , PW[1:2] F[1:2] U[1:2] YZS 1{Û[1:2] = U[1:2] }


≤ V PW[1:2] F[1:2] U[1:2] YZS Û[1:2] , P̃W[1:2] F[1:2] U[1:2] YZS Û[1:2]


+ V P̃W[1:2] F[1:2] U[1:2] YZS Û[1:2] , P̃W[1:2]F[1:2] U[1:2] YZS 1{Û[1:2] = U[1:2] }


+ V P̃W[1:2] F[1:2] U[1:2] YZS 1{Û[1:2] = U[1:2] }, PW[1:2] F[1:2] U[1:2] YZS 1{Û[1:2] = U[1:2] }


= V P̃W[1:2] F[1:2] U[1:2] YZS Û[1:2] , P̃W[1:2]F[1:2] U[1:2] YZS 1{Û[1:2] = U[1:2] }


U
U
+ 2V PW[1:2] F[1:2] , pW[1:2] pF[1:2] .

(83)

(84)

Thus, using (47), (53), and (84), we have
 

lim EB V PW[1:2] F[1:2] U[1:2] YZS Û[1:2] , PW[1:2]F[1:2] U[1:2] YZS 1{Û[1:2] = U[1:2] } = 0.

n→∞

Second, for the secrecy condition, using the union bound, we have
PB






U
U
max D PW[1:2] F[1:2] ZS ||pW[1:2] pF[1:2] pZS > 0
S∈S

(85)

21







 
U
U
≤ PB max D P̃W[1:2] F[1:2] ZS ||pW[1:2] pF[1:2] pZS > 0 + PB V P̃W[1:2] F[1:2] , pUW[1:2] pUF[1:2] > 0 .
S∈S

(86)

Thus, using (80), (82), and (86), we have




U
U
lim PB max D PW[1:2] F[1:2] ZS ||pW[1:2] pF[1:2] pZS > 0 = 0.

n→∞

S∈S

(87)

By applying the selection lemma to (85) and (87), there is at least one binning realization
∗(j)

∗(j)

b∗ = {b1 , b2

: j = 1, 2}, with a corresponding joint distribution p∗ for protocol B such that


lim V p∗W


∗
,
p
1
{
Û
=
U
}
= 0,
[1:2]
[1:2]
W[1:2] F[1:2] U[1:2] YZS
[1:2] F[1:2] U[1:2] YZS Û[1:2]
n→∞




and lim 1 max D p∗W[1:2] F[1:2] ZS ||pUW[1:2] pUF[1:2] pZS > 0 = 0,
n→∞

S∈S

∗(j)

(88)
(89)

∗(j)

where Wj = b1 (Uj ) and Fj = b2 (Uj ), j = 1, 2.
Next, we introduce the Ŵ variables to the joint distributions in (88). For j = 1, 2, Ŵj is a detern
o
∗(j)
ministic function of the random sequence Ûj . In particular, p∗Ŵ |Û (ŵj |ûj ) = 1 ŵj = b1 (û) .
j

j

Using (88) and a similar analysis as in [12, (58)-(64)], we have




lim EF[1:2] Pp∗ Ŵ[1:2] 6= W[1:2] |F[1:2]
n→∞


∗
∗
= lim V pW F U YZS Û , pW[1:2] F[1:2] U[1:2] YZS 1{Û[1:2] = U[1:2] } = 0.
n→∞

[1:2] [1:2]

[1:2]

[1:2]

(90)

Using the union bound, we also have




p∗W[1:2] ZS |F[1:2] ||pUW[1:2] p∗ZS |F[1:2]





>0
PF[1:2] max D
S∈S


U
U
∗
∗
U
∗
= P max D(pW[1:2] ZS |F[1:2] ||pW[1:2] pZS |F[1:2] ) > 0, and ∀S, pW[1:2] F[1:2] ZS = pW[1:2] pF[1:2] pZS
S∈S




∗
U
U
+ 1 max D pW[1:2] F[1:2] ZS ||pW[1:2] pF[1:2] pZS > 0
(91)
S∈S




∗
U
U
(92)
= 1 max D pW[1:2] F[1:2] ZS ||pW[1:2] pF[1:2] pZS > 0 ,
S∈S

where (92) follows since the first term on the right hand side of (91) is equal to zero. Thus,
using (89) and (92), we have


lim PF[1:2] max D

n→∞

S∈S



p∗W[1:2] ZS |F[1:2] ||pUW[1:2] p∗ZS |F[1:2]



>0



=0

(93)

22

Once again, applying the selection lemma to (90) and (93), implies that there is at least one
∗
realization f[1:2]
such that



∗
lim P Ŵ[1:2] 6= W[1:2] |F[1:2] = f[1:2]
= 0,

n→∞


∗
lim max I W[1:2] ; ZS |F[1:2] = f[1:2]
= 0.

n→∞ S∈S

(94)
(95)

Let p̃∗ be the induced joint distribution for protocol A which corresponds to the binning realizan
o

∗(j)
∗
tion b∗ . We identify p̃∗ (uj |wj , fj∗ ), p(xj |uj ), j = 1, 2 and p̃∗ (û[1:2] |y, f[1:2]
), {b1 (ûj ), j = 1, 2}
as the encoders and the decoder for the original channel model.

By combining the rate conditions in (45), (46), (50)-(52), (78), and (79), and taking ǫ̃1 , ǫ̃2 → 0,
we obtain the achievable strong secrecy rate region in (10)-(12). The convex hull follows by
time sharing independent codes and the fact that maximizing the secrecy constraint over S in
the whole block-length is upper bounded by its maximization over the individual segments of
the time sharing.
V. P ROOFS

FOR

T HEOREMS 2 AND 3

The proof for Theorem 2 follows similar steps as in the proof for Theorem 1. The difference
is that S and ZS , for all S ∈ S, in protocol A are defined as in (4), (5). We thus have, for
i, j = 1, 2, i 6= j, and all S ∈ S, that
H(Uj |ZS ) = H(Uj,S , Uj,S c |X1,S + X2,S )

(96)

= H(Uj,S |X1,S + X2,S ) + H(Uj,S c |Uj,S , X1,S + X2,S )

(97)

= H(Uj,S |X1,S + X2,S ) + H(Uj,S c )

(98)

= µH(Uj |X1 + X2 ) + (n − µ)H(Uj )

(99)

H(Ui |Uj , ZS ) = H(Ui,S , Ui,S c |Uj , X1,S + X2,S )

(100)

= H(Ui,S |Uj , X1,S + X2,S ) + H(Ui,S c |Ui,S , Uj , X1,S + X2,S )

(101)

= H(Ui,S |Uj,S , X1,S + X2,S ) + H(Ui,S c )

(102)

= µH(Ui |Uj , X1 + X2 ) + (n − µ)H(Ui ).

(103)

Thus, in applying Lemma 2 to the source model in protocol A, for i, j = 1, 2, i 6= j, and

23

ǫ̃j > 0, we choose
γj = (1 − ǫ̃j ) min H(Uj |ZS ) = (1 − ǫ̃j )[µH(Uj |X1 + X2 ) + (n − µ)H(Uj )]

(104)

γij = (1 − ǫ̃j ) min H(Ui |Uj , ZS ) = (1 − ǫ̃j )[µH(Ui |Uj , X1 + X2 ) + (n − µ)H(Ui )].

(105)

S∈S

S∈S

Using Hoeffding inequality, the conditions of the lemma are satisfied, and the rate conditions
required for the secrecy property in (80) are
R1 + R̃1 ≤ αH(U1 |X1 + X2 ) + (1 − α)H(U1 )

(106)

R2 + R̃2 ≤ αH(U2 |X1 + X2 ) + (1 − α)H(U2 )

(107)

R1 + R2 + R̃1 + R̃2 ≤ αH(U[1:2] |X1 + X2 ) + (1 − α)H(U[1:2] ).

(108)

These conditions, combined with the rate conditions for the Slepian-Wolf decoder, which are
R̃1 ≥ H(U1 |U2 , Y ),
R̃1 + R̃2 ≥ H(U[1:2] |Y ),

R̃2 ≥ H(U2 |U1 , Y ),

(109)
(110)

and using time sharing, establish the achievability for the strong secrecy rate region in Theorem
2.
Remark 9 By setting j = 1, i = 2, instead of the minimum in the right hand side of (41),
Lemma 2 results in the maximum binning rate R1 + R̃1 of the source U1 , and the corresponding
maximum conditional binning rate R2 + R̃2 for the source U2 given R1 + R̃1 , such that the
probability in the left hand side of (41) is vanishing. In other words, Lemma 2 provides the
corner points of the binning rate region such that the probability, over the random binning
of the sources, that the bins are independent, uniform, and independent from the wiretapper’s
observation, is vanishing.
Similarly, the proof for Theorem 3 follows similar steps as in the proof for Theorem 1.
In protocol A, S and ZS for all S ∈ S are defined as in (7) in Section II-B. The sequences
U1 , U2 are i.i.d. and the channel pV |U[1:2] is a discrete memoryless channel, since it results from
concatenating the two discrete memoryless channels pV |X[1:2] and pX[1:2] |U[1:2] . Thus, we have, for

24

i, j = 1, 2, i 6= j, and all S ∈ S,
H(Uj |ZS ) = H(Uj,S , Uj,S c |X1,S , X2,S , VS c )

(111)

= H(Uj,S |X1,S , X2,S , VS c ) + H(Uj,S c |Uj,S , X1,S , X2,S , VS c )

(112)

= H(Uj,S |Xj,S ) + H(Uj,S c |VS c )

(113)

= µH(Uj |Xj ) + (n − µ)H(Uj |V )

(114)

H(Ui |Uj , ZS ) = H(Ui,S , Ui,S c |Uj , X1,S , X2,S , VS c )

(115)

= H(Ui,S |Uj , X1,S , X2,S , VS c ) + H(Ui,S c |Ui,S , Uj,S , Uj,S c , X1,S , X2,S , VS c )

(116)

= H(Ui,S |Xi,S ) + H(Ui,S c |Uj,S c , VS c )

(117)

= µH(Ui |Xi ) + (n − µ)H(Ui |Uj , V ),

(118)

where (113) follows due to the Markov chains Uj,S −Xj,S −(Xi,S , VS c ) and (Uj,S , X1,S , X2,S )−
VS c − Uj,S c . Equation (117) follows from the Markov chains Ui,S − Xi,S − (Uj , Xj,S , VS c ) and
(Ui,S , Uj,S , X1,S , X2,S ) − (Uj,S c , VS c ) − Ui,S c . These Markov chains follow since the sequences
U1 , U2 are i.i.d. and the channels pX1 |U1 , pX2 |U2 , pV |U[1:2] are discrete memoryless.
Thus, for i, j = 1, 2, i 6= j, and ǫ̃j > 0, by choosing
γj = (1 − ǫ̃j ) min H(Uj |ZS ) = (1 − ǫ̃j )[µH(Uj |Xj ) + (n − µ)H(Uj |V )]

(119)

γij = (1 − ǫ̃j ) min H(Ui |Uj , ZS ) = (1 − ǫ̃j )[µH(Ui |Xi ) + (n − µ)H(Ui |Uj , V )],

(120)

S∈S

S∈S

and using Hoeffding inequality, the conditions of Lemma 2 are satisfied. The rate conditions
needed for the secrecy property in (80) are
R1 + R̃1 ≤ αH(U1 |X1 ) + (1 − α)H(U1 |V )

(121)

R2 + R̃2 ≤ αH(U2 |X2 ) + (1 − α)H(U2 |V )

(122)

R1 + R2 + R̃1 + R̃2 ≤ αH(U[1:2] |X[1:2] ) + (1 − α)H(U[1:2] |V ).

(123)

Combining (121)-(123) with the rate conditions required for the Slepian-Wolf decoder in (109)
and (110), and using time sharing, establish the achievability for the strong secrecy rate region
in Theorem 3.

25

VI. C ONCLUSION
In this paper, we have studied the extension of the wiretap channel II with a noisy main channel
in [10] and the generalized wiretap channel model in [12] to the multiple access setting. For the
multiple access wiretap channel II with a noisy main channel, we have proposed three attack
models for the wiretapper and derived an achievable strong secrecy rate region for each. We have
generalized the strongest attack model, in which the wiretapper observes the transmitted symbols
of both users in the positions of the subset she chooses, to the case when the wiretapper observes
the outputs of a noisy multiple access channel instead of erasures outside this subset, proposing
a generalized multiple access wiretap model. We have derived an achievable strong secrecy rate
region for this generalized model. This model generalizes the multiple access wiretap channel
in [15], [16] as well to the case when the wiretapper is provided with noiseless observations
for a subset, of her choice, of the transmitted codeword symbols of both uses. The tools we
have utilized for achievability extend the set of tools utilized for the single-user scenario in
[12] to a multi-user setting. Future work includes other multi-terminal setups with more capable
wiretappers.
A PPENDIX
First, we rewrite the relative entropy in (41) as follows:


D PW[1:2] F[1:2] ZS ||pUW[1:2] pUF[1:2] pZS
=

X

PW[1:2] F[1:2] ZS (w[1:2] , f[1:2] , z) log

X

PW[1:2] F[1:2] ZS (w[1:2] , f[1:2] , z) log

PW[1:2] F[1:2] ZS (w[1:2] , f[1:2] , z)
pUW[1:2] pUF[1:2] pZS (z)

w[1:2] ,f[1:2] ,z

=

w[1:2] ,f[1:2] ,z



(124)

PW[1:2] F[1:2] ZS (w[1:2] , f[1:2] , z) PW1 F1 ZS (w1 , f1 , z)
.
PW1 F1 ZS (w1 , f1 , z)pUW2 pUF2
pUW1 pUF1 pZS (z)



(125)

 

+ D PW1 F1 ZS ||pUW1 pUF1 pZS .
= EpZS D PW[1:2] F[1:2] |ZS ||PW1 F1 |ZS pUW2 pUF2

(126)

Thus, the probability in (41) is upper bounded as
PB









U
U
U
U
max D PW[1:2] F[1:2] ZS ||pW[1:2] pF[1:2] pZS ≥ 2ǫ̃ ≤ PB max D PW1 F1 ZS ||pW1 pF1 pZS > ǫ̃
S∈S
S∈S




U
U
(127)
+ PB max EpZS D PW[1:2] F[1:2] |ZS ||PW1F1 |ZS pW2 pF2 > ǫ̃ .
S∈S

26

We upper bound each term on the right hand side of (127). Using [12, Lemma 2], the first
term is upper bounded as


PB max D
S∈S

PW1 F1 ZS ||pUW1 pUF1 pZS





 2
−ǫ (1 − δ)2γ1
.
> ǫ̃ ≤ |S||Z| exp
3W̃1 F̃1

(128)

Next, we upper bound the second term in (127). For all S ∈ S, let us define
n
o

AS , z ∈ Z : PpX[1:2] |ZS (X[1:2] , z) ∈ DS1 ≥ 1 − δ ,

(129)

where DS1 is defined in (37). We have



/ DS1 ≥ δ
PpZS (AcS ) = PpZS PpX[1:2] |ZS (X[1:2] , z) ∈


1
≤ EpZS PpX |ZS (X[1:2] , z) ∈
/ DS1
[1:2]
δ

1
= PpX[1:2] ZS (X[1:2] , ZS ) ∈
/ DS1
δ
δ2
= δ.
≤
δ

(130)
(131)
(132)
(133)

where (131) follows from Markov’s inequality, and the inequality in (133) follows from (40).
For all w[1:2] , f[1:2] ∈ [1 : W̃ ] × [1 : F̃ ] , z ∈ Z, and S ∈ S, define
P1S (w[1:2] , f[1:2] |z) =

X

x[1:2] ∈X1 ×X2

P2S (w[1:2] , f[1:2] |z) =

X

x[1:2] ∈X1 ×X2


pX[1:2] |ZS (x[1:2] |z)1 (x[1:2] , z) ∈ DS1

n
o
(j)
(j)
× 1 B1 (xj ) = wj , B2 (xj ) = fj , ∀j = 1, 2

pX[1:2]|ZS (x[1:2] |z)1 (x[1:2] , z) ∈
/ DS1

n
o
(j)
(j)
× 1 B1 (xj ) = wj , B2 (xj ) = fj , ∀j = 1, 2 .

(134)

(135)

Thus, we have PW[1:2] F[1:2] |ZS (w[1:2] , f[1:2] |z) = P1S (w[1:2] , f[1:2] |z) + P2S (w[1:2] , f[1:2] |z).
Now, for every x2 ∈ X2 , define
Ux2 =

X

x1 ∈X1

n
o 
(2)
(2)
pX[1:2] |ZS (x[1:2] |z)1 B1 (x2 ) = w2 , B2 (x2 ) = f2 1 (x[1:2] , z) ∈ DS1 .

(136)

The random variables {Ux2 }x2 ∈X2 are non-negative and independent since the random variables
n
o
(2)
(2)
B1 (x2 ), B2 (x2 )
are independent. From the definition of DS1 in (37), we have for
x2 ∈X2

(x[1:2] , z) ∈ DS1 that (x[1:2] , z) ∈ DSγ21 . Additionally, from the definition of Dγ21 in (39), we have

27

that p(x2 |x1 , z) ≤ 2−γ21 . From (136), we have
Ux2 ≤

X
x1


pX1 |ZS (x1 |z)pX2 |X1 ,ZS (x2 |x1 , z)1 (x[1:2] , z) ∈ DS1

≤ 2−γ21

X
x1

≤ 2−γ21 .


pX1 |ZS (x1 |z)1 (x[1:2] , z) ∈ DS1

(137)
(138)
(139)

Since for all x2 ∈ X2 ,
 n
o
(2)
(2)
EB 1 B1 (x2 ) = w2 , B2 (x2 ) = f2
=

1
,
W̃2 F̃2

(140)

we have,
X

EB (Ux2 ) =

x2 ∈X2

=

1
W̃2 F̃2
Pp X

X

x[1:2] ∈X1 ×X2

[1:2] |ZS


pX[1:2] |ZS (x[1:2] |z)1 (x[1:2] , z) ∈ DS1



X[1:2] , z ∈ DS1

W̃2 F̃2

.

(141)

(142)

In addition, notice that
X

P1S (w[1:2] , f[1:2] |z) =

X

pX[1:2] |ZS (x[1:2] |z)1

x[1:2]

w1 ,f1

×

X

w1 ,f1

=
=

XX
x2

x1

X

Ux2

n




x[1:2] , z ∈ DS1

(j)
1 B(j)
1 (xj ) = wj , B2 (xj ) = fj , ∀j = 1, 2

o

n
o 

(2)
(2)
pX[1:2] |ZS (x[1:2] |z)1 B1 (x2 ) = w2 , B2 (x2 ) = f2 1 x[1:2] , z ∈ DS1

(143)
(144)
(145)

x2

We now state the following lemma, which is a variation on Chernoff’s bound that we need
to utilize in the proof.
Lemma 3 (A variation on Chernoff bound [12, Lemma 6]): Let U1 , U2 , · · · , Un be a sequence
of non-negative independent random variables with respective means E(Ui ) = m̄i . If Ui ∈ [0, b],
P
for all i ∈ [1 : n], and ni=1 m̄i ≤ m̄, then, for every ǫ ∈ [0, 1], we have
!
n

X
m̄ 
.
(146)
P
Ui ≥ (1 + ǫ)m̄ ≤ exp −ǫ2
3b
i=1

28

The random variables {Ux2 }x2 ∈X2 are non-negative, independent, and Ux2 ∈ [0, 2−γ21 ] for all
x2 ∈ X2 . By applying Lemma 3 to the random variables {Ux2 }x2 ∈X2 , we have,
PB




1+ǫ
PW1 F1 |ZS (w1 , f1 |z)
≥
W̃2 F̃2
!
X
X
1
+
ǫ
P1S (w[1:2] , f[1:2] |z) ≥
PW1 F1 |ZS (w1 , f1 |z)
W̃
F̃
2
2
w1 ,f1
w1 ,f1
!
X
1+ǫ
Ux2 ≥
W̃2 F̃2
x2
!
X


1+ǫ
Ux2 ≥
PpX[1:2] |ZS X[1:2] , z ∈ DS1
W̃2 F̃2
x2
!
X
X
EB (Ux2 )
Ux2 ≥ (1 + ǫ)

P1S (w[1:2] , f[1:2] |z)

≤ PB
=P
≤P
=P
≤ exp

(148)
(149)
(150)

x2

x2



(147)

−ǫ2 2γ21
PpX[1:2] |ZS
3W̃2 F̃2



X[1:2] , z ∈

DS1




.

(151)

where (148) follows from (145), (150) follows from (142), and (151) follows from Lemma 3.


From the definition of AS in (129), we have, for all z ∈ AS , that PpX[1:2] |ZS X[1:2] , z ∈ DS1 ≥

1 − δ. Thus, for all z ∈ AS ,
PB



P1S (w[1:2] , f[1:2] |z)

1+ǫ
≥
PW1 F1 |ZS (w1 , f1 |z)
W̃2 F̃2



≤ exp




−ǫ2 (1 − δ)2γ21
.
3W̃2 F̃2

(152)


Note that, for fixed z ∈ Z and S ∈ S, the random variables P1S (w[1:2] , f[1:2] |z) are identically
(j)

(j)

distributed for all w[1:2] , f[1:2] due to the symmetry in the random binning. Let b , {b1 , b2 , j =
1, 2} be a realization of the random binning B. We define the class G of binning functions b as
G,



b:

P1S (w[1:2] , f[1:2] |z)


1+ǫ
PW1 F1 |ZS (w1 , f1 |z), for all S ∈ S and z ∈ AS . (153)
<
W̃2 F̃2

Using the union bound, we have


1+ǫ
S
PB (G ) = PB P1 (w[1:2] , f[1:2] |z) ≥
PW1 F1 |ZS (w1 , f1 |z), for some S ∈ S or z ∈ AS
W̃2 F̃2
c

(154)


X
1+ǫ
S
≤
PB P1 (w[1:2] , f[1:2] |z) ≥
PW1 F1 |ZS (w1 , f1 |z)
W̃
F̃
2
2
S∈S,z∈AS
 2

X
−ǫ (1 − δ)2γ21
≤
|AS | exp
3W̃2 F̃2
S∈S

(155)
(156)

29

≤ |S||Z| exp




−ǫ2 (1 − δ)2γ21
,
3W̃2 F̃2

(157)

where (156) follows from (152).
(j)

(j)

Take b such that b ∈ G, and set Wj = b1 (Xj ) and Fj = b2 (Xj ) for j = 1, 2. For all S ∈ S,
we have

 
U
U
EpZS D PW[1:2] F[1:2] |ZS ||PW1F1 |ZS pW2 pF2


X
PW[1:2] F[1:2] |ZS (w[1:2] , f[1:2] |ZS )

= EpZS 
PW[1:2] F[1:2] |ZS (w[1:2] , f[1:2] |ZS ) log
(158)
U
U
P
W1 F1 |ZS (w1 , f1 |ZS )pW2 pF2
w[1:2] ,f[1:2]


P2
2
 X X

S


i=1 Pi (w[1:2] , f[1:2] |ZS )
S
Pi (w[1:2] , f[1:2] |ZS ) log
= EpZS 

2
P
w ,f i=1

PW1 F1 |ZS (w1 ,f1 |ZS ) P
S
[1:2] [1:2]
Pi (w[1:2] , f[1:2] |ZS )
W̃ F̃
2 2



2
X

 X
≤ EpZS 


PiS (w[1:2] , f[1:2] |ZS ) log

w[1:2] ,f[1:2] i=1

= EpZS


2
X


+ EpZS

(159)



PiS (w[1:2] , f[1:2] |ZS )

P

PW1 F1 |ZS (w1 ,f1 |ZS )
S
P
(w
,
f
|Z
)
[1:2] [1:2] S
i
W̃ F̃
2 2

w[1:2] ,f[1:2]

(160)

X

PiS (w[1:2] , f[1:2] |ZS ) log

i=1 w[1:2] ,f[1:2]

+ EpZS

i=1 w[1:2] ,f[1:2]

1
P

w[1:2] ,f[1:2]





PiS (w[1:2] , f[1:2] |ZS )


S
W̃
F̃
P
(w
,
f
|Z
)
2 2 1
[1:2] [1:2] S


P1S (w[1:2] , f[1:2] |ZS ) log
P
(w
1 , f1 |ZS )
W
F
|Z
1
1
S
w[1:2] ,f[1:2]


S
X
W̃2 F̃2 P2 (w[1:2] , f[1:2] |ZS )
,

P2S (w[1:2] , f[1:2] |ZS ) log
P
W1 F1 |ZS (w1 , f1 |ZS )
w
,f


X

[1:2]

(161)

[1:2]

where (160) follows from the log-sum inequality.

Now, we upper bound each term in the right hand side of (161) for b ∈ G. The second term
in the right hand side of (161) is upper bounded as follows:


S
X
W̃2 F̃2 P1 (w[1:2] , f[1:2] |ZS )

P1S (w[1:2] , f[1:2] |ZS ) log
EpZS 
P
W1 F1 |ZS (w1 , f1 |ZS )
w[1:2] ,f[1:2]


S
X
W̃2 F̃2 P1 (w[1:2] , f[1:2] |ZS )
= EpZS 
1 {ZS ∈/ AS }
P1S (w[1:2] , f[1:2] |ZS ) log
PW1 F1 |ZS (w1 , f1 |ZS )
w[1:2] ,f[1:2]

30



+ EpZS 

X

P1S (w[1:2] , f[1:2] |ZS ) log

W̃2 F̃2 P1S (w[1:2] , f[1:2] |ZS )
PW1 F1 |ZS (w1 , f1 |ZS )


w[1:2] ,f[1:2]



X

≤ log(W̃2 F̃2 ) EpZS 

w[1:2] ,f[1:2]



+ EpZS 

X

X

1 {ZS ∈ AS } (162)

P1S (w[1:2] , f[1:2] |ZS )1 {ZS ∈
/ AS }

P1S (w[1:2] , f[1:2] |ZS ) log

W̃2 F̃2 P1S (w[1:2] , f[1:2] |ZS )

w[1:2] ,f[1:2]

≤ log(W̃2 F̃2 )



pZS (z)1{z ∈
/ AS }

X

PW1 F1 |ZS (w1 , f1 |ZS )
P1S (w[1:2] , f[1:2] |z)



1 {ZS ∈ AS } (163)

w[1:2] ,f[1:2]

z∈Z



+ log(1 + ǫ) EpZS 

X

w[1:2] ,f[1:2]



P1S (w[1:2] , f[1:2] |ZS )

(164)

/ AS ) log(W̃2 F̃2 ) + log(1 + ǫ)
≤ PpZS (ZS ∈

(165)

≤ δ log(W̃2 F̃2 ) + ǫ,

(166)

where (163) follows because, for i = 1, 2,
PiS (w[1:2] , f[1:2] |ZS ) ≤ PW[1:2] F[1:2] |ZS (w[1:2] , f[1:2] |ZS )

and hence

PiS (w[1:2] ,f[1:2] |ZS )
PW1 F1 |ZS (w1 ,f1 |z)

(167)

= PW1 F1 |ZS (w1 , f1 |z)PW2 F2 |W1 F1 ZS (w2 , f2 |w1 , f1 , z)

(168)

≤ PW1 F1 |ZS (w1 , f1 |z),

(169)

≤ 1 for all w[1:2] , f[1:2] and i = 1, 2. Equation (164) follows because,

from (153), we have for all b ∈ G and z ∈ AS that

W̃2 F̃2 P1S (w[1:2] ,f[1:2] |ZS )
PW1 F1 |ZS (w1 ,f1 |ZS )

< (1 + ǫ).

Next, we upper bound the third term in the right hand side of (161). We have that


X
P2S (w[1:2] , f[1:2] |ZS )
EpZS 
w[1:2] ,f[1:2]

=

X

pZS (z)

z

X

pX[1:2] |ZS (x[1:2] , z)1

x[1:2]

×

X

w[1:2] ,f[1:2]

= PpX[1:2] ,ZS
≤ δ2,

n




x[1:2] , z ∈
/ DS1

(j)
1 B(j)
1 (xj ) = wj , B2 (xj ) = fj , j = 1, 2



X[1:2] , ZS ∈
/ DS1

o

(170)
(171)
(172)

31

where (172) follows from the assumption of the lemma in (40). Using (169) and (172), we have


S
X
W̃2 F̃2 P2 (w[1:2] , f[1:2] |ZS )

P2S (w[1:2] , f[1:2] |ZS ) log
EpZS 
P
(w
1 , f1 |ZS )
W
F
|Z
1
1
S
w[1:2] ,f[1:2]


X
P2S (w[1:2] , f[1:2] |ZS )
≤ log(W̃2 F̃2 ) EpZS 
(173)
w[1:2] ,f[1:2]

≤ δ 2 log(W̃2 F̃2 ).

(174)

Since we have
2
X

X

i=1 w[1:2] ,f[1:2]

X

w[1:2] ,f[1:2]


P1S w[1:2] , f[1:2] |ZS = PpX

X

and


PiS w[1:2] , f[1:2] |ZS = 1,

w[1:2] ,f[1:2]

[1:2] |ZS

(175)


X[1:2] , ZS ∈ DS1 ,


P2S w[1:2] , f[1:2] |ZS = 1 − PpX

[1:2] |ZS



X[1:2] , ZS ∈ DS1 ,

the first term on the right hand side of (161) is upper bounded as follows:


2
1

X X
PiS (w[1:2] , f[1:2] |ZS ) log P
EpZS 

S
Pi (w[1:2] , f[1:2] |ZS )
i=1 w
,f
[1:2]

[1:2]

(176)
(177)

w[1:2] ,f[1:2]

 


= EpZS Hb PpX[1:2] |ZS X[1:2] , ZS ∈ DS1




≤ Hb EpZS PpX |ZS X[1:2] , ZS ∈ DS1
[1:2]



= Hb PpX[1:2] ,ZS X[1:2] , ZS ∈ DS1
≤ Hb (1 − δ 2 ) = Hb (δ 2 ),

(178)
(179)
(180)
(181)

where (179) follows from Jensen’s inequality and the concavity of Hb , and (181) follows from
(40) and that Hb (x) is monotonically decreasing in x ∈ ( 21 , 1).
Using (166), (174), and (181), for any b ∈ G and for all S ∈ S, the left hand side of (161) is
upper bounded as

 
≤ ǫ + (δ + δ 2 ) log(W̃2 F̃2 ) + Hb (δ 2 ) ≤ ǫ̃.
EpZS D PW[1:2] F[1:2] |ZS ||PW1 F1 |ZS pUW2 pUF2

(182)

32

Thus, the second probability on the right hand side of (127) is upper bounded as



U
U
PB max EpZS D PW[1:2] F[1:2] |ZS ||PW1F1 |ZS pW2 pF2 > ǫ̃
S∈S




U
U
= 1 − PB max EpZS D PW[1:2] F[1:2] |ZS ||PW1 F1 |ZS pW2 pF2 ≤ ǫ̃
S∈S




= 1 − PB EpZS D PW[1:2] F[1:2] |ZS ||PW1 F1 |ZS pUW2 pUF2 ≤ ǫ̃ for all S ∈ S


≤ 1 − PB (G) = PB (Gc )
 2

−ǫ (1 − δ)2γ21
≤ |S||Z| exp
,
3W̃2 F̃2

(183)
(184)
(185)
(186)

where (186) follows from (157).
Finally, by rewriting (126) with switching the roles of (W1 , F1 ) and (W2 , F2 ) and repeating
the whole proof, we obtain the second term in the minimum in (41), which completes the proof
for Lemma 2.
R EFERENCES
[1] M. Nafea and A. Yener, “The multiple access wiretap channel II with a noisy main channel,” in IEEE International
Symposium on Information Theory, July 2016, pp. 2983–2987.
[2] ——, “A new multiple access wiretap channel model,” in IEEE Information Theory Workshop, September 2016, pp.
349–353.
[3] L. Ozarow and A. D. Wyner, “Wire-tap channel II,” Bell System Technical Journal, vol. 63, no. 10, pp. 2135–2157, 1984.
[4] A. D. Wyner, “The wire-tap channel,” Bell System Technical Journal, vol. 54, no. 8, pp. 1355–1387, 1975.
[5] V. K. Wei, “Generalized Hamming weights for linear codes,” IEEE Transactions on Information Theory, vol. 37, no. 5,
pp. 1412–1418, 1991.
[6] A. Thangaraj, S. Dihidar, A. R. Calderbank, S. W. McLaughlin, and J.-M. Merolla, “Applications of LDPC codes to the
wiretap channel,” IEEE Transactions on Information Theory, vol. 53, no. 8, pp. 2933–2945, 2007.
[7] R. Liu, Y. Liang, H. V. Poor, and P. Spasojevic, “Secure nested codes for type II wiretap channels,” in IEEE Information
Theory Workshop, September 2007, pp. 337–342.
[8] V. Aggarwal, L. Lai, A. R. Calderbank, and H. V. Poor, “Wiretap channel type II with an active eavesdropper,” in IEEE
International Symposium on Information Theory, July 2009, pp. 1944–1948.
[9] M. Bloch, M. Hayashi, and A. Thangaraj, “Error-control coding for physical-layer secrecy,” Proceedings of the IEEE, vol.
103, no. 10, pp. 1725–1746, 2015.
[10] M. Nafea and A. Yener, “Wiretap channel II with a noisy main channel,” in IEEE International Symposium on Information
Theory, June 2015, pp. 1159–1163.
[11] Z. Goldfeld, P. Cuff, and H. H. Permuter, “Semantic-security capacity for wiretap channels of type II,” IEEE Transactions
on Information Theory, vol. 62, no. 7, pp. 3863–3879, 2016.

33

[12] M. Nafea and A. Yener, “A new wiretap channel model and its strong secrecy capacity,” IEEE Transaction in Information
Theory, accepted for publication, November 2017, early access IEEEXplore DOI: 10.1109/TIT.2017.2786541.
[13] I. Csiszar and J. Korner, “Broadcast channels with confidential messages,” IEEE Transactions on Information Theory,
vol. 24, no. 3, pp. 339–3487, 1978.
[14] A. Yener and S. Ulukus, “Wireless physical-layer security: Lessons learned from information theory,” Proceedings of the
IEEE, vol. 103, no. 10, pp. 1814–1825, 2015.
[15] E. Tekin and A. Yener, “The Gaussian multiple access wire-tap channel,” IEEE Transactions on Information Theory,
vol. 54, no. 12, pp. 5747–5755, 2008.
[16] ——, “The general Gaussian multiple-access and two-way wiretap channels: Achievable rates and cooperative jamming,”
IEEE Transactions on Information Theory, vol. 54, no. 6, pp. 2735–2751, 2008.
[17] Y. Liang and H. V. Poor, “Multiple-access channels with confidential messages,” IEEE Transactions on Information Theory,
vol. 54, no. 3, pp. 976–1002, 2008.
[18] R. Liu, I. Maric, P. Spasojevic, and R. D. Yates, “Discrete memoryless interference and broadcast channels with confidential
messages: Secrecy rate regions,” IEEE Transactions on Information Theory, vol. 54, no. 6, pp. 2493–2507, 2008.
[19] X. He and A. Yener, “The role of feedback in two-way secure communications,” IEEE Transactions on Information Theory,
vol. 59, no. 12, pp. 8115–8130, 2013.
[20] ——, “The Gaussian many-to-one interference channel with confidential messages,” IEEE Transactions on Information
Theory, vol. 57, no. 5, pp. 2730–2745, 2011.
[21] M. H. Yassaee and M. R. Aref, “Multiple access wiretap channels with strong secrecy,” in IEEE Information Theory
Workshop, September 2010, pp. 1–5.
[22] R. Ahlswede and I. Csiszár, “Common randomness in information theory and cryptography–Part I: Secret sharing,” IEEE
Transactions on Information Theory, vol. 39, no. 4, pp. 1121–1132, 1993.
[23] M. H. Yassaee, M. R. Aref, and A. Gohari, “Achievability proof via output statistics of random binning,” IEEE Transactions
on Information Theory, vol. 60, no. 11, pp. 6760–6786, 2014.
[24] O. Simeone and A. Yener, “The cognitive multiple access wire-tap channel,” in IEEE Conference on Information Sciences
and Systems, March 2009, pp. 158–163.
[25] A. El Gamal and Y.-H. Kim, Network information theory.

Cambridge university press, 2011.

[26] W. Hoeffding, “Probability inequalities for sums of bounded random variables,” Journal of the American Statistical
Association, vol. 58, no. 301, pp. 13–30, 1963.
[27] M. Bloch and J. Barros, Physical-layer security: From information theory to security engineering. Cambridge University
Press, 2011.
[28] D. Slepian and J. K. Wolf, “Noiseless coding of correlated information sources,” IEEE Transactions on Information Theory,
vol. 19, no. 4, pp. 471–480, 1973.

