HTML5 Webook

38/84

sequence without error, he can retrieve the secret message by referencing the correspondence shown in Table 1. On the other hand, all 3-bit sequences are possibly generated in the channel to Eve at uniform probability irrespective of the transmitted secret messages, given that 3-bit sequences to be transmitted to Eve are randomly selected.erefore, information-theoretical security is guaran-teed. e above discussion is the core of the wiretap chan-nel coding. In fact, as errors occur also in Bob’s channel, error correction would be needed. In the following, we discuss the performance of the error correction. Here, Alice encodes a secret message of length k to a coding word of length n. e probability of decoding error is expressed as n as in the channel coding theorem. In addition, the amount of leaked information is expressed as n . Although this quantity is dened in various ways ([29]–[31], for example), basically it is estimated by statistical distance between the probability distribution of Eve and perfectly uniform distribution. Wyner showed that when the rate of secret message RB = k/n is smaller than the hiding capac-ity,)];();([max)(ZXIYXICxPSX ,both the decoding error probability n and the amount of leaked information n can be arbitrarily reduced by ex-tending n [1]. Here, I (X;Y) is the amount of information that Alice and Bob can share by error correction applying the channel coding theorem, and I (X;Z) is the amount of information leaked against an eavesdropper. Actually, in the example shown above, the information theoretical se-curely transmissible bit is 2 bits derived by subtracting the leaked one bit of information from the 3-bit message. Although the conditions );();(ZXIYXI should be realized to apply the Wyner theorem mentioned above, Csiszár and Körner [2] generalized the theorem by remov-ing the condition, using information theoretical techniques.3Secret key agreementWiretap channel coding that realizes condential com-munication without private key sharing using noise gener-ated in communication seems to be an ideal cipher technique. However, there is a practical problem that it does not work as intended under a condition that is ad-vantageous for Eve such as where the number of errors generated in the wiretap channel are less than in the main channel. e technique of secret key agreement published in 1993 [4]–[5] enables key establishment even though Eve can wiretap under advantageous conditions for her, by admitting use of an authenticated public channel as shown in Fig. 2. By secret key agreement, Alice and Bob share a key as a result of discussion over a public channel from a correlated random number that they shared in advance. Secret key agreement can be categorized into two types of protocols by the method of sharing the random number. One of the two is a source model where Alice and Bob (and Eve) receive a random number generated from a certain common source. e secret key agreement in radio wireless communication [7]–[12] is categorized into this type. On the other hand, the method where Alice transmits a prepared random number is called the channel model. One approach to achieve high-speed secret key agreement without its rate being inuenced by modulation speed of the atmosphere is to use wide bandwidths in free space optical communication or line-of-sight communication. To this end, the latter communication model is suitable. In the following, we roughly explain secret key agreement based on the channel model assuming simple additive noise.First of all, Alice generates random number xn of length n and transmits it to Bob and Eve. Bob and Eve receive the output signals yn = xn ⊕ en and zn = xn ⊕ dn to which sta-tistically independent noises en and dn generated in the main channel and wiretap channel were added. Here, ⊕ denotes exclusive OR for each bit. Next, Alice and Bob correct the discrepancies between the sequences by infor-mation reconciliation protocol [32] over the public channel. Here, we especially focus on so-called reverse information reconciliation where Bob transmits error-correction infor-mation to Alice and Alice estimates the sequence that Bob received based on the information. Of course, Eve tries to estimate the random number sequence of Bob using error-correction information obtained through public informa-tion. However, considering the condition where Eve wiretaps the random number sequence that Alice sent, it is more dicult for Eve to estimate Bob’s received random FiF2　Schematic view of secret key agreementAlice(Sender)Main ch.Wiretapper ch.Bob(Receiver)Eve(Wiretapper)Public ch.3 Quantum Key Distribution Network34　　　Journal of the National Institute of Information and Communications Technology Vol. 64 No. 1 (2017)