Nested Tailbiting Convolutional Codes for Secrecy, Privacy, and Storage

Nested Tailbiting Convolutional Codes for Secrecy, Privacy, and Storage Thomas Jerkovits Onur Günlü Vladimir Sidorenko [email protected] [email protected] Gerhard Kramer German Aerospace Center TU Berlin [email protected] WeÃ§ling, Germany Berlin, Germany [email protected] TU Munich Munich, Germany ABSTRACT them as physical “one-way functions” that are easy to compute and A key agreement problem is considered that has a biometric or difficult to invert [33]. physical identifier, a terminal for key enrollment, and a terminal There are several security, privacy, storage, and complexity con- for reconstruction. A nested convolutional code design is proposed straints that a PUF-based key agreement method should fulfill. First, that performs vector quantization during enrollment and error the method should not leak information about the secret key (neg- control during reconstruction. Physical identifiers with small bit ligible secrecy leakage). Second, the method should leak as little error probability illustrate the gains of the design. One variant of information about the identifier (minimum privacy leakage). The the nested convolutional codes improves on the best known key privacy leakage constraint can be considered as an upper bound vs. storage rate ratio but it has high complexity. A second variant on the secrecy leakage via the public information of the first en- with lower complexity performs similar to nested polar codes. The rollment of a PUF about the secret key generated by the second results suggest that the choice of code for key agreement with enrollment of the same PUF [12]. Third, one should limit the stor- identifiers depends primarily on the complexity constraint. age rate because storage can be expensive and limited, e.g., for internet-of-things (IoT) device applications. Similarly, the hardware CCS CONCEPTS cost, e.g., hardware area, of the encoder and decoder used for key agreement with PUFs should be small for such applications. • Security and privacy → Information-theoretic techniques. There are two common models for key agreement: the generated- KEYWORDS secret (GS) and the chosen-secret (CS) models. An encoder extracts a nested codes, information privacy, tailbiting, convolutional codes, secret key from an identifier measurement for the GS model, while physical unclonable functions for the CS model a secret key that is independent of the identifier ACM Reference Format: measurements is given to the encoder by a trusted entity. In the clas- Thomas Jerkovits, Onur Günlü, Vladimir Sidorenko, and Gerhard Kramer. sic key-agreement model introduced in [1] and [31], two terminals 2020. Nested Tailbiting Convolutional Codes for Secrecy, Privacy, and Stor- observe correlated random variables and have access to a public, age. In 2020 ACM Workshop on Information Hiding and Multimedia Security authenticated, and one-way communication link; an eavesdropper (IH&MMSec’20), June 22–24, 2020, Denver, CO, USA. ACM, New York, NY, observes only the public messages called helper data. The regions USA, 11 pages. https://doi.org/10.1145/3369412.3395063 of achievable secret-key vs. privacy-leakage (key-leakage) rates for the GS and CS models are given in [19, 26]. The storage rates 1 INTRODUCTION for general (non-negligible) secrecy-leakage levels are analyzed in Irises and fingerprints are biometric identifiers used to authenticate [23], while the rate regions with multiple encoder and decoder mea- and identify individuals, and to generate secret keys [4]. In a digital surements of a hidden source are treated in [16]. There are other device, there are digital circuits that have outputs unique to the key-agreement models with an eavesdropper that has access to a device. One can generate secret keys from such physical unclonable sequence correlated with the identifier outputs, e.g., in[6, 8, 12, 22]. arXiv:2004.13095v1 [cs.IT] 27 Apr 2020 functions (PUFs) by using their outputs as a source of randomness. This model is not realistic for PUFs, unlike physical-layer security Fine variations of ring oscillator (RO) outputs, the start-up behavior primitives and some biometric identifiers that are continuously of static random access memories (SRAM), and quantum-physical available for physical attacks. PUFs are used for on-demand key readouts through coherent scattering [37] can serve as PUFs that reconstruction, i.e., the attack should be performed during execu- have reliable outputs and high entropy [11, 18]. One can consider tion, and an invasive attack applied to obtain a correlated sequence permanently changes the identifier output [11, 13]. Therefore, we Permission to make digital or hard copies of all or part of this work for personal or assume that the eavesdropper cannot obtain a sequence correlated classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation with the PUF outputs. on the first page. Copyrights for components of this work owned by others than ACM Two classic code constructions for key agreement are code-offset must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fuzzy extractors (COFE) [10] and the fuzzy commitment scheme fee. Request permissions from [email protected]. (FCS) [21], which are based on a one-time padding step in combi- IH&MMSec ’20, June 22–24, 2020, Denver, CO, USA nation with an error correcting code. Both constructions require © 2020 Association for Computing Machinery. a storage rate of 1 bit/symbol due to the one-time padding step. A ACM ISBN 978-1-4503-7050-9/20/06...$15.00 https://doi.org/10.1145/3369412.3395063 Slepian-Wolf (SW) [38] coding method, which corresponds to syn- codes. In Section 5, we propose a design procedure for the new drome coding for binary sequences, is proposed in [5] to reduce the nested TBCCs adapted to the key agreement with PUFs problem. storage rate so that it is equal to the privacy-leakage rate. It is shown Section 6 compares the estimated decoding complexity of TBCCs in [14] that these methods do not achieve the key-leakage-storage and PCs. Section 7 illustrates the significant gains from nested boundaries of the GS and CS models. convolutional codes designed for practical PUF parameters as com- Wyner-Ziv (WZ) [42] coding constructions that bin the observed pared to previously-proposed nested PCs and other channel codes sequences are shown in [14] to be optimal deterministic code con- in terms of the key vs. storage rate ratio. structions for key agreement with PUFs. Nested random linear codes are shown to asymptotically achieve boundary points of the 2 PRELIMINARIES key-leakage-storage region. A second WZ-coding construction uses 2.1 Notation a nested version of polar codes (PCs) [3], which are designed in [14] F Fa×b for practical SRAM PUF parameters to illustrate that rate tuples Let 2 denote the finite field of order 2 and let 2 denote the set that cannot be achieved by using previous code constructions can of all a × b matrices over F2. Rows and columns of a × b matrices be achieved by nested PCs. are indexed by 1;:::; a and 1;:::;b, and hi; j is the element in the Fa A closely related problem to the key agreement problem is i-th row and j-th column of a matrix H. 2 denotes the set of all Wyner’s wiretap channel (WTC) [41]. The main aim in the WTC row vectors of length a over F2. With 0a×b we denote the all-zero problem is to hide a transmitted message from the eavesdropper matrix of size a × b. A linear block code over F2 of length N and FN that observes a channel output correlated with the observation of dimension K is a K-dimensional subspace of 2 and denoted by ¹N; Kº. A variable with superscript denotes a string of variables, a legitimate receiver. There are various code constructions for the n WTC that achieve the secrecy capacity, e.g., in [2, 25, 28, 30], and e.g., X =X1 ::: Xi ::: Xn, and a subscript denotes the position of a some of these constructions use nested PCs, e.g., [2, 28]. Similarly, variable in a string. A random variable X has probability distribution nested PCs are shown in [7] to achieve the strong coordination PX . Calligraphic letters such as X denote sets, and set sizes are capacity boundaries, defined and characterized in [9]. written as jXj. Enc¹·º is an encoder mapping and Dec¹·º is a decoder We design codes for key agreement with PUFs by constructing mapping. Hb ¹xº = −x log x −¹1−xº log¹1−xº is the binary entropy nested convolutional codes. Due to the broad use of nested codes in, function, where we take logarithms to the base 2. The ∗-operator is e.g., WTC and strong coordination problems, the proposed nested defined as p∗x = p¹1−xº+¹1−pºx. A BSC with crossover probability n n convolutional code constructions can be useful also for these prob- p is denoted by BSC(p). X ∼ Bern ¹αº is an independent and lems. A summary of the main contributions is as follows. identically distributed (i.i.d.) binary sequence of random variables T with Pr»Xi = 1¼ = α for i = 1; 2;:::;n. H represents the transpose • We propose a method to obtain nested tailbiting convolu- of the matrix H. Drawing an element e from a set E uniformly at tional codes (TBCCs) that are used as a WZ-coding construc- random is denoted by tion, which is a binning method used in various achievability $ schemes and can be useful for various practical code con- e −E: (1) structions.

Load more