Oblivious Transfer over Wireless Channels

Transcription

1 1 Obivious Transfer over Wireess Channes Jithin Ravi, Bikash Kumar Dey, Emanuee Viterbo arxiv:158664v1 [csit 4 Aug 15 Abstract We consider the probem of obivious transfer OT over OFDM and MIMO wireess communication systems where ony the receiver knows the channe state information The sender and receiver aso have unimited access to a noise-free rea channe Using a physica ayer approach, based on the properties of the noisy fading channe, we propose a scheme that enabes the transmitter to send obiviousy one-of-two fies, ie, without knowing which one has been actuay requested by the receiver, whie aso ensuring that the receiver does not get any information about the other fie I INTRODUCTION Consider a movie server, or a server of medica database A subscriber wants a specific item a movie, or information about a specific disease without the server being abe to know which item is desired by the subscriber The subscriber is aso not aowed to gain any significant information about any other item This is an exampe of obivious transfer In one-out-of-two string obivious transfer OT, one party, Aice, has two fies and the other party, Bob, wants one of these fies Bob needs to obtain the required fie without Aice finding out the identity of the fie chosen by him Bob shoud aso not be abe to recover any significant information about the other fie Aice and Bob are assumed to be honest but curious participants - they foow the agreed protoco but are aso curious to gain additiona knowedge of the other s data from their own observations during the protoco [1, [ OT has been studied in various forms for some time in cryptography [3, [4 It is a specia case of secure function computation probems, where mutipe parties want to compute a function without reveaing additiona information about their data to other parties It was shown by Kiian [5 that an OT protoco can be used as a subroutine to devise a protoco for two-party secure function computation for any function that is representabe by a booean circuit It is we known that OT can not be performed ony by interactive communication over a noise-free channe The OT is thus studied with a noisy channe as a critica resource in addition to unimited access to a noise-free channe The OT capacity is the argest ength of fie that can be transferred, per use of the noisy channe, between Aice and Bob In [1, [, one-out-of-two string OT has been studied when the noisy This paper was presented in part at the Information Theory Workshop, ITW 15, Jerusaem The work of Jithin R and B K Dey was supported by Department of Science and Techonogy under grant SB/S3/EECE/57/13 and by Information Technoogy Research Academy under grant ITRA/1564/Mobie/USEAADWN/1 The work of E Viterbo was supported by the Austraian Research Counci through the Discovery Project under grant DP Jithin R and B K Dey are with the Department of Eectrica Engineering at IIT Bombay, Mumbai, INDIA-476 Emai:{rjithin,bikash}@eeiitbacin E Viterbo is with the Department of Eectrica & Computer Systems Engineering at Monash University, Austraia Emai: emanueeviterbo@monashedu channe between Aice and Bob is a Discrete Memoryess Channe DMC An upper bound for the OT capacity of a DMC was given in [1 and it was shown that the given upper bound is achievabe by a simpe scheme for binary erasure channes BEC Muti-user variants of OT have been studied over broadcast erasure channes in [6, [7 One-out-of-two string OT has been considered in the context of AWGN channes in [8, where a protoco was proposed The case of fast fading wireess channes has aso been discussed in [8, where the fading state varies in each transmission and is not known to the transmitter or the receiver Under such assumption, the channe can be modeed by the conditiona probabiity distribution p Y X with the channe state marginaized The fading state does not directy provide any additiona advantage in OT here, other than through its infuence on p Y X The OT capacity is not known for many important channes incuding AWGN and binary symmetric channes In this paper, we consider OT over two casses of wireess sow-fading channes: orthogona frequency division mutipexing OFDM channe and mutipe input mutipe output MIMO channe, where the fading state information is avaiabe ony at the receiver CSIR, [9 Channes with CSIR Fig 1 have not been considered for OT before to the best of our knowedge CSIR is a common assumption in wireess communication which can be made when the coherence bock ength n is sufficienty arge We aow an interactive protoco to run over n uses of the channe during which the channe state remains fixed, and in that period the noise-free channe can be used any finite number of times In other words, we assume that one run of the OT protoco is competed in one coherence bock However, foowing common principe of rate-adaptation used in many wireess communication modes, the OT rate may vary from bock to bock depending on the channe state As we wi see in our schemes, the knowedge of the state ony at the receiver is the key to some interesting techniques for OT Our techniques have the favor of the protoco for BECs [1 Noise free channe K, K 1 A X Y Fig 1 p Y X,S S B K C Communication setup for obivious transfer over channes with state Communication under secrecy constraints has been studied by many authors see [1 In particuar, private communication over a wiretap channe in the presence of eavesdropper C

2 has been studied extensivey [11, [1, [13, [14, [15, [16 In this work, we make use of coding techniques for Gaussian wiretap channes as a buiding bock for our achievabiity schemes In both OFDM and MIMO, we rey on the modeing of the channe as parae fading channes For the MIMO setup, this is done using the SVD precoder matrix that is communicated by Bob to Aice The parae channes are grouped in pairs OT is performed independenty at different rates over different pairs We show Theorem 1 that the best pairing of the parae channes is that of the strongest channe with the weakest, and so on with the rest of the channes The idea of pairing good and bad subchannes in OFDM and SVD-precoded MIMO was aso used in [17, [18 with the aim of designing signa sets that minimize error probabiity or maximize mutua information Here, we expoit subchanne pairing to guarantee that Aice is obivious to which fie is requested and that Bob ony receives one of the two fies We aso derive the optima power aocation among the pairs of channes The paper is organized as foows Section II presents the probem definition and the system mode for both OFDM and MIMO channes In Section III, we present protocos for OT over -channes OFDM, MIMO and 1 MIMO channes We present the genera protoco for N-channes OFDM and N n B MIMO modes in Section IV, foowing a common principe Optimization of our protoco is discussed in Section V High SNR asymptotics of OT rate for our protoco is anayzed in Section VI We provide simuation resuts of our OT scheme for simpe OFDM and MIMO channes in Section VII Finay, we concude the paper in Section VIII The proof of our optima pairing Theorem 1 is presented in Appendix A II SYSTEM MODEL Aice A and Bob B are two parties in the system as shown in Fig 1 Aice has two binary strings K, K 1 of equa ength, and Bob wants one of these strings K C where C {, 1} is Bob s choice bit We assume that a the bits in K, K 1, C are iid Ber1/ Aice can communicate with Bob over a channe p Y X,S with state S, where the state remains fixed over a arge bock ength n, and varies from bock to bock in an iid manner The state is known to Bob at the beginning of a bock This modes wireess communication setups, where in a arge coherence bock of ength n, the fading state remains fixed, and the fading state is known estimated by the receiver This is commony known as the quasi-static channe mode [9,[1 In addition to this channe, there is aso a noise-free channe over which Aice and Bob can communicate rea numbers between each other without any error/distortion During each bock, the noise-free channe can be used any finite number of times The ength LS of K, K 1 depends on S Since Bob knows the state S at the beginning of a bock, he is assumed to compute and communicate LS to Aice over the noise-free channe The goa of a protoco is to transfer K C to Bob obiviousy, within the current bock, such that Bob has negigibe knowedge about K C, and Aice has no knowedge about C perfect secrecy against Aice Our setup can aso be used to transfer arge fies We then need mutipe coherence bocks to compete the OT session for one pair of fies The two fies can be broken into mutipe chunks to form one pair K i, K 1i for each bock i Then one run of the protoco is performed in each bock, where the choice bit C of Bob remains the same over the whoe session invoving many runs of the protoco An n, L OT protoco is parameterized by the number n of channe uses and by a function L of the state S There are a tota of k rounds of communication between Aice and Bob, incuding communication over both the noisy and noisefree channes These are indexed by 1,,, k, where k can be random and can be dependent on S But for every S, it is required to be finite with probabiity 1 The noisy channe is used at rounds i 1, i,, i n {1,, k} At every round before round i 1, between consecutive i j and i j1, and after round i n, Aice and Bob exchange a sequence of rea numbers over the noise-free channe In the foowing, X i and Y i denote respectivey the input and the output of the noisy channe at time index i In the foowing description of the protoco, we denote Y i := Y 1, Y,, Y i for any positive integer i E i, F i are aso simiary defined In the rest of the paper, we aso denote the transmitted ength-n vector by X The engthn vector transmitted by the -th antenna in case of MIMO or over the -th subchanne in case of OFDM wi be denoted by X = X 1, X,, X n A The structure of an n, L protoco: 1 Aice has two bit-strings K, K 1 of ength LS each, and Bob has a choice bit C K, K 1 can be substrings of two arger strings avaiabe with Aice, and their ength LS is computed by Aice based on some information about S sent by Bob during the protoco Aice and Bob generate private random variabes W A, W B, respectivey 3 For i j < i < i j1 for every j =, 1,, n assuming i = and i n1 = k 1, Aice sends E i = E i K, K 1, W A, F i 1 and Bob sends F i = F i C, S, W B, E i 1, Y j over the noise-free channe Here F = E = Y = 4 For i = i j, Aice transmits X j = X j K, K 1, W A, F ij 1 over the noisy channe and Bob receives Y j There is no communication over the noise-free channe in these rounds, and thus E i = F i = 5 At the end of the protoco, Bob computes KC = KC, S, W B, E k, Y n The rate LS/n of a protoco as described above is a function of the state S, and is denoted by RS Definition 1 A non-negative rate function RS is said to be achievabe if there is a sequence of n, L n -protocos such that for every S, RS as n, and the L n S n

3 3 protocos satisfy the conditions P K C K C IK K 1 W A F k ; C = 1 n ICSW BY n E k ; K C 1 The average rate R is the expectation of RS The OT capacity is the supremum of a achievabe average OT rates B Gaussian wiretap channe Wiretap channe has been studied as a standard mode for communication in the presence of an eavesdropper [11, [1 We mode our MIMO and OFDM channes as compex channes If Aice and Bob are respectivey the transmitter and receiver of a compex AWGN channe, and if Eve is a wiretapper, whose received symbo is more noisy than that of Bob degraded channe assumption, then the secrecy capacity of the wiretapper channe is given by P C c σb, P σe = og 1 P σ B og 1 P σ E where σb and σ E are the variance of the noise at Bob and Eve, respectivey, and P is the transmit power [1 Encoding for such channes invoves mixing the message with some random bits with rate equaing the capacity of the wiretapper before encoding for the compex AWGN channes Bob can decode both the message and the random bits as the tota rate of these is beow his capacity, whereas the random bits competey hide the message from Eve Eve gets amost no information about the message [13 We wi denote this channe with power constraint P as WT P, P, P Practica σb σe coding schemes approaching the secrecy capacity have been proposed for discrete memoryess channes using poar codes [19 and for the Gaussian channe based on attice codes [, under semantic security In this paper we consider two channes with states, OFDM and MIMO, as discussed beow The essentia technique used for OT over both these setups is the same Fig A K, K 1 Noise-free channe H H N 1 Z Z N 1 H, H 1,, H N 1 The OT setup with independent parae channes D The MIMO Setup B C K C Let us consider the MIMO system with transmitter Aice and receiver Bob, as shown in Fig 3 The transmitter has n A antennas and the receiver has n B antennas We assume that n A is even Let X = X j na 1 denote the compex matrix 1 j n transmitted by Aice over n uses of the MIMO channe The received matrix Y is given by Y = HX Z 3 where Z C nb n is the compex Gaussian noise matrix with a entries having iid rea and imaginary parts N, 1/ and H C n B n A represents the compex channe fading matrix The entries of H are assumed to be iid compex random variabes with independent rea and imaginary parts N, 1/ H remains fixed over the bock of ength n, and changes in an iid manner from bock to bock The average transmit power in any bock is constrained to be P, ie, n A 1 n = j=1 X j np We assume that H is known ony to Bob in the beginning of each bock Noise-free channe C The OFDM Setup The OFDM setup is modeed in Fig as N parae fading AWGN channes between Aice and Bob The channe states are given by independent fading coefficients H, H 1,, H N 1 If the vector X = X 1, X,, X n is transmitted in n channe uses over the -th channe for =, 1,, N 1, then the received vector over the -th channe is given by Y = H X Z, Fig 3 A X K, K 1 MIMO system for obivious transfer Y H B C K C where Z is the noise with iid rea and imaginary parts N, 1/ We assume that H are iid with Rayeigh distribution The channe gains remain fixed for a bock of ength n, and change from bock to bock in an iid manner We assume that they are known to Bob in the beginning of the bock The average transmitted power in any bock is restricted to P, ie, N 1 n = j=1 X j np III THE PROTOCOL: SOME EXAMPLES We now show our OT protocos for some simpe exampes to iustrate the basic principe In a the three exampes, Bob reveas some partia information about the channe state to Aice so that there are, in effect, two parae channes with different SNRs, and Aice does not know which of them is

4 4 the better channe Bob reveas the channe over which each fie is to be communicated the desired fie over the stronger channe, and the other fie over the weaker channe Aice uses encoding for a suitabe wiretap channe so that Bob can decode the fie transmitted over the stronger channe, but not the fie transmitted over the weaker channe A -Channes OFDM Let us consider an OFDM setup with subchannes, each of which undergo independent and identica Rayeigh fading For a bock, et us define B = arg max{ H, H 1 } W = C B R = C c P H B /, P H B / ɛ where denotes the moduo- addition, C c, is given in, and ɛ > is a pre-chosen constant The protoco: 1 Bob reveas W, H B, H B to Aice over the noise-free channe Aice takes strings K and K 1 of ength L H, H 1 := nr each She encodes K W and K W into two ength-n codewords X and X 1 respectivey, such that each has an average power P/ A code suitabe for WT P, P H B, P H B is used to encode both the strings X and X 1 are transmitted over the respective channes Note that K C has been encoded into X B, and K C has been encoded into X B 3 Bob receives Y and Y 1 with SNR P H / and P H 1 / respectivey He decodes K C from Y B using the decoder for the wiretap channe referred above Correctness of the protoco: Note that K C is transmitted over the stronger channe B, and K C is transmitted over the weaker channe B Bob s received SNR in the stronger channe is P H B /, whereas his received SNR in the weaker channe is P H B / Thus he can decode K C with vanishing probabiity of error, whereas he can get negigibe information about K C as his SNR is that of the wiretapper in this channe Since H and H 1 are independent and identicay distributed, it is easy to check that IW ; C =, thus Aice does not earn anything about Bob s choice C B MIMO Consider a fading MIMO channe between Aice and Bob Aice and Bob each has antennas Let H denote the compex fading matrix The input-output reation for the channe is given by 3, where Y, X, Z are n matrices Let the SVD decomposition of H be given by H = UΛV H, where Λ is a diagona matrix with diagona eements λ, λ 1 such that λ λ 1 These are the rea singuar vaues of H Let V, V 1 denote the coumns of V We define W, W 1 = V C, V C and R = C c P λ /, P λ 1/ ɛ 4 for some pre-decided ɛ, where the C c, above is defined in Note that W, W 1 are the same as V, V 1, but permuted depending on C Bob shares W, W 1 with Aice in our protoco, and Aice uses it as the precoding matrix Bob first pre-mutipies the received matrix by U H The resuting endto-end system is shown in Fig 5 where a switch, controed by Bob s choice bit C, determines which input of Aice passes through which channe to Bob The firm ines and dotted ines show the two positions of the couped switch The protoco: 1 Bob reveas W, W 1, λ, λ 1 to Aice over the noisefree channe The basic transmitter and receiver bock diagram is shown in Fig 4 Aice computes R using 4, and takes strings K and K 1 of ength Lλ, λ 1 := nr each She encodes K and K 1 into two ength-n codewords X and X 1 respectivey, such that each has an average power P/ A code suitabe for WT P, P λ, P λ 1 is used to encode both the strings She then transmits the X X 1 matrix [ X [W W 1 = W X X W 1 X 1 1 = V X C V 1 X [ C XC = V X C 3 Bob first mutipies the received n matrix by U H The resuting end-to-end channe is given by [ [ [ Ỹ Ỹ = = U H XC HV U H Z Ỹ 1 X C Z 1 [ [ λ X = C U H Z 5 λ 1 X C Z 1 Fig 4 Bob gets Ỹ and Ỹ1 with SNR P λ / and P λ 1/ respectivey He decodes K C from Y using the decoder for the wiretap channe referred above [W W Z Z 1 Y H U H 1 Ỹ 1 MIMO precoding for OT Correctness of the protoco: First note that since Ỹ is obtained by a unitary hence invertibe transformation on Y, it contains exacty the same information as Y So we wi henceforth treat Ỹ as Bob s received matrix Since U is a unitary matrix, U H Z has the same distribution as that of Z Aso note that K C is encoded into X C, which is received as Ỹ with SNR P λ / Since this encoding is done by Aice for a compex Gaussian Y 1 Ỹ

5 5 X X 1 Fig 5? λ λ 1 Z Z 1 The equivaent channe with a switch for MIMO setup wiretap channe with the same receiver SNR, Bob can decode K C with vanishing probabiity of error On the other hand, K C is encoded into X C, which is received as Ỹ1 with SNR P λ 1/ Bob can get negigibe information about K C as his SNR in Ỹ1 is that of the wiretapper This ensures secrecy of Aice against Bob About the secrecy of Bob against Aice, first note that H is circuary symmetric, and thus V, V 1 and V 1, V have the same distribution, that is, their joint distribution is symmetric in V and V 1 Aso, note that λ, λ 1 are independent of C, V, V 1 Thus Y Y 1 IW, W 1, λ, λ 1 ; C = IV C, V C ; C = This ensures the secrecy of Bob against Aice As seen in 5, the SVD precoding as shown in Fig 4 transforms the MIMO channe into a parae fading Gaussian channe, where Aice is unsure of which of the two channes has the gain λ, and which has gain λ 1 We now discuss the 1 MIMO system where the same technique takes a simpe eegant form C 1 MIMO Consider a 1 fading MIMO channe between Aice and Bob Let H = H, H 1 denote the 1 fading matrix such that the symbo received by Bob over the MIMO channe is given by Y = HX Z, where X = X, X 1 T is the vector transmitted by Aice, and Z is the noise Over n uses of the channe, the received vector is given by Y = HX Z, where X and Z are respectivey the n transmitted matrix and the noise vector of ength n Let the SVD of H be H = ΛV H where Λ = λ,, λ = H H 1, the first coumn of V is V = 1/λH H, and the second coumn of V is a unit vector V 1 orthogona to H The best way to communicate messages without any secrecy condition is using SVD precoding wherein Aice mutipies her message symbo with the first coumn of V and transmits Bob simpy divides the received symbo by λ C and chooses the message symbo nearest to the resut Note that if in addition, Aice added any scaar mutipe of V 1 to her transmission, it woud not contribute to the received symbo as V 1 is orthogona to H Thus this dimension which is orthonorma to H the nu-space of H is not usefu for communication, as it has zero gain This reduces the MIMO channe to a singe fading AWGN channe with fading coefficient λ We now give an OT protoco for this channe when ony Bob has the knowedge of H at the beginning of a bock We define W, W 1 = V C, V C 6 and R = og 1 P λ ɛ 7 for some pre-decided ɛ Bob shares W, W 1 with Aice in our protoco, and Aice uses it as the precoding matrix The resuting channe is equivaent to what is shown in Fig 6 where a switch, controed by Bob s choice bit C, determines which input of Aice passes through the channe to Bob The protoco 1 Bob reveas W, W 1, λ to Aice over the noise-free channe He sets W, W 1 as in 6 Both Aice and Bob compute Lλ := Rn with R given in 7 Aice encodes each of K and K 1 of ength Lλ each into a n-ength vector She uses a code suitabe for a compex AWGN channe with SNR P λ Let these encoded vectors be X and X 1 respectivey Over n uses of the channe, Aice transmits the n matrix W X W 1 X 1 3 Bob receives X X 1 Fig 6 Y = HW X W 1 X 1 Z = λx C Z Bob now decodes K C from Y with probabiity of error going to zero as n? The equivaent channe with a switch for 1 MIMO setup Correctness of the protoco: Since X C is transmitted in the nu-space of H, it does not contribute to Bob s received vector Thus Bob has no information about K C Since H has iid Gaussian entries, V, V 1 has a distribution which is symmetric in V and V 1, and λ is independent of V, V 1 Thus, IW, W 1, λ; C = Thus the secrecy of Bob against Aice is met λ Z Y C

6 6 IV THE GENERAL PROTOCOL In this section, we present a protoco for the genera Nchannes OFDM and N n B -MIMO modes Here we assume that Aice has more N antennas than Bob has n B The case n B > N is simiar, and is discussed briefy ater For the MIMO setup, we first discuss how Bob can revea some partia information about the channe matrix to reduce the channe to a parae channe We wi then treat both OFDM and MIMO modes as parae channes and present a common OT protoco The OT protoco wi group the parae channes into pairs and perform OT over each pair using simiar technique as in the previous section A Reducing MIMO setup to parae channes Let the SVD decomposition of H be given by H = UΛV H, where Λ is a n B N diagona matrix with diagona eements λ λ 1 λ λ nb 1 Let P be a random N N permutation matrix chosen by Bob Note that a permutation matrix is unitary, and thus P T = P 1 Let us add N n B zero rows with U H to define the N n B matrix [ U H Ũ = Bob sends W = VP over the noise-free channe, and Aice uses it as the precoding matrix to transmit VPX Bob first mutipies the received vector Y by P T Ũ to get Ỹ = P T ŨY [ = P T ΛPX U H Z [ [ = P T Λ PX P T U H Z Let us denote λ := λ, λ 1,,[ λ N 1 T as the N ength Λ vector of diagona eements of where λ = for [ n B Let us aso denote Z U := H Z Let π denote the permutation induced on a vector by pre-mutipication by P T, that is, P T λ = λ π, λ π1,, λ πn 1 in particuar Then Ỹ = λ π X Z π We note that for π n B, λ π = Z π = This gives a set of parae channes such that N n B of them have zero gain and zero noise These channes are competey useess for communication Since U H is unitary, U H Z is aso iid with independent rea and imaginary components N, 1/ Since Bob knows P and so π, he wi negect the channes for which π n B To reduce this mode to a standard parae AWGN channes mode with constant noise variance in a channes but different channe gains, we assume that Bob adds some independent noise with rea and imaginary parts N, 1/ to each of the channes for which π n B We now prove a emma which states that in the resuting parae channes, Aice can not know the order of the channe gains Lemma 1 Let H be the channe matrix and P is a permutation matrix chosen uniformy at random Let W = VP denote the precoding matrix sent to Aice by Bob, and λ be the zero-padded vector of ordered singuar vaues Then for any W and λ, and for any two permutations P and P, we have P rp W, λ = P rp W, λ = 1 N! Proof: V is uniformy distributed over the set of N N unitary matrices see [3, Lemma 5 Since P is a unitary matrix W = VP is aso unitary and both VP and VP are Haar matrices with the same uniform distribution over the set of N N unitary matrices Hence f W,λ P W, λ P = f V,λ WP T, λ = f V,λ W, λ, and aso f W,λ W, λ = f V,λ W, λ So we have P rp W, λ = 1 N! We have now reduced the MIMO channe to a standard parae AWGN channes with different gains singuar vaues in different subchannes The above emma says that from the partia channe state information given to Aice, she sti woud be competey uncertain about the association of the singuar vaues to the resuting subchannes The case of n B > N: When n B > N, U is an n B n B matrix and Λ is a n B N diagona matrix with n B N zero rows Let the ast n B N rows of U H, Λ and U H Z be removed to obtain respectivey Ũ, Λ and Z As before, Aice transmits VPX Bob first mutipies P T Ũ to the received vector to obtain Ỹ = P T ŨY = P T ΛPX P T Z The protoco now continues with the N components of Ỹ which constitute the output of the N parae channes as before In the foowing, we consider a set of parae channes indexed by 1,,, N, as depicted in Fig Such a mode coud have resuted from an OFDM channe or a MIMO channe under the scheme discussed above To treat MIMO and OFDM in a unified manner in the foowing, we aso assume λ = H to be the channe gains in case of OFDM as they provide the same performance For OFDM, we assume that λ 1, λ,, λ N are iid and Rayeigh distributed We now define an OT-pairing of the channes and a power aocation under a given tota power constraint Definition An OT-pairing of the N channes is defined using two maps, k : {1,,, N} {1,,, N} such that 1, k are 1 1 Im Imk = 3 λ > λ k The ordered pairs of the channes are then, k; = 1,,, N

7 7 B Power aocation Aice divides the tota average transmit power P between the subchannes In our OT protoco, Aice transmits the same power over the subchannes in a pair Let P the average power transmitted on each of the subchannes in pair, that is, in the subchannes and k, be P Then P and P P 8 =1 The rates for the pairs are taken as R = C c P λ, P λ k ɛ 9 for an arbitrariy sma fixed constant ɛ > We denote R = R 1, R,, R N Note that R is cose to the capacity of the wiretap channe WT P, P λ, P λ k Our OT protoco for the -channes OFDM can be used with average power constraint P to achieve a rate R for each pair of subchannes The tota rate achieved is thus R = C c P λ, P λ k ɛn 1 =1 For simpicity, we assume that nr is an integer for each We define for = 1,,, N, γ = γ, γ 1 =, k 11 λ = λ, λ k, 1 and denote γ := γ 1, γ,, γ N and λ = λ 1, λ,, λ N Let T denote the N N permutation matrix representing the transposition of [ consecutive pairs T consists of N 1 diagona bocks We define 1 { γ if C = γ = 13 γt if C = 1 Bob shares γ, λ with Aice From Aice s point of view, the parae channes appear to be associated with the gains shown in Fig 7 The association of the gains to the channes has one bit of uncertainty as depicted by the two possibe positions of the couped switches The position of the switches is controed by C, and is not known to Aice We give the protoco beow C The protoco 1 In case of a MIMO setup, Bob first reveas W to Aice, and Aice uses it as the precoding matrix Bob aso does appropriate pre-processing as discussed in Sec IV-A to reduce the channe to a set of parae channes Bob seects an OT pairing, k and reveas γ, λ to Aice over the noise-free channe He computes these using 13 and 1 respectivey 3 Both Aice and Bob compute R using 9 and L = R n for = 1,,, N Let us denote L = N =1 L For each j =, 1, Aice breaks K j of ength L into N substrings K j ; = 1,,, N of engths L respectivey For each j =, 1, and = 1,,, N, she encodes K j X 1 X k1 X N X kn Fig 7?? λ 1 λ k1 λ N λ kn The equivaent channe with a switch Z 1 Z k1 Z N Z kn Y 1 Y k1 Y N Y kn into a n-ength vector X j of average power P using a code for the wiretap channe WT P, P λ, P λ k Aice transmits this vector over n uses of the channe γ j 4 Note that from 13, γ C = and γ C = k for each = 1,,, N Thus Bob receives Y = λ X C Z Bob now decodes K C from Y with probabiity of error going to zero as n Correctness of the protoco: Bob can decode K C from Y for each with arbitrariy sma probabiity of error This foows from standard resuts in Gaussian wiretap channes [1 It aso foows that he gets ony an arbitrariy sma amount of information about K C from Y k in the sense of 1 [13 Aice knows that γ {γ, γt } Since γ and λ are reveaed to Aice during the protoco, the uncertainty in C is equivaent to the uncertainty in which of γ, γt is the vaue of γ Now, et us first consider an OFDM channe From the point of view of Aice, P rc = γ, λ = P r γ = γ γ {γ, γt }, λ = P r γ = γt γ {γ, γt }, λ 14 = P rc = 1 γ, λ Here 14 foows as we have assumed that the channe gains of the parae channes are iid This impies that IC; γ, λ = Simiary, if the parae channes have resuted from a MIMO channe, then Aice has aso earned the precoding C

8 8 matrix W Now, P rc = W, γ, λ = P r γ = γ W, γ {γ, γt }, λ = P r γ = γt W, γ {γ, γt }, λ 15 = P rc = 1 W, γ, λ Here 15 foows from Lemma 1 Thus we have IC; W, γ, λ = This proves that Aice does not gain any information about C from what she earns during the protoco We now discuss the optima OT-pairing and the optima power aocation V OPTIMIZATION OF THE PROTOCOL Let us first consider the simpe setup where equa power is aocated in a pairs of subchannes, ie, P = P N The capacity for this power aocation is R = og 1 P λ og 1 P λ k N N =1 =1 Ceary, this is maximized if λ > λ kj for a, j That is, provided the best haf of the channes form the stronger channes of the pairs, the achieved rate is independent of the actua pairing However, this is not true if we have the freedom to pair the channes as we as to aocate variabe power P to different pairs In genera, we woud ike to choose an optima pairing, k; 1 N and power aocation P ; 1 N so as to maximize R = og 1 P λ og 1 P λ k 16 N N The foowing theorem states that an optima OT pairing coupes the best channe with the worst, and so on with the remaining channes Theorem 1 An optima pairing combines the best channe with the worst channe and continues simiary with the remaining channes That is, the pairing is given by = σ and k = σn 1 for = 1,, N for some permutation σ which arranges the gains in a non-increasing order The proof of the theorem is given in the appendix In the theorem, the permutation σ is such that λ σ λ σ1 < N This resut reduces the probem of joint optimization of 16 for the best pairing and power aocation to separate optimization of the pairing and the power aocation among the pairs of channes With high probabiity, a the gains λ 1,, λ N are distinct Under this high probabiity event, Theorem 1 gives a unique optima pairing We now find the optima power aocation Optima Power Aocation: In ight of Theorem 1, we assume that the channes are ordered such that λ λ 1 =1 =1 for 1 < N and the channe with gain λ is paired with the channe with gain λ, where λ = λ N 1 Then for a given power aocation P ; 1 N, the achieved rate is RP 1,, P N = og1 P λ og1 P λ =1 We need to maximize this with respect to the P s under the condition P P =1 Simiar optimization was needed for power aocation over different fading states for bock fading wiretap channe [1 This can be soved by defining the Lagrangian objective function N J = RP 1,, P N η P P =1 =1 The optima power aocation is given by fλ, λ P =, η1/ if λ λ λ 1 η 1 if λ λ = where fλ, λ, η = λ 1 λ and η is determined by the condition P = P =1 [ 1 λ 1 λ 4, η Power aocation across coherence bocks: If variabe amount of average power is aowed to be transmitted in different bocks under a ong term average power constraint, then potentiay higher rates are achievabe Let λ 1, λ,, λ N denote the random vector that represents the ordered nonincreasing channe vector in a bock The optimum pairing in each bock is sti as given by Theorem 1 The optima power aocation is the maximizer of the expected rate [ N R = E og1 P λλ =1 under the average power constraint [ N E P λ P =1 og1 P λλ N 1 By simiar steps as before, the soution is given by fλ, λ P λ =, η1/ if λ λ λ 1 η 1 if λ λ =

9 9 where η is a goba constant determined by the condition [ N E P λ = P 17 =1 Here η depends ony on the channe statistics and P VI HIGH SNR ASYMPTOTICS Let us consider a set of parae channes We want to study the asymptotic expected rate Let us consider a fixed ordered channe vector λ 1, λ,, λ N to start with Note that in the case of a N n B MIMO system with precoding, there are N channes If n B N, then there are n B usefu pairs of channes with channe gains λ 1, λ 1, λ, λ,, λ nb, λ n B, where λ = λ N 1 =, for = 1,,, n B If N < n B < N, then there are N pairs N n B of them have the second channe gain zero, more specificay, λ 1 = = λ N n B = Ceary, η as P So, P as P Now, for a pair of channes with λ =, the rate contributed by the pair is For such a channe pair, R = og 1 P λ ogp λ 18 P = 1 1 η η λ ηp 1 as η 19 When λ and λ λ, as η, So, for such channe pairs, 1 ηp λ 1 1 λ R = og 1 P λ og 1 P λ λ og λ as P 1 Now, using 19 and, the power constraint gives ηp N n B as P Inspired by simiar concepts for communication over MIMO channes, it is reasonabe to define the OT-mutipexing gain as E [ i µ OT = im R i P og P Here we mean R ogp λ as P So, [ E :λ µ OT = im = R P og P [ E :λ = im P [ E :λ = im P using1 = ogp using18 og P =ogp ogηp og P EogηP [ E :λ = im = ogη P Eogη = E [ { : λ = } 3 Here 3 foows from 19 and Thus our protoco achieves the OT-mutipexing gain of n B if n B N µ OT = N n B if N < n B N if n B N In contrast, for communication over a N n B MIMO channe, the mutipexing gain is min{n B, N} For n B N, the average OT rate converges to a constant as P This can be seen as a consequnce of the fact that the secrecy capacity of the Gaussian wiretap channe goes to a constant as P VII NUMERICAL RESULTS In this section, we provide numerica resuts of our OT protocos for some simpe MIMO and OFDM channes which incude the exampes discussed in Section III In Fig 8, we pot the OT rate of our protoco for 1 and MIMO channes The average OT rate is numericay evauated using Monte Caro simuation methods for SNR varying from db to 5 db The channe capacities for these channes with CSIT are aso numericay evauated and shown It can be seen that OT rate of 1 MIMO channe at SNR P db is approximatey equa to the capacity of 1 MIMO channe with CSIT at 3 db ower transmit power This is due to the fact that in our OT protoco, haf of the power is given to the nu-space of H which is useess for communication OT rate of 1 MIMO channe increases at the rate of 1 bit/3db, as µ OT = 1 Using 1 we see that at very high SNR, [ the OT rate for MIMO system is given by R E og λ λ 1 Reca that λ, λ 1 are the eigenvaues of the Wishart matrix HH The joint pdf of the ordered eigenvaues, γ = λ, γ 1 = λ 1, is given by e γγ1 γ γ 1 [4, Theorem 17 The asymptotic vaue of the OT rate is thus [ E og γ γ 1 = γ og γ γ 1 = 1 n nats 345 bits e γγ1 γ γ 1 dγ 1 dγ In Fig 9, OT rates for MIMO with n A = 4 and 1 n B 4 are shown as a function of SNR As expected from Section VI,

10 1 Rate Fig 8 Rate x OT Rate x1 OT Rate x1 MIMO Capacity with CSIT x MIMO Capacity with CSIT SNR db OT Rate and MIMO capacity versus SNR for 1, MIMO 5 4x1 OT Rate 4x OT Rate 4x3 OT Rate 4x4 OT Rate SNR db Fig 9 OT Rates for MIMO with n A = 4 transmit antennas, and n B = 1,, 3, 4 receive antennas the best OT rate is achieved when n B = n A / =, with asymptotic sope of bits/3db µ OT = The asymptotic sope for n B = 1 and n B = 3 is 1 bit/3db µ OT = 1 For n B 4, µ OT =, and the rate is bounded Rate Fig channes OT Rate channes Capacity 4 channes OT Rate 4 channes Capacity SNR db OT Rate and OFDM capacity versus SNR for, 4 Channes OFDM In Fig 1, we show the OT rate for -channes OFDM and 4-channes OFDM, aong with the capacities of the corresponding channes The OT rate of -channe OFDM converges to a constant as SNR increases, since µ OT = To find this constant, we note that H and H 1 are iid with Rayeigh distribution So H and H 1 have exponentia distribution Let S = max H, H 1 and T = min H, H 1 Then the probabiity density functions of S and T are 1 e s e s and e t respectivey As SNR increases, the OT rate for our protoco converges to E[ogS/T = ogs/t1 e s e s e t dsdt = n nats = bits The OT rate of 4-channes OFDM aso converges to a constant and µ OT = VIII CONCLUSION We presented a technique for OT over parae fading AWGN channes with receiver CSI with appication to OFDM and MIMO For privacy of Bob against Aice, our techniques use primariy Bob s excusive knowedge of the fading states, whereas the additive noise is utiized for privacy of Aice against Bob In AWGN channes, the noise reaization is used to perform OT in [8, [ Foowing simiar principe, the noise reaization can potentiay be further utiized in our setup to achieve better rate In particuar, for a singe point-to-point fading channe or for parae fading channes with the same fading coefficient, an obvious scheme is for Bob to first revea the channe state to Aice over the noise-free channe Then they can foow a protoco suitabe for the resuting AWGN channe However, as pointed out in [, the OT rate saturates to a constant as P in AWGN channes Thus further utiization of the noise reaization in our protoco wi not ony resut in a much more compex protoco, but it wi aso not provide any additiona asymptotic OT-mutipexing gain With an odd number of OFDM channes, or an odd number of transmit antennas in a MIMO system, we have an odd number of parae channes In such a case, our protoco wi eave one channe of midde rank in strength unused That channe-state can be reveaed to Aice by Bob, and the OT protoco of [ can be used in the resuting AWGN channe This aso does not give any asymptotic P improvement in terms of mutipexing gain Atogether, the technique proposed in this paper can be an important too for performing OT efficienty over wireess channes APPENDIX A PROOF OF THEOREM 1 Lemma If P 1 > P, α > β, then 1 P 1 α1 P β > 1 P 1 β1 P α Proof: We first note the foowing basic fact x xα Caim: If x, y >, y > 1, then fα = yα monotonicay decreasing function of α Proof of the caim: It can be easiy checked that < α Thus the caim foows y x yα is a df dα = Now by the hypothesis of the emma, α > β and 1 P 1 < 1 P Thus by the above caim,

11 11 α 1 P β 1 < α 1 P 1 P β 1 P 1 = αp 1 βp 1 < αp 1 1 βp 1 1 = 1 αp 1 1 βp > 1 αp 1 βp 1 Lemma 3 For any, j {1,,, N}, an optima protoco can not have λ > λ k > λ j > λ kj Proof: We wi show that under the above condition, the pairing can be improved stricty with the same power aocation Let us consider another pairing defined by, k such that t = t t j j = k k t = kt t k = j That is, k and j are interchanged Ceary, k define a vaid pairing Consider the same power aocation Ony the rates R, R j wi change to R, R j say R R j = og 1 P λ 1 P jλ j 1 P λ k 1 P jλ kj R R j = og 1 P λ 1 P jλ k 1 P λ j 1 P jλ kj R R j R R j = og 1 P jλ j 1 P λ j 1 P λ k 1 P jλ k < since λ j < λ k Thus R R j > R R j Since R t = R t t, j, the new pairing gives more rate with the same power aocation Lemma 4 For an optima protoco Then λ λ kj, j Proof: If this is not true, then suppose λ < λ kj for some, j λ j > λ kj > λ > λ k which can not be true by Lemma 3 Lemma 5 For an optima protoco λ > λ j λ k λ kj Proof: By contradiction, suppose, j are such that λ > λ j and λ k > λ kj λ > λ j > λ k > λ kj as λ > λ k > λ j > λ kj can not be true by Lemma 3 Case 1: P > P j By Lemma, og1 P λ k og1 P jλ kj > og1 P j λ k og1 P λ kj 4 Consider a different pairing, k such that kt ; t, j k t = k ; t = j kj ; t = ie k, kj are interchanged Then the new rate R is such that R R = R t R t t=1 = R R R j R j = R R j R R j [ = og1 P λ og1 P λ kj og1 P j λ j og1 P jλ k [ og1 P λ og1 P λ k og1 P j λ j og1 P jλ kj > by 4 Thus the new pairing stricty improves the rate Case : P < P j By Lemma, og1 P j λ og1 P λ j > og1 P λ og1 P jλ j 5 Consider a different pairing, k such that t ; t, j t = ; t = j j ; t = ie, j are interchanged Then the new rate R is such that R R = R R j R R j [ = og1 P j λ og1 P λ j og1 P λ og1 P jλ > by 5 So the new pairing stricty improves the rate This competes the proof of the emma Now et us assume, without oss of generaity, that the pairs are indexed such that and λ λ 1 = 1,,, N 6 λ k λ k1 whenever λ = λ 1 7

12 1 for = 1,,, N Proof of Theorem 1: Let us define and σ = for = 1,, N σ = kn 1 for = N 1,, N We now need to prove that λ σ λ σ1 For = 1,,, N 1, this foows from 6 For = N, this foows from Lemma 4 For N < < N, if λ σ < λ σ1, then But then λ kj 1 > λ kj where j = N 1 > 1 λ j 1 λ j λ kj 1 > λ kj This contradicts either 7 or Lemma 5 Thus it must be true for N < < N that [17 S K Mohammed, E Viterbo, Y Hong, and A Chockaingam, Precoding by Pairing Subchannes to Increase MIMO Capacity With Discrete Input Aphabets, IEEE Transactions on Information Theory, pp , vo 57, no 7, Ju 11 [18 S K Mohammed, E Viterbo, Y Hong, and A Chockaingam, MIMO Precoding with X- and Y-Codes, IEEE Transactions on Information Theory, pp , vo 57, no 6, Jun 11 [19 H Mahdavifar and A Vardy, Achieving the secrecy capacity of wiretap channes using poar codes, IEEE Trans Inf Theory, vo 57, no 1, pp , Oct 11 [ C Ling, L Luzzi, J C Befiore, and D Stehé, Semanticay secure attice codes for the Gaussian wiretap channe, IEEE Transactions on Information Theory, pp , vo 6, no 1, Oct 14 [1 P K Gopaa, L Lai, and H E Gama, On the Secrecy Capacity of Fading Channes, IEEE Transactions on Information Theory, vo 54, no 1, pp , Oct 8 [ M Isaka, Unconditionay Secure Obivious Transfer from Agebraic Signaing over the Gaussian Channe, IEICE Trans Fundamentas,, vo E93 A, No 11, pp 17 5, Nov 1 [3 E Teatar, Capacity of muti-antenna Gaussian channes, Eur Trans Teecomm ETT, vo 1, no 6, pp , 1999 [4 A M Tuino and S Verdu, Random Matrix Theory and Wireess Communications, now Pubishers, 4 λ σ λ σ1 This competes the proof of the Theorem REFERENCES [1 R Ahswede and I Csiszar, On obivious transfer capacity, Information Theory, Combinatorics and Search Theory, Springer Berin Heideberg, pp , 13 [ A C A Nascimento and A Winter, On the obivious-transfer capacity of noisy resources, IEEE Transactions on Information Theory, vo 54, No 6, pp , 8 [3 M Rabin, How to exchange secrets by obivious transfer, Tech Memo TR-81, Aiken Computation Laboratory, Harvard University, 1981 [4 C Crépeau, Efficient Cryptographic Protocos Based on Noisy Channes, EUROCRYPT 1997, LNCS, vo 133, pp [5 J Kiian, Founding cryptography on obivious transfer, th Symposium on Theory of Computing, pp 31, 1988 [6 M Mishra, B K Dey, V M Prabhakaran and S Diggavi, The obivious transfer capacity of the wiretapped binary erasure channe, IEEE Internationa Symposium on Information Theory, Hawaii, Jun 14 [7 M Mishra, B K Dey, V M Prabhakaran and S Diggavi, On the Obivious Transfer Capacity Region of the Binary Erasure Broadcast Channe, IEEE Information Theory Workshop, Hobart, Nov 14 [8 M Isaka, On Unconditionay Secure Obivious Transfer from Continuous Channes, in Proc IEEE Internationa Symposium on Information Theory, Austin, Texas, USA, Jun 1 [9 D Tse and P Viswanath, Fundamentas of Wireess Communication, Cambridge University Press, 5 [1 M Boch and J Barros, Physica Layer Security From Information Theory to Security Engineering, Cambridge University Press, Oct 11 [11 A D Wyner, The Wiretap Channe, Be Syst Tech J, vo 54, pp , Oct 1975 [1 S K Leung-Yan-Cheong and M E Heman, The Gaussian wire-tap channe, IEEE Transactions on Information Theory, vo 4, No 4, pp , Ju 1978 [13 V Y F Tan and M R Boch, Information Spectrum Approach to Strong Converse Theorems for Degraded Wiretap Channes, Aerton Conference on Communication, Contro, and Computing, Oct 14 [14 A Khisti and G W Worne, Secure Transmission With Mutipe Antennas I: The MISOME Wiretap Channe, IEEE Transactions on Information Theory, pp , vo 56, no 7, Ju 1 [15 Z Rezki, A Khisti and M S Aouini, On the Secrecy Capacity of the Wiretap Channe with Imperfect Main Channe Estimation, IEEE Transactions on Communications, vo 6, no 1, Oct 14, pp [16 M Boch, J Barros, M R D Rodrigues, and S W McLaughin, Wireess information-theoretic security, IEEE Transactions on Information Theory, pp , vo 54, no 6, Jun 8