Ueli M. Maurer 2, Member, IEEENovember 7th, 2007
FiledNovember 7th, 2007Abstract. The problem of generating a shared secret key S by two parties knowing de- pendent random variables X and Y , respectively, but not sharing a secret key initially, is considered. An enemy who knows the random variable Z, jointly distributed with X and Y according to some probability distribution PXY Z , can also receive all messages exchanged by the two parties over a public channel. The goal of a protocol is that the enemy obtains at most a negligible amount of information about S. Upper bounds on H(S) as a function of PXY Z are presented. Lower bounds on the rate H(S)=N (as N ! 1) are derived for the case where X = [X1; : : : ; XN ], Y = [Y1; : : : ; YN ] and Z = [Z1; : : : ; ZN ] result from N independent executions of a random experiment generating Xi; Yi and Zi, for i = 1; : : :; N . In particular it is shown that such secret key agreement is possible for a scenario where all three parties receive the output of a binary symmetric source over independent binary symmetric